Data privacy act Flashcards by Lance Williamson So

An Act Protecting Individual Personal Information in

Information and Communications Systems in the Government and the Private Sector

Data Privacy Act of 2012

How well did you know this?

Not at all

Perfectly

When was the Data Privacy Act of 2012 enacted

Aug 15 2012

How well did you know this?

Not at all

Perfectly

Supports the right of persons to life, liberty and

property

Right to privacy

How well did you know this?

Not at all

Perfectly

Under the Bill of rights include these four:

Due process
Self incrimination
Freedom of speech
Freedom of religion

How well did you know this?

Not at all

Perfectly

Individuals ability to control the flow of information

concerning or describing him

Right to information privacy

How well did you know this?

Not at all

Perfectly

Right to Privacy must be overbalanced by _____

legitimate public concerns

How well did you know this?

Not at all

Perfectly

_____ of information on the part of the patient is a prerequisite to quality care and better health outcomes.

Full disclosure

How well did you know this?

Not at all

Perfectly

Implicit in the “Declaration of Policy” of the DPA is

the recognition that: (2 of them)

Law protects privacy

2. Free flow of information

How well did you know this?

Not at all

Perfectly

____ should not an obstacle for people to

obtain benefits from utilization of personal data

Data protection

How well did you know this?

Not at all

Perfectly

Use of personal data comes with a responsibility. The
_____ subjects should, at all times, be a
paramount consideration.

rights of data

How well did you know this?

Not at all

Perfectly

Any information from which the identity of an

individual is apparent

personal data

How well did you know this?

Not at all

Perfectly

Data containing Race, ethic origin, marital staturs, certificates issued by government agencies, education etc.

Sensitive personal information

How well did you know this?

Not at all

Perfectly

Processing of data can be done via: ( 2 of them)

automatically

2. Manually

How well did you know this?

Not at all

Perfectly

Who Process Personal Data

Personal information controller (PIC)

How well did you know this?

Not at all

Perfectly

the one who controls the processing of personal data, the one who decides

The individual, corporation or other sectors

How well did you know this?

Not at all

Perfectly

They are the ones that will be held liable in circumstances when Data Privacy Act is violated

Personal information controller (PIC)

How well did you know this?

Not at all

Perfectly

PIC is usually the head of the agency/ company.
Not the employees, not the data protection
officer, NOT the _____

Chief information officer

How well did you know this?

Not at all

Perfectly

Individual, corporation, or other body who
processes the personal data for a Personal
Information Controller (outsource. Ex: EMR
Provider)

Personal Information Processor

How well did you know this?

Not at all

Perfectly

Transparent data must be aware of : (2)

Nature

2. Purpose

How well did you know this?

Not at all

Perfectly

4 Extent of the processing of his/her personal data

Risk and safety
Identify PIC
Rights as data subject
How these rights are exercised

How well did you know this?

Not at all

Perfectly

The processing of information shall be with a declared

and specified purpose which must not be contrary to law, morals, or public policy

LEGITIMATE PURPOSE

How well did you know this?

Not at all

Perfectly

Proportionality must be these 4

→ Adequate
→ Relevant
→ Suitable
→ Necessary

How well did you know this?

Not at all

Perfectly

Any freely given, specified, informed indication of
will, whereby the data subject agree to the collection and processing of personal information
about and/or relating to him or her

Study These Flashcards

Consent

requires that processing of personal data shall be compatible with a declared and specified purpose.

Study These Flashcards

Adhering to the priciple of legitimate purpose

should be reflected on the | consent form

Data Privacy Principles

Under the privacy information law, data consent should be in

written consent

Cases in which consent is not required are as follows:

1. Private facts of person 2. Financial nature 3. Research or journals

Info necessary for banks and Financial Institution to | comply with provisions of the ____

Anti-monetary laundering act

Section where PERSONAL INFORMATION, NOT SENSITIVE | OR PRIVILEGED

sect. 12

Under this section the processing is necessary to protect vitally important interests of the data subject, including his or her life and health.

sect. 12

Section where SENSITIVE PERSONAL INFORMATION AND PRIVILEGED INFORMATION

Sect. 13

Section stating that the processing is provided for by existing laws and regulations, where personal data protection is guaranteed, and consent is required

Sect. 13

Data sharing is allowed provided that: 3

1. Safeguards 2. Follow prinicple of transparency 3. In agreement to the rules issued by the commission

Indicate what are the data to be shared, who can access, | how they will destroy, etc

DATA SHARING AGREEMENT

Data sharing agreement is subject to be reviewed via ____ or upon complaint of the data subject

motu proporio

Inform the patient about everything

Right to information

Object to the procurement of their data and object | to any violation of their rights

Right to object

Patients can have access to their data but they are | not allowed to have a copy of their record

Right to access

Any inaccurate information

Right to correct

When somebody is prejudiced because of data breach, they can file a complaint. The court may award damages.

Right to damages

If you have an old record from another hospital, you can tell your physician about it and they can request and use your old records from that hospital

Right to data portability

what to do when: adhering to dat Privacy rpinciples, from collection of personal data

Review and develop protection procedures

what to do when: Uphold the Rights of Data Subject, Including Privacy Notices

PIC should implement changes in policy and systems

what to do when: Obtain MEANINGFUL CONSENT for processing of personal data

Review existing contracts, | consent forms, and notices

what to do when: Enter into DATA SHARING AGREEMENTS

Know if data sharing is being done beofre agreeing

shall aim to maintain the | confidentiality, integrity, and availability of personal data

Security measures

This is not simply a means to demonstrate compliance | with one of the legal requirements

DESIGNATING A DATA PROTECTION OFFICER

should be empowered to perform functions so as to assure that an organization takes data privacy and security seriously

Data protection officer

must have top management support to allow for | meaningful changes in the organization

Data protection officer

process to evaluate and manage privacy impacts in an organization’s programs, process, activities, systems, and operation

Privacy impact assessment (PIA)

This should proceed from an understanding of the | processing systems within an organization.

Privacy management program (PMP)

This should take into account PIA and legal obligations and requirements. It includes privacy notices and privacy policies

Privacy management program (PMP)

Non-disclosure agreements, training and capacity | building are involved

MANAGEMENT OF HUMAN RESOURCES

These measures include design of office space and workstations, including the physical arrangement of furniture and equipment, shall provide privacy to anyone processing personal data

Physical sercurity measures

These measures are subject to guidelines are the commission may issue from time to time.

Techinal security measures

Report to the National Privacy Commission within __ hours from knowledge of breach based on info available

Follow up report on the data breach is submitted within

5 days from knowledge

Data privacy act Flashcards

(57 cards)