Blog

Are X and Y independent? Choose your answer below and state the reason on the scratch paper. No credit will be given without the justification.

Just Learn, a university that opened in 2020, wants to make sure that people at the university have ready access to healthcare. Just Learn has plans to open a healthcare clinic that can be used by both students and faculty. The President of Just Learn asks you, as the privacy officer, what privacy requirements the healthcare clinic likely should follow. You respond:

Doctor Yasmine Yellow specializes in surgeries that are not medically necessary such as face lifts. Since most of the procedures Doctor Yellow performs would not be covered under health insurance, she only accepts credit cards for payment and does not bill insurance. Billy Blue, a potential patient, looks online for a doctor to perform a facelift and finds Doctor Yellow’s website. When Billy visits Doctor Yellow’s office, Billy does not receive a privacy notice with his initial paperwork. Billy asks Doctor Yellow for a copy of the privacy notice and is told that the office does not maintain a privacy notice. Is it likely that Doctor Yellow has violated HIPAA?

After law enforcement officers in Atlanta, Georgia, located no eyewitnesses to an armed robbery that occurred in a parking lot after a Major League Baseball game, these officers obtained a geofence warrant. This warrant compelled Big Tech Company to provide these officers with access to the names and phone numbers of individuals who were within close proximity of the victim near the time of the crime. Based in part on the information obtained from the geofence warrant, the officers arrest Ben Yogi for the crime of armed robbery. At Ben’s criminal trial, his attorneys file a motion to exclude the information obtained pursuant to the geofence warrant, asserting violations of the defendant’s rights under the Fourth Amendment to the U.S. Constitution. Which exceptions to the Fourth Amendment’s warrant requirement is the judge likely to consider in making a decision on this motion:

Luke Lake, an experienced poker player, signs up to play in a national poker tournament at Cool Casino in Las Vegas, Nevada. After arriving at the casino, Luke decides to participate in 4 smaller tournaments in addition to the national poker tournament. To cover the entry fees, Luke pays the casino $20,000 in cash. Does this cash payment trigger a reporting requirement?

TalkTogether.com, a world-wide social media company, is based in San Francisco, California. TalkTogether.com had worldwide revenues of $100 billion in 2024. After numerous meetings of top officials, TalkTogether.com decides that the company should focus on the individual privacy rights of its users. Despite this decision, the CEO determines that data portability is not feasible for the company. What maximum fines could TalkTogether.com face under the GDPR?

Five years after Gus Green retired from working for a major tobacco producer, Gus was diagnosed with lung cancer. Gus hires an attorney to determine if he has a viable legal claim against his former employer. Gus’s attorney sends a number of requests to the company for records maintained about Gus as well as for practices in place at the time that Gus was an employee of the company. What are the reasons that the company likely maintained these records?

What is the name of this organic compound?

Ivan Ice, a 16-year-old college student at Georgia Tech, has developed a habit of partying since graduating from high school. After mid-term exams at Georgia Tech, Ivan realizes that he has failing grades in several classes. Although Ivan lives at home and is still a dependent on his parent’s tax return, Ivan does not think it would be wise to tell his parents about his grades. Based on Ivan’s behavior, his parents are concerned about his grades at Georgia Tech. Ivan’s parents know that you have taken a privacy class. Ivan’s parents ask if you think it is likely they can get access to Ivan’s grades. What is your response?

In 2025, Sunrise University was the victim of a ransomware attack where student data, including Social Security numbers, grade point averages, and student tax records used to determine financial aid packages, was compromised. After an internal investigation, Sunrise University learns that the ransomware group exploited a vulnerability in the software product that the university used for file transfers. Renee Rainer, the President of Sunrise University, asks Harry Howler, the university’s CISO, to explain the details of the federal cybersecurity requirements that are relevant to this breach. Harry responds: