Under North Carolina's Identity Theft Protection Act, within what specific timeframe must a business notify affected individuals after discovering a security breach involving personal information?
A. Within 30 days of discovery
B. Within 45 days of discovery
C. Within 60 days of discovery
D. There is no fixed number of days; notice must be given without unreasonable delay
Show answer and reasoning
Correct answer: D. There is no fixed number of days; notice must be given without unreasonable delay
Correct - the statute uses the 'without unreasonable delay' standard rather than a specific day count.
- A: Incorrect - NC law sets no fixed 30-day deadline; this is a specific number some other states use, not NC.
- B: Incorrect - NC law sets no fixed 45-day deadline.
- C: Incorrect - NC law sets no fixed 60-day deadline.
Source: N.C.G.S. 75-65
In addition to notifying affected individuals, North Carolina's Identity Theft Protection Act requires a business to notify which state entity about a security breach?
A. The Consumer Protection Division of the NC Attorney General's Office
B. The NC Department of Health and Human Services
C. The NC Medical Board
D. The NC Insurance Commissioner
Show answer and reasoning
Correct answer: A. The Consumer Protection Division of the NC Attorney General's Office
Correct - the Attorney General's Consumer Protection Division is the designated state recipient under G.S. 75-65.
- B: Incorrect - NC DHHS is not the recipient of this breach notice under Chapter 75; it is a public health agency, not the state's identity-theft/consumer-protection regulator.
- C: Incorrect - the Medical Board handles licensee discipline, not statewide breach notice intake.
- D: Incorrect - the Insurance Commissioner is not the recipient under this statute.
Source: N.C.G.S. 75-65
Under North Carolina's Identity Theft Protection Act, when must a business also notify nationwide consumer reporting agencies of a breach?
A. Whenever any breach occurs, regardless of size
B. Only if the breach involves Social Security numbers
C. When the business must notify more than 1,000 persons at one time
D. Never - NC law does not require notifying consumer reporting agencies
Show answer and reasoning
Correct answer: C. When the business must notify more than 1,000 persons at one time
Correct - the 1,000-person simultaneous-notification threshold triggers this requirement.
- A: Incorrect - the consumer reporting agency notice is triggered by the 1,000-person threshold, not every breach.
- B: Incorrect - the trigger is the number of people notified, not the specific data element involved.
- D: Incorrect - NC law does include this requirement once the threshold is met.
Source: N.C.G.S. 75-65(e)
A hospital's business office in North Carolina experiences unauthorized access to a database containing patient diagnosis codes and treatment histories, but no Social Security numbers, driver's license numbers, or financial account numbers. Does this trigger notice obligations under North Carolina's general Identity Theft Protection Act (G.S. Chapter 75)?
A. Yes, because medical diagnosis and treatment information is expressly listed as 'personal information' under the statute
B. No, because the Identity Theft Protection Act's definition of 'personal information' is built around identity-theft data elements (like SSNs, driver's license numbers, and financial account numbers) and does not itself include medical or health insurance information
C. Yes, but only if the patient is a minor
D. No, because HIPAA entirely preempts North Carolina from having any breach notification law
Show answer and reasoning
Correct answer: B. No, because the Identity Theft Protection Act's definition of 'personal information' is built around identity-theft data elements (like SSNs, driver's license numbers, and financial account numbers) and does not itself include medical or health insurance information
Correct - the enacted definition tracks identity-theft data elements, not medical content by itself, though HIPAA's separate federal breach rule can still apply to a covered entity.
- A: Incorrect - this describes a proposed 2019 bill (HB 904) that was never enacted; the current statute does not list medical/health information as its own trigger.
- C: Incorrect - there is no such minor-only carve-in in the statute.
- D: Incorrect - HIPAA sets a federal floor and does not categorically preempt state breach notification statutes; NC's ITPA operates alongside HIPAA.
Source: N.C.G.S. 75-61, 14-113.20(b)
Under North Carolina's Identity Theft Protection Act, if personal information is encrypted and the decryption key was NOT also compromised, how is this generally treated?
A. It is automatically still treated as a reportable security breach regardless of encryption
B. It generally falls outside the statute's definition of 'security breach,' since that definition is built around unauthorized access to unencrypted and unredacted data (or encrypted data plus the key)
C. It must be reported to HHS OCR but not to the NC Attorney General
D. North Carolina law prohibits the use of encryption for personal information
Show answer and reasoning
Correct answer: B. It generally falls outside the statute's definition of 'security breach,' since that definition is built around unauthorized access to unencrypted and unredacted data (or encrypted data plus the key)
Correct - this reflects the statute's own definition of 'security breach.'
- A: Incorrect - encryption without key compromise generally takes the incident outside the statutory definition of a reportable breach.
- C: Incorrect - this scenario describes state law treatment, not a federal OCR-only reporting obligation.
- D: Incorrect - nothing in NC law prohibits encryption; encryption is what can avoid triggering notice.
Source: N.C.G.S. 75-61
