HIPAA Cheat Sheet 2026

The 30 highest-yield HIPAA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Under HIPAA, which of the following is considered a 'covered transaction' that triggers compliance requirements? → An electronic submission of a health care claim to an insurance plan
2. A hospital uses key cards to restrict access to server rooms containing ePHI. This is an example of which HIPAA physical safeguard? → Facility Access Controls
3. Which of the following is included in a patient's 'designated record set' for purposes of the HIPAA right to access? → Medical and billing records used to make decisions about the patient
4. An EHR system must transmit patient data to a referring specialist. Which HIPAA requirement applies to this transmission? → Encryption must be used to protect ePHI during transmission over open networks
5. Which federal agency enforces the HIPAA Privacy Rule? → The Office for Civil Rights (OCR) within the Department of Health and Human Services
6. Which of the following items must be removed under HIPAA's Safe Harbor de-identification method? → ZIP codes with populations less than 20,000
7. A HIPAA violation is considered 'willful neglect' when the covered entity: → Consciously and intentionally fails to comply with HIPAA requirements
8. Which HIPAA provision allows a covered entity to disclose PHI to a correctional institution for a patient who is an inmate? → The correction and law enforcement provision within the Privacy Rule
9. Which of the following is NOT an example of a business associate under HIPAA? → A janitorial service that does not have access to PHI
10. A minor patient's parent requests access to the child's medical records. Under HIPAA, the parent's right to access is generally: → Subject to state law and certain exceptions
11. Which of the following best describes a 'hybrid entity' under HIPAA? → A single legal entity that performs both covered and non-covered functions
12. A hospital billing department receives a request for PHI from a health plan. Under the Minimum Necessary Standard, what should the hospital do? → Provide only the information reasonably necessary to fulfill the billing request
13. What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA? → To ensure business associates contractually agree to protect PHI they handle
14. Which entity has primary enforcement authority over HIPAA compliance? → The Office for Civil Rights (OCR) within HHS
15. When applying Safe Harbor de-identification, what must happen to telephone and fax numbers? → They must be removed entirely
16. Which entity type may voluntarily choose to be treated as a covered entity under HIPAA even if not strictly required? → A non-covered provider
17. OCR's HIPAA Audit Program, established under HITECH, is designed to: → Proactively assess covered entity and business associate compliance
18. Under the Security Rule's Integrity standard, what must covered entities implement to ensure ePHI has not been improperly altered or destroyed? → Mechanisms to authenticate ePHI
19. Under HIPAA, an authorization and/or supervision implementation specification requires covered entities to: → Supervise workforce members who work with ePHI
20. Which statement correctly describes the relationship between HIPAA patient rights and state law? → State laws that provide greater privacy protections than HIPAA generally prevail
21. Under the HIPAA Privacy Rule, 'treatment' as a permitted use of PHI includes: → Sharing PHI among healthcare providers for coordination and management of a patient's care
22. What is the HIPAA 'minimum necessary' standard as it applies to PHI? → Only the minimum amount of PHI needed to accomplish a purpose should be used or disclosed
23. Which of the following is an example of PHI in electronic form (ePHI) that must be protected under HIPAA's Security Rule? → A patient's diagnosis stored in an electronic health record system
24. A substance abuse treatment program receives a subpoena for a patient's records. Under 42 CFR Part 2, what is the program's proper response? → Notify the patient and resist disclosure without a court order and patient consent
25. In which of the following scenarios is a covered entity permitted to disclose PHI without the patient's authorization? → To a public health authority for disease surveillance purposes as required by law.
26. A covered entity provides breach notification to affected individuals 45 days after discovery. Is this compliant with HIPAA? → Yes, notification within 60 days of discovery satisfies the requirement
27. Which of the following breaches would require media notification under the HIPAA Breach Notification Rule? → A breach affecting 600 patients in a single state
28. A ransomware attack encrypts a covered entity's servers containing PHI. Under HHS guidance, how is this typically classified? → A breach unless the covered entity can demonstrate a low probability of PHI compromise
29. Which of the following geographic data elements is permitted to remain in a Safe Harbor de-identified dataset? → Three-digit ZIP code prefixes for all regions
30. A covered entity that operates both HIPAA-covered and non-covered components is known as what type of entity? → A hybrid entity