HIPAA Compliance Certification Exam — Questions and Answers

Question 1: What is the HIPAA requirement for communicating privacy policies to patients versus to the workforce?

Patients and workforce receive identical HIPAA information
Patients receive a Notice of Privacy Practices describing their rights; workforce members receive training on internal policies and procedures (Correct answer)
The same document serves both patients and workforce
No communication to patients is required; only workforce training is mandated

Correct answer: Patients receive a Notice of Privacy Practices describing their rights; workforce members receive training on internal policies and procedures

HIPAA has separate communication requirements: patients receive the NPP describing their rights; workforce members receive training on organizational policies for handling PHI.

Question 2: Under HIPAA, what privacy consideration applies when a mental health provider uses a video telehealth platform for therapy sessions?

Telehealth sessions are exempt from HIPAA as they occur outside a traditional treatment facility
Any commercially available video conferencing tool may be used for telehealth without restriction
The telehealth platform is a business associate requiring a BAA, and the session must be conducted on a HIPAA-compliant, encrypted platform (Correct answer)
Telehealth privacy is governed by state law only, not HIPAA

Correct answer: The telehealth platform is a business associate requiring a BAA, and the session must be conducted on a HIPAA-compliant, encrypted platform

Telehealth platforms handle PHI on behalf of providers, making them business associates requiring BAAs, and must use encrypted communications meeting HIPAA Security Rule requirements.

Question 3: Under HIPAA, what obligation does a mental health provider have when they receive a release of information request for records but believe the release was signed under duress?

Duress does not affect the validity of an authorization under HIPAA
The provider should investigate the circumstances and may decline to release records if the authorization appears involuntary, consulting legal counsel as appropriate (Correct answer)
The provider must report the suspected duress to HHS before making any decision
Any signed authorization must be honored without question

Correct answer: The provider should investigate the circumstances and may decline to release records if the authorization appears involuntary, consulting legal counsel as appropriate

A valid HIPAA authorization must be voluntarily signed; if the provider suspects duress, they should investigate and may withhold disclosure pending clarification of the authorization's voluntary nature.

Question 4: A large health insurance company experiences a breach affecting 1,000 members residing in the same state. In addition to notifying the affected individuals and the Secretary of HHS, what other notification is required by the HIPAA Breach Notification Rule?

Notify the Federal Trade Commission (FTC) within 60 days.
Notify prominent media outlets serving the state or jurisdiction. (Correct answer)
Post a notice in all company facilities for at least 90 days.
Notify the local police department where the company is headquartered.

Correct answer: Notify prominent media outlets serving the state or jurisdiction.

For breaches of unsecured PHI that affect more than 500 residents of a single state or jurisdiction, the covered entity is required to provide notice to prominent media outlets serving that area. This must be done without unreasonable delay and no later than 60 days after the discovery of the breach.

Question 5: What should an employee do if they suspect a HIPAA violation?

Post about it on social media
Ignore it to avoid getting involved
Inform the patient immediately
Report it to their supervisor or the HIPAA compliance officer (Correct answer)

Correct answer: Report it to their supervisor or the HIPAA compliance officer

Suspected HIPAA violations should be reported to a supervisor or the HIPAA compliance officer to address the issue appropriately.

Question 6: A pharmaceutical company pays a hospital to send promotional materials about a new brand-name drug to a specific list of patients with a relevant diagnosis. Under the HIPAA Omnibus Rule, what is required before the hospital can send these materials?

Approval from the hospital's Institutional Review Board (IRB).
The hospital must secure each patient's written authorization that acknowledges the remuneration. (Correct answer)
An opportunity for the patients to opt-out of the communication.
The communication must be classified as a treatment-related communication.

Correct answer: The hospital must secure each patient's written authorization that acknowledges the remuneration.

The Omnibus Rule significantly tightened the rules around marketing. If a covered entity receives financial remuneration from a third party to make a communication about a product or service, it is considered marketing and requires the patient's prior written authorization. The authorization must also state that remuneration is involved.

Question 7: A Business Associate Agreement (BAA) must include a provision that addresses the termination of the agreement. Which of the following is a required element of this termination provision?

A provision that all PHI becomes the property of the business associate upon termination.
A requirement that the business associate pay a financial penalty to the covered entity upon any termination.
A mandate for the business associate to return or destroy all PHI at the end of the contract. (Correct answer)
A clause stating that the BAA is perpetual and can only be terminated by mutual consent.

Correct answer: A mandate for the business associate to return or destroy all PHI at the end of the contract.

A standard and required component of a BAA is a clause specifying that upon termination of the contract, the business associate must, if feasible, return or destroy all PHI received from, or created or received by the business associate on behalf of, the covered entity. If this is not feasible, protections must be extended to the information, and limits must be placed on further uses and disclosures.

Question 8: My practice can respond to a request to amend a record:

When i get around to it
Only if deemed to affect a patient's care
Within 90 days
Within 60 days (Correct answer)

Correct answer: Within 60 days

The correct answer is "Within 60 days.''This means that the practice is able to respond to a request to amend a record within a maximum time frame of 60 days. <br>It indicates that the practice is committed to promptly addressing any requests for record amendments within this specified period.

Question 9: A hospital billing department outsources its coding to a third-party company. The coding company requires access to patient charts to perform its function. Under HIPAA, what is the most critical step the hospital must take before granting this access?

Ensure the coding company has general liability insurance.
Obtain individual patient authorization for each record shared.
Execute a Business Associate Agreement (BAA) with the coding company. (Correct answer)
De-identify all patient data before sending it to the coding company.

Correct answer: Execute a Business Associate Agreement (BAA) with the coding company.

When a covered entity (the hospital) hires a person or entity (the coding company) to perform functions involving the use or disclosure of PHI, that entity is considered a Business Associate. HIPAA requires a formal, written Business Associate Agreement (BAA) to be in place before any PHI is shared. This contract legally requires the business associate to maintain the same level of protection for the PHI as the covered entity.

Question 10: What does PHI stand for in the context of HIPAA?

Personal Health Identifier
Protected Health Information (Correct answer)
Patient Health Input
Private Health Insurance

Correct answer: Protected Health Information

PHI stands for Protected Health Information, which includes any information about health status, provision of healthcare, or payment for healthcare that can be linked to an individual.

Question 11: A nurse is discussing a patient's care with a doctor in a semi-private room. A patient in the next bed, separated by a curtain, overhears the doctor mention the first patient's name and diagnosis. Assuming the conversation was conducted in a low voice and was necessary for treatment, how would this situation be classified under HIPAA?

A reportable breach of unsecured PHI.
A permitted disclosure for treatment purposes.
A violation of the Minimum Necessary Rule.
An incidental disclosure. (Correct answer)

Correct answer: An incidental disclosure.

This scenario describes an incidental disclosure. An incidental disclosure is a secondary, unavoidable exposure of PHI that occurs as a byproduct of an otherwise permissible activity (like a treatment discussion). It is not a violation, provided that reasonable safeguards (speaking in low voices) were in place and the minimum necessary information was shared for the primary purpose of treatment.

Question 12: In which of the following situations is a Business Associate Agreement (BAA) NOT required?

A hospital hires a shredding company to dispose of paper records containing PHI.
A health plan uses a third-party administrator to process claims.
A physician's office uses a courier service, like the US Postal Service, to mail patient records to another provider for treatment purposes. (Correct answer)
A medical practice hires an IT consultant who has persistent access to their electronic health record (EHR) system.

Correct answer: A physician's office uses a courier service, like the US Postal Service, to mail patient records to another provider for treatment purposes.

HIPAA does not require a BAA with entities that act as a mere conduit for PHI, such as the US Postal Service or other couriers, where access to PHI is transient and not persistent. The other scenarios involve services where the vendor creates, receives, maintains, or transmits PHI on behalf of the covered entity, which explicitly defines them as business associates requiring a BAA.

Question 13: Under HIPAA, a covered entity may disclose PHI about a deceased individual to a medical examiner or coroner to:

Support a civil lawsuit filed by the deceased's surviving family members
Comply with insurance claims processing requirements from the deceased's health plan
Help the covered entity reduce liability exposure related to the death
Identify a deceased individual or determine the cause of death (Correct answer)

Correct answer: Identify a deceased individual or determine the cause of death

The HIPAA Privacy Rule explicitly permits disclosure of PHI to medical examiners and coroners for purposes of identifying a deceased person or determining the cause of death. This exception recognizes the public interest in proper death investigation. It does not extend to litigation support or liability management.

Question 14: A covered entity is preparing a breach notification letter for affected individuals. Which of the following elements is explicitly required to be included in the notice according to the Breach Notification Rule?

A detailed technical report of the forensic investigation.
An offer of complimentary credit monitoring services for one year.
A brief description of what the entity is doing to investigate the breach and prevent future breaches. (Correct answer)
The names of the employees responsible for the breach.

Correct answer: A brief description of what the entity is doing to investigate the breach and prevent future breaches.

The HIPAA Breach Notification Rule specifies several required elements for individual notifications. These include a brief description of the breach, the types of information involved, steps individuals should take to protect themselves, what the entity is doing to investigate, mitigate harm, and prevent future breaches, and contact information.

Question 15: Under HIPAA's criminal penalty structure, what is the most severe penalty for an individual who knowingly obtains and uses PHI for commercial advantage or personal gain?

Up to $250,000 and 10 years in prison (Correct answer)
Up to $100,000 and 5 years in prison
A civil monetary penalty of over $1.5 million
Up to $50,000 and 1 year in prison

Correct answer: Up to $250,000 and 10 years in prison

The criminal penalties for HIPAA violations are tiered. The highest tier, for offenses involving the intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm, allows for fines up to $250,000 and imprisonment for up to 10 years.

Question 16: Under HIPAA, within how many days must a covered entity respond to a patient's request to amend their health information?

30 days
120 days
60 days (Correct answer)
90 days

Correct answer: 60 days

Covered entities must act on an amendment request within 60 days, with one possible 30-day extension.

Question 17: What was HITECH's impact on the use of PHI for research purposes?

HITECH completely prohibited all use of PHI for research
Research uses of PHI were expanded and de-regulated under HITECH
HITECH maintained research exceptions but required BAAs with research institutions handling PHI and strengthened accounting of disclosures for research uses (Correct answer)
HITECH created a separate research exemption outside HIPAA's scope

Correct answer: HITECH maintained research exceptions but required BAAs with research institutions handling PHI and strengthened accounting of disclosures for research uses

HITECH maintained research exceptions under HIPAA but subjected research-related business associates to direct HIPAA obligations and strengthened accountability requirements.

Question 18: A covered entity disagrees with a patient's amendment request and submits a written denial. The patient may then:

File a criminal complaint against the provider immediately
Demand the record be sealed until the dispute is resolved
Request that HHS override the covered entity's decision
Submit a written statement of disagreement to be included with the PHI (Correct answer)

Correct answer: Submit a written statement of disagreement to be included with the PHI

When an amendment is denied, patients have the right to submit a statement of disagreement that the covered entity must attach to the disputed record.

Question 19: How should a covered entity implement the Minimum Necessary Standard for internal workforce access to PHI?

Allow all employees to access any PHI to ensure operational flexibility
Implement role-based access controls so employees access only PHI needed for their job functions (Correct answer)
Require all PHI access to go through a privacy officer
Restrict PHI access only to licensed healthcare professionals

Correct answer: Implement role-based access controls so employees access only PHI needed for their job functions

Role-based access controls ensure each workforce member can access only the PHI necessary to perform their specific job function, satisfying the Minimum Necessary Standard.

Question 20: A covered entity discovers their EHR vendor experienced a data breach affecting 550 patients. What are ALL the required notification steps?

Notify affected patients, HHS, and (due to exceeding 500 in a state) potentially local media within required timeframes (Correct answer)
No notification is required unless more than 1,000 patients are affected
Notify affected patients only
Notify HHS only, as the vendor is responsible for patient notification

Correct answer: Notify affected patients, HHS, and (due to exceeding 500 in a state) potentially local media within required timeframes

Breaches affecting 500+ individuals require notification to affected patients, HHS (within 60 days), and prominent media outlets in affected states.

Question 21: Under HIPAA, a healthcare clearinghouse serves what primary function in the context of electronic transaction standards?

It translates non-standard electronic transactions into HIPAA-standard formats, and vice versa (Correct answer)
It enforces HIPAA transaction compliance on behalf of HHS
It approves all electronic claims before they are submitted to payers
It stores patient medical records on behalf of covered entities

Correct answer: It translates non-standard electronic transactions into HIPAA-standard formats, and vice versa

A HIPAA clearinghouse is a business that processes or facilitates the processing of health information by translating non-standard formats into HIPAA-compliant standard transactions (or vice versa). Clearinghouses do not store records as a primary function, do not have claims-approval authority, and are not enforcement bodies.

Question 22: A hospital EHR system is hit by ransomware. Under HIPAA, what is this event presumed to be?

A minor technical incident not requiring notification
A breach of unsecured PHI unless the organization can demonstrate a low probability that PHI was compromised (Correct answer)
An internal security incident not covered by HIPAA's breach notification rule
Only a breach if patient data was actually exported

Correct answer: A breach of unsecured PHI unless the organization can demonstrate a low probability that PHI was compromised

HHS guidance states that ransomware involving ePHI is presumed to be a breach, requiring notification unless a four-factor risk assessment shows low probability of PHI compromise.

Question 23: A covered entity hires a third-party data analytics firm to process patient data for a quality improvement study. The analytics firm then hires a cloud storage provider to host the data. According to HIPAA, what is the minimum requirement for Business Associate Agreements (BAAs) in this scenario?

The covered entity must have a single, three-party BAA with both the analytics firm and the cloud provider.
The covered entity must have a BAA with the analytics firm, and the analytics firm must have a separate BAA with the cloud provider. (Correct answer)
The covered entity only needs a BAA with the analytics firm, as this agreement automatically extends to any of their subcontractors.
No BAAs are required as long as the data is de-identified before being transferred to the cloud provider.

Correct answer: The covered entity must have a BAA with the analytics firm, and the analytics firm must have a separate BAA with the cloud provider.

HIPAA requires a 'chain of custody' for Protected Health Information (PHI). The covered entity must have a BAA with its direct business associate (the analytics firm). That business associate must then have its own BAA with its subcontractor (the cloud provider) that will handle the PHI. This ensures that HIPAA protections and liability flow down the entire chain of vendors handling the PHI.

Question 24: What role does stigma play in HIPAA's treatment of mental health and substance use disorder information?

HIPAA treats mental health information identically to all other health information with no recognition of stigma
Stigma is addressed only in state law, not federal regulations
HIPAA's heightened protections for psychotherapy notes and 42 CFR Part 2's strict substance use protections reflect Congressional recognition that stigma creates greater harm risks for mental health and SUD information (Correct answer)
HIPAA prohibits discrimination based on mental health status, which addresses stigma concerns

Correct answer: HIPAA's heightened protections for psychotherapy notes and 42 CFR Part 2's strict substance use protections reflect Congressional recognition that stigma creates greater harm risks for mental health and SUD information

The heightened federal protections for psychotherapy notes and substance use disorder records reflect congressional recognition that mental health and SUD stigma creates real risks of discrimination and harm.

Question 25: A patient's friend calls a hospital and asks for an update on the patient's condition. The patient is conscious and able to make their own decisions. According to the HIPAA Privacy Rule, what should the hospital staff do?

Inform the patient of the friend's inquiry and ask the patient if they consent to the disclosure. (Correct answer)
Refuse to provide any information, citing HIPAA.
Give the friend the patient's room number and direct visiting hours.
Provide a general, one-word condition update (e.g., 'stable').

Correct answer: Inform the patient of the friend's inquiry and ask the patient if they consent to the disclosure.

If the patient has the capacity to make their own decisions, the covered entity must provide them with the opportunity to agree or object to the disclosure of their information to family, friends, or others involved in their care. The staff should ask the patient for permission before sharing any information.

Question 26: U.S.C. 7332 deals with confidentially of patient medical record information related to:

Drug abuse, alcoholism, infection with the HIV virus, and sickle cell anemia (Correct answer)
Drug abuse, sexually transmitted diseases, and tuberculosis
Mental illness, HIV status, drug and alcohol abuse
HIV/Aids Status

Correct answer: Drug abuse, alcoholism, infection with the HIV virus, and sickle cell anemia

U.S.C. 7332 deals with the confidentiality of patient medical record information related to drug abuse, alcoholism, infection with the HIV virus, and sickle cell anemia. <br>This means that any information related to these conditions cannot be disclosed without the patient's consent.<br>It is important to protect the privacy of individuals and their medical information, especially when it comes to sensitive topics like drug abuse, alcoholism, HIV infection, and sickle cell anemia.

Question 27: Which of the following is a direct liability for a Business Associate under the HIPAA Omnibus Rule?

Designating a new Privacy Official without notifying the covered entity.
Failing to provide a Notice of Privacy Practices to patients.
Charging an unreasonable, cost-based fee for providing an individual with access to their PHI.
Failure to comply with the HIPAA Security Rule. (Correct answer)

Correct answer: Failure to comply with the HIPAA Security Rule.

The HIPAA Omnibus Rule and HITECH Act made Business Associates directly liable for compliance with the HIPAA Security Rule. This includes implementing administrative, physical, and technical safeguards. Other duties, like providing a Notice of Privacy Practices or liability for charging unreasonable fees for records access, generally remain the direct responsibility of the Covered Entity.

Question 28: Under HIPAA, what is the maximum look-back period for which a patient can request an accounting of disclosures?

3 years
6 years (Correct answer)
10 years
1 year

Correct answer: 6 years

Patients may request an accounting covering up to 6 years prior to the date of the request.

Question 29: Which of the following is included in a patient's 'designated record set' for purposes of the HIPAA right to access?

Psychotherapy notes kept separately by a mental health provider
Medical and billing records used to make decisions about the patient (Correct answer)
Peer review records protected under state law
Quality improvement records used solely for internal benchmarking

Correct answer: Medical and billing records used to make decisions about the patient

The designated record set includes medical and billing records used to make decisions about individuals, giving patients the right to access them.

Question 30: Which of the following data elements, when combined with a patient's medical condition, would NOT be considered Protected Health Information (PHI) under HIPAA?

A patient's full face photograph
The year of a patient's birth
The initial three digits of a zip code for a geographic area containing 25,000 people (Correct answer)
A medical record number

Correct answer: The initial three digits of a zip code for a geographic area containing 25,000 people

According to the HIPAA Safe Harbor method for de-identification, the initial three digits of a zip code are not considered a direct identifier if the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people. The other options—full face photograph, year of birth (for those under 90), and medical record number—are all explicitly listed as identifiers that constitute PHI.

Question 31: Under HIPAA, can a patient's mental health provider share PHI with the patient's employer without authorization?

No, mental health PHI may not be disclosed to employers without authorization except in very limited circumstances (Correct answer)
Yes, employers have a right to know about employee mental health conditions
Yes, if the mental health provider believes the patient is unfit for work
Only if the employer requests the information through an official HR process

Correct answer: No, mental health PHI may not be disclosed to employers without authorization except in very limited circumstances

Mental health PHI generally cannot be disclosed to employers without patient authorization — the treatment relationship is confidential and employment status is not a HIPAA exception.

Question 32: A covered entity learns that its business associate has a pattern of non-compliance that constitutes a material breach of the Business Associate Agreement (BAA). If the business associate fails to cure the breach, what is the covered entity's primary obligation under HIPAA?

Immediately pay any fines on behalf of the business associate.
Publish a notice of the business associate's non-compliance in a major newspaper.
Terminate the BAA with the business associate, if feasible. (Correct answer)
Report the business associate to the local law enforcement agency.

Correct answer: Terminate the BAA with the business associate, if feasible.

If a covered entity knows of a material breach or violation by the business associate, it must take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the covered entity is required to terminate the contract or arrangement, if doing so is feasible.

Question 33: Under HIPAA, which code set is used to report drugs dispensed by a retail pharmacy?

National Drug Codes (NDC) (Correct answer)
ICD-10-PCS
HCPCS Level II J-codes
CPT Category II

Correct answer: National Drug Codes (NDC)

NDC is the HIPAA standard code set for retail pharmacy drug transactions.

Question 34: A minor patient's parent requests access to the child's medical records. Under HIPAA, the parent's right to access is generally:

Prohibited because the minor is the patient
Unconditional in all situations
Subject to state law and certain exceptions (Correct answer)
Allowed only if the minor consents in writing

Correct answer: Subject to state law and certain exceptions

Parents are generally the personal representatives of minors, but state law and specific HIPAA exceptions can limit this access.

Question 35: What is the relationship between HITECH's Meaningful Use incentives and HIPAA Security Rule compliance?

Meaningful Use participation exempts covered entities from HIPAA Security Rule requirements
Meaningful Use Stage 1 and 2 required security risk analysis as a core objective, making HIPAA Security compliance a condition of receiving incentive payments (Correct answer)
Security Rule compliance is entirely separate from Meaningful Use qualification
Meaningful Use only addresses privacy, not security requirements

Correct answer: Meaningful Use Stage 1 and 2 required security risk analysis as a core objective, making HIPAA Security compliance a condition of receiving incentive payments

Meaningful Use's core measures included conducting a security risk analysis per HIPAA's Security Rule, directly tying HIPAA security compliance to federal incentive payment qualification.

Question 36: Which of the following healthcare entities is NOT typically a covered entity under HIPAA?

A workers' compensation insurer (Correct answer)
A hospital emergency department
An individual physician in private practice who submits claims electronically
A Medicare Advantage plan

Correct answer: A workers' compensation insurer

Workers' compensation insurers are specifically excluded from HIPAA's definition of health plans because they provide coverage for work-related injuries, not health coverage per se.

Question 37: A hospital employee knowingly accesses the medical records of a celebrity patient out of curiosity and then sells the information to a media outlet. Which federal agency is most likely to lead the prosecution for this criminal act?

The Federal Trade Commission (FTC)
The HHS Office for Civil Rights (OCR)
The Department of Justice (DOJ) (Correct answer)
The Centers for Medicare & Medicaid Services (CMS)

Correct answer: The Department of Justice (DOJ)

While the HHS Office for Civil Rights (OCR) handles civil and some criminal investigations, the Department of Justice (DOJ) is responsible for the criminal prosecution of HIPAA violations. Violations involving intentional access for personal gain or commercial advantage fall under the criminal provisions of HIPAA.

Question 38: According to the HIPAA Privacy Rule's 'Minimum Necessary' standard, a covered entity must make reasonable efforts to limit the use and disclosure of PHI. In which of the following scenarios does the Minimum Necessary standard NOT apply?

A disclosure from one healthcare provider to another for treatment purposes. (Correct answer)
A use of PHI for internal quality assessment activities.
A disclosure to a business associate for billing operations.
A request for PHI from another covered entity for payment purposes.

Correct answer: A disclosure from one healthcare provider to another for treatment purposes.

The HIPAA Privacy Rule explicitly exempts disclosures of PHI for treatment purposes between healthcare providers from the Minimum Necessary standard. This allows providers to freely share information necessary to provide quality care. However, the Minimum Necessary standard does apply to disclosures for payment and healthcare operations, such as billing or quality assessment.

Question 39: A hospital's radiology department shares full patient demographic and financial histories with radiologists reviewing imaging results. Does this comply with the Minimum Necessary Standard?

No, because radiologists typically need only clinical information relevant to the images, not full financial histories (Correct answer)
No, because radiology departments cannot access PHI without patient authorization
Yes, because radiologists are healthcare providers and are exempt from the standard
Yes, because hospitals may share any PHI internally without restriction

Correct answer: No, because radiologists typically need only clinical information relevant to the images, not full financial histories

Radiologists reviewing imaging need clinical information related to the study, but full financial histories are generally not minimum necessary for that purpose.

Question 40: When an IRB considers whether to waive HIPAA authorization for a research study, which of the following is NOT a required criterion for granting that waiver?

The research could not practicably be conducted without access to the PHI
The research could not practicably be conducted without the waiver of authorization
The researcher must be a full-time employee of the covered entity holding the records (Correct answer)
The research involves no more than minimal risk to the privacy of individuals

Correct answer: The researcher must be a full-time employee of the covered entity holding the records

HIPAA's criteria for an IRB or Privacy Board to waive authorization focus on privacy risk, practicability, and adequacy of protections — not on the employment relationship between the researcher and the covered entity. Researchers from academic institutions, government agencies, or other organizations may qualify for waivers.

Question 41: What HIPAA obligation applies when a covered entity wants to use patient PHI for a research study?

A BAA with the research institution is sufficient to permit PHI use for research
Research is always permitted without authorization as a treatment activity
Research uses of PHI require individual authorization, an IRB waiver, or another HIPAA-compliant research pathway (Correct answer)
Covered entities cannot use PHI for research under any circumstances

Correct answer: Research uses of PHI require individual authorization, an IRB waiver, or another HIPAA-compliant research pathway

Using PHI for research requires patient authorization, an IRB/privacy board waiver of authorization, or another HIPAA research pathway such as use of de-identified data or a limited data set.

Question 42: A clinic is notified by the HHS Office for Civil Rights (OCR) of a potential HIPAA violation. The investigation reveals the violation was due to reasonable cause and not willful neglect. The clinic immediately takes corrective action. Which of the following is an affirmative defense that could prevent OCR from imposing a civil monetary penalty?

The violation was a first-time offense for the clinic.
The clinic has a history of excellent patient care.
The violation was corrected within 30 days of when the clinic knew or should have known about it. (Correct answer)
The financial cost of the penalty would be excessive for the clinic.

Correct answer: The violation was corrected within 30 days of when the clinic knew or should have known about it.

Under 45 CFR § 160.410, an affirmative defense exists if the violation was due to reasonable cause (and not willful neglect) and was corrected within 30 days. If these conditions are met, HHS is prohibited from imposing a civil monetary penalty. While other factors might mitigate the amount, timely correction of a 'reasonable cause' violation is a specific affirmative defense.

Question 43: A patient discovers an error in their medical record and submits a formal written request to their provider to have it corrected. Under the HIPAA Privacy Rule, what right is the patient exercising?

The Right to Restrict Disclosures
The Right to an Accounting of Disclosures
The Right to Amend PHI (Correct answer)
The Right of Access

Correct answer: The Right to Amend PHI

The HIPAA Privacy Rule provides patients with the right to request an amendment of their PHI in a designated record set if they believe the information is inaccurate or incomplete. The covered entity must then review the request and either make the amendment or provide a written denial to the patient.

Question 44: Under HIPAA, which of the following is a 'covered entity'?

A software company that builds EHR systems
A healthcare clearinghouse that processes health insurance claims electronically (Correct answer)
A law firm advising a hospital on HIPAA compliance
A patient advocacy organization that does not handle billing

Correct answer: A healthcare clearinghouse that processes health insurance claims electronically

Healthcare clearinghouses that process health information from non-standard to standard formats are one of the three categories of HIPAA covered entities.

Question 45: A hospital billing department needs to send a list of patient accounts to a third-party collection agency. According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following actions is most appropriate?

Provide the patient's name and total amount due, but no contact information.
Disclose only the demographic and financial information necessary for collection purposes. (Correct answer)
Send the entire medical record for each patient to provide complete context.
Refuse to disclose any information without a court order for each individual patient.

Correct answer: Disclose only the demographic and financial information necessary for collection purposes.

The 'minimum necessary' standard requires covered entities to make reasonable efforts to limit the use or disclosure of Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose. For debt collection, this includes demographic information to identify and locate the individual and financial information about the debt, but not their entire clinical history.

Question 46: Which organization develops and maintains the ASC X12 transaction standards that HIPAA requires for most electronic healthcare transactions?

Accredited Standards Committee X12 (ASC X12) (Correct answer)
The Centers for Medicare & Medicaid Services (CMS)
The American Medical Association (AMA)
The Office of the National Coordinator for Health IT (ONC)

Correct answer: Accredited Standards Committee X12 (ASC X12)

ASC X12 is the standards development organization that creates and maintains the X12 electronic data interchange (EDI) standards adopted by HIPAA. CMS enforces HIPAA; the AMA maintains CPT codes; ONC oversees health IT policy but does not develop transaction standards.

Question 47: A research institution wants to use a large dataset of patient information for a study. To avoid HIPAA constraints, they decide to de-identify the data using the Safe Harbor method. Which of the following must be removed from the dataset?

The state of residence for all patients.
The patient's year of birth.
All patient ages over 89, aggregated into a single category of '90 or older'.
The first three digits of a zip code if the area has fewer than 20,000 people. (Correct answer)

Correct answer: The first three digits of a zip code if the area has fewer than 20,000 people.

The Safe Harbor method requires the removal of 18 specific identifiers. For geographic subdivisions smaller than a state, zip codes must be handled carefully. The initial three digits of a zip code must be removed (or changed to 000) if the geographic unit contains 20,000 or fewer people. The state of residence and year of birth (for those under 90) are generally permissible, and aggregating ages over 89 is a requirement, not a removal of a valid data point.

Question 48: What is a Business Associate Agreement (BAA) in HIPAA compliance?

A contract between two healthcare providers
A contract that outlines how a business associate will protect PHI (Correct answer)
A contract for purchasing medical supplies
An agreement for sharing marketing information

Correct answer: A contract that outlines how a business associate will protect PHI

A BAA is a contract between a covered entity and a business associate that details how PHI will be protected.

Question 49: Under HIPAA, what rights does a patient have regarding their psychotherapy notes if they request access?

Patients have the same right to access psychotherapy notes as any other medical record
Patients can only access psychotherapy notes through a court order
Covered entities may deny patients access to psychotherapy notes — this is one of the few exceptions to the general right of access (Correct answer)
Psychotherapy notes must be shared with patients upon request within 30 days

Correct answer: Covered entities may deny patients access to psychotherapy notes — this is one of the few exceptions to the general right of access

HIPAA specifically allows covered entities to deny patients access to psychotherapy notes — this is one of the few exceptions to the general right of access to PHI.

Question 50: Which of the following BEST describes a patient's right to request confidential communications?

The right to demand encrypted email for all correspondence
The right to keep all PHI completely secret from everyone
The right to prohibit providers from contacting them by phone
The right to receive communications by alternative means or at an alternative location (Correct answer)

Correct answer: The right to receive communications by alternative means or at an alternative location

HIPAA's right to confidential communications lets patients request PHI be sent to a different address or via a different method.

Question 51: A business associate of a covered entity experiences a data breach involving unsecured PHI. According to the HIPAA Breach Notification Rule, what is the primary responsibility of the business associate?

To notify the affected individuals directly within 60 days.
To notify the Secretary of HHS and prominent media outlets.
To conduct a risk assessment and determine if notification is necessary.
To notify the covered entity of the breach without unreasonable delay. (Correct answer)

Correct answer: To notify the covered entity of the breach without unreasonable delay.

The HIPAA Breach Notification Rule requires a business associate to notify the covered entity after discovering a breach of unsecured PHI. This notification must occur without unreasonable delay and no later than 60 days from discovery. The covered entity is ultimately responsible for notifying affected individuals, the Secretary, and the media, as applicable.

Question 52: A medical clinic discovers a breach on January 15th. They complete their investigation and have all necessary information by January 30th. According to the HIPAA Breach Notification Rule's requirement to notify individuals 'without unreasonable delay,' what is the most appropriate course of action?

Wait until March 15th, the 60-day deadline, to send all notifications at once.
Request an extension from HHS before sending the notifications.
Send the notifications within 10 business days of the discovery on January 15th.
Send the notifications shortly after January 30th, as soon as they can be mailed. (Correct answer)

Correct answer: Send the notifications shortly after January 30th, as soon as they can be mailed.

The rule requires notification to be made 'without unreasonable delay' and in no case later than 60 days following the discovery of a breach. Waiting until the 60-day deadline when all information is available sooner would be considered an unreasonable delay. Therefore, the clinic should send the notices as soon as possible after completing its investigation.

Question 53: Under HIPAA, what is an 'incidental disclosure' and when does it not constitute a violation?

Only disclosures of fewer than 5 patients' information qualify as incidental
Any unintended disclosure is an incidental disclosure and always a HIPAA violation
Incidental disclosures are only excused for verbal communications, not written
An incidental disclosure is an inadvertent secondary disclosure that occurs as a result of a permitted use or disclosure, and is not a violation if reasonable safeguards were in place (Correct answer)

Correct answer: An incidental disclosure is an inadvertent secondary disclosure that occurs as a result of a permitted use or disclosure, and is not a violation if reasonable safeguards were in place

Incidental disclosures — like overhearing a name in a waiting room — are permitted if they result from a permitted use/disclosure and the covered entity had reasonable safeguards in place.

Question 54: A patient requests an accounting of disclosures of their Protected Health Information (PHI) from a hospital. Which of the following disclosures must be EXCLUDED from this accounting report?

A disclosure made to the patient's health plan for payment purposes. (Correct answer)
A disclosure made to law enforcement in response to a court order.
A disclosure made to a public health authority for disease control purposes.
A disclosure made to a health oversight agency for an audit.

Correct answer: A disclosure made to the patient's health plan for payment purposes.

The HIPAA Privacy Rule specifically exempts disclosures made for Treatment, Payment, and healthcare Operations (TPO) from the accounting of disclosures requirement. Disclosures for public health activities, in response to court orders, or for health oversight are not part of TPO and must be included in an accounting if requested.

Question 55: A law firm provides legal services to a hospital and, in the course of its work, has access to PHI. Under HIPAA, what is the relationship between the law firm and the hospital?

The law firm is exempt from HIPAA because legal services are not a core healthcare function.
The law firm is considered part of the hospital's workforce and does not need a BAA.
The law firm is a 'Business Associate' and must have a signed BAA with the hospital. (Correct answer)
The law firm is a 'Covered Entity' in this context, operating under its own HIPAA policies.

Correct answer: The law firm is a 'Business Associate' and must have a signed BAA with the hospital.

A business associate is a person or entity that performs certain functions or activities involving the use or disclosure of PHI on behalf of a covered entity. Providing legal services that involve access to PHI is explicitly listed as a business associate function. Therefore, the hospital (covered entity) must have a signed BAA with the law firm (business associate).

Question 56: The HIPAA Omnibus Rule of 2013 modified the Breach Notification Rule by replacing the subjective "harm threshold." An impermissible use or disclosure of PHI is now presumed to be a breach unless the covered entity or business associate demonstrates what?

The individuals affected have been notified and offered credit monitoring.
A formal risk of harm analysis shows no significant financial impact.
The data was encrypted after the impermissible disclosure was discovered.
There is a low probability that the protected health information has been compromised. (Correct answer)

Correct answer: There is a low probability that the protected health information has been compromised.

The Omnibus Rule established that an impermissible use or disclosure of unsecured PHI is presumed to be a breach. This presumption can only be overcome if a risk assessment, considering at least four specific factors, demonstrates a 'low probability that the PHI has been compromised.' The previous 'harm threshold' was considered too subjective.

Question 57: Under HIPAA, an authorization and/or supervision implementation specification requires covered entities to:

Have all PHI access approved by a privacy officer
Obtain written authorization from patients before access
Require dual authorization for all ePHI access
Supervise workforce members who work with ePHI (Correct answer)

Correct answer: Supervise workforce members who work with ePHI

Workforce members who work with ePHI must be supervised as appropriate, especially those working in locations with physical access to facilities with ePHI.

Question 58: Under HIPAA, what happens to the de-identified status of information if additional data is added that re-identifies individuals?

Only the newly added identifying data becomes PHI; the original de-identified portion remains non-PHI
HIPAA does not address what happens when de-identified data is later re-identified
The information remains de-identified as long as it was originally properly de-identified
When de-identified information is combined with identified data, the resulting combined dataset is PHI subject to full HIPAA protections (Correct answer)

Correct answer: When de-identified information is combined with identified data, the resulting combined dataset is PHI subject to full HIPAA protections

When de-identified information is combined with identifying information, the entire resulting dataset is treated as PHI because the data can now be linked to individuals.

Question 59: Under HIPAA, what training requirement applies specifically to staff of a covered entity who answer calls from patients' family members seeking mental health information?

Staff must be trained on: permitted disclosures to family members, the limited circumstances under which they may share mental health information, how to handle state-specific restrictions, and how to protect vulnerable patients from potentially abusive inquirers (Correct answer)
Only the Privacy Officer may respond to family member inquiries about patients
Staff should automatically refer all family inquiries to the treating physician
No special training is required beyond general HIPAA training

Correct answer: Staff must be trained on: permitted disclosures to family members, the limited circumstances under which they may share mental health information, how to handle state-specific restrictions, and how to protect vulnerable patients from potentially abusive inquirers

Front-line staff handling family inquiries about mental health patients need specific training on HIPAA's family disclosure rules, state mental health privacy laws, and red flags for potentially harmful disclosures.

Question 60: A patient asks a covered entity to amend a record and the entity agrees. What must the entity do next?

Require the patient to sign a new HIPAA authorization form
File the amendment with the HHS Secretary within 30 days
Inform the patient and identify persons or entities that need the amendment (Correct answer)
Delete the original entry and replace it with the amended one

Correct answer: Inform the patient and identify persons or entities that need the amendment

When agreeing to an amendment, the entity must notify the patient and share the amendment with relevant parties who received the original PHI.

Question 61: Which of the following rights does the HIPAA Privacy Rule grant to individuals regarding their Protected Health Information (PHI)?

The right to sue a business associate directly for a privacy violation.
The right to have factually incorrect information removed from their medical record entirely.
The right to demand that their health plan not be informed of treatment for which they paid out-of-pocket in full. (Correct answer)
The right to receive a free, comprehensive audit trail of every internal access to their electronic record.

Correct answer: The right to demand that their health plan not be informed of treatment for which they paid out-of-pocket in full.

The HIPAA Privacy Rule gives individuals the right to request restrictions on certain uses and disclosures of their PHI. A key right is to restrict disclosures to a health plan if the individual has paid for the service or item out-of-pocket in full. The provider must agree to this request.

Question 62: Under the HIPAA Privacy Rule, a covered entity may use or disclose PHI for research without individual authorization when:

The research will be published in a peer-reviewed journal within 12 months
The research is funded entirely by a federal agency such as the NIH
The researcher is employed full-time by the covered entity
An Institutional Review Board (IRB) or Privacy Board has approved a waiver of authorization (Correct answer)

Correct answer: An Institutional Review Board (IRB) or Privacy Board has approved a waiver of authorization

HIPAA permits use or disclosure of PHI for research without individual authorization if an IRB or Privacy Board has approved a waiver, finding that the research meets specific criteria (e.g., minimal privacy risk, impracticable to conduct otherwise). Employment status and funding source are not the determining factors.

Question 63: What is required under HIPAA when an EHR system is taken out of service or decommissioned?

Simply powering off the system fulfills HIPAA requirements
All PHI must be securely disposed of or transferred to a compliant system before decommissioning (Correct answer)
Decommissioning requires advance notice to all patients
The decommissioned system must be donated to a non-profit

Correct answer: All PHI must be securely disposed of or transferred to a compliant system before decommissioning

HIPAA requires secure disposal of PHI when decommissioning systems, ensuring patient data cannot be recovered from retired hardware or software.

Question 64: Which component of the contingency plan addresses how a covered entity will continue operating in the event of a system failure?

Emergency mode operation plan (Correct answer)
Testing and revision procedure
Data backup plan
Disaster recovery plan

Correct answer: Emergency mode operation plan

The emergency mode operation plan is required to enable continuation of critical business processes for protection of the security of ePHI during system failure.

Question 65: HIPAA's Safe Harbor de-identification method requires removal of how many specific identifiers?

24 identifiers
15 identifiers
18 identifiers (Correct answer)
12 identifiers

Correct answer: 18 identifiers

HIPAA's Safe Harbor method requires removal of 18 specific categories of identifiers to de-identify health information.

Question 66: Which of the following situations would NOT be considered a 'breach' under the HIPAA Breach Notification Rule, thereby exempting the organization from notification requirements?

A former employee accesses patient records from home using their still-active login credentials.
A billing employee unintentionally accesses the record of a patient they are not treating, realizes the mistake immediately, and does not further use or disclose the information. (Correct answer)
A hacker gains access to a hospital's patient database containing unencrypted PHI.
An unencrypted laptop containing PHI is stolen from an employee's locked office.

Correct answer: A billing employee unintentionally accesses the record of a patient they are not treating, realizes the mistake immediately, and does not further use or disclose the information.

The HIPAA Breach Notification Rule includes three exceptions to the definition of a breach. One exception is for the unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of their authority, provided the information is not further used or disclosed. The other scenarios represent clear breaches requiring notification.

Question 67: Under HIPAA, what should be the immediate response when a workforce member reports a potential privacy violation by a colleague?

Only investigate if the report comes from a supervisor
Wait until the end of the year to review all reported incidents together
Inform the reporting employee that peer violations are not their concern
Document the report, investigate promptly, determine if a breach occurred, and take appropriate corrective action (Correct answer)

Correct answer: Document the report, investigate promptly, determine if a breach occurred, and take appropriate corrective action

Reported potential violations require immediate documentation, prompt investigation, breach analysis, and appropriate follow-up — delays undermine compliance and can extend breach notification timelines.

Question 68: Which of the following is an example of a state law that would NOT be preempted by HIPAA?

A state law permitting PHI disclosure without patient consent for marketing purposes
A state law requiring additional patient authorization for releasing psychotherapy notes beyond HIPAA's requirements (Correct answer)
A state law removing a patient's right to request restrictions on certain disclosures
A state law eliminating the requirement for a covered entity to issue a Notice of Privacy Practices

Correct answer: A state law requiring additional patient authorization for releasing psychotherapy notes beyond HIPAA's requirements

A state law requiring additional authorization for psychotherapy notes goes beyond what HIPAA mandates, making it more protective of patient privacy. Such laws survive HIPAA preemption. The other options all weaken patient protections below HIPAA's floor and would be preempted because they conflict with HIPAA's purposes.

Question 69: Which of the following disclosures to public health authorities is subject to the Minimum Necessary Standard?

Mandatory disease reporting required by state law
Voluntary sharing of patient data beyond what is legally required for a public health investigation (Correct answer)
All public health disclosures are fully exempt from the standard
Any reporting done at the request of the CDC

Correct answer: Voluntary sharing of patient data beyond what is legally required for a public health investigation

While mandatory public health reporting required by law is generally exempt, voluntary or excess disclosures beyond what the law requires must still meet the Minimum Necessary Standard.

Question 70: A patient who paid out-of-pocket for a service asks their provider NOT to share that information with their health plan. Under HIPAA, the provider must:

Share anyway because the plan has a right to know
Comply only if the plan is Medicare or Medicaid
Refuse because it complicates billing coordination
Comply if it is technically feasible (Correct answer)

Correct answer: Comply if it is technically feasible

HIPAA requires providers to honor such a restriction request when the patient paid in full out-of-pocket.

Question 71: Under HIPAA's Safe Harbor method, what must be done with telephone and fax numbers associated with patients?

Telephone numbers may be retained if they are not cell phones
Only direct lines to patients must be removed; facility main numbers may be retained
Phone numbers may be retained if more than 2 years old
All telephone numbers and fax numbers associated with individuals must be removed (Correct answer)

Correct answer: All telephone numbers and fax numbers associated with individuals must be removed

Both telephone and fax numbers are among the 18 Safe Harbor identifiers and must be removed during de-identification.

Question 72: Under HIPAA, for which of the following can psychotherapy notes be disclosed WITHOUT patient authorization?

For training mental health students at the covered entity (Correct answer)
To a specialist consulting on the patient's care
To the patient's insurance company for claims payment
For routine healthcare operations like quality improvement

Correct answer: For training mental health students at the covered entity

HIPAA permits disclosure of psychotherapy notes without authorization for training of mental health students at the covered entity — one of the very limited exceptions.

Question 73: The HIPAA Security Rule requires covered entities to implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. This requirement is known as:

Integrity Controls
Audit Controls (Correct answer)
Information System Activity Review
Access Control

Correct answer: Audit Controls

This question directly defines the Audit Controls standard (§ 164.312(b)) under the Technical Safeguards. The purpose of these controls is to create a record or log of system activity, such as who accessed what data and when, which can be used to detect and investigate security incidents. Information System Activity Review is a related, but separate, Administrative Safeguard.

Question 74: Under what circumstance may a covered entity deny a patient's request to access their own PHI?

A licensed healthcare professional determines access is likely to cause substantial harm to the patient (Correct answer)
The patient owes an outstanding balance for services
The patient requests records in electronic format
The records are more than 5 years old

Correct answer: A licensed healthcare professional determines access is likely to cause substantial harm to the patient

A covered entity may deny access if a licensed healthcare professional believes the information could endanger the life or safety of the patient or another person.

Question 75: Under HIPAA, why must Social Security Numbers be removed in the Safe Harbor de-identification method?

SSNs are unique national identifiers that can definitively link de-identified health records back to specific individuals through cross-referencing (Correct answer)
SSNs are already encrypted in healthcare databases
Only the last 4 digits of SSNs need to be removed
SSNs are government data and not healthcare information

Correct answer: SSNs are unique national identifiers that can definitively link de-identified health records back to specific individuals through cross-referencing

SSNs are unique national identifiers that can be cross-referenced with government and commercial databases to link apparently de-identified health records to specific individuals.

HIPAA Compliance Certification Exam

The HIPAA Compliance Certification exam tests knowledge of the Health Insurance Portability and Accountability Act, including the Privacy Rule, Security Rule, Breach Notification Rule, PHI handling, patient rights, business associate requirements, and enforcement penalties.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

ahima.org — Test delivery, fees, exam format, passing score, renewal, retake policy, score validity · verified Oct 2026