HIPAA Compliance Training Post-Test Prep – Real Practice Questions,
Answers & Detailed Rationales (Updated 2026) | HIPAA Privacy &
Security Rules, Protected Health Information (PHI), Patient
Confidentiality Standards, Healthcare Data Protection, Breach Reporting
Procedures, Administrative, Physical & Technical Safeguards, Electronic
Health Records (EHR) Security, Workplace Compliance & Healthcare
Ethics
Question 1: Which of the following best defines Protected Health Information (PHI)
under HIPAA?
A. Any health information stored electronically
B. Individually identifiable health information held or transmitted by a covered entity or
business associate
C. Any medical record created after 1996
D. Health information shared only for treatment purposes
CORRECT ANSWER: B. Individually identifiable health information held or
transmitted by a covered entity or business associate
Rationale: HIPAA defines PHI as individually identifiable health information that is
created, received, maintained, or transmitted by a covered entity or business associate,
in any form or medium (electronic, paper, or oral). It must contain at least one identifier
that links the information to a specific individual.
Question 2: Under the HIPAA Privacy Rule, which of the following is NOT considered
a covered entity?
A. A health insurance company
B. A healthcare clearinghouse
C. A fitness app developer not contracted by a healthcare provider
D. A hospital that transmits claims electronically
CORRECT ANSWER: C. A fitness app developer not contracted by a healthcare
provider
Rationale: Covered entities under HIPAA include health plans, healthcare
clearinghouses, and healthcare providers who transmit health information
electronically in connection with standard transactions. A fitness app developer
operating independently without a business associate relationship is not a covered
entity.
Question 3: What is the primary purpose of the HIPAA Security Rule?
A. To ensure patient access to their medical records
B. To establish national standards for protecting electronic PHI
C. To regulate the use of PHI for marketing purposes
D. To mandate breach notification timelines
,CORRECT ANSWER: B. To establish national standards for protecting electronic PHI
Rationale: The HIPAA Security Rule specifically addresses electronic protected health
information (ePHI) and requires covered entities and business associates to implement
administrative, physical, and technical safeguards to ensure the confidentiality,
integrity, and availability of ePHI.
Question 4: A patient requests a copy of their medical records. Under HIPAA, within
how many days must a covered entity generally respond to this request?
A. 15 days
B. 30 days
C. 45 days
D. 60 days
CORRECT ANSWER: B. 30 days
Rationale: HIPAA requires covered entities to act on a patient's request for access to
PHI no later than 30 calendar days after receipt of the request. One 30-day extension is
permitted if the entity provides a written statement of the reasons for the delay and the
date by which it will act.
Question 5: Which of the following scenarios would MOST likely constitute a
breach under HIPAA?
A. A nurse discusses a patient's condition with another nurse involved in the patient's
care
B. An unencrypted laptop containing PHI is stolen from a locked office
C. A covered entity discloses PHI to a public health authority as required by law
D. A business associate shares de-identified data with a researcher
CORRECT ANSWER: B. An unencrypted laptop containing PHI is stolen from a
locked office
Rationale: A breach is defined as the acquisition, access, use, or disclosure of PHI in a
manner not permitted by the Privacy Rule that compromises the security or privacy of
the PHI. The theft of an unencrypted device containing PHI is presumed to be a breach
unless a risk assessment demonstrates a low probability of compromise.
Question 6: What does the "Minimum Necessary" standard require under HIPAA?
A. Covered entities must collect the least amount of PHI possible during patient intake
B. Covered entities must make reasonable efforts to limit PHI use, disclosure, and
requests to the minimum necessary to accomplish the intended purpose
C. Patients must minimize the health information they share with providers
D. Business associates must destroy PHI after 6 years
CORRECT ANSWER: B. Covered entities must make reasonable efforts to limit PHI
use, disclosure, and requests to the minimum necessary to accomplish the
intended purpose
,Rationale: The Minimum Necessary Standard requires covered entities to reasonably
limit uses, disclosures, and requests of PHI to the least amount necessary to achieve
the purpose of the use or disclosure. Exceptions include disclosures for treatment
purposes or pursuant to a valid patient authorization.
Question 7: Which of the following is an example of a technical safeguard required
by the HIPAA Security Rule?
A. Workforce training on privacy policies
B. Facility access controls with badge readers
C. Encryption of ePHI during transmission
D. Sanction policies for policy violations
CORRECT ANSWER: C. Encryption of ePHI during transmission
Rationale: Technical safeguards under the Security Rule include access controls, audit
controls, integrity controls, authentication, and transmission security. Encryption of
ePHI during electronic transmission is an addressable implementation specification
under transmission security.
Question 8: When is a covered entity permitted to disclose PHI without patient
authorization for treatment purposes?
A. Only if the patient is unconscious
B. Only to other covered entities within the same health system
C. To any healthcare provider involved in the patient's treatment, regardless of entity
type
D. Only after obtaining verbal consent
CORRECT ANSWER: C. To any healthcare provider involved in the patient's
treatment, regardless of entity type
Rationale: HIPAA permits covered entities to use and disclose PHI for treatment
purposes without patient authorization. This includes sharing information with any
healthcare provider involved in the patient's care, even if that provider is not a covered
entity, as long as the disclosure is for treatment.
Question 9: Which of the following actions is REQUIRED when a covered entity
discovers a breach of unsecured PHI affecting fewer than 500 individuals in a state?
A. Notify the Secretary of HHS within 60 days of the end of the calendar year
B. Notify the local media within 30 days
C. Notify the state attorney general within 10 business days
D. Notify each affected individual within 60 days of discovery
CORRECT ANSWER: D. Notify each affected individual within 60 days of discovery
Rationale: Under the Breach Notification Rule, covered entities must notify affected
individuals without unreasonable delay and no later than 60 calendar days after
, discovery of a breach. For breaches affecting fewer than 500 individuals, notification to
the Secretary of HHS may be submitted annually.
Question 10: What is the role of a Business Associate Agreement (BAA) under
HIPAA?
A. To allow business associates to use PHI for marketing without restriction
B. To outline the permitted uses and disclosures of PHI by a business associate and
require safeguards
C. To exempt business associates from HIPAA compliance requirements
D. To transfer liability for breaches solely to the covered entity
CORRECT ANSWER: B. To outline the permitted uses and disclosures of PHI by a
business associate and require safeguards
Rationale: A BAA is a contract required by HIPAA between a covered entity and a
business associate that specifies the permissible uses and disclosures of PHI by the
business associate, requires appropriate safeguards, and ensures the business
associate will report breaches and comply with applicable Security Rule provisions.
Question 11: Which patient right under HIPAA allows an individual to request
corrections to their PHI?
A. Right to an accounting of disclosures
B. Right to request restrictions
C. Right to request amendment
D. Right to confidential communications
CORRECT ANSWER: C. Right to request amendment
Rationale: HIPAA grants individuals the right to request that a covered entity amend
their PHI or records about them if they believe the information is incorrect or
incomplete. The covered entity must act on the request within 60 days and may deny it
only under specific circumstances.
Question 12: Under HIPAA, which of the following is NOT a valid reason for a
covered entity to deny a patient's request for access to their PHI?
A. The information is psychotherapy notes
B. The request is verbal rather than written
C. Access is reasonably likely to endanger the life or physical safety of the individual or
another person
D. The PHI was compiled in reasonable anticipation of a legal proceeding
CORRECT ANSWER: B. The request is verbal rather than written
Rationale: HIPAA permits covered entities to require that access requests be in writing,
but they cannot deny a request solely because it was made verbally if the entity accepts
verbal requests. Valid denial reasons include psychotherapy notes, information
compiled for legal proceedings, or risk of harm.
Answers & Detailed Rationales (Updated 2026) | HIPAA Privacy &
Security Rules, Protected Health Information (PHI), Patient
Confidentiality Standards, Healthcare Data Protection, Breach Reporting
Procedures, Administrative, Physical & Technical Safeguards, Electronic
Health Records (EHR) Security, Workplace Compliance & Healthcare
Ethics
Question 1: Which of the following best defines Protected Health Information (PHI)
under HIPAA?
A. Any health information stored electronically
B. Individually identifiable health information held or transmitted by a covered entity or
business associate
C. Any medical record created after 1996
D. Health information shared only for treatment purposes
CORRECT ANSWER: B. Individually identifiable health information held or
transmitted by a covered entity or business associate
Rationale: HIPAA defines PHI as individually identifiable health information that is
created, received, maintained, or transmitted by a covered entity or business associate,
in any form or medium (electronic, paper, or oral). It must contain at least one identifier
that links the information to a specific individual.
Question 2: Under the HIPAA Privacy Rule, which of the following is NOT considered
a covered entity?
A. A health insurance company
B. A healthcare clearinghouse
C. A fitness app developer not contracted by a healthcare provider
D. A hospital that transmits claims electronically
CORRECT ANSWER: C. A fitness app developer not contracted by a healthcare
provider
Rationale: Covered entities under HIPAA include health plans, healthcare
clearinghouses, and healthcare providers who transmit health information
electronically in connection with standard transactions. A fitness app developer
operating independently without a business associate relationship is not a covered
entity.
Question 3: What is the primary purpose of the HIPAA Security Rule?
A. To ensure patient access to their medical records
B. To establish national standards for protecting electronic PHI
C. To regulate the use of PHI for marketing purposes
D. To mandate breach notification timelines
,CORRECT ANSWER: B. To establish national standards for protecting electronic PHI
Rationale: The HIPAA Security Rule specifically addresses electronic protected health
information (ePHI) and requires covered entities and business associates to implement
administrative, physical, and technical safeguards to ensure the confidentiality,
integrity, and availability of ePHI.
Question 4: A patient requests a copy of their medical records. Under HIPAA, within
how many days must a covered entity generally respond to this request?
A. 15 days
B. 30 days
C. 45 days
D. 60 days
CORRECT ANSWER: B. 30 days
Rationale: HIPAA requires covered entities to act on a patient's request for access to
PHI no later than 30 calendar days after receipt of the request. One 30-day extension is
permitted if the entity provides a written statement of the reasons for the delay and the
date by which it will act.
Question 5: Which of the following scenarios would MOST likely constitute a
breach under HIPAA?
A. A nurse discusses a patient's condition with another nurse involved in the patient's
care
B. An unencrypted laptop containing PHI is stolen from a locked office
C. A covered entity discloses PHI to a public health authority as required by law
D. A business associate shares de-identified data with a researcher
CORRECT ANSWER: B. An unencrypted laptop containing PHI is stolen from a
locked office
Rationale: A breach is defined as the acquisition, access, use, or disclosure of PHI in a
manner not permitted by the Privacy Rule that compromises the security or privacy of
the PHI. The theft of an unencrypted device containing PHI is presumed to be a breach
unless a risk assessment demonstrates a low probability of compromise.
Question 6: What does the "Minimum Necessary" standard require under HIPAA?
A. Covered entities must collect the least amount of PHI possible during patient intake
B. Covered entities must make reasonable efforts to limit PHI use, disclosure, and
requests to the minimum necessary to accomplish the intended purpose
C. Patients must minimize the health information they share with providers
D. Business associates must destroy PHI after 6 years
CORRECT ANSWER: B. Covered entities must make reasonable efforts to limit PHI
use, disclosure, and requests to the minimum necessary to accomplish the
intended purpose
,Rationale: The Minimum Necessary Standard requires covered entities to reasonably
limit uses, disclosures, and requests of PHI to the least amount necessary to achieve
the purpose of the use or disclosure. Exceptions include disclosures for treatment
purposes or pursuant to a valid patient authorization.
Question 7: Which of the following is an example of a technical safeguard required
by the HIPAA Security Rule?
A. Workforce training on privacy policies
B. Facility access controls with badge readers
C. Encryption of ePHI during transmission
D. Sanction policies for policy violations
CORRECT ANSWER: C. Encryption of ePHI during transmission
Rationale: Technical safeguards under the Security Rule include access controls, audit
controls, integrity controls, authentication, and transmission security. Encryption of
ePHI during electronic transmission is an addressable implementation specification
under transmission security.
Question 8: When is a covered entity permitted to disclose PHI without patient
authorization for treatment purposes?
A. Only if the patient is unconscious
B. Only to other covered entities within the same health system
C. To any healthcare provider involved in the patient's treatment, regardless of entity
type
D. Only after obtaining verbal consent
CORRECT ANSWER: C. To any healthcare provider involved in the patient's
treatment, regardless of entity type
Rationale: HIPAA permits covered entities to use and disclose PHI for treatment
purposes without patient authorization. This includes sharing information with any
healthcare provider involved in the patient's care, even if that provider is not a covered
entity, as long as the disclosure is for treatment.
Question 9: Which of the following actions is REQUIRED when a covered entity
discovers a breach of unsecured PHI affecting fewer than 500 individuals in a state?
A. Notify the Secretary of HHS within 60 days of the end of the calendar year
B. Notify the local media within 30 days
C. Notify the state attorney general within 10 business days
D. Notify each affected individual within 60 days of discovery
CORRECT ANSWER: D. Notify each affected individual within 60 days of discovery
Rationale: Under the Breach Notification Rule, covered entities must notify affected
individuals without unreasonable delay and no later than 60 calendar days after
, discovery of a breach. For breaches affecting fewer than 500 individuals, notification to
the Secretary of HHS may be submitted annually.
Question 10: What is the role of a Business Associate Agreement (BAA) under
HIPAA?
A. To allow business associates to use PHI for marketing without restriction
B. To outline the permitted uses and disclosures of PHI by a business associate and
require safeguards
C. To exempt business associates from HIPAA compliance requirements
D. To transfer liability for breaches solely to the covered entity
CORRECT ANSWER: B. To outline the permitted uses and disclosures of PHI by a
business associate and require safeguards
Rationale: A BAA is a contract required by HIPAA between a covered entity and a
business associate that specifies the permissible uses and disclosures of PHI by the
business associate, requires appropriate safeguards, and ensures the business
associate will report breaches and comply with applicable Security Rule provisions.
Question 11: Which patient right under HIPAA allows an individual to request
corrections to their PHI?
A. Right to an accounting of disclosures
B. Right to request restrictions
C. Right to request amendment
D. Right to confidential communications
CORRECT ANSWER: C. Right to request amendment
Rationale: HIPAA grants individuals the right to request that a covered entity amend
their PHI or records about them if they believe the information is incorrect or
incomplete. The covered entity must act on the request within 60 days and may deny it
only under specific circumstances.
Question 12: Under HIPAA, which of the following is NOT a valid reason for a
covered entity to deny a patient's request for access to their PHI?
A. The information is psychotherapy notes
B. The request is verbal rather than written
C. Access is reasonably likely to endanger the life or physical safety of the individual or
another person
D. The PHI was compiled in reasonable anticipation of a legal proceeding
CORRECT ANSWER: B. The request is verbal rather than written
Rationale: HIPAA permits covered entities to require that access requests be in writing,
but they cannot deny a request solely because it was made verbally if the entity accepts
verbal requests. Valid denial reasons include psychotherapy notes, information
compiled for legal proceedings, or risk of harm.
