WGU C801 Health Information Law and Regulations 2026/2027 | ACTUAL-Style Practice Questions & Answers, HIPAA Privacy, Healthcare Compliance, Medical Records Law, and Detailed Rationales

WGU C801 Health Information Law and
Regulations 2026/2027 | ACTUAL-Style
Practice Questions & Answers, HIPAA Privacy,
Healthcare Compliance, Medical Records Law,
and Detailed Rationales
WGU C801 Health Information Law and Regulations — 160 Practice
Questions
Question 1: Which federal law established the first national standards
for the protection of individually identifiable health information?
A. The Health Insurance Portability and Accountability Act
B. The Medicare Conditions of Participation
C. The Clinical Laboratory Improvement Amendments
D. The Patient Safety and Quality Improvement Act
CORRECT ANSWER: A. The Health Insurance Portability and
Accountability Act
Rationale: HIPAA, enacted in 1996, established the first comprehensive
federal standards for protecting the privacy and security of individually
identifiable health information. The Privacy Rule and Security Rule
promulgated under HIPAA remain the foundational federal regulations
governing protected health information in the United States. The other
options address different regulatory domains.


Question 2: Under the HIPAA Privacy Rule, the "minimum necessary"
standard requires that covered entities:
A. Disclose only the information explicitly requested by the patient
B. Limit uses and disclosures of protected health information to the
minimum amount reasonably necessary to accomplish the intended
purpose
C. Obtain patient authorization for every disclosure regardless of purpose
D. Restrict all disclosures to treatment purposes only
CORRECT ANSWER: B. Limit uses and disclosures of protected health
information to the minimum amount reasonably necessary to
accomplish the intended purpose

,Rationale: The minimum necessary standard mandates that covered
entities make reasonable efforts to use, disclose, and request only the
minimum amount of protected health information needed to accomplish
the intended purpose of the use or disclosure. This principle applies to
most disclosures but has exceptions, including disclosures to or requests
by a healthcare provider for treatment purposes. Option A misstates the
rule, Option C is overly broad, and Option D incorrectly limits the
standard's scope.


Question 3: The legal health record (LHR) is best defined as:
A. All health information generated during a patient's lifetime
B. The record that the healthcare organization maintains and designates as
its official business record
C. Only the physician's progress notes and orders
D. Any information stored in the electronic health record system
CORRECT ANSWER: B. The record that the healthcare organization
maintains and designates as its official business record
Rationale: The legal health record is the information collected and
maintained by a healthcare organization that constitutes its official
business record for purposes of disclosure to courts, regulators, and third
parties. It is defined by the organization's policies and applicable law, not
by format or provider type. Option A is too broad, Option C is too narrow,
and Option D conflates the LHR with the EHR system.


Question 4: Which of the following is an element of a valid negligence
claim against a healthcare provider?
A. The provider held board certification in a specialty
B. The patient suffered harm as a result of the provider's breach of the
standard of care
C. The provider failed to document the encounter within 24 hours
D. The patient signed an informed consent form
CORRECT ANSWER: B. The patient suffered harm as a result of the
provider's breach of the standard of care

,Rationale: The four elements of a negligence claim are duty, breach of duty
(deviation from the standard of care), causation, and damages (harm). The
patient must prove that the provider's breach directly caused the patient's
injury. Board certification is not an element of negligence, late
documentation alone does not establish negligence, and the presence of
informed consent does not negate a negligence claim.


Question 5: Under HIPAA, a patient's right to request an accounting of
disclosures applies to:
A. All disclosures made for treatment, payment, and healthcare operations
B. All disclosures made for any purpose whatsoever
C. Disclosures made for purposes other than treatment, payment, and
healthcare operations, with certain exceptions
D. Only disclosures made to law enforcement agencies
CORRECT ANSWER: C. Disclosures made for purposes other than
treatment, payment, and healthcare operations, with certain
exceptions
Rationale: HIPAA's accounting of disclosures requirement generally
excludes disclosures for treatment, payment, and healthcare operations.
Patients may request an accounting of other disclosures, such as those
made to public health authorities or pursuant to court orders, subject to
limited exceptions. Options A, B, and D are either too broad or too narrow
in scope.


Question 6: The "designated record set" under HIPAA refers to:
A. All records maintained by a covered entity in any form
B. The group of records maintained by or for a covered entity that includes
medical and billing records used to make decisions about individuals
C. Only the records that a patient has specifically requested to review
D. Records that are exempt from disclosure under state law
CORRECT ANSWER: B. The group of records maintained by or for a
covered entity that includes medical and billing records used to make
decisions about individuals

, Rationale: The designated record set is the group of records maintained by
or for a covered entity that includes medical and billing records and other
records used in whole or in part by or for the covered entity to make
decisions about individuals. This definition is critical because patients
have rights to access and amend records within the designated record set.
Option A is too broad, Option C is inaccurate, and Option D conflates state
law exemptions with the HIPAA definition.


Question 7: Which of the following is a recognized exception to the
HIPAA Privacy Rule's authorization requirement?
A. Disclosure for marketing purposes
B. Disclosure for treatment, payment, and healthcare operations
C. Disclosure of psychotherapy notes for any purpose
D. Disclosure of the entire record to the patient's employer
CORRECT ANSWER: B. Disclosure for treatment, payment, and
healthcare operations
Rationale: HIPAA permits uses and disclosures for treatment, payment,
and healthcare operations without patient authorization. Marketing
generally requires authorization, psychotherapy notes require specific
authorization for most disclosures, and disclosures to employers generally
require authorization except in limited workers' compensation situations.
Options A, C, and D are not exceptions to the authorization requirement.


Question 8: The term "protected health information" (PHI) under HIPAA
includes:
A. Information that identifies an individual and relates to their past,
present, or future physical or mental health condition
B. Only information maintained in a designated record set
C. Information about deceased individuals only for 50 years after death
D. Only information created by a physician
CORRECT ANSWER: A. Information that identifies an individual and
relates to their past, present, or future physical or mental health
condition