WGU D220 | INFORMATION TECHNOLOGY IN NURSING PRACTICE
WGU D220
EHR and HIPAA Review
2026–2027 | Health Information Technology
Original practice review • 40 multiple-choice questions • Detailed answer rationales
How to Use This Review
Suggested time: 60–75 minutes. Answer each item before reviewing the explanation. The questions are
original study material designed for practice, not official WGU assessment items.
• Choose the single best answer (A–D) for each question.
• Focus on safe clinical judgment, minimum-necessary access, secure handling of electronic protected
health information (ePHI), and appropriate documentation.
• Review missed questions by topic and use the final checklist to guide additional study.
High-Yield Concept Review
EHR vs. EMR: An electronic medical record (EMR) generally focuses on a clinical setting or organization.
An electronic health record (EHR) is designed to support a more longitudinal view of health information
across care settings when systems can exchange data.
HIPAA Privacy Rule: Sets standards for permitted uses and disclosures of protected health information
(PHI), patient rights, and safeguards for privacy. The minimum-necessary standard generally applies to
many uses, disclosures, and requests, with exceptions such as disclosures for treatment.
HIPAA Security Rule: Requires administrative, physical, and technical safeguards for electronic PHI.
Examples include risk analysis, access controls, facility safeguards, authentication, audit controls, and
transmission security.
Confidentiality and access: Access PHI only when authorized and needed for assigned duties. Curiosity,
personal relationships, or convenience are not valid reasons to open a record.
Secure workflow: Use individual credentials, lock screens, avoid shared passwords, verify recipients,
use approved secure communication, and report suspected incidents promptly.
EHR & HIPAA REVIEW • Original educational practice resource | Page 1
, WGU D220 | INFORMATION TECHNOLOGY IN NURSING PRACTICE
Audit trails: System records of access and activity can help investigate inappropriate access, identify
patterns, and support accountability. Do not alter or delete audit evidence.
EHR safety: Use patient identifiers, verify orders, document promptly and accurately, correct errors
through approved amendment workflows, and never copy forward information without checking it.
Interoperability: Systems exchange and use information meaningfully. Standardized formats and
terminologies can support safer handoffs and continuity of care.
Clinical decision support: Alerts and reminders can support decisions, but clinicians must assess
relevance and use professional judgment. Repeated low-value alerts can contribute to alert fatigue.
Incident response: Contain risk when safe, promptly notify the designated privacy/security officer or
supervisor, preserve relevant details, and follow organizational policy. Do not independently determine
that a reportable breach has or has not occurred.
Practice Questions
Select one best answer for each question. Answers and explanations follow each item for focused
learning.
Question 1. A nurse opens the EHR of a neighbor who is not assigned to the nurse’s care
team because the nurse is curious about the neighbor’s diagnosis. Which action best
reflects HIPAA-compliant practice?
A. Access the chart because the nurse works for the organization.
B. Access only the diagnosis tab and avoid other sections.
C. Do not access the chart unless there is an authorized work-related need.
D. Ask a colleague to open the chart instead.
Correct Answer: C
Detailed Rationale: Access must be based on an authorized role and legitimate work-related need.
Employment by the organization does not grant unrestricted access.
Why the other options are incorrect: A: Being an employee does not create a right to view every
record. B: Limiting the amount viewed does not make unauthorized access permissible. D: Having
another person access the chart does not make the request appropriate.
Question 2. Which example is most clearly electronic protected health information (ePHI)?
A. A de-identified aggregate report that cannot reasonably identify individuals.
EHR & HIPAA REVIEW • Original educational practice resource | Page 2
, WGU D220 | INFORMATION TECHNOLOGY IN NURSING PRACTICE
B. A named patient’s diagnosis stored in an electronic health record.
C. A blank medication-administration template.
D. A public hospital brochure with visiting hours.
Correct Answer: B
Detailed Rationale: Individually identifiable health information maintained or transmitted
electronically is ePHI.
Why the other options are incorrect: A: Properly de-identified information is generally not PHI under
HIPAA. C: A blank template contains no patient-specific health information. D: General public
information is not patient-specific health information.
Question 3. A nurse steps away from a workstation in a shared clinical area. What is the
best immediate action?
A. Minimize the EHR window only.
B. Leave the chart open if the workstation faces a wall.
C. Lock or log off the workstation according to policy.
D. Ask a nearby visitor to watch the screen.
Correct Answer: C
Detailed Rationale: Locking or logging off helps prevent unauthorized viewing or use of the session.
Why the other options are incorrect: A: Minimizing a window may leave the session accessible. B:
Screen placement alone is not a sufficient safeguard. D: Visitors should not be responsible for
protecting access to clinical systems.
Question 4. A colleague asks to borrow a nurse’s login because the colleague forgot a
password. What should the nurse do?
A. Share credentials for one task only.
B. Log in and let the colleague document under the nurse’s account.
C. Refuse to share credentials and direct the colleague to the approved reset process.
D. Write the password on a note for the shift.
Correct Answer: C
Detailed Rationale: Individual credentials support accountability and reliable audit trails. Use the
organization’s approved account-recovery process.
EHR & HIPAA REVIEW • Original educational practice resource | Page 3
WGU D220
EHR and HIPAA Review
2026–2027 | Health Information Technology
Original practice review • 40 multiple-choice questions • Detailed answer rationales
How to Use This Review
Suggested time: 60–75 minutes. Answer each item before reviewing the explanation. The questions are
original study material designed for practice, not official WGU assessment items.
• Choose the single best answer (A–D) for each question.
• Focus on safe clinical judgment, minimum-necessary access, secure handling of electronic protected
health information (ePHI), and appropriate documentation.
• Review missed questions by topic and use the final checklist to guide additional study.
High-Yield Concept Review
EHR vs. EMR: An electronic medical record (EMR) generally focuses on a clinical setting or organization.
An electronic health record (EHR) is designed to support a more longitudinal view of health information
across care settings when systems can exchange data.
HIPAA Privacy Rule: Sets standards for permitted uses and disclosures of protected health information
(PHI), patient rights, and safeguards for privacy. The minimum-necessary standard generally applies to
many uses, disclosures, and requests, with exceptions such as disclosures for treatment.
HIPAA Security Rule: Requires administrative, physical, and technical safeguards for electronic PHI.
Examples include risk analysis, access controls, facility safeguards, authentication, audit controls, and
transmission security.
Confidentiality and access: Access PHI only when authorized and needed for assigned duties. Curiosity,
personal relationships, or convenience are not valid reasons to open a record.
Secure workflow: Use individual credentials, lock screens, avoid shared passwords, verify recipients,
use approved secure communication, and report suspected incidents promptly.
EHR & HIPAA REVIEW • Original educational practice resource | Page 1
, WGU D220 | INFORMATION TECHNOLOGY IN NURSING PRACTICE
Audit trails: System records of access and activity can help investigate inappropriate access, identify
patterns, and support accountability. Do not alter or delete audit evidence.
EHR safety: Use patient identifiers, verify orders, document promptly and accurately, correct errors
through approved amendment workflows, and never copy forward information without checking it.
Interoperability: Systems exchange and use information meaningfully. Standardized formats and
terminologies can support safer handoffs and continuity of care.
Clinical decision support: Alerts and reminders can support decisions, but clinicians must assess
relevance and use professional judgment. Repeated low-value alerts can contribute to alert fatigue.
Incident response: Contain risk when safe, promptly notify the designated privacy/security officer or
supervisor, preserve relevant details, and follow organizational policy. Do not independently determine
that a reportable breach has or has not occurred.
Practice Questions
Select one best answer for each question. Answers and explanations follow each item for focused
learning.
Question 1. A nurse opens the EHR of a neighbor who is not assigned to the nurse’s care
team because the nurse is curious about the neighbor’s diagnosis. Which action best
reflects HIPAA-compliant practice?
A. Access the chart because the nurse works for the organization.
B. Access only the diagnosis tab and avoid other sections.
C. Do not access the chart unless there is an authorized work-related need.
D. Ask a colleague to open the chart instead.
Correct Answer: C
Detailed Rationale: Access must be based on an authorized role and legitimate work-related need.
Employment by the organization does not grant unrestricted access.
Why the other options are incorrect: A: Being an employee does not create a right to view every
record. B: Limiting the amount viewed does not make unauthorized access permissible. D: Having
another person access the chart does not make the request appropriate.
Question 2. Which example is most clearly electronic protected health information (ePHI)?
A. A de-identified aggregate report that cannot reasonably identify individuals.
EHR & HIPAA REVIEW • Original educational practice resource | Page 2
, WGU D220 | INFORMATION TECHNOLOGY IN NURSING PRACTICE
B. A named patient’s diagnosis stored in an electronic health record.
C. A blank medication-administration template.
D. A public hospital brochure with visiting hours.
Correct Answer: B
Detailed Rationale: Individually identifiable health information maintained or transmitted
electronically is ePHI.
Why the other options are incorrect: A: Properly de-identified information is generally not PHI under
HIPAA. C: A blank template contains no patient-specific health information. D: General public
information is not patient-specific health information.
Question 3. A nurse steps away from a workstation in a shared clinical area. What is the
best immediate action?
A. Minimize the EHR window only.
B. Leave the chart open if the workstation faces a wall.
C. Lock or log off the workstation according to policy.
D. Ask a nearby visitor to watch the screen.
Correct Answer: C
Detailed Rationale: Locking or logging off helps prevent unauthorized viewing or use of the session.
Why the other options are incorrect: A: Minimizing a window may leave the session accessible. B:
Screen placement alone is not a sufficient safeguard. D: Visitors should not be responsible for
protecting access to clinical systems.
Question 4. A colleague asks to borrow a nurse’s login because the colleague forgot a
password. What should the nurse do?
A. Share credentials for one task only.
B. Log in and let the colleague document under the nurse’s account.
C. Refuse to share credentials and direct the colleague to the approved reset process.
D. Write the password on a note for the shift.
Correct Answer: C
Detailed Rationale: Individual credentials support accountability and reliable audit trails. Use the
organization’s approved account-recovery process.
EHR & HIPAA REVIEW • Original educational practice resource | Page 3
