HIPAA COMPLIANCE TRAINING EXAM PREP |
400+ PRACTICE QUESTIONS & VERIFIED
ANSWERS WITH DETAILED RATIONALES |
PATIENT PRIVACY, PHI PROTECTION &
HEALTHCARE DATA SECURITY CERTIFICATION
GUIDE
HIPAA COMPLIANCE TRAINING EXAM PREP
400 Practice Questions with Verified Answers & Detailed RATIONALE
Patient Privacy | PHI Protection | Healthcare Data Security
SECTION 1: HIPAA OVERVIEW & FUNDAMENTALS
Question 1. What does the acronym HIPAA stand for?
A. Health Information Privacy and Accountability Act B. Health Insurance Portability and
Accountability Act C. Healthcare Integrity Protection and Authorization Act D. Health
Information Protection and Assurance Act E. Hospital Insurance Procedures and
Accountability Act
CORRECT ANSWER: B. Health Insurance Portability and Accountability Act
RATIONALE: HIPAA stands for the Health Insurance Portability and Accountability
Act, signed into law by President Bill Clinton on August 21, 1996. It was originally
designed to allow workers to carry health insurance between jobs and later expanded to
protect patient health information.
Question 2. In what year was HIPAA enacted?
A. 1990 B. 1993 C. 1996 D. 2000 E. 2003
CORRECT ANSWER: C. 1996
RATIONALE: HIPAA was signed into law on August 21, 1996. It was enacted under
President Clinton and has since been expanded through various rules including the
Privacy Rule (2003), Security Rule (2005), and the HITECH Act (2009).
,Question 3. Which federal agency is primarily responsible for enforcing HIPAA
regulations?
A. The Food and Drug Administration (FDA) B. The Centers for Medicare & Medicaid
Services (CMS) C. The Department of Justice (DOJ) D. The Office for Civil Rights
(OCR) within HHS E. The Federal Trade Commission (FTC)
CORRECT ANSWER: D. The Office for Civil Rights (OCR) within HHS
RATIONALE: The Office for Civil Rights (OCR), a division of the U.S. Department of
Health and Human Services (HHS), is the primary agency responsible for enforcing the
HIPAA Privacy and Security Rules. The DOJ handles criminal violations of HIPAA.
Question 4. Which of the following is NOT one of the main rules under HIPAA?
A. The Privacy Rule B. The Security Rule C. The Breach Notification Rule D. The
Financial Disclosure Rule E. The Enforcement Rule
CORRECT ANSWER: D. The Financial Disclosure Rule
RATIONALE: HIPAA's main rules are the Privacy Rule, Security Rule, Breach
Notification Rule, Omnibus Rule, and Enforcement Rule. There is no "Financial
Disclosure Rule" under HIPAA. Financial disclosures are governed by other laws such
as the Sarbanes-Oxley Act.
Question 5. What is the primary purpose of the HIPAA Privacy Rule?
A. To protect electronic health records from cyberattacks B. To establish national
standards for the protection of individuals' medical records and personal health
information C. To regulate the financial transactions of healthcare organizations D. To
standardize the format of health insurance claims E. To provide guidelines for hiring
healthcare workers
CORRECT ANSWER: B. To establish national standards for the protection of
individuals' medical records and personal health information
RATIONALE: The HIPAA Privacy Rule, effective April 14, 2003, establishes national
standards to protect individuals' medical records and other personal health information.
It gives patients rights over their health information and sets rules about who can look at
and receive that information.
,Question 6. Which of the following entities is considered a Covered Entity under
HIPAA?
A. A marketing company that analyzes health trends B. A health plan that pays for
medical care C. A software company that develops apps for wellness D. A gym that
tracks member fitness goals E. A university that conducts general research
CORRECT ANSWER: B. A health plan that pays for medical care
RATIONALE: Covered Entities under HIPAA include health plans, healthcare
clearinghouses, and healthcare providers who transmit health information electronically.
A health plan is explicitly listed as a Covered Entity because it handles protected health
information in the course of administering benefits.
Question 7. What legislation expanded HIPAA's reach and strengthened its
enforcement?
A. The Affordable Care Act (ACA) B. The Health Information Technology for Economic
and Clinical Health (HITECH) Act C. The Social Security Act D. The Medicare
Modernization Act E. The Balanced Budget Act
CORRECT ANSWER: B. The Health Information Technology for Economic and
Clinical Health (HITECH) Act
RATIONALE: The HITECH Act, enacted as part of the American Recovery and
Reinvestment Act of 2009, significantly expanded HIPAA's reach by extending
obligations directly to Business Associates, increasing penalties, and strengthening
enforcement mechanisms.
Question 8. Which of the following is an example of a Healthcare Clearinghouse under
HIPAA?
A. A hospital emergency room B. A dental insurance company C. A billing service that
processes non-standard health data into standard formats D. A physical therapy
practice E. A pharmaceutical company
CORRECT ANSWER: C. A billing service that processes non-standard health
data into standard formats
, RATIONALE: Healthcare clearinghouses are entities that process nonstandard
information into standard data elements or vice versa. They serve as intermediaries
between healthcare providers and payers, converting medical billing data into
standardized formats.
Question 9. Which of the following is TRUE regarding HIPAA preemption of state law?
A. HIPAA always overrides state privacy laws B. State laws that provide greater privacy
protections than HIPAA are not preempted C. State laws that provide less protection
than HIPAA always take precedence D. HIPAA has no relationship with state privacy
laws E. State laws are completely irrelevant once HIPAA applies
CORRECT ANSWER: B. State laws that provide greater privacy protections
than HIPAA are not preempted
RATIONALE: HIPAA sets a federal floor for privacy protection, but it does not preempt
state laws that provide greater privacy protections to patients. States may enact stricter
requirements and those laws must be followed when they offer more protection than
HIPAA.
Question 10. Under HIPAA, who is responsible for ensuring that Business Associates
comply with HIPAA requirements?
A. The Department of Justice B. The covered entity that contracts with the Business
Associate C. The Business Associate alone bears full responsibility D. The patient
whose data is being shared E. The state health department
CORRECT ANSWER: B. The covered entity that contracts with the Business
Associate
RATIONALE: While Business Associates are directly liable for HIPAA compliance
under the HITECH Act, Covered Entities also bear responsibility for ensuring their
Business Associates comply through proper Business Associate Agreements (BAAs).
Covered Entities must obtain satisfactory assurances before sharing PHI with a
Business Associate.
Question 11. What is the minimum necessary standard under HIPAA?
A. Using the minimum amount of PHI necessary to accomplish the intended purpose B.
Collecting the minimum number of patient records per year C. Employing the fewest
400+ PRACTICE QUESTIONS & VERIFIED
ANSWERS WITH DETAILED RATIONALES |
PATIENT PRIVACY, PHI PROTECTION &
HEALTHCARE DATA SECURITY CERTIFICATION
GUIDE
HIPAA COMPLIANCE TRAINING EXAM PREP
400 Practice Questions with Verified Answers & Detailed RATIONALE
Patient Privacy | PHI Protection | Healthcare Data Security
SECTION 1: HIPAA OVERVIEW & FUNDAMENTALS
Question 1. What does the acronym HIPAA stand for?
A. Health Information Privacy and Accountability Act B. Health Insurance Portability and
Accountability Act C. Healthcare Integrity Protection and Authorization Act D. Health
Information Protection and Assurance Act E. Hospital Insurance Procedures and
Accountability Act
CORRECT ANSWER: B. Health Insurance Portability and Accountability Act
RATIONALE: HIPAA stands for the Health Insurance Portability and Accountability
Act, signed into law by President Bill Clinton on August 21, 1996. It was originally
designed to allow workers to carry health insurance between jobs and later expanded to
protect patient health information.
Question 2. In what year was HIPAA enacted?
A. 1990 B. 1993 C. 1996 D. 2000 E. 2003
CORRECT ANSWER: C. 1996
RATIONALE: HIPAA was signed into law on August 21, 1996. It was enacted under
President Clinton and has since been expanded through various rules including the
Privacy Rule (2003), Security Rule (2005), and the HITECH Act (2009).
,Question 3. Which federal agency is primarily responsible for enforcing HIPAA
regulations?
A. The Food and Drug Administration (FDA) B. The Centers for Medicare & Medicaid
Services (CMS) C. The Department of Justice (DOJ) D. The Office for Civil Rights
(OCR) within HHS E. The Federal Trade Commission (FTC)
CORRECT ANSWER: D. The Office for Civil Rights (OCR) within HHS
RATIONALE: The Office for Civil Rights (OCR), a division of the U.S. Department of
Health and Human Services (HHS), is the primary agency responsible for enforcing the
HIPAA Privacy and Security Rules. The DOJ handles criminal violations of HIPAA.
Question 4. Which of the following is NOT one of the main rules under HIPAA?
A. The Privacy Rule B. The Security Rule C. The Breach Notification Rule D. The
Financial Disclosure Rule E. The Enforcement Rule
CORRECT ANSWER: D. The Financial Disclosure Rule
RATIONALE: HIPAA's main rules are the Privacy Rule, Security Rule, Breach
Notification Rule, Omnibus Rule, and Enforcement Rule. There is no "Financial
Disclosure Rule" under HIPAA. Financial disclosures are governed by other laws such
as the Sarbanes-Oxley Act.
Question 5. What is the primary purpose of the HIPAA Privacy Rule?
A. To protect electronic health records from cyberattacks B. To establish national
standards for the protection of individuals' medical records and personal health
information C. To regulate the financial transactions of healthcare organizations D. To
standardize the format of health insurance claims E. To provide guidelines for hiring
healthcare workers
CORRECT ANSWER: B. To establish national standards for the protection of
individuals' medical records and personal health information
RATIONALE: The HIPAA Privacy Rule, effective April 14, 2003, establishes national
standards to protect individuals' medical records and other personal health information.
It gives patients rights over their health information and sets rules about who can look at
and receive that information.
,Question 6. Which of the following entities is considered a Covered Entity under
HIPAA?
A. A marketing company that analyzes health trends B. A health plan that pays for
medical care C. A software company that develops apps for wellness D. A gym that
tracks member fitness goals E. A university that conducts general research
CORRECT ANSWER: B. A health plan that pays for medical care
RATIONALE: Covered Entities under HIPAA include health plans, healthcare
clearinghouses, and healthcare providers who transmit health information electronically.
A health plan is explicitly listed as a Covered Entity because it handles protected health
information in the course of administering benefits.
Question 7. What legislation expanded HIPAA's reach and strengthened its
enforcement?
A. The Affordable Care Act (ACA) B. The Health Information Technology for Economic
and Clinical Health (HITECH) Act C. The Social Security Act D. The Medicare
Modernization Act E. The Balanced Budget Act
CORRECT ANSWER: B. The Health Information Technology for Economic and
Clinical Health (HITECH) Act
RATIONALE: The HITECH Act, enacted as part of the American Recovery and
Reinvestment Act of 2009, significantly expanded HIPAA's reach by extending
obligations directly to Business Associates, increasing penalties, and strengthening
enforcement mechanisms.
Question 8. Which of the following is an example of a Healthcare Clearinghouse under
HIPAA?
A. A hospital emergency room B. A dental insurance company C. A billing service that
processes non-standard health data into standard formats D. A physical therapy
practice E. A pharmaceutical company
CORRECT ANSWER: C. A billing service that processes non-standard health
data into standard formats
, RATIONALE: Healthcare clearinghouses are entities that process nonstandard
information into standard data elements or vice versa. They serve as intermediaries
between healthcare providers and payers, converting medical billing data into
standardized formats.
Question 9. Which of the following is TRUE regarding HIPAA preemption of state law?
A. HIPAA always overrides state privacy laws B. State laws that provide greater privacy
protections than HIPAA are not preempted C. State laws that provide less protection
than HIPAA always take precedence D. HIPAA has no relationship with state privacy
laws E. State laws are completely irrelevant once HIPAA applies
CORRECT ANSWER: B. State laws that provide greater privacy protections
than HIPAA are not preempted
RATIONALE: HIPAA sets a federal floor for privacy protection, but it does not preempt
state laws that provide greater privacy protections to patients. States may enact stricter
requirements and those laws must be followed when they offer more protection than
HIPAA.
Question 10. Under HIPAA, who is responsible for ensuring that Business Associates
comply with HIPAA requirements?
A. The Department of Justice B. The covered entity that contracts with the Business
Associate C. The Business Associate alone bears full responsibility D. The patient
whose data is being shared E. The state health department
CORRECT ANSWER: B. The covered entity that contracts with the Business
Associate
RATIONALE: While Business Associates are directly liable for HIPAA compliance
under the HITECH Act, Covered Entities also bear responsibility for ensuring their
Business Associates comply through proper Business Associate Agreements (BAAs).
Covered Entities must obtain satisfactory assurances before sharing PHI with a
Business Associate.
Question 11. What is the minimum necessary standard under HIPAA?
A. Using the minimum amount of PHI necessary to accomplish the intended purpose B.
Collecting the minimum number of patient records per year C. Employing the fewest
