Health Information Management
HEALTH INFORMATION MANAGEMENT EXAM PREP: HIPAA,
EHR, CMS-1500 BILLING & HEALTH INFORMATION
EXCHANGE STUDY GUIDE WITH ANSWERS 2026/2027
1. Which federal law establishes national standards for protecting
individually identifiable health information?
A. HIPAA (Health Insurance Portability and Accountability Act)
B. Affordable Care Act
C. FERPA
D. HITECH Act
ANSWER : A. HIPAA (Health Insurance Portability and Accountability
Act)
2. Under the HIPAA Privacy Rule, what is the term for health
information that can be linked to a specific individual?
A. General Health Data
B. Protected Health Information (PHI)
C. Aggregate Health Statistics
D. Clinical Metadata
ANSWER : B. Protected Health Information (PHI)
3. Which of the following is NOT considered one of HIPAA's 18
identifiers that make health information individually identifiable?
A. Dates directly related to an individual
B. Social Security number
C. Patient name
Page 1 of 26
, Health Information Management
D. General statements about disease prevalence in a population
ANSWER : D. General statements about disease prevalence in a
population
4. Under the Minimum Necessary standard, healthcare workers should:
A. Access all patient records to stay informed
B. Access only the PHI needed to complete their specific job function
C. Share PHI freely between departments
D. Limit PHI access only during audits
ANSWER : B. Access only the PHI needed to complete their specific job
function
5. A Notice of Privacy Practices (NPP) must be:
A. Provided to patients describing how their PHI may be used and
disclosed
B. Signed only by physicians
C. Filed exclusively with CMS
D. Updated only when a breach occurs
ANSWER : A. Provided to patients describing how their PHI may be
used and disclosed
6. Which entity is responsible for enforcing HIPAA Privacy Rule
violations?
A. Federal Trade Commission
B. State Board of Medicine
C. The Joint Commission
D. Office for Civil Rights (OCR), U.S. Department of Health and Human
Services
ANSWER : D. Office for Civil Rights (OCR), U.S. Department of Health
and Human Services
7. A 'covered entity' under HIPAA includes all of the following EXCEPT:
A. A patient's employer
B. Health plans
C. Healthcare clearinghouses
D. Healthcare providers who transmit health information electronically
Page 2 of 26
, Health Information Management
ANSWER : A. A patient's employer
8. Patients have the right under HIPAA to do which of the following
regarding their own records?
A. Transfer ownership of the physical chart to themselves
B. Delete any record they disagree with immediately
C. Prevent all providers from ever viewing their chart
D. Request an amendment to their PHI if they believe it is inaccurate
ANSWER : D. Request an amendment to their PHI if they believe it is
inaccurate
9. A Business Associate Agreement (BAA) is required when:
A. Two physicians in the same practice discuss a patient's case
B. A hospital purchases new furniture for its lobby
C. A patient shares their own diagnosis with a family member
D. A third-party vendor performs a function involving PHI on behalf of a
covered entity
ANSWER : D. A third-party vendor performs a function involving PHI
on behalf of a covered entity
10. Which disclosure of PHI does NOT require patient authorization
under HIPAA?
A. Disclosure for treatment, payment, and healthcare operations (TPO)
B. Sharing PHI with a patient's employer for job screening
C. Posting PHI on a public website
D. Selling PHI to a marketing company
ANSWER : A. Disclosure for treatment, payment, and healthcare
operations (TPO)
11. The 'right of access' under HIPAA generally requires a covered
entity to provide a patient's requested records within how many days?
A. 90 days
B. 180 days
C. 30 days
D. 5 days
ANSWER : C. 30 days
Page 3 of 26
HEALTH INFORMATION MANAGEMENT EXAM PREP: HIPAA,
EHR, CMS-1500 BILLING & HEALTH INFORMATION
EXCHANGE STUDY GUIDE WITH ANSWERS 2026/2027
1. Which federal law establishes national standards for protecting
individually identifiable health information?
A. HIPAA (Health Insurance Portability and Accountability Act)
B. Affordable Care Act
C. FERPA
D. HITECH Act
ANSWER : A. HIPAA (Health Insurance Portability and Accountability
Act)
2. Under the HIPAA Privacy Rule, what is the term for health
information that can be linked to a specific individual?
A. General Health Data
B. Protected Health Information (PHI)
C. Aggregate Health Statistics
D. Clinical Metadata
ANSWER : B. Protected Health Information (PHI)
3. Which of the following is NOT considered one of HIPAA's 18
identifiers that make health information individually identifiable?
A. Dates directly related to an individual
B. Social Security number
C. Patient name
Page 1 of 26
, Health Information Management
D. General statements about disease prevalence in a population
ANSWER : D. General statements about disease prevalence in a
population
4. Under the Minimum Necessary standard, healthcare workers should:
A. Access all patient records to stay informed
B. Access only the PHI needed to complete their specific job function
C. Share PHI freely between departments
D. Limit PHI access only during audits
ANSWER : B. Access only the PHI needed to complete their specific job
function
5. A Notice of Privacy Practices (NPP) must be:
A. Provided to patients describing how their PHI may be used and
disclosed
B. Signed only by physicians
C. Filed exclusively with CMS
D. Updated only when a breach occurs
ANSWER : A. Provided to patients describing how their PHI may be
used and disclosed
6. Which entity is responsible for enforcing HIPAA Privacy Rule
violations?
A. Federal Trade Commission
B. State Board of Medicine
C. The Joint Commission
D. Office for Civil Rights (OCR), U.S. Department of Health and Human
Services
ANSWER : D. Office for Civil Rights (OCR), U.S. Department of Health
and Human Services
7. A 'covered entity' under HIPAA includes all of the following EXCEPT:
A. A patient's employer
B. Health plans
C. Healthcare clearinghouses
D. Healthcare providers who transmit health information electronically
Page 2 of 26
, Health Information Management
ANSWER : A. A patient's employer
8. Patients have the right under HIPAA to do which of the following
regarding their own records?
A. Transfer ownership of the physical chart to themselves
B. Delete any record they disagree with immediately
C. Prevent all providers from ever viewing their chart
D. Request an amendment to their PHI if they believe it is inaccurate
ANSWER : D. Request an amendment to their PHI if they believe it is
inaccurate
9. A Business Associate Agreement (BAA) is required when:
A. Two physicians in the same practice discuss a patient's case
B. A hospital purchases new furniture for its lobby
C. A patient shares their own diagnosis with a family member
D. A third-party vendor performs a function involving PHI on behalf of a
covered entity
ANSWER : D. A third-party vendor performs a function involving PHI
on behalf of a covered entity
10. Which disclosure of PHI does NOT require patient authorization
under HIPAA?
A. Disclosure for treatment, payment, and healthcare operations (TPO)
B. Sharing PHI with a patient's employer for job screening
C. Posting PHI on a public website
D. Selling PHI to a marketing company
ANSWER : A. Disclosure for treatment, payment, and healthcare
operations (TPO)
11. The 'right of access' under HIPAA generally requires a covered
entity to provide a patient's requested records within how many days?
A. 90 days
B. 180 days
C. 30 days
D. 5 days
ANSWER : C. 30 days
Page 3 of 26
