RCAL NAB ADMINISTRATOR EXAM (FEDERAL):
HIPAA & CONFIDENTIALITY STUDY GUIDE
(2026/2027) QOO% ACCURATE!
TABLE OF CONTENTS
1. Introduction to HIPAA in RC/AL
2. Key Concepts Summary: HIPAA Privacy & Security Rules
3. 30 Exam-Level Multiple-Choice Questions & Rationales
4. Real-World Application & Administrator Decision-Making
1. Introduction to HIPAA in RC/AL
For the NAB RCAL exam, HIPAA is not just about IT; it is a core component of the
Resident Rights and Quality Assurance domains. Administrators must manage the
balance between operational efficiency and the legal requirement to protect Protected
Health Information (PHI).
2. Key Concepts Summary
● Privacy Rule: Protects the privacy of PHI. Limits use and disclosure to the
"Minimum Necessary" standard.
● Security Rule: Protects electronic PHI (ePHI). Requires Administrative,
Physical, and Technical safeguards.
● Breach Notification Rule: Requires notification to affected individuals and the
HHS Secretary if a breach of unsecured PHI occurs.
● Notice of Privacy Practices (NPP): A document provided to residents
explaining how the facility uses and discloses their PHI.
● Business Associate Agreement (BAA): A contract required when a third party
(e.g., billing company, cloud storage) handles PHI.
3. 30 Multiple-Choice Questions & Detailed Rationales
, Q1. An administrator is approached by a resident's sibling asking for the
resident's recent diagnosis. The resident is mentally alert and competent. What is
the correct action?
● A) Share the info if the sibling pays the facility fees.
● B) Deny the request unless the resident has provided written authorization.
● C) Share the info as family members have inherent rights.
● D) Ask the staff nurse to decide.
● Answer: B | Rationale: Competent residents control their own information. A, C,
and D ignore the resident's right to privacy.
Q2. A facility uses a cloud-based server for electronic medical records (EMR).
What is mandatory?
● A) A Business Associate Agreement (BAA).
● B) A physical guard at the server location.
● C) An internet firewall only.
● D) Nothing, as it is online.
● Answer: A | Rationale: Third-party vendors handling PHI must sign a BAA
ensuring they comply with HIPAA.
Q3. Under the "Minimum Necessary" rule, staff should:
● A) Access the entire chart regardless of the task.
● B) Access only the amount of PHI required to perform their specific job function.
● C) Share all info with the entire staff to ensure transparency.
● D) Only access records during an audit.
● Answer: B | Rationale: HIPAA limits access to the minimum information needed.
Q4. A staff member discusses a resident's condition in the facility elevator. This
is:
● A) Acceptable if no one else is in the elevator.
● B) A violation of the HIPAA Privacy Rule.
● C) Allowed if it is work-related.
● D) A breach of the facility’s fire policy.
● Answer: B | Rationale: Privacy must be maintained in public/common areas.
HIPAA & Confidentiality: Test Bank (Q5–Q30)
Q5. When a resident moves to a hospital, what information can you disclose to
the hospital staff without specific authorization?
HIPAA & CONFIDENTIALITY STUDY GUIDE
(2026/2027) QOO% ACCURATE!
TABLE OF CONTENTS
1. Introduction to HIPAA in RC/AL
2. Key Concepts Summary: HIPAA Privacy & Security Rules
3. 30 Exam-Level Multiple-Choice Questions & Rationales
4. Real-World Application & Administrator Decision-Making
1. Introduction to HIPAA in RC/AL
For the NAB RCAL exam, HIPAA is not just about IT; it is a core component of the
Resident Rights and Quality Assurance domains. Administrators must manage the
balance between operational efficiency and the legal requirement to protect Protected
Health Information (PHI).
2. Key Concepts Summary
● Privacy Rule: Protects the privacy of PHI. Limits use and disclosure to the
"Minimum Necessary" standard.
● Security Rule: Protects electronic PHI (ePHI). Requires Administrative,
Physical, and Technical safeguards.
● Breach Notification Rule: Requires notification to affected individuals and the
HHS Secretary if a breach of unsecured PHI occurs.
● Notice of Privacy Practices (NPP): A document provided to residents
explaining how the facility uses and discloses their PHI.
● Business Associate Agreement (BAA): A contract required when a third party
(e.g., billing company, cloud storage) handles PHI.
3. 30 Multiple-Choice Questions & Detailed Rationales
, Q1. An administrator is approached by a resident's sibling asking for the
resident's recent diagnosis. The resident is mentally alert and competent. What is
the correct action?
● A) Share the info if the sibling pays the facility fees.
● B) Deny the request unless the resident has provided written authorization.
● C) Share the info as family members have inherent rights.
● D) Ask the staff nurse to decide.
● Answer: B | Rationale: Competent residents control their own information. A, C,
and D ignore the resident's right to privacy.
Q2. A facility uses a cloud-based server for electronic medical records (EMR).
What is mandatory?
● A) A Business Associate Agreement (BAA).
● B) A physical guard at the server location.
● C) An internet firewall only.
● D) Nothing, as it is online.
● Answer: A | Rationale: Third-party vendors handling PHI must sign a BAA
ensuring they comply with HIPAA.
Q3. Under the "Minimum Necessary" rule, staff should:
● A) Access the entire chart regardless of the task.
● B) Access only the amount of PHI required to perform their specific job function.
● C) Share all info with the entire staff to ensure transparency.
● D) Only access records during an audit.
● Answer: B | Rationale: HIPAA limits access to the minimum information needed.
Q4. A staff member discusses a resident's condition in the facility elevator. This
is:
● A) Acceptable if no one else is in the elevator.
● B) A violation of the HIPAA Privacy Rule.
● C) Allowed if it is work-related.
● D) A breach of the facility’s fire policy.
● Answer: B | Rationale: Privacy must be maintained in public/common areas.
HIPAA & Confidentiality: Test Bank (Q5–Q30)
Q5. When a resident moves to a hospital, what information can you disclose to
the hospital staff without specific authorization?
