WGU C801 — HEALTH INFORMATION LAW
AND REGULATIONS PRACTICE EXAM 2026 |
150 ORIGINAL QUESTIONS & ANSWERS |
DETAILED RATIONALES | COMPLETE EXAM
PREP GRADED A+
MOST TESTED TOPICS
• HIPAA Privacy Rule
• HIPAA Security Rule
• HIPAA Breach Notification Rule
• Protected Health Information (PHI)
• Covered Entities and Business Associates
• Minimum Necessary Standard
• Patient Rights and Access
• Authorization and Uses/Disclosures
• HITECH Act
• Meaningful Use and EHR requirements
• Confidentiality and privacy
• Administrative, physical, and technical safeguards
• Risk analysis and risk management
• Enforcement and penalties
, • State and federal health-information requirements
• Documentation, retention, and release of information
• Special categories of protected health information
1.
A hospital employee accesses the medical record of a patient who is not involved
in the employee's assigned duties. The employee does not disclose the
information to anyone but reviews the patient's diagnosis out of curiosity. Which
statement best describes this activity?
A. It is permitted because no information was disclosed externally.
B. It is permitted if the employee has a valid hospital login.
C. It is permitted because the employee is part of the covered entity.
D. It is an impermissible access of PHI.
Answer: D. It is an impermissible access of PHI.
HIPAA applies to inappropriate internal access as well as external disclosure.
Having credentials or being employed by the organization does not create
unlimited access to patient information.
2.
A patient requests a copy of the patient's electronic health record. Under HIPAA,
which right is most directly implicated?
A. Right to amend all information without limitation
B. Right of access to PHI maintained in a designated record set
C. Right to prohibit all disclosures
D. Right to require deletion of the medical record
,Answer: B. Right of access to PHI maintained in a designated record set.
HIPAA provides individuals with a right to inspect and obtain copies of certain PHI
in designated record sets. This does not generally create a right to delete legally
required records.
3.
A physician wants to send a patient's complete medical record to another
physician for treatment purposes. The patient has not signed a specific
authorization. Which is generally correct?
A. The disclosure is prohibited without written authorization.
B. The disclosure may generally occur for treatment purposes without
authorization.
C. The disclosure requires approval from the Department of Health and Human
Services.
D. The disclosure is permitted only if the patient is unconscious.
Answer: B. The disclosure may generally occur for treatment purposes without
authorization.
HIPAA generally permits disclosures of PHI for treatment, payment, and health
care operations without a patient's authorization, subject to applicable
requirements.
4.
A health care organization discovers that an employee accidentally emailed PHI to
the wrong recipient. What should the organization initially do?
A. Automatically assume that a reportable breach occurred.
B. Immediately destroy the employee's email account.
C. Perform a breach risk assessment as required by the applicable rules.
D. Ignore the incident because the disclosure was accidental.
, Answer: C. Perform a breach risk assessment as required by the applicable rules.
An impermissible acquisition, access, use, or disclosure of PHI does not
automatically mean notification is required. The organization evaluates the
applicable factors to determine whether there is a low probability that the PHI
was compromised.
5.
Which organization is most clearly a HIPAA covered entity?
A. A hospital transmitting electronic health care transactions covered by HIPAA
B. A company selling office furniture to hospitals
C. A patient's family member
D. A newspaper publishing health-related articles
Answer: A. A hospital transmitting electronic health care transactions covered
by HIPAA.
Covered entities include health plans, health care clearinghouses, and certain
health care providers that conduct specified electronic transactions.
6.
A health care provider hires an outside company to store and process electronic
PHI on its behalf. The company performs functions involving PHI for the provider.
What is the company most likely considered?
A. Covered entity
B. Business associate
C. Health plan
D. Clearinghouse
Answer: B. Business associate.
A business associate performs certain functions or services involving PHI on behalf
of a covered entity and is subject to applicable HIPAA requirements.
AND REGULATIONS PRACTICE EXAM 2026 |
150 ORIGINAL QUESTIONS & ANSWERS |
DETAILED RATIONALES | COMPLETE EXAM
PREP GRADED A+
MOST TESTED TOPICS
• HIPAA Privacy Rule
• HIPAA Security Rule
• HIPAA Breach Notification Rule
• Protected Health Information (PHI)
• Covered Entities and Business Associates
• Minimum Necessary Standard
• Patient Rights and Access
• Authorization and Uses/Disclosures
• HITECH Act
• Meaningful Use and EHR requirements
• Confidentiality and privacy
• Administrative, physical, and technical safeguards
• Risk analysis and risk management
• Enforcement and penalties
, • State and federal health-information requirements
• Documentation, retention, and release of information
• Special categories of protected health information
1.
A hospital employee accesses the medical record of a patient who is not involved
in the employee's assigned duties. The employee does not disclose the
information to anyone but reviews the patient's diagnosis out of curiosity. Which
statement best describes this activity?
A. It is permitted because no information was disclosed externally.
B. It is permitted if the employee has a valid hospital login.
C. It is permitted because the employee is part of the covered entity.
D. It is an impermissible access of PHI.
Answer: D. It is an impermissible access of PHI.
HIPAA applies to inappropriate internal access as well as external disclosure.
Having credentials or being employed by the organization does not create
unlimited access to patient information.
2.
A patient requests a copy of the patient's electronic health record. Under HIPAA,
which right is most directly implicated?
A. Right to amend all information without limitation
B. Right of access to PHI maintained in a designated record set
C. Right to prohibit all disclosures
D. Right to require deletion of the medical record
,Answer: B. Right of access to PHI maintained in a designated record set.
HIPAA provides individuals with a right to inspect and obtain copies of certain PHI
in designated record sets. This does not generally create a right to delete legally
required records.
3.
A physician wants to send a patient's complete medical record to another
physician for treatment purposes. The patient has not signed a specific
authorization. Which is generally correct?
A. The disclosure is prohibited without written authorization.
B. The disclosure may generally occur for treatment purposes without
authorization.
C. The disclosure requires approval from the Department of Health and Human
Services.
D. The disclosure is permitted only if the patient is unconscious.
Answer: B. The disclosure may generally occur for treatment purposes without
authorization.
HIPAA generally permits disclosures of PHI for treatment, payment, and health
care operations without a patient's authorization, subject to applicable
requirements.
4.
A health care organization discovers that an employee accidentally emailed PHI to
the wrong recipient. What should the organization initially do?
A. Automatically assume that a reportable breach occurred.
B. Immediately destroy the employee's email account.
C. Perform a breach risk assessment as required by the applicable rules.
D. Ignore the incident because the disclosure was accidental.
, Answer: C. Perform a breach risk assessment as required by the applicable rules.
An impermissible acquisition, access, use, or disclosure of PHI does not
automatically mean notification is required. The organization evaluates the
applicable factors to determine whether there is a low probability that the PHI
was compromised.
5.
Which organization is most clearly a HIPAA covered entity?
A. A hospital transmitting electronic health care transactions covered by HIPAA
B. A company selling office furniture to hospitals
C. A patient's family member
D. A newspaper publishing health-related articles
Answer: A. A hospital transmitting electronic health care transactions covered
by HIPAA.
Covered entities include health plans, health care clearinghouses, and certain
health care providers that conduct specified electronic transactions.
6.
A health care provider hires an outside company to store and process electronic
PHI on its behalf. The company performs functions involving PHI for the provider.
What is the company most likely considered?
A. Covered entity
B. Business associate
C. Health plan
D. Clearinghouse
Answer: B. Business associate.
A business associate performs certain functions or services involving PHI on behalf
of a covered entity and is subject to applicable HIPAA requirements.
