Page 1 of 85
HEALTH INFORMATION LAW & REGULATIONS
PRACTICE (150) QUESTIONS WITH RADICLE
RATIONALES
Health care
Exam coverage:
I. Section 1 (Q1–25): HIPAA Privacy Rule fundamentals, patient
rights, permitted disclosures, and minimum necessary
standard.
II. Section 2 (Q26–50): HIPAA Security Rule,
technical/administrative/physical safeguards, and 2025
proposed updates (mandatory encryption, MFA, vulnerability
scanning).
III. Section 3 (Q51–75): HITECH Act, breach notification
requirements, timelines, risk assessment, and FTC
enforcement.
IV. Section 4 (Q76–100): 21st Century Cures Act, information
blocking prohibition, penalties ($1M/violation), and ONC
enforcement.
V. Section 5 (Q101–125): FTC Act enforcement, state privacy
laws (NY, WA, VA, MT, CO), and GINA genetic privacy.
VI. Section 6 (Q126–150): GDPR, European Health Data Space
(EHDS), 42 CFR Part 2 (substance use records), and emerging
international regulations.
, Page 2 of 85
Section 1: HIPAA Privacy Rule – Fundamentals & Patient
Rights (Questions 1–25)
Question 1
A healthcare provider is reviewing the HIPAA Privacy Rule to
ensure compliance. The Privacy Rule establishes national
standards to protect individually identifiable health information
held or transmitted by covered entities and their business
associates. Which of the following is the primary purpose of the
HIPAA Privacy Rule?
A. To establish minimum security standards for electronic
protected health information
B. To set limits and conditions on the uses and disclosures of
protected health information (PHI) without patient authorization
C. To require healthcare providers to obtain written consent for
all treatment decisions
D. To mandate the use of electronic health records for all
Medicare providers
CORRECT ANSWER: B
RATIONALE: The HIPAA Privacy Rule establishes national
standards to protect individually identifiable health information,
sets limits and conditions on the uses and disclosures of PHI,
and gives patients rights over their health information.
, Page 3 of 85
Question 2
A hospital administrator is explaining patient rights under the
HIPAA Privacy Rule to a new employee. The administrator
correctly states that individuals have which of the following
rights over their health records?
A. The right to inspect and obtain a copy of their health records,
request amendments, and receive an accounting of disclosures
B. The right to prevent their health information from being used
for treatment purposes
C. The right to require their healthcare provider to delete all
health records
D. The right to access the health records of any family member
without authorization
CORRECT ANSWER: A
RATIONALE: Pursuant to the HIPAA Privacy Rule, individuals
have certain rights over their health records, including the right
to inspect and copy their PHI, request amendments, and obtain
an accounting of disclosures.
Question 3
A healthcare provider is asked to disclose PHI to a value-based
care organization for treatment activities. According to the
HIPAA Privacy Rule, which of the following is true regarding this
disclosure?
A. The provider must obtain the patient's written authorization
, Page 4 of 85
for any disclosure to a value-based care organization
B. The provider may disclose PHI to participants in value-based
care arrangements, such as accountable care organizations, for
treatment purposes without patient authorization
C. The provider may only disclose de-identified data to value-
based care organizations
D. The provider must obtain a court order before disclosing any
PHI
CORRECT ANSWER: B
RATIONALE: Healthcare providers may disclose protected
health information to participants in value-based care
arrangements, such as accountable care organizations, for
treatment purposes without an individual's authorization.
Question 4
A covered entity is considering disclosing PHI to a family
member involved in the patient's care. Under the HIPAA Privacy
Rule, the covered entity:
A. May never disclose PHI to family members without a court
order
B. May disclose PHI to family members involved in the patient's
care if the patient does not object
C. Must obtain written authorization from the patient for all
family disclosures
D. May disclose PHI only if the patient is incapacitated
HEALTH INFORMATION LAW & REGULATIONS
PRACTICE (150) QUESTIONS WITH RADICLE
RATIONALES
Health care
Exam coverage:
I. Section 1 (Q1–25): HIPAA Privacy Rule fundamentals, patient
rights, permitted disclosures, and minimum necessary
standard.
II. Section 2 (Q26–50): HIPAA Security Rule,
technical/administrative/physical safeguards, and 2025
proposed updates (mandatory encryption, MFA, vulnerability
scanning).
III. Section 3 (Q51–75): HITECH Act, breach notification
requirements, timelines, risk assessment, and FTC
enforcement.
IV. Section 4 (Q76–100): 21st Century Cures Act, information
blocking prohibition, penalties ($1M/violation), and ONC
enforcement.
V. Section 5 (Q101–125): FTC Act enforcement, state privacy
laws (NY, WA, VA, MT, CO), and GINA genetic privacy.
VI. Section 6 (Q126–150): GDPR, European Health Data Space
(EHDS), 42 CFR Part 2 (substance use records), and emerging
international regulations.
, Page 2 of 85
Section 1: HIPAA Privacy Rule – Fundamentals & Patient
Rights (Questions 1–25)
Question 1
A healthcare provider is reviewing the HIPAA Privacy Rule to
ensure compliance. The Privacy Rule establishes national
standards to protect individually identifiable health information
held or transmitted by covered entities and their business
associates. Which of the following is the primary purpose of the
HIPAA Privacy Rule?
A. To establish minimum security standards for electronic
protected health information
B. To set limits and conditions on the uses and disclosures of
protected health information (PHI) without patient authorization
C. To require healthcare providers to obtain written consent for
all treatment decisions
D. To mandate the use of electronic health records for all
Medicare providers
CORRECT ANSWER: B
RATIONALE: The HIPAA Privacy Rule establishes national
standards to protect individually identifiable health information,
sets limits and conditions on the uses and disclosures of PHI,
and gives patients rights over their health information.
, Page 3 of 85
Question 2
A hospital administrator is explaining patient rights under the
HIPAA Privacy Rule to a new employee. The administrator
correctly states that individuals have which of the following
rights over their health records?
A. The right to inspect and obtain a copy of their health records,
request amendments, and receive an accounting of disclosures
B. The right to prevent their health information from being used
for treatment purposes
C. The right to require their healthcare provider to delete all
health records
D. The right to access the health records of any family member
without authorization
CORRECT ANSWER: A
RATIONALE: Pursuant to the HIPAA Privacy Rule, individuals
have certain rights over their health records, including the right
to inspect and copy their PHI, request amendments, and obtain
an accounting of disclosures.
Question 3
A healthcare provider is asked to disclose PHI to a value-based
care organization for treatment activities. According to the
HIPAA Privacy Rule, which of the following is true regarding this
disclosure?
A. The provider must obtain the patient's written authorization
, Page 4 of 85
for any disclosure to a value-based care organization
B. The provider may disclose PHI to participants in value-based
care arrangements, such as accountable care organizations, for
treatment purposes without patient authorization
C. The provider may only disclose de-identified data to value-
based care organizations
D. The provider must obtain a court order before disclosing any
PHI
CORRECT ANSWER: B
RATIONALE: Healthcare providers may disclose protected
health information to participants in value-based care
arrangements, such as accountable care organizations, for
treatment purposes without an individual's authorization.
Question 4
A covered entity is considering disclosing PHI to a family
member involved in the patient's care. Under the HIPAA Privacy
Rule, the covered entity:
A. May never disclose PHI to family members without a court
order
B. May disclose PHI to family members involved in the patient's
care if the patient does not object
C. Must obtain written authorization from the patient for all
family disclosures
D. May disclose PHI only if the patient is incapacitated
