WGU C801 Health Information Law and
Regulations 2026/2027 | ACTUAL-Style
Practice Questions & Answers, HIPAA Privacy,
Healthcare Compliance, Medical Records Law,
and Detailed Rationales
Question 1: Under the HIPAA Privacy Rule, which of the following best
defines "protected health information" (PHI)?
A. Any health information created or received by a covered entity regardless
of format
B. Individually identifiable health information transmitted or maintained in
any form or medium
C. Health information that is stored only in electronic systems
D. Any information related to a patient's medical condition that is shared
with family members
CORRECT ANSWER: B. Individually identifiable health information
transmitted or maintained in any form or medium
Rationale: PHI is defined as individually identifiable health information that
is transmitted or maintained in any form or medium by a covered entity or
business associate. This includes demographic data that relates to the
individual's past, present, or future physical or mental health condition.
Question 2: Which of the following is NOT a required element of a valid
HIPAA authorization for disclosure of PHI?
A. Description of the information to be used or disclosed
B. Name of the person or entity authorized to make the disclosure
C. The patient's financial account information
D. Expiration date or event that ends the authorization
CORRECT ANSWER: C. The patient's financial account information
Rationale: A valid HIPAA authorization must contain specific core elements
including a description of the PHI, the name of the disclosing entity, the
recipient, the purpose of disclosure, expiration date, and the individual's
signature. Financial account information is not a required element.
Question 3: A covered entity experiences a breach of unsecured PHI
affecting 350 individuals. What is the timeframe for notifying the
affected individuals?
,A. Within 10 business days
B. Without unreasonable delay and no later than 60 calendar days from
discovery
C. Within 30 calendar days
D. Immediately upon discovery, with no exceptions
CORRECT ANSWER: B. Without unreasonable delay and no later than
60 calendar days from discovery
Rationale: Under the HIPAA Breach Notification Rule, covered entities must
notify affected individuals without unreasonable delay and no later than 60
calendar days after discovery of the breach. Notification must be made via
first-class mail to the individual's last known address.
Question 4: Which federal law requires healthcare providers to provide
patients with a Notice of Privacy Practices?
A. The Health Insurance Portability and Accountability Act (HIPAA)
B. The Americans with Disabilities Act (ADA)
C. The Clinical Laboratory Improvement Amendments (CLIA)
D. The Emergency Medical Treatment and Labor Act (EMTALA)
CORRECT ANSWER: A. The Health Insurance Portability and
Accountability Act (HIPAA)
Rationale: The HIPAA Privacy Rule requires covered entities to provide
patients with a Notice of Privacy Practices that describes how their PHI
may be used and disclosed and explains their rights regarding their health
information.
Question 5: What is the primary purpose of the HIPAA Security Rule?
A. To establish national standards for the security of electronic protected
health information
B. To regulate the physical security of hospital buildings
C. To prevent fraud and abuse in Medicare billing
D. To set standards for the privacy of paper records only
CORRECT ANSWER: A. To establish national standards for the security
of electronic protected health information
Rationale: The HIPAA Security Rule specifically addresses the security of
electronic protected health information (ePHI) by requiring covered entities
,to implement administrative, physical, and technical safeguards to ensure
the confidentiality, integrity, and availability of ePHI.
Question 6: Which of the following is an example of a HIPAA Privacy
Rule violation?
A. A nurse discusses a patient's condition with the patient's treating
physician
B. A hospital billing department sends an itemized bill to the patient's home
address
C. A healthcare worker discusses a patient's diagnosis in an elevator with a
colleague
D. A patient signs an authorization for their records to be sent to another
provider
CORRECT ANSWER: C. A healthcare worker discusses a patient's
diagnosis in an elevator with a colleague
Rationale: Discussing a patient's diagnosis in a public area such as an
elevator where the conversation may be overheard by unauthorized
individuals constitutes a breach of patient confidentiality and a HIPAA
Privacy Rule violation.
Question 7: What is the "minimum necessary" standard under HIPAA?
A. The requirement to use the least amount of anesthesia necessary for a
procedure
B. The requirement to limit PHI use and disclosure to the minimum needed
to accomplish the intended purpose
C. The requirement to keep the minimum number of employees with
access to PHI
D. The requirement to store PHI for the minimum amount of time required
by law
CORRECT ANSWER: B. The requirement to limit PHI use and disclosure
to the minimum needed to accomplish the intended purpose
Rationale: The Minimum Necessary Rule requires covered entities to make
reasonable efforts to limit PHI to the minimum necessary to accomplish
the intended purpose of the use, disclosure, or request. This principle
applies to most routine uses and disclosures.
, Question 8: A patient requests an amendment to their medical record.
Under HIPAA, how long does the covered entity have to act on this
request?
A. 10 days
B. 30 days, with one 30-day extension permitted
C. 60 days, with one 30-day extension permitted
D. 90 days
CORRECT ANSWER: C. 60 days, with one 30-day extension permitted
Rationale: Under the HIPAA Privacy Rule, a covered entity must act on an
individual's request for amendment within 60 days. A single 30-day
extension is permitted if the entity provides written notice to the individual
explaining the delay and the expected date of completion.
Question 9: Which of the following would be considered a breach of PHI
under the HIPAA Breach Notification Rule?
A. A lost laptop that was fully encrypted according to HHS guidance
B. Unauthorized access to PHI by a workforce member who has no
business need
C. A patient reviewing their own medical record through a patient portal
D. Disclosure of PHI to a public health authority for disease reporting
CORRECT ANSWER: B. Unauthorized access to PHI by a workforce
member who has no business need
Rationale: Unauthorized access to PHI by a workforce member who lacks a
business need constitutes an impermissible use or disclosure and is
presumed to be a breach unless the covered entity demonstrates a low
probability that the PHI was compromised.
Question 10: What is the role of a Privacy Officer within a healthcare
organization?
A. To oversee the development and implementation of privacy policies and
procedures
B. To provide direct patient care services
C. To manage the organization's financial investments
D. To represent the organization in malpractice lawsuits
Regulations 2026/2027 | ACTUAL-Style
Practice Questions & Answers, HIPAA Privacy,
Healthcare Compliance, Medical Records Law,
and Detailed Rationales
Question 1: Under the HIPAA Privacy Rule, which of the following best
defines "protected health information" (PHI)?
A. Any health information created or received by a covered entity regardless
of format
B. Individually identifiable health information transmitted or maintained in
any form or medium
C. Health information that is stored only in electronic systems
D. Any information related to a patient's medical condition that is shared
with family members
CORRECT ANSWER: B. Individually identifiable health information
transmitted or maintained in any form or medium
Rationale: PHI is defined as individually identifiable health information that
is transmitted or maintained in any form or medium by a covered entity or
business associate. This includes demographic data that relates to the
individual's past, present, or future physical or mental health condition.
Question 2: Which of the following is NOT a required element of a valid
HIPAA authorization for disclosure of PHI?
A. Description of the information to be used or disclosed
B. Name of the person or entity authorized to make the disclosure
C. The patient's financial account information
D. Expiration date or event that ends the authorization
CORRECT ANSWER: C. The patient's financial account information
Rationale: A valid HIPAA authorization must contain specific core elements
including a description of the PHI, the name of the disclosing entity, the
recipient, the purpose of disclosure, expiration date, and the individual's
signature. Financial account information is not a required element.
Question 3: A covered entity experiences a breach of unsecured PHI
affecting 350 individuals. What is the timeframe for notifying the
affected individuals?
,A. Within 10 business days
B. Without unreasonable delay and no later than 60 calendar days from
discovery
C. Within 30 calendar days
D. Immediately upon discovery, with no exceptions
CORRECT ANSWER: B. Without unreasonable delay and no later than
60 calendar days from discovery
Rationale: Under the HIPAA Breach Notification Rule, covered entities must
notify affected individuals without unreasonable delay and no later than 60
calendar days after discovery of the breach. Notification must be made via
first-class mail to the individual's last known address.
Question 4: Which federal law requires healthcare providers to provide
patients with a Notice of Privacy Practices?
A. The Health Insurance Portability and Accountability Act (HIPAA)
B. The Americans with Disabilities Act (ADA)
C. The Clinical Laboratory Improvement Amendments (CLIA)
D. The Emergency Medical Treatment and Labor Act (EMTALA)
CORRECT ANSWER: A. The Health Insurance Portability and
Accountability Act (HIPAA)
Rationale: The HIPAA Privacy Rule requires covered entities to provide
patients with a Notice of Privacy Practices that describes how their PHI
may be used and disclosed and explains their rights regarding their health
information.
Question 5: What is the primary purpose of the HIPAA Security Rule?
A. To establish national standards for the security of electronic protected
health information
B. To regulate the physical security of hospital buildings
C. To prevent fraud and abuse in Medicare billing
D. To set standards for the privacy of paper records only
CORRECT ANSWER: A. To establish national standards for the security
of electronic protected health information
Rationale: The HIPAA Security Rule specifically addresses the security of
electronic protected health information (ePHI) by requiring covered entities
,to implement administrative, physical, and technical safeguards to ensure
the confidentiality, integrity, and availability of ePHI.
Question 6: Which of the following is an example of a HIPAA Privacy
Rule violation?
A. A nurse discusses a patient's condition with the patient's treating
physician
B. A hospital billing department sends an itemized bill to the patient's home
address
C. A healthcare worker discusses a patient's diagnosis in an elevator with a
colleague
D. A patient signs an authorization for their records to be sent to another
provider
CORRECT ANSWER: C. A healthcare worker discusses a patient's
diagnosis in an elevator with a colleague
Rationale: Discussing a patient's diagnosis in a public area such as an
elevator where the conversation may be overheard by unauthorized
individuals constitutes a breach of patient confidentiality and a HIPAA
Privacy Rule violation.
Question 7: What is the "minimum necessary" standard under HIPAA?
A. The requirement to use the least amount of anesthesia necessary for a
procedure
B. The requirement to limit PHI use and disclosure to the minimum needed
to accomplish the intended purpose
C. The requirement to keep the minimum number of employees with
access to PHI
D. The requirement to store PHI for the minimum amount of time required
by law
CORRECT ANSWER: B. The requirement to limit PHI use and disclosure
to the minimum needed to accomplish the intended purpose
Rationale: The Minimum Necessary Rule requires covered entities to make
reasonable efforts to limit PHI to the minimum necessary to accomplish
the intended purpose of the use, disclosure, or request. This principle
applies to most routine uses and disclosures.
, Question 8: A patient requests an amendment to their medical record.
Under HIPAA, how long does the covered entity have to act on this
request?
A. 10 days
B. 30 days, with one 30-day extension permitted
C. 60 days, with one 30-day extension permitted
D. 90 days
CORRECT ANSWER: C. 60 days, with one 30-day extension permitted
Rationale: Under the HIPAA Privacy Rule, a covered entity must act on an
individual's request for amendment within 60 days. A single 30-day
extension is permitted if the entity provides written notice to the individual
explaining the delay and the expected date of completion.
Question 9: Which of the following would be considered a breach of PHI
under the HIPAA Breach Notification Rule?
A. A lost laptop that was fully encrypted according to HHS guidance
B. Unauthorized access to PHI by a workforce member who has no
business need
C. A patient reviewing their own medical record through a patient portal
D. Disclosure of PHI to a public health authority for disease reporting
CORRECT ANSWER: B. Unauthorized access to PHI by a workforce
member who has no business need
Rationale: Unauthorized access to PHI by a workforce member who lacks a
business need constitutes an impermissible use or disclosure and is
presumed to be a breach unless the covered entity demonstrates a low
probability that the PHI was compromised.
Question 10: What is the role of a Privacy Officer within a healthcare
organization?
A. To oversee the development and implementation of privacy policies and
procedures
B. To provide direct patient care services
C. To manage the organization's financial investments
D. To represent the organization in malpractice lawsuits
