Wgu C801 Health Information Law And Regulations
Actual-Style Practice Questions And Correct Answers With
Rationales| Instant Download
This exam assesses mastery of the legal and regulatory framework governing health information, including
HIPAA Privacy, Security, and Breach Notification Rules, HITECH, 42 CFR Part 2, state laws, and AHIMA
standards. Questions require advanced analysis of compliance scenarios, preemption, authorization requirements,
and enforcement mechanisms. It contains 140 multiple-choice questions, each with four distractors and a fully
worked rationale that explains why the keyed answer is correct. Content is organized into 11 focused sections:
Legal and Regulatory Framework of Health Information, Patient Privacy and Confidentiality (HIPAA Privacy
Rule), Security of Health Information (HIPAA Security Rule), Release of Information and Patient Access Rights,
Consent, Authorization, and Disclosure Requirements, Health Information Management Ethics and Professional
Standards, Retention, Destruction, and Record Management, Legal Health Record and Documentation Standards,
Breach Notification and Enforcement, Compliance, Auditing, and Risk Management, Emerging Issues: EHRs,
Telehealth, and Data Governance. Targeted learning outcomes include: Apply HIPAA Privacy Rule preemption
analysis to conflicting state health information laws.; Differentiate permitted disclosures for treatment, payment,
and operations versus those requiring authorization.; Evaluate security incident response obligations under the
HIPAA Breach Notification Rule and HITECH.; Analyze enforcement penalties and compliance program
requirements under CMS and OIG guidance.. Every item has been reviewed for clinical accuracy, current
Section 1: Legal and Regulatory Framework of Health Information (Questions 1-14)
1 A state law requires patient consent for all disclosures of mental health
records, while HIPAA permits disclosure for treatment without authorization.
Which law applies?
A) HIPAA preempts the state law because it is less stringent.
B) The state law applies because it is more stringent than HIPAA.
C) Neither law applies; federal common law governs.
D) HIPAA and the state law are concurrently enforced with equal weight.
Answer: B
Rationale: Under HIPAA preemption analysis (45 CFR 160.203), a state law
that is more stringent than HIPAA-such as requiring consent for disclosures
that HIPAA permits without authorization-is not preempted and applies.
HIPAA sets a floor, not a ceiling. Options A, C, and D misstate preemption
principles.
2 A covered entity discloses PHI to a public health authority without
authorization. Which HIPAA provision permits this?
A) 45 CFR 164.512(b) - public health activities.
B) 45 CFR 164.508 - authorizations.
C) 45 CFR 164.502(a)(1)(iv) - incidental uses.
,D) 45 CFR 164.514 - de-identification.
Answer: A
Rationale: 45 CFR 164.512(b) permits disclosures to public health authorities
for activities such as disease reporting without patient authorization.
Authorizations (B) are not required for this permitted disclosure; incidental
uses (C) and de-identification (D) are inapplicable.
3 Which scenario constitutes a HIPAA breach requiring notification under the
Breach Notification Rule?
A) A nurse accidentally accesses a neighbor's record out of curiosity.
B) A patient requests and receives their own record.
C) A covered entity encrypts a lost laptop containing PHI.
D) PHI is disclosed to a business associate under a signed BAA.
Answer: A
Rationale: Unauthorized access to PHI—even without further disclosure—is a
breach unless a exception applies. The curiosity access is not permitted and
presumes breach. B is patient access, C is secured (encryption safe harbor), and
D is a permitted disclosure under a BAA.
4 Under HITECH, what is the maximum annual penalty for a violation due to
willful neglect that is not corrected?
A) $50,000 per violation
B) $1.5 million per identical provision
C) $250,000 per violation
D) $100,000 per violation
Answer: B
Rationale: HITECH established a tiered penalty structure with an annual cap of
$1.5 million for identical provisions. Willful neglect not corrected falls in the
highest tier. The other amounts are lower tier caps or per-violation amounts,
not the annual maximum.
5 A patient requests an amendment to their medical record. The covered entity
disagrees. What is the required action?
A) Deny the request and discard the patient's statement.
B) Deny the request but include the patient's statement of disagreement in
future disclosures.
,C) Amend the record as requested to avoid litigation.
D) Refer the matter to the state licensing board.
Answer: B
Rationale: Under 45 CFR 164.526, if the covered entity denies an amendment,
it must permit the individual to submit a statement of disagreement and include
it in subsequent disclosures. Discarding (A) violates the rule; amending
without basis (C) is improper; referral (D) is not required.
6 Which is a valid authorization element under the HIPAA Privacy Rule?
A) A statement that the individual has a right to revoke authorization.
B) A statement that the covered entity may condition treatment on
authorization.
C) A description of the purpose without specificity.
D) An expiration date that is indefinite.
Answer: A
Rationale: 45 CFR 164.508(c) requires core elements including a statement of
the individual's right to revoke. Conditioning treatment (B) is generally
prohibited; purpose must be specific (C); and an expiration date or event is
required (D).
7 Which law requires patient consent for disclosure of substance use disorder
records, even for treatment purposes?
A) HIPAA Privacy Rule
B) 42 CFR Part 2
C) HITECH Act
D) State mental health confidentiality laws
Answer: B
Rationale: 42 CFR Part 2 provides stricter confidentiality for substance use
disorder records, requiring patient consent for most disclosures, including
treatment, unless a specific exception applies. HIPAA (A) permits treatment
disclosures without authorization; HITECH (C) and state laws (D) do not
uniformly impose this requirement.
8 A covered entity's security incident involves unauthorized access to
unencrypted PHI. What is the immediate documentation requirement?
A) Document the incident and its outcome in a security incident log.
, B) Report to the media within 24 hours.
C) Notify the FBI immediately.
D) No documentation is required if no harm occurred.
Answer: A
Rationale: The HIPAA Security Rule (45 CFR 164.308(a)(6)(ii)) requires
documentation of security incidents and their outcomes. Media notification (B)
and FBI notification (C) are not immediate requirements; documentation is
required regardless of harm (D).
9 Under the HIPAA Security Rule, which safeguard requires a risk analysis?
A) Administrative safeguards
B) Physical safeguards
C) Technical safeguards
D) Organizational requirements
Answer: A
Rationale: 45 CFR 164.308(a)(1)(ii)(A) under administrative safeguards
mandates a risk analysis. Physical and technical safeguards (B, C) have other
requirements; organizational requirements (D) address business associate
agreements, not risk analysis.
10 Which federal agency enforces the HIPAA Privacy Rule for covered entities
other than health plans?
A) Centers for Medicare & Medicaid Services (CMS)
B) Office for Civil Rights (OCR)
C) Department of Justice (DOJ)
D) Federal Trade Commission (FTC)
Answer: B
Rationale: OCR enforces the HIPAA Privacy, Security, and Breach Notification
Rules for most covered entities. CMS (A) enforces for health plans; DOJ (C)
handles criminal violations; FTC (D) enforces for non-HIPAA entities.
11 A state law requires reporting of all gunshot wounds to police; HIPAA
permits disclosure without authorization. Which principle governs?
A) HIPAA preempts state law because it is federal.
B) State law is preempted unless it is more stringent than HIPAA.
Actual-Style Practice Questions And Correct Answers With
Rationales| Instant Download
This exam assesses mastery of the legal and regulatory framework governing health information, including
HIPAA Privacy, Security, and Breach Notification Rules, HITECH, 42 CFR Part 2, state laws, and AHIMA
standards. Questions require advanced analysis of compliance scenarios, preemption, authorization requirements,
and enforcement mechanisms. It contains 140 multiple-choice questions, each with four distractors and a fully
worked rationale that explains why the keyed answer is correct. Content is organized into 11 focused sections:
Legal and Regulatory Framework of Health Information, Patient Privacy and Confidentiality (HIPAA Privacy
Rule), Security of Health Information (HIPAA Security Rule), Release of Information and Patient Access Rights,
Consent, Authorization, and Disclosure Requirements, Health Information Management Ethics and Professional
Standards, Retention, Destruction, and Record Management, Legal Health Record and Documentation Standards,
Breach Notification and Enforcement, Compliance, Auditing, and Risk Management, Emerging Issues: EHRs,
Telehealth, and Data Governance. Targeted learning outcomes include: Apply HIPAA Privacy Rule preemption
analysis to conflicting state health information laws.; Differentiate permitted disclosures for treatment, payment,
and operations versus those requiring authorization.; Evaluate security incident response obligations under the
HIPAA Breach Notification Rule and HITECH.; Analyze enforcement penalties and compliance program
requirements under CMS and OIG guidance.. Every item has been reviewed for clinical accuracy, current
Section 1: Legal and Regulatory Framework of Health Information (Questions 1-14)
1 A state law requires patient consent for all disclosures of mental health
records, while HIPAA permits disclosure for treatment without authorization.
Which law applies?
A) HIPAA preempts the state law because it is less stringent.
B) The state law applies because it is more stringent than HIPAA.
C) Neither law applies; federal common law governs.
D) HIPAA and the state law are concurrently enforced with equal weight.
Answer: B
Rationale: Under HIPAA preemption analysis (45 CFR 160.203), a state law
that is more stringent than HIPAA-such as requiring consent for disclosures
that HIPAA permits without authorization-is not preempted and applies.
HIPAA sets a floor, not a ceiling. Options A, C, and D misstate preemption
principles.
2 A covered entity discloses PHI to a public health authority without
authorization. Which HIPAA provision permits this?
A) 45 CFR 164.512(b) - public health activities.
B) 45 CFR 164.508 - authorizations.
C) 45 CFR 164.502(a)(1)(iv) - incidental uses.
,D) 45 CFR 164.514 - de-identification.
Answer: A
Rationale: 45 CFR 164.512(b) permits disclosures to public health authorities
for activities such as disease reporting without patient authorization.
Authorizations (B) are not required for this permitted disclosure; incidental
uses (C) and de-identification (D) are inapplicable.
3 Which scenario constitutes a HIPAA breach requiring notification under the
Breach Notification Rule?
A) A nurse accidentally accesses a neighbor's record out of curiosity.
B) A patient requests and receives their own record.
C) A covered entity encrypts a lost laptop containing PHI.
D) PHI is disclosed to a business associate under a signed BAA.
Answer: A
Rationale: Unauthorized access to PHI—even without further disclosure—is a
breach unless a exception applies. The curiosity access is not permitted and
presumes breach. B is patient access, C is secured (encryption safe harbor), and
D is a permitted disclosure under a BAA.
4 Under HITECH, what is the maximum annual penalty for a violation due to
willful neglect that is not corrected?
A) $50,000 per violation
B) $1.5 million per identical provision
C) $250,000 per violation
D) $100,000 per violation
Answer: B
Rationale: HITECH established a tiered penalty structure with an annual cap of
$1.5 million for identical provisions. Willful neglect not corrected falls in the
highest tier. The other amounts are lower tier caps or per-violation amounts,
not the annual maximum.
5 A patient requests an amendment to their medical record. The covered entity
disagrees. What is the required action?
A) Deny the request and discard the patient's statement.
B) Deny the request but include the patient's statement of disagreement in
future disclosures.
,C) Amend the record as requested to avoid litigation.
D) Refer the matter to the state licensing board.
Answer: B
Rationale: Under 45 CFR 164.526, if the covered entity denies an amendment,
it must permit the individual to submit a statement of disagreement and include
it in subsequent disclosures. Discarding (A) violates the rule; amending
without basis (C) is improper; referral (D) is not required.
6 Which is a valid authorization element under the HIPAA Privacy Rule?
A) A statement that the individual has a right to revoke authorization.
B) A statement that the covered entity may condition treatment on
authorization.
C) A description of the purpose without specificity.
D) An expiration date that is indefinite.
Answer: A
Rationale: 45 CFR 164.508(c) requires core elements including a statement of
the individual's right to revoke. Conditioning treatment (B) is generally
prohibited; purpose must be specific (C); and an expiration date or event is
required (D).
7 Which law requires patient consent for disclosure of substance use disorder
records, even for treatment purposes?
A) HIPAA Privacy Rule
B) 42 CFR Part 2
C) HITECH Act
D) State mental health confidentiality laws
Answer: B
Rationale: 42 CFR Part 2 provides stricter confidentiality for substance use
disorder records, requiring patient consent for most disclosures, including
treatment, unless a specific exception applies. HIPAA (A) permits treatment
disclosures without authorization; HITECH (C) and state laws (D) do not
uniformly impose this requirement.
8 A covered entity's security incident involves unauthorized access to
unencrypted PHI. What is the immediate documentation requirement?
A) Document the incident and its outcome in a security incident log.
, B) Report to the media within 24 hours.
C) Notify the FBI immediately.
D) No documentation is required if no harm occurred.
Answer: A
Rationale: The HIPAA Security Rule (45 CFR 164.308(a)(6)(ii)) requires
documentation of security incidents and their outcomes. Media notification (B)
and FBI notification (C) are not immediate requirements; documentation is
required regardless of harm (D).
9 Under the HIPAA Security Rule, which safeguard requires a risk analysis?
A) Administrative safeguards
B) Physical safeguards
C) Technical safeguards
D) Organizational requirements
Answer: A
Rationale: 45 CFR 164.308(a)(1)(ii)(A) under administrative safeguards
mandates a risk analysis. Physical and technical safeguards (B, C) have other
requirements; organizational requirements (D) address business associate
agreements, not risk analysis.
10 Which federal agency enforces the HIPAA Privacy Rule for covered entities
other than health plans?
A) Centers for Medicare & Medicaid Services (CMS)
B) Office for Civil Rights (OCR)
C) Department of Justice (DOJ)
D) Federal Trade Commission (FTC)
Answer: B
Rationale: OCR enforces the HIPAA Privacy, Security, and Breach Notification
Rules for most covered entities. CMS (A) enforces for health plans; DOJ (C)
handles criminal violations; FTC (D) enforces for non-HIPAA entities.
11 A state law requires reporting of all gunshot wounds to police; HIPAA
permits disclosure without authorization. Which principle governs?
A) HIPAA preempts state law because it is federal.
B) State law is preempted unless it is more stringent than HIPAA.
