HIPAA Questions – Healthcare Compliance – 2026 – Study and Practice Guide
Protected Health Information (PHI) - correct answer ✔✔ Individually identifiable health
information protected under HIPAA.
What does HIPAA stand for? - correct answer ✔✔ Health Insurance Portability and
Accountability Act
The 3 Categories of "Covered Entities" under HIPAA - correct answer ✔✔ 1. Health Plans
2. Healthcare Clearinghouses
3. Healthcare providers who transmit health information in a HIPAA transaction
What do you tell a client that wants to sue a physician for violating HIPAA? - correct answer ✔✔
There is no private right of action under HIPAA.
Can the attorney general enforce HIPAA against a law firm and will the attorney general enforce
HIPAA against a law firm? - correct answer ✔✔ 1. Yes, they can come in, conduct an
investigation, and fine the law firm for not keeping their client's information protected.
2. Yes, some of them will enforce HIPAA.
Business Associate - correct answer ✔✔ Individual or entity that performs a service, function, or
activity on behalf of a covered entity.
6 Individual Rights Granted Under HIPAA (CARINA) - correct answer ✔✔ Right to:
1. Receive communications of your PHI by alternative means or at alternative locations.
, 2. Request amendment of your own PHI (and appeal denial).
3. Request restrictions on certain uses and disclosures of your PHI.
4. Inspect and copy your own PHI (and appeal denial).
5. Receive the Notice of Privacy Practices electronically and/or a paper copy of it.
6. Receive an accounting of disclosures (not those related to treatment, payment, or health care
operations or those made pursuant to an authorization).
Hypo 1:
Mom is asking to change her daughters medical record. In her daughter's medical record, the
doctor will always include her family history. So the doctor will include the fact that the mom
was a drug addict. Now the mom is coming to the provider and wants it changed because she is
sober now. What is the physicians response? - correct answer ✔✔ The mom is not the
physicians patient. The physician got the moms information when they were looking into the
history of the daughter who is their patient. The mom would need to go to her provider and tell
them to remove that information if she wanted it removed from her record.
Hypo 2:
Mark will graduate from high school in June 2023 and is planning to attend Texas A&M
University in the fall on a football scholarship. Mark will be 19 years old in August and lives with
his parents. Mark goes to his doctor's office for a complete physical and several lab tests. The
day after Mark's physical, his mother calls the doctor's office and asks which lab tests Mark took
and what were the results of those tests. Can the doctor's office provide Mark's mother with
the information she's requesting? Why or why not? - correct answer ✔✔ Since Mark is an adult,
age 19, he has the ability to keep his lab records confidential from his mother under HIPAA. The
doctor should tell the mother that they cannot give her the information.
Protected Health Information (PHI) - correct answer ✔✔ Individually identifiable health
information protected under HIPAA.
What does HIPAA stand for? - correct answer ✔✔ Health Insurance Portability and
Accountability Act
The 3 Categories of "Covered Entities" under HIPAA - correct answer ✔✔ 1. Health Plans
2. Healthcare Clearinghouses
3. Healthcare providers who transmit health information in a HIPAA transaction
What do you tell a client that wants to sue a physician for violating HIPAA? - correct answer ✔✔
There is no private right of action under HIPAA.
Can the attorney general enforce HIPAA against a law firm and will the attorney general enforce
HIPAA against a law firm? - correct answer ✔✔ 1. Yes, they can come in, conduct an
investigation, and fine the law firm for not keeping their client's information protected.
2. Yes, some of them will enforce HIPAA.
Business Associate - correct answer ✔✔ Individual or entity that performs a service, function, or
activity on behalf of a covered entity.
6 Individual Rights Granted Under HIPAA (CARINA) - correct answer ✔✔ Right to:
1. Receive communications of your PHI by alternative means or at alternative locations.
, 2. Request amendment of your own PHI (and appeal denial).
3. Request restrictions on certain uses and disclosures of your PHI.
4. Inspect and copy your own PHI (and appeal denial).
5. Receive the Notice of Privacy Practices electronically and/or a paper copy of it.
6. Receive an accounting of disclosures (not those related to treatment, payment, or health care
operations or those made pursuant to an authorization).
Hypo 1:
Mom is asking to change her daughters medical record. In her daughter's medical record, the
doctor will always include her family history. So the doctor will include the fact that the mom
was a drug addict. Now the mom is coming to the provider and wants it changed because she is
sober now. What is the physicians response? - correct answer ✔✔ The mom is not the
physicians patient. The physician got the moms information when they were looking into the
history of the daughter who is their patient. The mom would need to go to her provider and tell
them to remove that information if she wanted it removed from her record.
Hypo 2:
Mark will graduate from high school in June 2023 and is planning to attend Texas A&M
University in the fall on a football scholarship. Mark will be 19 years old in August and lives with
his parents. Mark goes to his doctor's office for a complete physical and several lab tests. The
day after Mark's physical, his mother calls the doctor's office and asks which lab tests Mark took
and what were the results of those tests. Can the doctor's office provide Mark's mother with
the information she's requesting? Why or why not? - correct answer ✔✔ Since Mark is an adult,
age 19, he has the ability to keep his lab records confidential from his mother under HIPAA. The
doctor should tell the mother that they cannot give her the information.
