CHPS 2026 Exam Prep: Health Privacy &
Security Practice Questions with Answer
Rationales HIPAA Regulations | Information
Security | Risk Assessment | Compliance | Data
Protection | Clinical Review
SECTION 1: HIPAA REGULATIONS AND PRIVACY RULE (Questions 1–
30)
1. Which federal law established the first national standards for the protection
of health information in the United States?
A. HITECH Act
B. HIPAA
C. Affordable Care Act
D. Gramm-Leach-Bliley Act
Rationale: The Health Insurance Portability and Accountability Act (HIPAA) was
signed into federal law in 1996 as Public Law 104-191. HIPAA codified the
responsibility of healthcare providers, health plans, health care clearinghouses, and
their business associates who electronically transmit health and related
information. Key provisions are embodied in the Privacy Rule, Security Rule, and
Breach Notification Rule.
2. Which HIPAA rule sets standards for the protection of protected health
information (PHI) and gives patients important rights with respect to their
health information?
A. Security Rule
B. Privacy Rule
C. Breach Notification Rule
D. Enforcement Rule
Rationale: The Privacy Rule sets standards for the protection of PHI and gives
patients important rights with respect to their health information. It governs how
,covered entities may use and disclose PHI and establishes patient rights such as
access, amendment, and accounting of disclosures.
3. What does PHI stand for in the context of HIPAA?
A. Personal Health Information
B. Protected Health Information
C. Private Health Identifier
D. Patient Health Index
Rationale: PHI stands for Protected Health Information. Under HIPAA, PHI is
individually identifiable health information that is created, received, maintained, or
transmitted by a covered entity or business associate. The Privacy Rule sets
standards for the protection of PHI and gives patients important rights with respect
to their health information.
4. Which of the following is considered a covered entity under HIPAA?
A. A patient's family member
B. A health care clearinghouse
C. A medical equipment manufacturer
D. A pharmaceutical sales representative
Rationale: Covered entities under HIPAA include health care providers, health
plans, and health care clearinghouses that electronically transmit health and related
information such as health records, enrollment, billing, and eligibility verification.
A health care clearinghouse is explicitly included as a covered entity.
5. What is the primary purpose of the HIPAA Security Rule?
A. To set standards for the protection of PHI in any form
B. To establish safeguards that covered entities and their business associates
must implement to protect the privacy, integrity, and security of electronic
PHI
C. To require notification of breaches of unsecured PHI
D. To establish patient rights to access their health information
Rationale: The Security Rule establishes safeguards that covered entities and their
business associates must implement to protect the privacy, integrity, and security
of electronic PHI (e-PHI). It requires reasonable and appropriate administrative,
technical, and physical safeguards.
,6. Which HIPAA rule requires covered entities to notify affected individuals,
the federal government, and in some cases, the media of a breach of unsecured
PHI?
A. Privacy Rule
B. Security Rule
C. Breach Notification Rule
D. Enforcement Rule
Rationale: The Breach Notification Rule requires covered entities to notify
affected individuals, the federal government, and in some cases, the media of a
breach of unsecured PHI. Notification to individuals must be made without
unreasonable delay and no later than 60 days following a breach.
7. What is the HIPAA minimum necessary standard?
A. The minimum number of staff required to access PHI
B. The requirement to limit PHI use, disclosure, and requests to the minimum
amount necessary to accomplish the purpose
C. The minimum encryption standard required by HIPAA
D. The minimum retention period for medical records
Rationale: The HIPAA minimum necessary standard requires covered entities and
business associates to make reasonable efforts to limit the disclosure and use of
protected health information to the minimum necessary to accomplish the purpose
of the proposed disclosure and use. There are six exceptions to this standard,
including disclosures to the patient and for treatment purposes.
8. Which of the following is NOT an exception to the HIPAA minimum
necessary standard?
A. Disclosure to the individual who is the subject of the PHI
B. Disclosure to a pharmaceutical company for marketing purposes
C. Disclosure to a health care provider for treatment purposes
D. Disclosure required by law
Rationale: The minimum necessary standard does not apply to disclosures to the
individual, disclosures for treatment purposes, disclosures required by law, and
certain other exceptions. Disclosure to a pharmaceutical company for marketing
purposes would require patient authorization and is not an exception.
, 9. What is the primary purpose of the HIPAA Privacy Rule's "notice of
privacy practices"?
A. To inform patients of their financial responsibilities
B. To inform patients about possible uses of PHI and about patient rights
under HIPAA regulations
C. To document patient consent for treatment
D. To list all medications the patient is taking
Rationale: Health care providers must provide a notice about their possible uses of
PHI and about patient rights under HIPAA regulations. The Notice of Privacy
Practices (NPP) is a key transparency requirement of the Privacy Rule.
10. Under HIPAA, who is considered an authorized "personal representative"
of a patient?
A. Any family member
B. A guardian or conservator with authority over health decisions
C. Any friend of the patient
D. A neighbor
Rationale: For purposes of the Privacy Rule, an authorized "personal
representative" of the patient is a guardian or conservator with authority over
health decisions, an agent or proxy appointed in an advance directive or durable
power of attorney for health care, or a family member or friend authorized to serve
as a surrogate for health decisions under state law.
11. When must a covered entity provide a Notice of Privacy Practices to a
patient?
A. Only when the patient requests it
B. At the first date of service delivery
C. Within 30 days of the first service
D. Only when the patient's information is disclosed
Rationale: Health care providers must provide a notice about their possible uses of
PHI and about patient rights under HIPAA regulations. This notice is typically
provided at the first date of service delivery, though the exact timing may vary
based on the specific circumstances.
12. Which of the following patient rights is guaranteed by the HIPAA Privacy
Rule?
Security Practice Questions with Answer
Rationales HIPAA Regulations | Information
Security | Risk Assessment | Compliance | Data
Protection | Clinical Review
SECTION 1: HIPAA REGULATIONS AND PRIVACY RULE (Questions 1–
30)
1. Which federal law established the first national standards for the protection
of health information in the United States?
A. HITECH Act
B. HIPAA
C. Affordable Care Act
D. Gramm-Leach-Bliley Act
Rationale: The Health Insurance Portability and Accountability Act (HIPAA) was
signed into federal law in 1996 as Public Law 104-191. HIPAA codified the
responsibility of healthcare providers, health plans, health care clearinghouses, and
their business associates who electronically transmit health and related
information. Key provisions are embodied in the Privacy Rule, Security Rule, and
Breach Notification Rule.
2. Which HIPAA rule sets standards for the protection of protected health
information (PHI) and gives patients important rights with respect to their
health information?
A. Security Rule
B. Privacy Rule
C. Breach Notification Rule
D. Enforcement Rule
Rationale: The Privacy Rule sets standards for the protection of PHI and gives
patients important rights with respect to their health information. It governs how
,covered entities may use and disclose PHI and establishes patient rights such as
access, amendment, and accounting of disclosures.
3. What does PHI stand for in the context of HIPAA?
A. Personal Health Information
B. Protected Health Information
C. Private Health Identifier
D. Patient Health Index
Rationale: PHI stands for Protected Health Information. Under HIPAA, PHI is
individually identifiable health information that is created, received, maintained, or
transmitted by a covered entity or business associate. The Privacy Rule sets
standards for the protection of PHI and gives patients important rights with respect
to their health information.
4. Which of the following is considered a covered entity under HIPAA?
A. A patient's family member
B. A health care clearinghouse
C. A medical equipment manufacturer
D. A pharmaceutical sales representative
Rationale: Covered entities under HIPAA include health care providers, health
plans, and health care clearinghouses that electronically transmit health and related
information such as health records, enrollment, billing, and eligibility verification.
A health care clearinghouse is explicitly included as a covered entity.
5. What is the primary purpose of the HIPAA Security Rule?
A. To set standards for the protection of PHI in any form
B. To establish safeguards that covered entities and their business associates
must implement to protect the privacy, integrity, and security of electronic
PHI
C. To require notification of breaches of unsecured PHI
D. To establish patient rights to access their health information
Rationale: The Security Rule establishes safeguards that covered entities and their
business associates must implement to protect the privacy, integrity, and security
of electronic PHI (e-PHI). It requires reasonable and appropriate administrative,
technical, and physical safeguards.
,6. Which HIPAA rule requires covered entities to notify affected individuals,
the federal government, and in some cases, the media of a breach of unsecured
PHI?
A. Privacy Rule
B. Security Rule
C. Breach Notification Rule
D. Enforcement Rule
Rationale: The Breach Notification Rule requires covered entities to notify
affected individuals, the federal government, and in some cases, the media of a
breach of unsecured PHI. Notification to individuals must be made without
unreasonable delay and no later than 60 days following a breach.
7. What is the HIPAA minimum necessary standard?
A. The minimum number of staff required to access PHI
B. The requirement to limit PHI use, disclosure, and requests to the minimum
amount necessary to accomplish the purpose
C. The minimum encryption standard required by HIPAA
D. The minimum retention period for medical records
Rationale: The HIPAA minimum necessary standard requires covered entities and
business associates to make reasonable efforts to limit the disclosure and use of
protected health information to the minimum necessary to accomplish the purpose
of the proposed disclosure and use. There are six exceptions to this standard,
including disclosures to the patient and for treatment purposes.
8. Which of the following is NOT an exception to the HIPAA minimum
necessary standard?
A. Disclosure to the individual who is the subject of the PHI
B. Disclosure to a pharmaceutical company for marketing purposes
C. Disclosure to a health care provider for treatment purposes
D. Disclosure required by law
Rationale: The minimum necessary standard does not apply to disclosures to the
individual, disclosures for treatment purposes, disclosures required by law, and
certain other exceptions. Disclosure to a pharmaceutical company for marketing
purposes would require patient authorization and is not an exception.
, 9. What is the primary purpose of the HIPAA Privacy Rule's "notice of
privacy practices"?
A. To inform patients of their financial responsibilities
B. To inform patients about possible uses of PHI and about patient rights
under HIPAA regulations
C. To document patient consent for treatment
D. To list all medications the patient is taking
Rationale: Health care providers must provide a notice about their possible uses of
PHI and about patient rights under HIPAA regulations. The Notice of Privacy
Practices (NPP) is a key transparency requirement of the Privacy Rule.
10. Under HIPAA, who is considered an authorized "personal representative"
of a patient?
A. Any family member
B. A guardian or conservator with authority over health decisions
C. Any friend of the patient
D. A neighbor
Rationale: For purposes of the Privacy Rule, an authorized "personal
representative" of the patient is a guardian or conservator with authority over
health decisions, an agent or proxy appointed in an advance directive or durable
power of attorney for health care, or a family member or friend authorized to serve
as a surrogate for health decisions under state law.
11. When must a covered entity provide a Notice of Privacy Practices to a
patient?
A. Only when the patient requests it
B. At the first date of service delivery
C. Within 30 days of the first service
D. Only when the patient's information is disclosed
Rationale: Health care providers must provide a notice about their possible uses of
PHI and about patient rights under HIPAA regulations. This notice is typically
provided at the first date of service delivery, though the exact timing may vary
based on the specific circumstances.
12. Which of the following patient rights is guaranteed by the HIPAA Privacy
Rule?
