HCCA CHPC Exam Study Guide 2026/2027 | 400+ Practice Questions &
Regulation-Citing Answers | HIPAA Privacy, Security & PHI
Questions 1–50: HIPAA Foundations & PHI
1. Which entities are directly regulated as HIPAA covered entities?
A. Employers, schools, and pharmacies
B. Health plans, healthcare clearinghouses, and certain healthcare
providers
C. Patients, visitors, and caregivers
D. Software companies only
Answer: B
Rationale: HIPAA identifies health plans, healthcare clearinghouses, and
healthcare providers that conduct certain covered electronic
transactions as covered entities. Reference: 45 CFR §160.103.
2. What is PHI?
A. Any information stored by a hospital
B. Individually identifiable health information held or transmitted by a
covered entity or business associate, subject to exclusions
C. Only electronic medical records
D. Only information containing a diagnosis
Answer: B
Rationale: PHI is individually identifiable health information held or
transmitted by a covered entity or business associate, subject to HIPAA
exclusions. Reference: 45 CFR §160.103.
3. Which information is generally excluded from PHI because of the
HIPAA education-record exclusion?
A. A hospital medical record
,B. A treatment note
C. A record covered by FERPA
D. An insurance claim
Answer: C
Rationale: Certain education records covered by FERPA are excluded
from the HIPAA definition of PHI. Reference: 45 CFR §160.103.
4. Which is an example of an identifier that can make health
information individually identifiable?
A. Random clinical statistic with no identifiers
B. Patient name
C. Anonymous aggregate percentage
D. General medical knowledge
Answer: B
Rationale: Names are among the identifiers that can identify an
individual when associated with health information. Reference: 45 CFR
§164.514.
5. Which HIPAA rule primarily governs uses and disclosures of PHI?
A. Privacy Rule
B. Security Rule
C. Enforcement Rule
D. Breach Notification Rule
Answer: A
Rationale: The Privacy Rule establishes national standards for the use
and disclosure of PHI by covered entities and certain rights of
individuals. Reference: 45 CFR Part 164, Subpart E.
,6. Which rule specifically addresses electronic PHI security?
A. Privacy Rule
B. Security Rule
C. Enforcement Rule
D. Transaction Rule
Answer: B
Rationale: The Security Rule establishes administrative, physical, and
technical safeguards for ePHI. Reference: 45 CFR Part 164, Subpart C.
7. What is the primary purpose of the HIPAA Security Rule?
A. Establish reimbursement rates
B. Protect ePHI
C. Regulate medical licensing
D. Establish clinical standards
Answer: B
Rationale: The Security Rule protects the confidentiality, integrity, and
availability of electronic protected health information. Reference: 45
CFR §164.306.
8. Which three safeguard categories are used by the Security Rule?
A. Clinical, financial, legal
B. Administrative, physical, technical
C. State, federal, local
D. Internal, external, public
Answer: B
Rationale: HIPAA's Security Rule organizes safeguards into
administrative, physical, and technical categories. Reference: 45 CFR
§§164.308, 164.310, 164.312.
, 9. What does ePHI mean?
A. Encrypted patient history information only
B. Electronic protected health information
C. Emergency patient health information only
D. Employee protected health information
Answer: B
Rationale: ePHI is PHI maintained or transmitted in electronic form.
Reference: 45 CFR §160.103.
10. Which is generally NOT a HIPAA covered entity solely because it
employs healthcare workers?
A. Health plan
B. Healthcare clearinghouse
C. Covered healthcare provider
D. Ordinary employer
Answer: D
Rationale: An employer does not become a covered entity merely by
employing healthcare professionals. Reference: 45 CFR §160.103.
11. What is a business associate?
A. Any patient representative
B. A person or entity performing certain functions or services involving
PHI on behalf of a covered entity
C. Every healthcare employee
D. Any government agency
Answer: B
Rationale: HIPAA defines business associates based on functions or
services performed for covered entities that involve PHI. Reference: 45
CFR §160.103.
Regulation-Citing Answers | HIPAA Privacy, Security & PHI
Questions 1–50: HIPAA Foundations & PHI
1. Which entities are directly regulated as HIPAA covered entities?
A. Employers, schools, and pharmacies
B. Health plans, healthcare clearinghouses, and certain healthcare
providers
C. Patients, visitors, and caregivers
D. Software companies only
Answer: B
Rationale: HIPAA identifies health plans, healthcare clearinghouses, and
healthcare providers that conduct certain covered electronic
transactions as covered entities. Reference: 45 CFR §160.103.
2. What is PHI?
A. Any information stored by a hospital
B. Individually identifiable health information held or transmitted by a
covered entity or business associate, subject to exclusions
C. Only electronic medical records
D. Only information containing a diagnosis
Answer: B
Rationale: PHI is individually identifiable health information held or
transmitted by a covered entity or business associate, subject to HIPAA
exclusions. Reference: 45 CFR §160.103.
3. Which information is generally excluded from PHI because of the
HIPAA education-record exclusion?
A. A hospital medical record
,B. A treatment note
C. A record covered by FERPA
D. An insurance claim
Answer: C
Rationale: Certain education records covered by FERPA are excluded
from the HIPAA definition of PHI. Reference: 45 CFR §160.103.
4. Which is an example of an identifier that can make health
information individually identifiable?
A. Random clinical statistic with no identifiers
B. Patient name
C. Anonymous aggregate percentage
D. General medical knowledge
Answer: B
Rationale: Names are among the identifiers that can identify an
individual when associated with health information. Reference: 45 CFR
§164.514.
5. Which HIPAA rule primarily governs uses and disclosures of PHI?
A. Privacy Rule
B. Security Rule
C. Enforcement Rule
D. Breach Notification Rule
Answer: A
Rationale: The Privacy Rule establishes national standards for the use
and disclosure of PHI by covered entities and certain rights of
individuals. Reference: 45 CFR Part 164, Subpart E.
,6. Which rule specifically addresses electronic PHI security?
A. Privacy Rule
B. Security Rule
C. Enforcement Rule
D. Transaction Rule
Answer: B
Rationale: The Security Rule establishes administrative, physical, and
technical safeguards for ePHI. Reference: 45 CFR Part 164, Subpart C.
7. What is the primary purpose of the HIPAA Security Rule?
A. Establish reimbursement rates
B. Protect ePHI
C. Regulate medical licensing
D. Establish clinical standards
Answer: B
Rationale: The Security Rule protects the confidentiality, integrity, and
availability of electronic protected health information. Reference: 45
CFR §164.306.
8. Which three safeguard categories are used by the Security Rule?
A. Clinical, financial, legal
B. Administrative, physical, technical
C. State, federal, local
D. Internal, external, public
Answer: B
Rationale: HIPAA's Security Rule organizes safeguards into
administrative, physical, and technical categories. Reference: 45 CFR
§§164.308, 164.310, 164.312.
, 9. What does ePHI mean?
A. Encrypted patient history information only
B. Electronic protected health information
C. Emergency patient health information only
D. Employee protected health information
Answer: B
Rationale: ePHI is PHI maintained or transmitted in electronic form.
Reference: 45 CFR §160.103.
10. Which is generally NOT a HIPAA covered entity solely because it
employs healthcare workers?
A. Health plan
B. Healthcare clearinghouse
C. Covered healthcare provider
D. Ordinary employer
Answer: D
Rationale: An employer does not become a covered entity merely by
employing healthcare professionals. Reference: 45 CFR §160.103.
11. What is a business associate?
A. Any patient representative
B. A person or entity performing certain functions or services involving
PHI on behalf of a covered entity
C. Every healthcare employee
D. Any government agency
Answer: B
Rationale: HIPAA defines business associates based on functions or
services performed for covered entities that involve PHI. Reference: 45
CFR §160.103.
