HCCA CHPC Study Questions 2026
Certified in Healthcare Privacy Compliance:
150 Comprehensive Exam Questions with
Answers and Rationale
1. Which of the following is a covered entity under HIPAA?
A. A health plan
B. A life insurance company
C. A workers' compensation carrier
D. An employer that sponsors a wellness program
Answer: A
Rationale: Covered entities are health plans, healthcare
clearinghouses, and healthcare providers that transmit
standard transactions electronically. Life insurers, workers'
compensation carriers, and employers (in their role as
employer) are not covered entities.
2. Which of the following best defines protected health
information (PHI)?
A. Any health information held by any organization
B. Individually identifiable health information held or
transmitted by a covered entity or business associate in
any form or medium
C. Only health information stored electronically
D. Only information found in the medical record
Answer: B
, Rationale: PHI is individually identifiable health information
created, received, maintained, or transmitted by a covered
entity or business associate in any form: electronic, paper, or
oral.
3. Employment records held by a covered entity in its role as
an employer are:
A. Always PHI
B. Protected as PHI but with fewer patient rights
C. Excluded from the definition of PHI
D. PHI only if they contain diagnoses
Answer: C
Rationale: HIPAA expressly excludes employment records
held by a covered entity in its role as employer. Other laws
(ADA, FMLA, state law) may still protect them.
4. Education records protected by FERPA are:
A. Subject to HIPAA but only for minors
B. Subject to both FERPA and HIPAA
C. Subject to HIPAA only when held by a school nurse
D. Excluded from the definition of PHI
Answer: D
Rationale: Records covered by FERPA, including treatment
records of students, are excluded from the HIPAA definition of
PHI.
5. For how long after death is a decedent's PHI protected
under the Privacy Rule?
A. 50 years
B. 25 years
C. 6 years
D. 75 years
, Answer: A
Rationale: HIPAA protects the PHI of a deceased individual
for 50 years following the date of death.
6. Which of the following uses or disclosures generally does
NOT require patient authorization?
A. Marketing using PHI where a third party pays the covered
entity
B. Use or disclosure for treatment, payment, or health
care operations
C. Sale of PHI
D. Disclosure of psychotherapy notes to a researcher
Answer: B
Rationale: The Privacy Rule permits use and disclosure of
PHI for treatment, payment, and health care operations (TPO)
without authorization. The other options generally require
authorization.
7. The minimum necessary standard does NOT apply to:
A. Disclosures for payment
B. Uses for health care operations
C. Disclosures to a provider for treatment purposes
D. Disclosures to a health plan for audits
Answer: C
Rationale: Exceptions to minimum necessary include
disclosures to or requests by a provider for treatment,
disclosures to the individual, disclosures under authorization,
disclosures to HHS, those required by law, and those required
for HIPAA compliance.
, 8. Which federal agency is primarily responsible for
enforcing the HIPAA Privacy, Security, and Breach
Notification Rules?
A. Federal Trade Commission
B. Department of Justice only
C. Centers for Medicare & Medicaid Services only
D. HHS Office for Civil Rights (OCR)
Answer: D
Rationale: OCR enforces the HIPAA Rules civilly. DOJ
handles criminal referrals; CMS enforces HIPAA transactions
and code sets standards.
9. Which of the following was a major change brought about
by the HITECH Act?
A. It made business associates directly liable for certain
HIPAA requirements and established federal breach
notification
B. It created the Privacy Rule
C. It eliminated minimum necessary
D. It allowed patients to sue covered entities under HIPAA
Answer: A
Rationale: HITECH extended direct HIPAA liability to
business associates, created breach notification
requirements, strengthened enforcement, and increased
penalties.
Certified in Healthcare Privacy Compliance:
150 Comprehensive Exam Questions with
Answers and Rationale
1. Which of the following is a covered entity under HIPAA?
A. A health plan
B. A life insurance company
C. A workers' compensation carrier
D. An employer that sponsors a wellness program
Answer: A
Rationale: Covered entities are health plans, healthcare
clearinghouses, and healthcare providers that transmit
standard transactions electronically. Life insurers, workers'
compensation carriers, and employers (in their role as
employer) are not covered entities.
2. Which of the following best defines protected health
information (PHI)?
A. Any health information held by any organization
B. Individually identifiable health information held or
transmitted by a covered entity or business associate in
any form or medium
C. Only health information stored electronically
D. Only information found in the medical record
Answer: B
, Rationale: PHI is individually identifiable health information
created, received, maintained, or transmitted by a covered
entity or business associate in any form: electronic, paper, or
oral.
3. Employment records held by a covered entity in its role as
an employer are:
A. Always PHI
B. Protected as PHI but with fewer patient rights
C. Excluded from the definition of PHI
D. PHI only if they contain diagnoses
Answer: C
Rationale: HIPAA expressly excludes employment records
held by a covered entity in its role as employer. Other laws
(ADA, FMLA, state law) may still protect them.
4. Education records protected by FERPA are:
A. Subject to HIPAA but only for minors
B. Subject to both FERPA and HIPAA
C. Subject to HIPAA only when held by a school nurse
D. Excluded from the definition of PHI
Answer: D
Rationale: Records covered by FERPA, including treatment
records of students, are excluded from the HIPAA definition of
PHI.
5. For how long after death is a decedent's PHI protected
under the Privacy Rule?
A. 50 years
B. 25 years
C. 6 years
D. 75 years
, Answer: A
Rationale: HIPAA protects the PHI of a deceased individual
for 50 years following the date of death.
6. Which of the following uses or disclosures generally does
NOT require patient authorization?
A. Marketing using PHI where a third party pays the covered
entity
B. Use or disclosure for treatment, payment, or health
care operations
C. Sale of PHI
D. Disclosure of psychotherapy notes to a researcher
Answer: B
Rationale: The Privacy Rule permits use and disclosure of
PHI for treatment, payment, and health care operations (TPO)
without authorization. The other options generally require
authorization.
7. The minimum necessary standard does NOT apply to:
A. Disclosures for payment
B. Uses for health care operations
C. Disclosures to a provider for treatment purposes
D. Disclosures to a health plan for audits
Answer: C
Rationale: Exceptions to minimum necessary include
disclosures to or requests by a provider for treatment,
disclosures to the individual, disclosures under authorization,
disclosures to HHS, those required by law, and those required
for HIPAA compliance.
, 8. Which federal agency is primarily responsible for
enforcing the HIPAA Privacy, Security, and Breach
Notification Rules?
A. Federal Trade Commission
B. Department of Justice only
C. Centers for Medicare & Medicaid Services only
D. HHS Office for Civil Rights (OCR)
Answer: D
Rationale: OCR enforces the HIPAA Rules civilly. DOJ
handles criminal referrals; CMS enforces HIPAA transactions
and code sets standards.
9. Which of the following was a major change brought about
by the HITECH Act?
A. It made business associates directly liable for certain
HIPAA requirements and established federal breach
notification
B. It created the Privacy Rule
C. It eliminated minimum necessary
D. It allowed patients to sue covered entities under HIPAA
Answer: A
Rationale: HITECH extended direct HIPAA liability to
business associates, created breach notification
requirements, strengthened enforcement, and increased
penalties.
