HIPAA Challenge Exam Questions and
Answers | Latest Version | 2025/2026 |
Correct & Verified
What is the purpose of the Notice of Privacy Practices (NPP)?
✔✔To inform patients how their PHI may be used and their rights under HIPAA.
Can PHI be shared with insurance companies for claim processing?
✔✔Yes, PHI can be shared as necessary to process claims or obtain payment.
What is an example of electronic PHI (ePHI)?
✔✔Medical records, lab results, and patient information stored in electronic health record
systems.
What is the difference between PHI and non-PHI data?
✔✔PHI identifies a patient and relates to their health, while non-PHI cannot be linked to an
individual.
Can PHI be shared for fundraising purposes without patient consent?
1
, ✔✔Only in limited cases where patients can opt-out and minimal information is used.
What should be done if an unauthorized individual gains access to PHI?
✔✔Report the incident immediately, investigate, and notify affected individuals if required.
Can employees discuss patient information with students or trainees?
✔✔Yes, but only for educational purposes and with proper safeguards.
Can PHI be used to identify patients in presentations or publications?
✔✔Only if de-identified or patient consent has been obtained.
Is verbal disclosure of PHI allowed in semi-private patient rooms?
✔✔Only if precautions are taken to ensure unauthorized persons cannot overhear.
What is required to safely send PHI through text messaging?
✔✔Use encryption or secure messaging apps that comply with HIPAA standards.
Can PHI be accessed remotely by employees?
2
Answers | Latest Version | 2025/2026 |
Correct & Verified
What is the purpose of the Notice of Privacy Practices (NPP)?
✔✔To inform patients how their PHI may be used and their rights under HIPAA.
Can PHI be shared with insurance companies for claim processing?
✔✔Yes, PHI can be shared as necessary to process claims or obtain payment.
What is an example of electronic PHI (ePHI)?
✔✔Medical records, lab results, and patient information stored in electronic health record
systems.
What is the difference between PHI and non-PHI data?
✔✔PHI identifies a patient and relates to their health, while non-PHI cannot be linked to an
individual.
Can PHI be shared for fundraising purposes without patient consent?
1
, ✔✔Only in limited cases where patients can opt-out and minimal information is used.
What should be done if an unauthorized individual gains access to PHI?
✔✔Report the incident immediately, investigate, and notify affected individuals if required.
Can employees discuss patient information with students or trainees?
✔✔Yes, but only for educational purposes and with proper safeguards.
Can PHI be used to identify patients in presentations or publications?
✔✔Only if de-identified or patient consent has been obtained.
Is verbal disclosure of PHI allowed in semi-private patient rooms?
✔✔Only if precautions are taken to ensure unauthorized persons cannot overhear.
What is required to safely send PHI through text messaging?
✔✔Use encryption or secure messaging apps that comply with HIPAA standards.
Can PHI be accessed remotely by employees?
2
