Certification Exam: HIPAA Patient Confidentiality

Question 1 of 10

What is the internal reporting timeline for a suspected PHI breach in a 2026 world-class organization?

A) 60 days B) When you have time C) 24 hours D) One week

Question 2 of 10

What is "Minimum Necessary" in the context of HIPAA PHI access?

A) Talking in a whisper B) Only keeping records for 1 year C) Using a small font on medical forms D) Accessing only the smallest amount of data required to do your specific job

Question 3 of 10

What is the February 16, 2026, deadline regarding HIPAA compliance?

A) Updating the Notice of Privacy Practices (NPP) and 42 CFR Part 2 alignment B) Finalizing all paper shredding C) Switching to paper records D) Hiring a new IT manager

Question 4 of 10

What is the "Safe Harbor" for a lost or stolen laptop in 2026?

A) Reporting it within a year B) The laptop was unencrypted but in a locked car C) The laptop was old D) The data on the laptop was fully encrypted to NIST standards

Question 5 of 10

What is "Internal Snooping" in a healthcare facility?

A) Accessing the records of friends, celebrities, or coworkers out of curiosity B) Repairing the EHR system C) Cleaning the patient rooms D) Looking for a patient's room number for a delivery

Question 6 of 10

What is the "Accounting of Disclosures" patients can request?

A) A 6-year history of everyone who saw their PHI for purposes outside of Treatment, Payment, or Operations B) A list of their prescriptions C) A list of all medical treatments received D) A bill for their services

Question 7 of 10

In 2026, how many days does a provider have to fulfill a patient's request for medical records?

A) 30 days B) 5 days C) 15 days D) 60 days

Question 8 of 10

Under the 2026 Reproductive Health Privacy Rule, can you share PHI with law enforcement for the purpose of investigating lawful medical care?

A) No, HIPAA now provides a Federal Privacy Shield for lawful reproductive health data B) Yes, always C) Only if the officer is friendly D) Only in certain states

Question 9 of 10

Which of these is considered one of the 18 HIPAA identifiers?

A) General age (over 89) B) IP Address and Full-face photographs C) State of residence D) Type of medical insurance

Question 10 of 10

How are Substance Use Disorder (SUD) records (42 CFR Part 2) handled in 2026?

A) They are treated exactly like regular PHI with no extra protection B) They have heightened protections and generally cannot be used in court against the patient without consent C) They must be deleted after 30 days D) They are public record