Certification Exam: HIPAA Patient Confidentiality

Question 1 of 10

What is the "Accounting of Disclosures" patients can request?

A) A 6-year history of everyone who saw their PHI for purposes outside of Treatment, Payment, or Operations B) A bill for their services C) A list of their prescriptions D) A list of all medical treatments received

Question 2 of 10

Under the 2026 Reproductive Health Privacy Rule, can you share PHI with law enforcement for the purpose of investigating lawful medical care?

A) No, HIPAA now provides a Federal Privacy Shield for lawful reproductive health data B) Only if the officer is friendly C) Only in certain states D) Yes, always

Question 3 of 10

How are Substance Use Disorder (SUD) records (42 CFR Part 2) handled in 2026?

A) They must be deleted after 30 days B) They are treated exactly like regular PHI with no extra protection C) They have heightened protections and generally cannot be used in court against the patient without consent D) They are public record

Question 4 of 10

In 2026, what is the mandatory security requirement for any system accessing ePHI?

A) A specialized mouse B) A long password C) Multi-Factor Authentication (MFA) D) A private office

Question 5 of 10

What is the internal reporting timeline for a suspected PHI breach in a 2026 world-class organization?

A) One week B) When you have time C) 60 days D) 24 hours

Question 6 of 10

What is the "Safe Harbor" for a lost or stolen laptop in 2026?

A) The laptop was unencrypted but in a locked car B) The data on the laptop was fully encrypted to NIST standards C) Reporting it within a year D) The laptop was old

Question 7 of 10

Which of these is considered one of the 18 HIPAA identifiers?

A) State of residence B) Type of medical insurance C) IP Address and Full-face photographs D) General age (over 89)

Question 8 of 10

What is "Internal Snooping" in a healthcare facility?

A) Accessing the records of friends, celebrities, or coworkers out of curiosity B) Looking for a patient's room number for a delivery C) Cleaning the patient rooms D) Repairing the EHR system

Question 9 of 10

What is "Minimum Necessary" in the context of HIPAA PHI access?

A) Talking in a whisper B) Only keeping records for 1 year C) Accessing only the smallest amount of data required to do your specific job D) Using a small font on medical forms

Question 10 of 10

According to the 2026 NIST standard, how should paper PHI be disposed of?

A) Recycling bin B) Trash can with a lid C) Tearing it in half D) Shredding (cross-cut), burning, or pulping