Free HIPAA Practice Test Online

Official exam: HIPAA — General Workforce

Take a free HIPAA practice test online: a full 40-question paper with every answer explained, no sign-up, scored by topic. The full 110-question bank and the timed simulator are $14.99 for 30 days.

First published: September 2, 2026Bank updated: September 2, 2026Published by CertQuestUSA · review process

TL;DR

HIPAA — General Workforce: a 110-question practice bank for the real HIPAA / Healthcare Compliance standard, 2 full papers of 40 questions each with no repeats, every question written to the regulation it comes from.

Where these questions come from

Every question in this bank cites a source -- primarily 45 CFR (100%) of this exam's citations.

Take a full practice test free. 40 real questions built to the exam's domain weights, every answer explained, no sign-up required, with a domain-by-domain score at the end.

Start diagnostic

Want the whole bank for HIPAA — General Workforce? One payment of $14.99 gives you 30 days of full access to this exam. It does not renew. No account needed to buy, and there is a 7-day money-back guarantee.

Not ready yet? Take the free practice test first.

Ways to pay for the full bank

30-day pass

$14.99

about $15 a month

This exam only. Pays once, does not renew.

Monthly

$19.99

$19.99 a month

Every exam. Cancel any time.

Yearly

$143.93

about $11.99 a month

Every exam. Billed once a year.

Lifetime

$39.99

pay once

This exam only, no time limit.

See all plans and bundles

2

full papers, no repeats

40

questions per paper

110

questions in the bank

What this exam covers

Breach Notification Basics20%
Privacy Rule Fundamentals36%
Security Rule Safeguards29%
Workforce Responsibilities and Sanctions15%

5 real sample questions

Under HIPAA, "protected health information" (PHI) is individually identifiable health information that is:

A. Transmitted or maintained in electronic media, or transmitted or maintained in any other form or medium

B. Only information stored in an electronic medical record system

C. Only information a patient has explicitly labeled as confidential

D. Only information about a diagnosis, never about payment for care

Show answer and reasoning

Correct answer: A. Transmitted or maintained in electronic media, or transmitted or maintained in any other form or medium

B: PHI is not limited to electronic systems; paper records and spoken information are covered too.
C: PHI status does not depend on the patient labeling it; it is defined by the nature of the information.
D: PHI includes payment and operations information tied to an individual, not only clinical diagnosis data.

Source: 45 CFR 160.103 (definition of protected health information)

Under 45 CFR 160.103, what is the key difference between a "use" and a "disclosure" of PHI?

A. A "use" is sharing information within the entity that maintains it; a "disclosure" is releasing it outside that entity

B. A "use" always requires patient authorization, while a "disclosure" never does

C. There is no legal distinction; the terms are interchangeable

D. A "use" applies only to paper records, and a "disclosure" applies only to electronic records

Show answer and reasoning

Correct answer: A. A "use" is sharing information within the entity that maintains it; a "disclosure" is releasing it outside that entity

B: Both uses and disclosures can require authorization or be permitted without it, depending on the purpose.
C: The Privacy Rule treats the two terms differently throughout Subpart E, so the distinction is legally significant.
D: The distinction is about internal handling versus external release, not about the record format.

Source: 45 CFR 160.103 (definitions of use and disclosure)

Under 45 CFR 160.103, who counts as a member of a covered entity's "workforce"?

A. Employees, volunteers, trainees, and other persons whose work conduct is under the direct control of the covered entity or business associate, whether or not they are paid

B. Only salaried, full-time employees

C. Only individuals who have signed a business associate agreement

D. Only clinical staff who directly treat patients

Show answer and reasoning

Correct answer: A. Employees, volunteers, trainees, and other persons whose work conduct is under the direct control of the covered entity or business associate, whether or not they are paid

B: Part-time staff, volunteers, and trainees are workforce members too, not just salaried employees.
C: A business associate is a separate, distinct category from workforce; workforce members are under the entity's direct control.
D: Non-clinical staff (billing, front desk, IT, housekeeping) who handle PHI are workforce members as well.

Source: 45 CFR 160.103 (definition of workforce)

A billing company that processes claims on behalf of a physician practice, and in doing so creates and transmits PHI, is best described under HIPAA as:

A. A business associate of the physician practice

B. A covered entity in its own right, identical in status to the practice

C. Part of the practice's workforce

D. Exempt from HIPAA because it does not provide direct patient care

Show answer and reasoning

Correct answer: A. A business associate of the physician practice

B: The billing company is not a covered entity itself here; it acts on behalf of one under contract.
C: Workforce members are under the entity's direct control; a contracted outside vendor is a business associate instead.
D: Handling PHI on behalf of a covered entity, even without direct patient contact, brings HIPAA obligations, not an exemption.

Source: 45 CFR 160.103 (definitions of covered entity and business associate)

What is the general rule that opens 45 CFR 164.502, "Uses and disclosures of protected health information: general rules"?

A. A covered entity or business associate may not use or disclose PHI except as the Privacy Rule permits or requires

B. A covered entity may use or disclose PHI for any business purpose it decides is reasonable

C. PHI may be freely shared among all workforce members regardless of job function

D. PHI may be disclosed to anyone who requests it in writing

Show answer and reasoning

Correct answer: A. A covered entity or business associate may not use or disclose PHI except as the Privacy Rule permits or requires

B: The Privacy Rule does not leave "reasonable business purpose" as an open-ended justification; specific permitted categories apply.
C: Even within one entity, the minimum necessary standard limits who sees PHI based on job function.
D: A written request alone does not create a right to PHI; the request must fall within a permitted category.

Source: 45 CFR 164.502(a)

Frequently asked questions

Where can I take a free HIPAA practice test online?

Right here. CertQuestUSA's free HIPAA practice test online is a full 40-question practice paper built to the real exam's domain weights, with every answer explained, with no sign-up and no credit card, and shows your score by topic at the end. The full 110-question bank, with every answer explained and cited to the regulation it comes from, is $14.99 for a 30-day pass that never renews.

How many questions are on the CertQuestUSA HIPAA — General Workforce practice test?

110 questions total, split into 2 full papers of 40 each with no repeats across papers.

What topics does the HIPAA — General Workforce test cover?

4 domains, with the heaviest weight on Privacy Rule Fundamentals (36%), Security Rule Safeguards (29%), and Breach Notification Basics (20%).

Where do CertQuestUSA's HIPAA — General Workforce questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free HIPAA — General Workforce practice test?

Yes -- one full 40-question practice paper built to the exam's domain weights, free with no sign-up, with every answer explained and a domain-by-domain score at the end.

Need the certificate itself, not just the practice?

This page is a practice test. Certified Training USA, our sister site, sells the HIPAA for the General Healthcare Workforce course with a certificate of completion.

See the course