Free Alabama HIPAA Practice Test Online

Correct answer: A. A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with certain transactions

Correct. 45 CFR § 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who conduct certain covered electronic transactions.

• B: Incorrect. Simply storing files does not make an organization a HIPAA covered entity; the definition is tied to health plan, clearinghouse, or provider functions.
• C: Incorrect. A general retailer, even one selling health-adjacent products, is not automatically a covered entity absent qualifying health care functions.
• D: Incorrect. Media reporting on public health topics does not involve the individually identifiable health information transactions that trigger covered entity status.

Correct answer: B. A business associate

Correct. 45 CFR § 160.103 defines a business associate as a person or entity that performs functions or activities involving PHI on behalf of a covered entity, such as claims processing.

• A: Incorrect. A billing company itself is not a health plan, clearinghouse, or provider; it acts on behalf of one.
• C: Incorrect. A patient representative is someone authorized to act for the patient, not a vendor performing services for the covered entity.
• D: Incorrect. Business associates have direct HIPAA obligations, including under the Security Rule and portions of the Privacy Rule, and are not exempt from compliance.

Correct answer: C. A patient's name linked to their diagnosis, held by a covered entity

Correct. A patient's name linked to a diagnosis, held by a covered entity, is individually identifiable health information and meets the PHI definition under 45 CFR § 160.103.

• A: Incorrect. Properly de-identified data (using the Safe Harbor or Expert Determination method) falls outside the PHI definition.
• B: Incorrect. Aggregate, non-identifiable statistics do not meet the individually identifiable health information standard for PHI.
• D: Incorrect. A phone book listing without health information is not PHI, since it lacks any connection to health status, treatment, or payment.

Correct answer: D. Make reasonable efforts to limit PHI use, disclosure, and requests to the minimum necessary to accomplish the intended purpose

Correct. 45 CFR §§ 164.502(b) and 164.514(d) require reasonable efforts to limit PHI use, disclosure, and requests to what is minimally necessary for the purpose.

• A: Incorrect. Releasing an entire record regardless of purpose is the opposite of what the minimum necessary standard requires.
• B: Incorrect. HIPAA permits many disclosures (for treatment, payment, operations, and others); the minimum necessary standard limits scope, it does not prohibit disclosure outright.
• C: Incorrect. The minimum necessary standard applies broadly to uses and disclosures generally, not solely to insurance-related disclosures, and notably does not apply to disclosures for treatment purposes.

Correct answer: A. Disclosures for treatment purposes between health care providers

Correct. 45 CFR § 164.502(b)(2) exempts disclosures for treatment purposes among health care providers from the minimum necessary requirement, since clinicians need full relevant information for care.

• B: Incorrect. Marketing disclosures are tightly restricted under HIPAA and generally require authorization; they are not exempt from minimum necessary limits.
• C: Incorrect. Unauthorized disclosures to an employer are not a recognized minimum-necessary exemption and generally require patient authorization.
• D: Incorrect. Unauthorized sale of PHI is prohibited and not a minimum-necessary exemption category.