HIPAA General Workforce Compliance (CO)

First published: September 2, 2026Last verified: September 2, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA General Workforce Compliance (CO): a 30-question practice bank for the real HIPAA / Healthcare Compliance standard, 3 full papers of 30 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (100%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

3

full papers, no repeats

30

questions per paper

30

questions in the bank

What this exam covers

Accounting Of Disclosures3%
Administrative Safeguards3%
Authorization Requirements3%
Authorization Revocation3%
Breach Definition3%
Breach Notification Hhs3%
Breach Notification Individuals3%
Breach Notification Media3%
Business Associate Agreement3%
Business Associate Definition3%
Covered Entity Definition3%
De Identification Expert Determination3%
De Identification Safe Harbor3%
Disclosures Without Authorization3%
Eighteen Identifiers3%
Incidental Disclosures3%
Minimum Necessary Exceptions3%
Minimum Necessary Standard3%
Notice Of Privacy Practices3%
Permitted Use Operations3%
Permitted Use Payment3%
Permitted Use Treatment3%
Phi Definition3%
Physical Safeguards3%
Right Of Access3%
Right Of Access Timeline3%
Right To Amend3%
Security Rule Risk Analysis3%
Technical Safeguards3%
Workforce Sanctions3%

5 real sample questions

Under the HIPAA Privacy Rule, which of the following is a "covered entity"?

A. A health plan that pays claims for its enrollees

B. A shredding company hired by a hospital to destroy old records

C. A cloud storage vendor that hosts a clinic's patient database

D. A billing service that processes claims on behalf of a physician practice

Source: 45 CFR 160.103

A software vendor hosts a hospital's electronic health record system and can access PHI to provide technical support. What is this vendor's HIPAA classification?

A. Covered entity, because it handles PHI directly

B. Business associate, because it creates, receives, maintains, or transmits PHI on the hospital's behalf

C. Not subject to HIPAA, because it never treats patients

D. Hybrid entity, because it has both covered and non-covered functions

Source: 45 CFR 160.103

Before a covered entity allows a business associate to access PHI to perform outsourced billing services, what must be in place?

A. Verbal agreement to keep information confidential

B. A signed business associate agreement meeting the requirements of 45 CFR 164.504(e)

C. Patient consent for each individual disclosure

D. Nothing, as long as the vendor promises to comply with HIPAA

Source: 45 CFR 164.504(e)

A front-desk scheduler needs to confirm a patient's upcoming appointment. Under the minimum necessary standard, the scheduler should access:

A. The patient's complete medical record, including psychotherapy notes

B. Only the scheduling information needed to confirm the appointment

C. The patient's full billing and insurance history

D. All records for every family member linked to the account

Source: 45 CFR 164.502(b)

Which of the following disclosures is EXEMPT from the minimum necessary standard?

A. A disclosure to another treating physician for treatment purposes

B. A marketing mailing to former patients

C. An internal report sent to the compliance department for a random audit

D. A researcher's request for a broad data set without a data use agreement

Source: 45 CFR 164.502(b)(2)

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA General Workforce Compliance (CO) practice test?

30 questions total, split into 3 full papers of 30 each with no repeats across papers.

What topics does the HIPAA General Workforce Compliance (CO) test cover?

30 domains, with the heaviest weight on Accounting Of Disclosures (3%), Administrative Safeguards (3%), and Authorization Requirements (3%).

Where do CertQuestUSA's HIPAA General Workforce Compliance (CO) questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA General Workforce Compliance (CO)?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.