HIPAA General Workforce Compliance (ID)

First published: September 4, 2026Last verified: September 4, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA General Workforce Compliance (ID): a 112-question practice bank for the real HIPAA / Healthcare Compliance standard, 3 full papers of 112 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (78%) and 45 CFR 160.103 - Definitions (9%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

3

full papers, no repeats

112

questions per paper

112

questions in the bank

What this exam covers

Accounting of Disclosures4%
Administrative Safeguards4%
Administrative Safeguards - Training4%
Administrative Safeguards - Workforce Access4%
Authorization Requirements4%
Breach Definition4%
Breach Notification - Large Breaches4%
Breach Notification Timing4%
Breach Risk Assessment4%
Business Associate Agreements4%
Covered Entities & Business Associates7%
De-identification4%
Marketing and Sale of PHI4%
Minimum Necessary Standard7%
Notice of Privacy Practices4%
Patient Right of Access4%
Patient Right to Amend4%
Permitted Uses and Disclosures4%
PHI Definition4%
Physical Safeguards4%
Right to Request Restrictions4%
Technical Safeguards - Access Control4%
Technical Safeguards - Audit Controls4%
Technical Safeguards - Transmission Security4%
Workforce Sanctions4%
Workforce Training Timing4%

5 real sample questions

Which of the following best defines 'protected health information' (PHI) under HIPAA?

A. Any information a hospital keeps about its employees, including payroll records

B. Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium

C. Only health information that has been printed on paper and stored in a locked file room

D. Any medical research data, regardless of whether it can be linked to a specific person

Source: 45 CFR 160.103 - Definitions (Protected Health Information)

For health information to qualify as 'individually identifiable' under HIPAA, it must do which of the following?

A. Contain a Social Security number

B. Relate to the past, present, or future health, treatment, or payment of an individual, and either identify the individual or provide a reasonable basis to identify them

C. Be stored in an electronic health record system

D. Have been created by a physician rather than a nurse or technician

Source: 45 CFR 160.103 - Definitions (Individually Identifiable Health Information)

A home health aide overhears a patient's diagnosis while providing care in the patient's home and later repeats it to a coworker without authorization. Is this information PHI?

A. No, because it was communicated orally rather than in writing

B. No, because it was not generated inside a hospital or clinic building

C. Yes, because PHI includes individually identifiable health information in oral form, regardless of where the care is delivered

D. Yes, but only if the patient signed a written authorization beforehand

Source: 45 CFR 160.103; 164.501 - Definitions

A hospital's HR department keeps a file on a nurse documenting her sick leave requests submitted as part of her employment with the hospital. Under HIPAA, this file is generally treated as:

A. PHI, because it references a health-related absence

B. Not PHI, because it falls within the employment records exception when held by the covered entity in its role as employer

C. PHI only if the nurse also happens to be a patient of the hospital

D. Not PHI, because HR files are never covered by any federal privacy law

Source: 45 CFR 160.103 - Definitions (Employment Records Exception)

Which of the following organizations meets the HIPAA definition of a 'covered entity'?

A. A health care clearinghouse that processes standard electronic transactions

B. A parking garage attached to a hospital

C. A vendor that manufactures hospital beds

D. A newspaper that reports on local health department statistics

Source: 45 CFR 160.103 - Definitions (Covered Entity)

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA General Workforce Compliance (ID) practice test?

112 questions total, split into 3 full papers of 112 each with no repeats across papers.

What topics does the HIPAA General Workforce Compliance (ID) test cover?

26 domains, with the heaviest weight on Covered Entities & Business Associates (7%), Minimum Necessary Standard (7%), and Accounting of Disclosures (4%).

Where do CertQuestUSA's HIPAA General Workforce Compliance (ID) questions come from?

Primarily 45 CFR (78%) and 45 CFR 160.103 - Definitions (9%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA General Workforce Compliance (ID)?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.