HIPAA General Workforce Compliance (MA)

First published: September 2, 2026Last verified: September 2, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA General Workforce Compliance (MA): a 30-question practice bank for the real HIPAA / Healthcare Compliance standard, 3 full papers of 30 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (93%) and M.G.L. c. (3%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

3

full papers, no repeats

30

questions per paper

30

questions in the bank

What this exam covers

Breach Notification Content3%
Breach Notification Definition3%
Breach Notification Exception3%
Breach Notification Timeframe3%
Business Associate Agreement3%
Business Associate Definition3%
De Identification Safe Harbor3%
Enforcement Penalties3%
Massachusetts Data Security3%
Massachusetts Medical Records Law3%
Patient Rights Amendment3%
Privacy Notice Requirements3%
Privacy Rule Authorization3%
Privacy Rule Business Operations Disclosure3%
Privacy Rule Covered Entities3%
Privacy Rule Incidental Use3%
Privacy Rule Minimum Necessary3%
Privacy Rule Minimum Necessary Disclosure3%
Privacy Rule Patient Rights3%
Privacy Rule Patient Rights Access Denial3%
Privacy Rule Uses Disclosures3%
Security Rule Administrative Safeguards3%
Security Rule Audit Controls3%
Security Rule Device Media Controls3%
Security Rule Encryption Standard3%
Security Rule Incident Response3%
Security Rule Password Management3%
Security Rule Physical Safeguards3%
Security Rule Technical Safeguards3%
Security Rule Workforce Authorization3%

5 real sample questions

Which of the following is a covered entity under the HIPAA Privacy Rule?

A. A pharmacy that sells over-the-counter vitamins.

B. A medical device manufacturer that collects product safety data.

C. A health insurance company that uses medical information to underwrite policies.

D. A life coach who provides wellness advice without handling protected health information.

Source: 45 CFR 164.102

Why would a cloud storage company contracted by a healthcare provider to store patient records be considered a business associate under HIPAA?

A. Because it provides general IT services to the healthcare provider's office.

B. Because it receives, maintains, or transmits protected health information on behalf of the covered entity.

C. Because it sells the provider's software licensing agreements.

D. Because it operates in the same geographic region as the provider.

Source: 45 CFR 160.103

A hospital's billing department needs to contact a patient about unpaid medical bills. What is the minimum necessary protected health information the billing department should request?

A. The patient's full medical history to verify they received services.

B. Only the patient's name, address, phone number, and account balance owed.

C. All of the patient's test results and diagnoses.

D. The patient's insurance provider information and medical procedures.

Source: 45 CFR 164.502(b)

Under the HIPAA Privacy Rule, a patient requests access to their medical records. A covered entity must provide the records within what timeframe?

A. Upon written request, with no specific deadline.

B. Immediately, on the same day of request.

C. 90 days, to allow for administrative review.

D. 30 days, with a possible 30-day extension if access cannot be provided within the initial timeframe.

Source: 45 CFR 164.524

Under the HIPAA Security Rule, a covered entity must implement administrative safeguards. Which of the following is an example of an administrative safeguard?

A. Using encryption to secure files transmitted over the internet.

B. Installing a firewall on the entity's computer network.

C. Conducting a security risk analysis and documenting findings in a formal written report.

D. Installing motion-sensor locks on server room doors.

Source: 45 CFR 164.308

Same exam, other states

AR AZ CA FL GA IL IN KS MI MS NC NJ NY OH PA TN TX VA WA

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA General Workforce Compliance (MA) practice test?

30 questions total, split into 3 full papers of 30 each with no repeats across papers.

What topics does the HIPAA General Workforce Compliance (MA) test cover?

30 domains, with the heaviest weight on Breach Notification Content (3%), Breach Notification Definition (3%), and Breach Notification Exception (3%).

Where do CertQuestUSA's HIPAA General Workforce Compliance (MA) questions come from?

Primarily 45 CFR (93%) and M.G.L. c. (3%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA General Workforce Compliance (MA)?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.