Free Missouri HIPAA Practice Test Online

Correct answer: A. A patient's name linked to their diagnosis, stored in a hospital's billing system

PHI is individually identifiable health information (name, diagnosis, etc.) held or transmitted by a covered entity or business associate in any form, per 45 CFR § 160.103 — this fits the definition exactly.

• B: Properly de-identified data with no individual identifiers falls outside the definition of PHI under 45 CFR § 164.514, so it is not PHI even though it originated from patient records.
• C: General facility policy information is not individually identifiable health information about a specific patient, so it does not meet the PHI definition.
• D: Employment records held by a covered entity in its role as employer (not as a healthcare provider) are excluded from PHI under 45 CFR § 160.103's definition, which carves out employment records held by a covered entity in its employer capacity.

Correct answer: B. Only the information reasonably necessary to verify coverage for that specific visit, such as visit date and billing codes

45 CFR § 164.502(b) requires covered entities to make reasonable efforts to limit PHI use and disclosure to the minimum necessary to accomplish the intended purpose — here, only visit-specific billing data is needed.

• A: Pulling the entire record, including unrelated psychiatric history, exceeds what is reasonably necessary for a billing/insurance-verification task and violates the minimum necessary standard.
• C: Accessing the patient's complete cross-provider lifetime history is far broader than needed to verify coverage for one visit, exceeding the minimum necessary scope.
• D: Accessing PHI out of curiosity rather than for a legitimate job function violates minimum necessary and workforce access-control obligations under § 164.502(b) and § 164.308(a)(4).

Correct answer: B. Disclosure to the patient of their own PHI in response to an access request

45 CFR § 164.514(d) and § 164.502(b)(2) exempt disclosures to the individual who is the subject of the information (i.e., access requests under § 164.524) from the minimum necessary requirement.

• A: Marketing analytics is not one of the enumerated exceptions in § 164.502(b)(2), so the minimum necessary standard still applies and full-record pulls without justification would violate it.
• C: Curiosity-driven access is not a permitted use at all, let alone an exception to minimum necessary — it is a privacy violation and workforce sanction issue under § 164.530(e).
• D: Sending an entire chart when only specific lab values were requested is a textbook minimum necessary violation, not an exception, since the disclosure exceeds what was needed to satisfy the request.

Correct answer: B. Treatment, payment, and healthcare operations (TPO)

45 CFR § 164.506 permits covered entities to use and disclose PHI for treatment, payment, and healthcare operations without needing separate patient authorization, since these are core functions of delivering and administering care.

• A: Sale of PHI for marketing purposes requires specific patient authorization under § 164.508(a)(4) and is not covered by the TPO exception.
• C: Using patient photos for marketing/promotional purposes requires prior written authorization under § 164.508; it is not a permitted TPO use.
• D: Disclosing diagnosis information to an employer is not a TPO activity and generally requires the patient's written authorization under § 164.508, absent a specific exception (e.g., workers' compensation).

Correct answer: B. A valid, specific written authorization signed by the patient, since psychotherapy notes require heightened protection

45 CFR § 164.508 requires a specific written authorization for disclosures not otherwise permitted, and psychotherapy notes receive additional protection under § 164.508(a)(2), generally requiring their own dedicated authorization separate from the rest of the record.

• A: Life insurance underwriting is not a treatment, payment, or healthcare operations activity for the treating provider, so the TPO exception under § 164.506 does not apply here.
• C: HIPAA authorizations for uses like this must be in writing and meet the core elements specified in § 164.508(c); a verbal consent does not satisfy the requirement.
• D: Psychotherapy notes can be disclosed with a valid specific authorization from the patient — HIPAA does not impose an absolute bar, only heightened procedural protection.