HIPAA General Workforce Compliance (OK)

First published: September 2, 2026Last verified: September 2, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA General Workforce Compliance (OK): a 30-question practice bank for the real HIPAA / Healthcare Compliance standard, 3 full papers of 30 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (100%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

3

full papers, no repeats

30

questions per paper

30

questions in the bank

What this exam covers

access-timeframe3%
accounting-of-disclosures3%
administrative-safeguards3%
audit-controls3%
authorization-required3%
breach-definition3%
breach-notification-timing3%
breach-risk-assessment3%
business-associate3%
business-associate-agreement3%
complaints-and-retaliation3%
covered-entity3%
de-identification3%
encryption-addressable3%
incidental-disclosure3%
marketing-authorization3%
minimum-necessary3%
minimum-necessary-exceptions3%
notice-of-privacy-practices3%
permitted-uses-tpo3%
personal-representative3%
phi-definition3%
physical-safeguards3%
psychotherapy-notes3%
right-of-access3%
right-to-amend3%
right-to-restrict3%
risk-analysis3%
technical-safeguards-access3%
workforce-sanctions3%

5 real sample questions

A patient requests a list of everyone their hospital has disclosed their PHI to over the past several years, outside of treatment, payment, and operations disclosures. What is the applicable lookback period?

A. Up to 30 days prior to the date of the request

B. Up to six years prior to the date of the request

C. The entire lifetime of the patient's relationship with the hospital, with no limit

D. Only the current calendar year

Source: 45 CFR § 164.528

A hospital billing system stores a patient's name linked to their diagnosis. Under HIPAA, how is this information classified?

A. Protected Health Information (PHI), because it is individually identifiable health information held by a covered entity

B. De-identified data, because billing systems do not count as clinical records

C. Public information, because hospital billing records are not confidential by law

D. Employment record information, because it is stored in an administrative system

Source: 45 CFR § 160.103

A billing clerk needs to confirm a patient's insurance coverage for one recent visit. Under the minimum necessary standard, what should the clerk access?

A. The patient's entire lifetime medical record across every provider in the system

B. Only the information reasonably needed to verify coverage for that visit, such as the visit date and billing codes

C. The patient's unrelated psychiatric treatment history, in case it becomes relevant later

D. Whatever information is fastest to pull up on the screen, regardless of relevance

Source: 45 CFR § 164.502(b)

Which of the following disclosures is exempt from the minimum necessary standard?

A. A hospital marketing department pulling patient lists for a fundraising mailing

B. A health plan disclosing PHI to an employer for hiring decisions

C. A physician sending a patient's full chart to a specialist for treatment purposes

D. A researcher accessing PHI without an authorization or IRB waiver

Source: 45 CFR § 164.502(b)(2)

Which of the following organizations meets HIPAA's definition of a 'covered entity'?

A. A life insurance company that never transmits health information electronically

B. A software vendor that hosts a hospital's scheduling application

C. A patient's employer that receives sick-leave documentation

D. A health plan that pays for or provides the cost of medical care

Source: 45 CFR § 160.103

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA General Workforce Compliance (OK) practice test?

30 questions total, split into 3 full papers of 30 each with no repeats across papers.

What topics does the HIPAA General Workforce Compliance (OK) test cover?

30 domains, with the heaviest weight on access-timeframe (3%), accounting-of-disclosures (3%), and administrative-safeguards (3%).

Where do CertQuestUSA's HIPAA General Workforce Compliance (OK) questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA General Workforce Compliance (OK)?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.