HIPAA General Workforce Compliance (OR)

First published: September 2, 2026Last verified: September 2, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA General Workforce Compliance (OR): a 28-question practice bank for the real HIPAA / Healthcare Compliance standard, 3 full papers of 28 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (100%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

3

full papers, no repeats

28

questions per paper

28

questions in the bank

What this exam covers

accounting-of-disclosures4%
addressable-vs-required-specifications4%
authorization-requirements4%
breach-definition4%
breach-notification-large-breach4%
breach-notification-timing4%
business-associate-agreement4%
business-associate-definition4%
covered-entity-definition4%
de-identification4%
incidental-disclosure4%
minimum-necessary-exceptions4%
minimum-necessary-standard4%
notice-of-privacy-practices4%
patient-right-of-access4%
permitted-disclosure-law-enforcement4%
permitted-disclosure-public-health4%
permitted-uses-tpo4%
phi-definition4%
psychotherapy-notes4%
right-to-amend4%
security-rule-administrative-safeguards4%
security-rule-physical-safeguards4%
security-rule-technical-safeguards4%
social-media-phi4%
workforce-sanctions4%
workforce-training4%
workstation-physical-safeguard4%

5 real sample questions

Under the HIPAA Privacy Rule, which organization meets the definition of a "covered entity"?

A. A health plan that pays claims for its enrollees' medical care

B. A janitorial company that cleans a hospital after hours

C. A transcription vendor typing dictated physician notes

D. A software company hosting a clinic's appointment scheduler

Source: 45 CFR 160.103

A cloud vendor stores a physician group's electronic health records and can technically access patient data to provide support. How is this vendor classified under HIPAA?

A. Covered entity, because it stores PHI directly

B. Business associate, because it creates, receives, maintains, or transmits PHI on the group's behalf

C. Hybrid entity, because it performs both covered and non-covered functions

D. Exempt from HIPAA, because it never provides treatment

Source: 45 CFR 160.103

Before a medical practice allows a billing vendor to access PHI, what must be executed?

A. A written business associate agreement satisfying 45 CFR 164.504(e)

B. Written consent from every patient whose records the vendor will touch

C. Nothing, provided the vendor states it follows HIPAA

D. A verbal confidentiality agreement with the vendor's manager

Source: 45 CFR 164.504(e)

Which of the following is "protected health information" (PHI) under HIPAA?

A. A hospital's aggregate quarterly bed-occupancy statistics with no patient identifiers

B. A patient's name linked to a lab result held by a hospital

C. A de-identified dataset stripped of all 18 HIPAA identifiers

D. Employment records held by a hospital in its role as an employer

Source: 45 CFR 160.103

A billing clerk requests access to a patient's full mental health treatment notes to process a routine insurance claim that only needs diagnosis and procedure codes. What does the minimum necessary standard require?

A. Access should be limited to the specific information needed for the billing function

B. Full record access is fine as long as the clerk works for the covered entity

C. The clerk must obtain a new patient authorization before viewing any records

D. Minimum necessary does not apply to internal workforce members

Source: 45 CFR 164.502(b)

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA General Workforce Compliance (OR) practice test?

28 questions total, split into 3 full papers of 28 each with no repeats across papers.

What topics does the HIPAA General Workforce Compliance (OR) test cover?

28 domains, with the heaviest weight on accounting-of-disclosures (4%), addressable-vs-required-specifications (4%), and authorization-requirements (4%).

Where do CertQuestUSA's HIPAA General Workforce Compliance (OR) questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA General Workforce Compliance (OR)?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.