HIPAA General Workforce Compliance (UT)

First published: September 2, 2026Last verified: September 2, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA General Workforce Compliance (UT): a 26-question practice bank for the real HIPAA / Healthcare Compliance standard, 3 full papers of 26 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (100%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

3

full papers, no repeats

26

questions per paper

26

questions in the bank

What this exam covers

authorization-required8%
breach-notification12%
business-associate-agreements8%
enforcement8%
minimum-necessary-standard8%
notice-of-privacy-practices4%
patient-rights12%
permitted-uses-and-disclosures12%
phi-definition8%
safeguards15%
workforce-sanctions8%

5 real sample questions

Under HIPAA, individually identifiable health information becomes "Protected Health Information" (PHI) when it is created or received by which type of entity?

A. A covered entity (health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction) or its business associate

B. Only hospitals, and no other type of health care provider

C. Only the federal government

D. Any business that stores personal data of any kind, regardless of industry

Source: 45 CFR 160.103

Which of the following is the best example of Protected Health Information (PHI) under HIPAA?

A. An employee's payroll salary information held by the HR department

B. A company's general marketing email list with no health information included

C. A patient's name linked to their diagnosis and treatment date in a medical record

D. A de-identified dataset stripped of all 18 HIPAA identifiers used for public health statistics

Source: 45 CFR 160.103

Under the HIPAA minimum necessary standard, a workforce member accessing PHI to perform their job duties should generally do what?

A. Share PHI freely with any coworker who asks, since all staff are presumed trustworthy

B. Access the complete medical record for every patient regardless of their specific task

C. Access, use, or disclose only the amount of PHI reasonably necessary to accomplish the intended purpose

D. Avoid accessing any PHI under any circumstances to eliminate risk

Source: 45 CFR 164.502(b); 45 CFR 164.514(d)

Which of the following disclosures is expressly excluded from the HIPAA minimum necessary standard?

A. Routine administrative disclosures to a billing vendor

B. Disclosures for treatment purposes between health care providers

C. Disclosures to a health plan for payment purposes

D. Marketing disclosures to a third-party advertiser

Source: 45 CFR 164.502(b)(2)

Under the HIPAA Privacy Rule, a covered entity may use or disclose PHI without obtaining the patient's written authorization for which category of activity?

A. Sale of PHI to a data broker for marketing purposes

B. Treatment, payment, and health care operations (TPO)

C. Disclosure to an employer for use in an employment decision

D. Posting patient information on a public social media page

Source: 45 CFR 164.506

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA General Workforce Compliance (UT) practice test?

26 questions total, split into 3 full papers of 26 each with no repeats across papers.

What topics does the HIPAA General Workforce Compliance (UT) test cover?

11 domains, with the heaviest weight on safeguards (15%), breach-notification (12%), and patient-rights (12%).

Where do CertQuestUSA's HIPAA General Workforce Compliance (UT) questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA General Workforce Compliance (UT)?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.