Free Washington HIPAA Practice Test Online

Correct answer: A. A for-profit menstrual-cycle tracking app with no relationship to any HIPAA covered entity or business associate

The app is a for-profit business collecting consumer health data with no HIPAA nexus, so it falls squarely within the My Health My Data Act's 'regulated entity' definition rather than any HIPAA exemption.

• B: RCW 19.373.010 expressly excludes government agencies from the definition of 'regulated entity,' so a county public health department is not covered by this chapter.
• C: RCW 19.373.010 expressly excludes tribal nations from the definition of 'regulated entity,' so a tribal health clinic is not covered by this chapter.
• D: RCW 19.373.100 exempts protected health information maintained by a HIPAA covered entity or business associate, so the hospital's HIPAA-regulated EHR data is outside this chapter's scope.

Correct answer: B. Personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status, including derived or inferred health information

RCW 19.373.010 defines consumer health data as personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status, which explicitly includes data that is merely derived or inferred from other information.

• A: The statutory definition is not limited to formal medical charts; it reaches consumer health data collected by apps, wearables, and other non-clinical sources.
• C: Genetic data is one example included within the broader definition, but the definition is not limited to laboratory-ordered genetic tests.
• D: Insurance billing codes could fall within the definition if linkable to a consumer's health status, but the definition is not restricted to billing codes alone.

Correct answer: C. 2,000 feet or less from the perimeter of the location

RCW 19.373.010 defines a geofence as technology establishing a virtual boundary of 2,000 feet or less from the perimeter of a physical location.

• A: 5,000 feet is not the boundary set by the statute and overstates the distance defined in RCW 19.373.010.
• B: 500 feet is not the boundary set by the statute and understates the distance defined in RCW 19.373.010.
• D: One mile is far larger than the 2,000-foot boundary actually specified in the statute.

Correct answer: D. 1,750 feet

RCW 19.373.010 defines precise location information as data derived from technology such as GPS coordinates that identifies a specific location within a 1,750-foot radius.

• A: Ten miles is far larger than the radius actually used in the statutory definition and would not qualify as 'precise' location information.
• B: One hundred feet is smaller than the radius actually specified in the statute.
• C: The statute does specify a numeric radius, so this option is incorrect.

Correct answer: A. A small business, subject to a later compliance deadline than larger regulated entities

RCW 19.373.010 defines a small business as a regulated entity that collects fewer than 100,000 consumers' health data annually, or derives less than half its revenue from health data while processing fewer than 25,000 consumers' data, and small businesses were given a later compliance deadline than larger regulated entities.

• B: Nothing in the facts describes a government agency, and the classification described in the statute for this fact pattern is 'small business,' not government agency.
• C: The facts describe a company that determines its own purposes for collecting data, which is the hallmark of a regulated entity or small business, not a processor acting on another entity's instructions.
• D: Nothing in the facts describes a tribal nation, and the statutory classification for this revenue and volume profile is 'small business.'