HIPAA Study Guide 2026

Everything you need to pass the HIPAA exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.

📋 HIPAA Exam Format at a Glance

Questions

90 min

Time Limit

70%

Passing Score

Take a Full HIPAA Exam Simulation →

📚 HIPAA Topics to Study (21)

De-identification and Data Anonymization · 36 cards Electronic Health Records (EHR) Compliance · 36 cards Healthcare Provider Obligations and Covered Entities · 36 cards HITECH Act and Technology Requirements · 36 cards Mental Health and Substance Abuse Privacy Rules · 36 cards Workforce Training and Compliance Programs · 29 cards Compliance · 11 cards Medical Information · 11 cards Minimum Necessary Standard · 7 cards Minimum Necessary Standard · 7 cards Minimum Necessary Standard · 7 cards Administrative Safeguards · 6 cards Business Associate Agreements · 6 cards Breach Notification Rule · 6 cards Enforcement and Penalties · 6 cards Patient Rights Under HIPAA · 6 cards Protected Health Information (PHI) · 6 cards Technical & Physical Safeguards · 6 cards The HIPAA Privacy Rule · 6 cards The HIPAA Security Rule · 6 cards The Omnibus Rule · 6 cards

✍️ Sample HIPAA Questions & Answers

1. A hospital migrates to a new EHR system. What HIPAA requirement applies to PHI stored in the old system?

✓ It must be retained according to applicable retention laws and securely disposed of when no longer needed

HIPAA requires that PHI be retained per applicable state and federal retention laws, and disposed of securely when retention periods expire.

2. A covered entity's employee discovers that a family member is a patient at their organization. Under HIPAA, what is the employee's obligation?

✓ The employee must not access the family member's records unless they are directly involved in that person's care

Workforce members may not access PHI of patients they are not involved in treating — 'snooping' on family members' records is a HIPAA violation even with good intentions.

3. What are 'psychotherapy notes' under HIPAA, and how do they differ from other mental health records?

✓ Psychotherapy notes are notes from a therapist's private files capturing mental impressions during therapy, separate from formal treatment records, and requiring specific authorization for disclosure

Psychotherapy notes are mental impressions and analysis captured in a therapist's private files — distinct from treatment records — and require specific authorization for most disclosures.

4. A patient requests an accounting of disclosures of their Protected Health Information (PHI) from a hospital. Which of the following disclosures must be EXCLUDED from this accounting report?

✓ A disclosure made to the patient's health plan for payment purposes.

The HIPAA Privacy Rule specifically exempts disclosures made for Treatment, Payment, and healthcare Operations (TPO) from the accounting of disclosures requirement. Disclosures for public health activities, in response to court orders, or for health oversight are not part of TPO and must be included in an accounting if requested.

5. What is 'top-coding' and 'bottom-coding' in the context of health data de-identification?

✓ Capping extreme values at a threshold to prevent identification of outliers — e.g., capping age at '65+' or capping charges at '$100,000+'

Top-coding and bottom-coding cap extreme values at a threshold, preventing identification of outliers who might be identifiable by unusual values.

6. Which HITECH provision specifically addressed the problem of organizations that lacked proper safeguards but had never been investigated by HHS?

✓ The mandate for HHS to conduct periodic audits of covered entities and business associates

HITECH directed HHS to conduct regular compliance audits, creating proactive oversight rather than relying solely on complaint-driven enforcement.

🎯 Free HIPAA Practice Tests

HITECH Act and Technology Requirements · 36 questions Electronic Health Records (EHR) Compliance · 36 questions Mental Health and Substance Abuse Privacy Rules · 36 questions Healthcare Provider Obligations and Covered Entities · 36 questions De-identification and Data Anonymization · 36 questions Workforce Training and Compliance Programs · 29 questions Medical Information · 11 questions Compliance · 11 questions Minimum Necessary Standard · 7 questions Minimum Necessary Standard · 7 questions

📖 HIPAA Guides & Articles

Your HIPAA Study Path

1. Learn with Flashcards → 2. Drill Practice Tests → 3. Take the Full Exam Simulation

🃏 HIPAA Flashcards (312)🏆 HIPAA Exam Simulation