HIPAA practice test for medical billing and coding
Free HIPAA practice test for medical billing and coding.
You touch PHI on every claim you scrub, every EOB you post, and every payer call you make. This free practice test checks the judgment calls billers and coders face daily: what a payer may see, what a spouse may hear about a bill, and where minimum necessary draws the line. Work through the scenarios, get scored instantly, and see exactly which rules to review.
This version mixes 9 billing and coding scenarios with core HIPAA questions drawn from our 40-question pool.
Question basis: federal HIPAA rules and HHS/OCR guidance. State privacy laws and your organization's policies may be stricter.
Free practice test
Start the HIPAA practice test for medical billing and coding
20 multiple-choice questions across the Privacy Rule, Security Rule, breach notification, business associates, and real workplace scenarios. You see whether each answer is right as you go. At the end you unlock your scored results, full explanations, and a short study plan.
This practice test helps you study. It is not a substitute for completing the HIPAA course, passing its graded assessment, and earning a dated certificate.
Sample questions
HIPAA quiz questions and answers for medical billing and coding
Claims and Payers
A payer requests supporting documentation for a claim it is reviewing for one date of service. What should you send?
- The patient's complete chart so the reviewer has full context
- Nothing, because payers can never see clinical records without a signed patient authorization
- Only the documentation for that date of service that supports the billed codes
- A written summary you draft yourself in place of the actual records
Show answer
Correct answer: Only the documentation for that date of service that supports the billed codes
Disclosures to a payer for payment are permitted without patient authorization, but the minimum necessary standard applies. Send the records that support the claim under review, not the whole chart.
Working Across Clients
You work claims for several practices at a billing company. While posting payments for Practice A, you recognize the name of a patient you also saw in Practice B's system and want to compare their claim history. Is that allowed?
- Yes, because your company holds both records, they are fair game
- Yes, as long as you do not print or export anything
- Yes, if you finish your assigned work for Practice A first
- No, you may only access the records needed for the task assigned for each specific client
Show answer
Correct answer: No, you may only access the records needed for the task assigned for each specific client
Each client's PHI may only be used for that client's work. Cross-client browsing without a work reason exceeds minimum necessary and violates role-based access, even when both records sit in your company's systems.
Patient Billing Calls
A patient's spouse calls about an unpaid balance and asks what the charges are for. The patient has never objected to the spouse handling the household's medical bills. What may you share?
- Information directly relevant to the spouse's involvement in payment, after verifying who you are speaking with
- Nothing, because HIPAA bans discussing any bill with anyone but the patient
- The full clinical record, since spouses are treated the same as the patient
- Everything in the account, but only if the spouse promises confidentiality
Show answer
Correct answer: Information directly relevant to the spouse's involvement in payment, after verifying who you are speaking with
HIPAA permits sharing PHI with a family member involved in the patient's care or payment for care when the patient does not object, limited to what is relevant to that involvement. Verify the caller and keep the discussion to the bill, because a spouse is not automatically a personal representative with full access.
PHI Basics
Which of the following is protected health information (PHI) under HIPAA?
- A patient's first name stored next to their appointment diagnosis
- A hospital's published main phone number
- A fully de-identified research dataset with no identifiers
- A generic brochure about flu season
Show answer
Correct answer: A patient's first name stored next to their appointment diagnosis
PHI is individually identifiable health information transmitted or maintained by a covered entity or business associate, subject to the exclusions in 45 CFR 160.103. A name tied to a diagnosis identifies the person and reveals health information, so it qualifies.
PHI Basics
Which set of data points are all HIPAA identifiers that can make health information individually identifiable?
- Favorite color, shoe size, and zodiac sign
- Full name, medical record number, and email address
- Weather, traffic data, and store hours
- Stock prices, exchange rates, and tax brackets
Show answer
Correct answer: Full name, medical record number, and email address
HIPAA lists 18 identifiers including names, medical record numbers, and email addresses. When any of these are linked to health information, the data becomes PHI.
FAQ
HIPAA questions medical billing and coding actually ask
Do medical billers and coders need HIPAA training?
Yes. Billers and coders work with diagnoses, procedure codes, and insurance identifiers on nearly every task, and all of that is PHI. Covered entities must train affected workforce members within a reasonable period after hire, and billing companies acting as business associates must run their own security awareness training. Most employers and clients also expect documented annual refreshers as proof of an ongoing compliance program.
Does minimum necessary apply when a payer asks for records to support a claim?
Yes. Disclosures for payment are permitted without patient authorization, but they remain subject to the minimum necessary standard, so you send the documentation that supports the claim in question rather than the full chart. The exemption for treatment disclosures between providers does not extend to payment work. When a payer specifies what it needs, you may generally treat that request as reasonable, but your response should still stay within it.
Is a billing company a covered entity or a business associate?
A billing company that submits claims and handles PHI on behalf of providers is a business associate, so it must sign a BAA with each client and is directly liable under the Security Rule and key Privacy Rule requirements. A healthcare clearinghouse is different: converting claims between standard and nonstandard formats makes it one of the three types of covered entities in its own right. Many revenue cycle firms wear both hats depending on the function, so knowing which role applies to each workflow matters.
Can I discuss a patient's bill with their spouse or family member?
Often yes. HIPAA permits sharing information with a family member who is involved in the patient's care or payment for care, as long as the patient has not objected and you limit the conversation to what is relevant to that involvement. Verify who you are speaking with before discussing the account, and keep clinical details out unless they are needed to explain the charge. A spouse is not automatically a personal representative, so they do not get blanket access to the full record.
Keep going
HIPAA resources for medical billing and coding
Guide
HIPAA Training for Medical Billing
Role-based HIPAA training built for claims, billing, and revenue cycle teams.
Read moreGuide
HIPAA Training for Medical Coders
HIPAA training for coding specialists handling diagnosis data and claim workflows.
Read moreGuide
HIPAA Minimum Necessary Standard
Plain-English guide to the standard that governs most disclosures in billing work.
Read moreWant the broadest version? Take the general HIPAA practice test with the full 40-question pool.
From practice to proof