HIPAA practice test for mental health professionals
Free HIPAA practice test for mental health professionals.
You handle some of the most sensitive PHI in healthcare: session notes, diagnoses, and the simple fact that someone is in therapy at all. This free practice test checks how you would handle the situations that actually come up in practice: a parent demanding a teen's counseling record, an insurer requesting psychotherapy notes, or a telehealth session run from your home office. Answer the questions and get a scored result showing where you stand.
This version mixes nine scenarios written for therapists, counselors, psychologists, and clinical social workers with core HIPAA questions every workforce member should know.
Question basis: federal HIPAA rules and HHS/OCR guidance. State privacy laws and your organization's policies may be stricter.
Free practice test
Start the HIPAA practice test for mental health professionals
20 multiple-choice questions across the Privacy Rule, Security Rule, breach notification, business associates, and real workplace scenarios. You see whether each answer is right as you go. At the end you unlock your scored results, full explanations, and a short study plan.
This practice test helps you study. It is not a substitute for completing the HIPAA course, passing its graded assessment, and earning a dated certificate.
Sample questions
HIPAA quiz questions and answers for mental health professionals
Psychotherapy Notes
A client's insurer asks your practice for the complete record, including your psychotherapy notes, to process an out of network claim. What should you send?
- Everything requested, because payment is part of TPO and never needs authorization
- Nothing, because insurers may never see mental health records
- The regular medical record only; releasing psychotherapy notes requires the client's separate written authorization
- The psychotherapy notes only, since they are the most complete account of care
Show answer
Correct answer: The regular medical record only; releasing psychotherapy notes requires the client's separate written authorization
Psychotherapy notes sit outside the normal TPO permissions. Almost any disclosure of them, including to a health plan for payment, requires a specific authorization signed by the client, while the rest of the record can be shared for payment under the usual rules.
Psychotherapy Notes
You keep a private notebook analyzing what clients say in session, stored apart from the chart. Which item belongs in the regular record rather than in protected psychotherapy notes?
- Your impressions of the client's transference during a session
- The client's diagnosis, medication list, and session start and stop times
- Your analysis of themes in the client's dialogue across recent sessions
- Your hypotheses about the meaning of a dream the client described
Show answer
Correct answer: The client's diagnosis, medication list, and session start and stop times
Psychotherapy notes are limited to a clinician's separated notes documenting or analyzing conversation during private, couples, or group sessions. Diagnoses, medications, session times, treatment plans, test results, and progress summaries are part of the general record no matter where you write them.
Psychotherapy Notes
A client asks for a complete copy of their file, including the psychotherapy notes you keep separately. How does the HIPAA right of access apply?
- Psychotherapy notes are excluded from the right of access; provide the rest of the record and use professional judgment about the notes
- You must hand over every page, including psychotherapy notes, within 30 days
- You may deny access to the entire record because it involves mental health
- You must destroy the psychotherapy notes once the client asks about them
Show answer
Correct answer: Psychotherapy notes are excluded from the right of access; provide the rest of the record and use professional judgment about the notes
Clients have a strong right of access to the designated record set, but HIPAA specifically carves psychotherapy notes out of that right. You may still choose to share them, and some state laws grant broader access, so check your state's rules too.
PHI Basics
Which of the following is protected health information (PHI) under HIPAA?
- A patient's first name stored next to their appointment diagnosis
- A hospital's published main phone number
- A fully de-identified research dataset with no identifiers
- A generic brochure about flu season
Show answer
Correct answer: A patient's first name stored next to their appointment diagnosis
PHI is individually identifiable health information transmitted or maintained by a covered entity or business associate, subject to the exclusions in 45 CFR 160.103. A name tied to a diagnosis identifies the person and reveals health information, so it qualifies.
PHI Basics
Which set of data points are all HIPAA identifiers that can make health information individually identifiable?
- Favorite color, shoe size, and zodiac sign
- Full name, medical record number, and email address
- Weather, traffic data, and store hours
- Stock prices, exchange rates, and tax brackets
Show answer
Correct answer: Full name, medical record number, and email address
HIPAA lists 18 identifiers including names, medical record numbers, and email addresses. When any of these are linked to health information, the data becomes PHI.
FAQ
HIPAA questions mental health professionals actually ask
Are psychotherapy notes really treated differently from the rest of a therapy record?
Yes. Psychotherapy notes are a clinician's separated notes analyzing session conversation, and nearly every disclosure of them requires the client's specific written authorization, even to the client's own health plan for payment. They are also excluded from the client's HIPAA right of access. Diagnoses, medications, treatment plans, test results, and session start and stop times never qualify as psychotherapy notes, no matter where you write them.
Does HIPAA stop me from warning someone my client has threatened?
No. HIPAA includes a specific permission for good faith disclosures needed to prevent or lessen a serious and imminent threat, made to people reasonably able to help, such as police or the threatened person. State duty to warn laws determine when you must act, and HIPAA is written to accommodate them. Document your reasoning whenever you rely on this permission.
Can a parent always see a minor's counseling records?
Usually a parent acts as the minor's personal representative and can exercise the minor's HIPAA rights. The main exceptions arise when the minor lawfully consented to the treatment on their own, could lawfully receive it without parental consent, or the parent agreed to a confidential relationship between the minor and the clinician. In those situations HIPAA defers to state law on parental access, and where state law is silent a licensed professional may use judgment.
Is this practice test the same as HIPAA training?
No. This is a free self check that shows where you stand, not documented workforce training. HIPAA requires covered practices to train workforce members on their privacy and security policies and to keep records of that training. If you miss questions here, a full course built for mental health professionals will close the gaps and give you a certificate your practice can file.
Keep going
HIPAA resources for mental health professionals
Guide
HIPAA Training for Therapists
Role specific HIPAA training built for therapists, counselors, and counseling practices.
Read moreGuide
HIPAA Training for Behavioral Health
Compliance training for behavioral health and counseling organizations.
Read moreGuide
Telehealth HIPAA Compliance
How to run compliant video sessions, choose platforms, and handle digital PHI.
Read moreWant the broadest version? Take the general HIPAA practice test with the full 40-question pool.
From practice to proof