HIPAA practice test for nurses
Free HIPAA practice test for nurses.
You handle PHI every hour of a shift: bedside report, the unit whiteboard, a daughter on the phone asking for an update, a chart open on a workstation on wheels. This free practice test puts you in those exact moments and shows you where the line actually is. Answer nurse-specific scenarios plus core HIPAA questions and get your score instantly.
This version mixes nine nurse-specific scenarios, from shift report to social media, with core HIPAA questions every healthcare worker should be able to answer.
Question basis: federal HIPAA rules and HHS/OCR guidance. State privacy laws and your organization's policies may be stricter.
Free practice test
Start the HIPAA practice test for nurses
20 multiple-choice questions across the Privacy Rule, Security Rule, breach notification, business associates, and real workplace scenarios. You see whether each answer is right as you go. At the end you unlock your scored results, full explanations, and a short study plan.
This practice test helps you study. It is not a substitute for completing the HIPAA course, passing its graded assessment, and earning a dated certificate.
Sample questions
HIPAA quiz questions and answers for nurses
Care Team Communication
You are giving shift report to the oncoming nurse who is taking over your patients. How much clinical detail can you share?
- Only the patient's name, room number, and code status, nothing else
- Nothing, unless the patient signs an authorization covering each handoff
- Whatever the oncoming nurse needs for safe care, because handoff is a treatment communication
- Only information the patient verbally approved earlier that day
Show answer
Correct answer: Whatever the oncoming nurse needs for safe care, because handoff is a treatment communication
Sharing PHI with the caregiver taking over a patient is a treatment disclosure, which HIPAA permits without authorization. The minimum necessary standard does not restrict disclosures between providers for treatment, so a complete, useful report is both legal and good care.
Bedside Privacy
Your unit's hallway whiteboard lists every room with the patient's full name and diagnosis, and visitors walk past it all day. What is the right fix?
- Limit the board to what staff actually need, such as initials instead of full names, and move it out of the public line of sight
- Leave it alone, because unit whiteboards are exempt from HIPAA
- Remove the board entirely, because HIPAA forbids patient tracking tools
- Cover it with a curtain during visiting hours only
Show answer
Correct answer: Limit the board to what staff actually need, such as initials instead of full names, and move it out of the public line of sight
Reasonable safeguards and minimum necessary apply to whiteboards and census boards just like any other PHI. Units can keep the tool, but they should trim what it displays and reduce its visibility to passersby rather than ignoring the exposure or banning a useful workflow.
EMR Access Discipline
A coworker from your unit was admitted two floors up. You are not assigned to her care, but you want to peek at her chart to see how she is doing before sending flowers. What does HIPAA say?
- Opening the chart is fine as long as you never repeat what you read
- It is allowed because you both work for the same hospital
- It is allowed if you only check her room number and skip the clinical notes
- Do not open the chart, because without a role in her care you have no permitted purpose
Show answer
Correct answer: Do not open the chart, because without a role in her care you have no permitted purpose
EMR access must be tied to your job duties for that specific patient, and concern or friendship is not treatment, payment, or operations. Hospitals audit for exactly this pattern and discipline it even when nothing is shared. Ask her or her family directly instead.
PHI Basics
Which of the following is protected health information (PHI) under HIPAA?
- A patient's first name stored next to their appointment diagnosis
- A hospital's published main phone number
- A fully de-identified research dataset with no identifiers
- A generic brochure about flu season
Show answer
Correct answer: A patient's first name stored next to their appointment diagnosis
PHI is individually identifiable health information transmitted or maintained by a covered entity or business associate, subject to the exclusions in 45 CFR 160.103. A name tied to a diagnosis identifies the person and reveals health information, so it qualifies.
PHI Basics
Which set of data points are all HIPAA identifiers that can make health information individually identifiable?
- Favorite color, shoe size, and zodiac sign
- Full name, medical record number, and email address
- Weather, traffic data, and store hours
- Stock prices, exchange rates, and tax brackets
Show answer
Correct answer: Full name, medical record number, and email address
HIPAA lists 18 identifiers including names, medical record numbers, and email addresses. When any of these are linked to health information, the data becomes PHI.
FAQ
HIPAA questions nurses actually ask
Do nurses need HIPAA certification?
HIPAA itself does not issue or require a certificate, but it does require covered entities to train workforce members whose jobs touch PHI, which includes essentially every nurse. Employers, staffing agencies, travel contracts, and nursing programs routinely ask for proof of training, and a course certificate is the standard way to document it. Most employers refresh training annually and after any material policy change.
Can I give bedside report if my patient has a roommate?
Yes. Handoff between caregivers is a treatment communication, which HIPAA permits without authorization. If a roommate overhears despite reasonable safeguards like a lowered voice and a pulled curtain, that is an incidental disclosure, which the rule allows. Save especially sensitive topics, such as behavioral health or infectious disease details, for a more private moment when you reasonably can.
Is it a HIPAA violation to look up my own chart or a family member's chart in the EMR?
For a family member, yes: your EMR access is tied to your job duties, and being related to the patient does not create a permitted purpose, so those lookups show up in audits as snooping. For your own chart, HIPAA gives you a right of access to your records, but most facilities require you to use the patient portal or the standard release process rather than your clinical login, and violating that policy can still cost you your job.
What should I do if I accidentally access or share PHI I should not have?
Report it right away to your charge nurse, manager, or privacy officer through your facility's incident process. Prompt reporting lets the organization contain the exposure, assess whether it is a reportable breach, and document the response. Self-reporting an honest mistake is treated very differently from an access pattern that surfaces later in an audit.
Keep going
HIPAA resources for nurses
Guide
HIPAA Training for Nurses
Role-specific HIPAA certification course for RNs, LPNs, and CNAs, with a dated certificate employers can verify.
Read moreGuide
HIPAA Minimum Necessary Standard
How much PHI you can access and share for a given task, and when the treatment exception applies.
Read moreGuide
HIPAA Social Media Policy for Healthcare Teams
What clinical staff can and cannot post, and how facilities should set the rules in writing.
Read moreWant the broadest version? Take the general HIPAA practice test with the full 40-question pool.
From practice to proof