HIPAA practice test for pharmacy teams
Free HIPAA practice test for pharmacy teams.
Every shift brings PHI decisions: a husband at the counter for his wife's prescription, a caller claiming to be from a prescriber's office, a will-call shelf full of labeled bags. This free scored test uses situations pharmacists and pharmacy technicians actually face, so you can see where your instincts match the rules before formal training or an audit.
This test combines nine pharmacy-specific scenarios, from the drive-through lane to the will-call bins, with core HIPAA questions on the Privacy Rule, Security Rule, and breach notification.
Question basis: federal HIPAA rules and HHS/OCR guidance. State privacy laws and your organization's policies may be stricter.
Free practice test
Start the HIPAA practice test for pharmacy teams
20 multiple-choice questions across the Privacy Rule, Security Rule, breach notification, business associates, and real workplace scenarios. You see whether each answer is right as you go. At the end you unlock your scored results, full explanations, and a short study plan.
This practice test helps you study. It is not a substitute for completing the HIPAA course, passing its graded assessment, and earning a dated certificate.
Sample questions
HIPAA quiz questions and answers for pharmacy teams
Pickup and Phone Calls
A man at the counter asks to pick up his wife's prescription. She is not with him and has not filed any paperwork naming him. What may the pharmacist do?
- Refuse until his wife signs a written HIPAA authorization naming him
- Call the patient and get verbal permission before releasing anything
- Release the prescription if, in the pharmacist's professional judgment, it is in the patient's best interest
- Release it only if he can show they share the same insurance plan
Show answer
Correct answer: Release the prescription if, in the pharmacist's professional judgment, it is in the patient's best interest
HIPAA lets a pharmacist use professional judgment and common practice to give a filled prescription to a family member or friend acting on the patient's behalf. No written authorization or advance phone call is required for a routine pickup.
Counter and Drive-Through
At pickup, a patient asks how to take their new blood thinner. Four customers are waiting in line close behind. What should the pharmacist do?
- Counsel the patient using reasonable safeguards, such as stepping to the counseling window or lowering their voice
- Decline to counsel until every other customer has left the store
- Skip verbal counseling and staple written instructions to the bag instead
- Counsel at normal volume, since anything overheard in a retail store is exempt from HIPAA
Show answer
Correct answer: Counsel the patient using reasonable safeguards, such as stepping to the counseling window or lowering their voice
Counseling is part of treatment, and fragments overheard despite reasonable safeguards are permitted incidental disclosures. Moving a step away or lowering your voice is the safeguard HIPAA expects, not silence or refusal.
Counter and Drive-Through
A technician notices that customers leaning over the counter can read patient names and drug names on bags in the will-call bins. What is the right response?
- Nothing needs to change, because the bins are behind the counter
- Report it to HHS as a breach affecting every patient with a bag in will-call
- Keep patient names visible for speed but cover only the drug names
- Reposition or shield the bins so labels are not readable from the customer side
Show answer
Correct answer: Reposition or shield the bins so labels are not readable from the customer side
Will-call storage is fine, but reasonable safeguards require keeping labels out of public view. Turning bags around, angling shelves, or adding a screen corrects the exposure; it is a safeguards problem to fix, not automatically a reportable breach.
PHI Basics
Which of the following is protected health information (PHI) under HIPAA?
- A patient's first name stored next to their appointment diagnosis
- A hospital's published main phone number
- A fully de-identified research dataset with no identifiers
- A generic brochure about flu season
Show answer
Correct answer: A patient's first name stored next to their appointment diagnosis
PHI is individually identifiable health information transmitted or maintained by a covered entity or business associate, subject to the exclusions in 45 CFR 160.103. A name tied to a diagnosis identifies the person and reveals health information, so it qualifies.
PHI Basics
Which set of data points are all HIPAA identifiers that can make health information individually identifiable?
- Favorite color, shoe size, and zodiac sign
- Full name, medical record number, and email address
- Weather, traffic data, and store hours
- Stock prices, exchange rates, and tax brackets
Show answer
Correct answer: Full name, medical record number, and email address
HIPAA lists 18 identifiers including names, medical record numbers, and email addresses. When any of these are linked to health information, the data becomes PHI.
FAQ
HIPAA questions pharmacy teams actually ask
Can a family member or friend pick up someone else's prescription?
Yes. HIPAA allows pharmacists to use professional judgment to release a filled prescription to a family member or friend acting on the patient's behalf, which is routine practice at every pharmacy counter. You do not need a written authorization or a signed form for an ordinary pickup. If something seems off, such as a family conflict the patient has warned you about, you can still decline and contact the patient directly.
Is it a HIPAA violation if a customer overhears counseling at the counter?
Not automatically. HIPAA permits incidental disclosures that happen despite reasonable safeguards, such as lowered voices, a separate counseling window, or a stand-back line for waiting customers. The rule expects reasonableness, not soundproof booths. Problems arise when no safeguards are used at all, like announcing a patient's medication across the store.
Are refill reminders considered marketing under HIPAA?
No. Refill reminders and communications about a drug the patient is currently prescribed are excluded from the definition of marketing, even if a manufacturer pays the pharmacy, as long as the payment is limited to the reasonable cost of sending them. Switch communications promoting a different product in exchange for payment are treated differently: those are marketing and require patient authorization.
Do pharmacy technicians need HIPAA training, or just pharmacists?
Every workforce member of a covered pharmacy needs training, including technicians, clerks who run the register, and delivery drivers. Technicians often touch more PHI than anyone else through refill calls, pickup verification, insurance questions, and will-call management. Training must happen within a reasonable period after a person joins and again when a material policy change affects their job.
Keep going
HIPAA resources for pharmacy teams
Guide
HIPAA Training for Pharmacists
Role-specific HIPAA certification covering prescriptions, medication counseling, and pharmacy data privacy.
Read moreGuide
HIPAA Training for Pharmacy Technicians
Training built around refill calls, pickup verification, insurance questions, and shared pharmacy systems.
Read moreGuide
HIPAA Training for Pharmacies
Compliance training for retail and clinical pharmacies, from refill workflows to patient counseling.
Read moreWant the broadest version? Take the general HIPAA practice test with the full 40-question pool.
From practice to proof