All 10 Questions With Complete Rationales
Prefer to read straight through, or want to review after taking the quiz? Every question, the correct answer, and the reasoning behind it are laid out below.
Question 1
A patient's employer calls the pharmacy asking if the patient is currently taking any medications. Under HIPAA, the pharmacist:
A. May disclose the information if the employer has a legitimate business reason B. May disclose only the drug name but not the diagnosis C. Must not disclose any PHI to the employer without written patient authorization D. May disclose if the patient is currently at the pharmacy counter
✅ Answer: C — Must not disclose any PHI to the employer without written patient authorization
An employer is not a covered entity in a treatment, payment, or healthcare operations (TPO) relationship with the patient's pharmacy. Without explicit written authorization from the patient, the pharmacist must not disclose any protected health information to an employer. Even calling to "verify employment" does not override HIPAA. Workplace drug testing programs have their own specific regulatory framework separate from HIPAA.
Question 2
A law enforcement officer presents a court order requiring disclosure of a patient's controlled substance dispensing records. Under HIPAA, the pharmacist:
A. Must refuse — court orders do not override HIPAA B. May disclose PHI as required by the court order C. Must contact the DEA before complying with the court order D. May only disclose if the patient gives verbal consent
✅ Answer: B — May disclose PHI as required by the court order
HIPAA specifically permits disclosure of PHI to comply with a court order or legal process. This is a recognized exception to the authorization requirement. The pharmacist should disclose only the minimum PHI specified or required by the court order (minimum necessary standard applies). A court order is a legally binding directive — the pharmacist must comply.
Question 3
A pharmacist inadvertently leaves a message on a patient's answering machine stating the name of the medication ready for pickup. Under HIPAA, this is:
A. Always a HIPAA violation requiring breach notification B. Acceptable if the patient has not previously indicated a preference for how to be contacted C. A criminal violation of HIPAA D. Always a violation if the medication name is disclosed
✅ Answer: B — Acceptable if the patient has not previously indicated a preference for how to be contacted
Incidental disclosures (like leaving a message on an answering machine) are not HIPAA violations if the covered entity has implemented reasonable safeguards. Pharmacies may leave messages with medication information if no alternative has been specifically requested. However, if the patient has indicated a preference (e.g., "call my cell only" or "do not leave a message"), the pharmacy must honor that request under the Right to Confidential Communications.
Question 4
Under HIPAA, the "minimum necessary" standard applies to which of the following disclosures?
A. Disclosures for treatment purposes to another treating provider B. Disclosures to the patient themselves C. All disclosures except those required by law D. Disclosures for payment purposes (insurance billing)
✅ Answer: D — Disclosures for payment purposes (insurance billing)
The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI disclosure to the minimum needed to accomplish the purpose. It applies to most disclosures EXCEPT: (1) Disclosures for treatment (to other treating providers), (2) Disclosures to the patient themselves, (3) Disclosures authorized by the patient, and (4) Disclosures required by law. Disclosures for payment (insurance billing) DO require applying the minimum necessary standard.
Question 5
A pharmacy experiences a data breach affecting 600 patients when an unencrypted laptop is stolen. Under HIPAA Breach Notification Rule, the pharmacy must notify:
A. Only the affected patients within 30 days B. Affected patients and HHS within 60 days only C. Affected patients, HHS, and prominent media outlets in the affected state within 60 days D. Only HHS; patient notification is optional
✅ Answer: C — Affected patients, HHS, and prominent media outlets in the affected state within 60 days
When a breach affects 500 or more individuals in a state or jurisdiction, HIPAA requires: (1) Notify affected individuals within 60 days of discovery; (2) Notify HHS within 60 days of discovery; (3) Notify prominent media outlets serving the affected state or jurisdiction within 60 days. For breaches affecting fewer than 500 individuals, HHS notification may be deferred to an annual log submitted no later than 60 days after the end of the calendar year.
Question 6
Under HIPAA, a patient requests access to their pharmacy dispensing records. Within how many days must the pharmacy respond?
A. 15 calendar days B. 30 calendar days (with one 30-day extension possible) C. 45 calendar days D. 60 calendar days
✅ Answer: B — 30 calendar days (with one 30-day extension possible)
HIPAA gives individuals the right to access their PHI, and covered entities must respond within 30 calendar days of receipt of the request. One 30-day extension is permitted if the pharmacy notifies the patient in writing before the initial 30-day period expires, stating the reason for the delay and when the pharmacy expects to fulfill the request. The pharmacy may charge a reasonable cost-based fee for producing copies.
Question 7
A pharmacist is asked to disclose a patient's PHI for a research study at a local university. Under HIPAA, this disclosure:
A. Always requires written patient authorization B. May occur without authorization if the IRB grants a waiver of authorization C. Is always prohibited without patient consent D. Requires DEA approval before proceeding
✅ Answer: B — May occur without authorization if the IRB grants a waiver of authorization
PHI may be disclosed for research purposes without individual authorization if an Institutional Review Board (IRB) or Privacy Board grants a waiver of authorization, provided the research meets specific criteria (including that it cannot practicably be conducted without the waiver). Research may also proceed with properly de-identified data (which is no longer PHI) or with explicit patient authorization. HIPAA does not completely prohibit research use of PHI.
Question 8
Which of the following is protected by 42 CFR Part 2 (in addition to HIPAA) and requires special authorization even for treatment purposes?
A. HIV/AIDS treatment records B. Substance use disorder treatment records C. Mental health therapy records D. Cardiovascular disease treatment records
✅ Answer: B — Substance use disorder treatment records
42 CFR Part 2 provides additional protections beyond HIPAA for records related to substance use disorder (alcohol and drug) treatment at federally-assisted programs. Unlike HIPAA, which permits disclosure for treatment without authorization, 42 CFR Part 2 requires explicit written patient consent even for disclosure to other treating providers (with narrow exceptions for medical emergencies). This is a frequently tested MPJE topic because the rule is stricter than HIPAA.
Question 9
A pharmacist receives a fax from a physician's office that was clearly sent to the wrong pharmacy — it contains another patient's PHI. Under HIPAA, the pharmacist should:
A. Keep the fax for future reference in case it is needed B. Destroy or return the fax and notify the sender of the error; do not use the PHI C. Use the PHI to contact the patient and direct them to the correct pharmacy D. Report the incident to law enforcement immediately
✅ Answer: B — Destroy or return the fax and notify the sender of the error; do not use the PHI
When PHI is received in error, the pharmacist should: (1) not review, use, or disclose the information beyond what is necessary to handle the error; (2) notify the sending covered entity of the error; and (3) destroy or return the misdirected PHI if requested. Using the PHI (even to help the patient) exceeds what HIPAA authorizes when the pharmacy is not involved in that patient's care.
Question 10
A patient's adult child accompanies the patient to the pharmacy and asks the pharmacist to explain the patient's medications. The patient is present and does not object. Under HIPAA, the pharmacist:
A. Must refuse — only the patient can receive medication information B. May provide information using professional judgment, since the patient is present and does not object C. Must obtain written authorization before speaking with the family member D. May provide information only if the adult child is listed as the patient's legal representative
✅ Answer: B — May provide information using professional judgment, since the patient is present and does not object
HIPAA permits disclosure of PHI to family members or others involved in the patient's care when the patient is present and does not object, or when the pharmacist can infer from the circumstances that the patient would not object. The patient being present and not objecting is sufficient authorization. Written authorization or legal representative status is not required in this situation.
📌 How to use these
Answer each question before reading the rationale, and treat "right but unsure" as wrong. The rationale matters more than the answer — if you cannot explain why the other three options fail, you have not learned the rule yet. Ready for more? Work through the other free quizzes or the pharmacy law cheat sheet.