Learn HIPAA vocabulary for healthcare IT: PHI, covered entities, BAA, de-identification, and security rule terms.
0 / 15 completed
1 / 15
PHI (Protected Health Information) includes:
PHI is any health information that identifies an individual and relates to their health status, treatment, or payment — if combined with 18 types of identifiers (name, DOB, zip, etc.).
2 / 15
A Business Associate Agreement (BAA) is required when:
A BAA is a legal contract required by HIPAA when a covered entity (hospital, insurance) shares PHI with a business associate (cloud provider, billing service) that handles PHI on their behalf.
3 / 15
HIPAA de-identification of data requires:
HIPAA Safe Harbor de-identification removes all 18 specified identifiers (name, DOB, geographic data smaller than state, SSN, etc.) — de-identified data is no longer PHI.
4 / 15
HIPAA's Security Rule applies to:
The HIPAA Security Rule specifically applies to ePHI — it requires covered entities to implement administrative, physical, and technical safeguards to protect electronic health information.
5 / 15
Which is an example of a HIPAA technical safeguard?
Technical safeguards include audit controls, access controls, encryption, and authentication. Audit logging tracks access to ePHI — a core HIPAA technical requirement.
6 / 15
Code Review Comment: During a code review of the new patient onboarding module, Sarah flagged this line:
patient.address = data['address'];
Sarah's comment states: 'This doesn't explicitly handle potential PHI within the address field – we need to ensure it aligns with HIPAA guidelines.' Which of the following best describes Sarah's concern?
Sarah's comment correctly identifies a potential HIPAA violation. Simply assigning data from an external source without considering its sensitivity is a key risk. Data minimization—only collecting and retaining the minimum necessary information—is a core HIPAA principle. The incorrect options focus on performance or outdated APIs, which are unrelated to PHI protection.
7 / 15
Slack Message: John from the security team sent this message to the development team:
'We've received a notification that a developer recently accessed patient records without a valid business need. Please review your access controls and ensure you're only accessing data required for your tasks.'
What does this Slack message primarily highlight regarding HIPAA compliance?
This Slack message directly addresses the risk of unauthorized access to PHI. BAAs are crucial documents that define responsibilities when handling PHI and establish a legitimate business necessity for accessing it. The other options represent unrelated concerns – speed, authentication, or database problems—and don't reflect the core issue raised by the notification.
8 / 15
API Response: The following is an example response from a patient data API after a request for demographic information:
{
"patientId": "12345",
"firstName": "John",
"lastName": "Doe",
"dateOfBirth": "1980-03-15",
"address": "1600 Amphitheatre Parkway, Mountain View, CA 94043"
}
Considering HIPAA regulations, what is the most significant concern regarding this API response?
The address field contains Personally Identifiable Information (PII), which falls under the definition of PHI. While masking or redaction might be necessary depending on the context and usage, the primary concern highlighted by HIPAA is the potential for this information to be considered protected health data. The other options relate to data structure or formatting issues, not direct PHI exposure.
9 / 15
PR Description: A developer submitted the following PR description for a change that updates the patient registration form:
'This commit adds a new field to collect patients' preferred pronouns. This will improve our patient experience and help us provide more personalized care.'
From a HIPAA perspective, how should this PR description be evaluated?
Collecting 'preferred pronouns' can be considered PHI under HIPAA because it relates directly to an individual's protected health information. The developer needs to demonstrate that this collection aligns with legitimate business purposes and implement appropriate safeguards (e.g., data minimization, access controls) to protect the data. The other options present overly restrictive or incorrect interpretations of HIPAA requirements.
10 / 15
Standup Update: During the daily stand-up meeting, Mark said: 'I'm working on implementing a new feature that allows doctors to view patient lab results directly within our system.'
Which of the following is the MOST relevant HIPAA consideration for Mark's update?
Accessing patient lab results inherently involves handling PHI. Mark needs to evaluate the scope of data being accessed, determine if it falls under HIPAA's definition of protected health information, and then implement appropriate safeguards—such as access controls limiting who can view the data and audit trails tracking access—to ensure compliance. The other options focus on unrelated development concerns.
11 / 15
Code Review Comment: During a code review of the new patient onboarding module, Sarah flagged this line:
patient.address = data['address'];
Sarah's comment states: 'This doesn't explicitly handle potential PHI within the address field – we need to ensure it aligns with HIPAA guidelines.' Which of the following best describes Sarah's concern?
Sarah's comment correctly identifies a potential HIPAA violation. Simply assigning data from an external source without considering its sensitivity is a key risk. Data minimization—only collecting and retaining the minimum necessary information—is a core HIPAA principle. The incorrect options focus on performance or outdated APIs, which are unrelated to PHI protection.
12 / 15
Slack Message: John from the security team sent this message to the development team:
'We've received a notification that a developer recently accessed patient records without a valid business need. Please review your access controls and ensure you're only accessing data required for your tasks.'
What does this Slack message primarily highlight regarding HIPAA compliance?
This Slack message directly addresses the risk of unauthorized access to PHI. BAAs are crucial documents that define responsibilities when handling PHI and establish a legitimate business necessity for accessing it. The other options represent unrelated concerns – speed, authentication, or database problems—and don't reflect the core issue raised by the notification.
13 / 15
API Response: The following is an example response from a patient data API after a request for demographic information:
{
"patientId": "12345",
"firstName": "John",
"lastName": "Doe",
"dateOfBirth": "1980-03-15",
"address": "1600 Amphitheatre Parkway, Mountain View, CA 94043"
}
Considering HIPAA regulations, what is the most significant concern regarding this API response?
The address field contains Personally Identifiable Information (PII), which falls under the definition of PHI. While masking or redaction might be necessary depending on the context and usage, the primary concern highlighted by HIPAA is the potential for this information to be considered protected health data. The other options relate to data structure or formatting issues, not direct PHI exposure.
14 / 15
PR Description: A developer submitted the following PR description for a change that updates the patient registration form:
'This commit adds a new field to collect patients' preferred pronouns. This will improve our patient experience and help us provide more personalized care.'
From a HIPAA perspective, how should this PR description be evaluated?
Collecting 'preferred pronouns' can be considered PHI under HIPAA because it relates directly to an individual's protected health information. The developer needs to demonstrate that this collection aligns with legitimate business purposes and implement appropriate safeguards (e.g., data minimization, access controls) to protect the data. The other options present overly restrictive or incorrect interpretations of HIPAA requirements.
15 / 15
Standup Update: During the daily stand-up meeting, Mark said: 'I'm working on implementing a new feature that allows doctors to view patient lab results directly within our system.'
Which of the following is the MOST relevant HIPAA consideration for Mark's update?
Accessing patient lab results inherently involves handling PHI. Mark needs to evaluate the scope of data being accessed, determine if it falls under HIPAA's definition of protected health information, and then implement appropriate safeguards—such as access controls limiting who can view the data and audit trails tracking access—to ensure compliance. The other options focus on unrelated development concerns.
What will I practise in "HIPAA Vocabulary for IT"?
Learn HIPAA vocabulary for healthcare IT: PHI, covered entities, BAA, de-identification, and security rule terms.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Health IT exercises?
Browse the full Health IT hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.