20 Safety, Privacy, Records & Risk Practice Questions & Answers

1. 1. An OSHA inspector observes a serious hazard for which no specific OSHA standard exists. Under what authority can the employer still be cited?

   • A.The injury and illness recordkeeping rule, which requires a log of work-related cases at the establishment
   • B.The general duty clause, which requires a workplace free of recognized hazards likely to cause serious harm✓ Answer
   • C.The hazard communication standard, which requires chemical labels and accessible safety data sheets on site
   • D.The anti-retaliation provision, which protects employees who raise safety concerns with their own employer

   When no specific standard covers the hazard, OSHA cites the general duty clause, because the OSH Act obligates every covered employer to furnish a workplace free from recognized hazards likely to cause death or serious physical harm. It is the usual basis for citations involving workplace violence, ergonomics, and heat.

   Source: OSH Act of 1970, Section 5(a)(1) (general duty clause)Report a problem with this question

2. 2. Which statement correctly distinguishes OSHA recordkeeping from OSHA reporting?

   • A.Recordkeeping means keeping chemical safety data sheets available on every shift; reporting means sending the annual summary to OSHA for review
   • B.Recordkeeping means entering qualifying cases on the employer's injury log; reporting means notifying OSHA of a fatality or severe injury✓ Answer
   • C.Recordkeeping means filing each case with the state workers' compensation carrier; reporting means telling the injured employee's own supervisor
   • D.Recordkeeping means notifying OSHA of every injury treated by a physician; reporting means posting the annual summary for employees to read

   Recordkeeping is internal and continuous: qualifying work-related injuries and illnesses go on the employer's own log and annual summary, which is posted where employees can see it. Reporting is external and event-driven: the employer must notify OSHA directly of a work-related fatality, in-patient hospitalization, amputation, or loss of an eye.

   Source: OSHA injury and illness recordkeeping and reporting rule, 29 CFR Part 1904Report a problem with this question

3. 3. Which of the following is an employee right under the Occupational Safety and Health Act?

   • A.Asking OSHA to inspect the workplace, with the employee's identity withheld from the employer✓ Answer
   • B.Collecting a share of whatever monetary penalty OSHA assesses against the employer for a violation
   • C.Refusing any assigned task the employee finds unpleasant, without giving the employer a reason
   • D.Negotiating privately with OSHA to have a citation removed from the employer's inspection record

   The OSH Act gives employees the right to request an inspection and to have their name kept off the complaint shown to the employer, to have a representative accompany the walkaround, to review the injury log, and to be free from retaliation for exercising those rights.

   Source: OSH Act of 1970, Sections 8(f) and 11(c) (employee rights and anti-retaliation)Report a problem with this question

4. 4. Flying metal chips from a machine are striking operators. Under the hierarchy of controls, which of these options is the strongest?

   • A.Issuing goggles and a face shield to each operator who is assigned to run the machine
   • B.Posting a work rule telling operators to stand to one side of the machine while cutting
   • C.Rotating operators so that no single person runs the machine for an entire work shift
   • D.Installing a guard on the machine so that the chips cannot reach the operator at all✓ Answer

   The hierarchy ranks controls by how reliably they work: elimination, substitution, engineering controls, administrative controls, and personal protective equipment last. A guard is an engineering control that removes the exposure regardless of behavior, while goggles depend on each worker wearing them correctly every time.

   Source: OSHA and NIOSH hierarchy of controlsReport a problem with this question

5. 5. What does the Drug-Free Workplace Act require of a covered federal contractor?

   • A.Discharging any employee whose off-duty drug use is reported by a coworker or a shift supervisor
   • B.Publishing a written policy against drug activity at work and running an employee awareness program✓ Answer
   • C.Testing every job applicant for controlled substances before any offer of employment is extended
   • D.Testing the whole workforce at random intervals during each year the federal contract remains open

   The Act is a policy-and-education statute, not a testing statute. Covered contractors and grantees must publish a policy prohibiting drug activity in the workplace, notify employees, establish a drug-free awareness program, and require employees to report a workplace drug conviction; drug testing is not mandated.

   Source: Drug-Free Workplace Act of 1988 (41 U.S.C. Chapter 81)Report a problem with this question

6. 6. Where must an employer keep the medical information it receives with an employee's accommodation request?

   • A.In the supervisor's departmental records, so that the manager can track the accommodation day to day
   • B.In the benefits enrollment file, because medical details belong with the group health plan's own paperwork
   • C.In the confidential medical file, kept apart from the personnel file and seen only as needed✓ Answer
   • D.In the general personnel file, because the accommodation changes how the employee's own job is performed

   The ADA requires medical information about applicants and employees to be collected on separate forms and kept in a separate, confidential file. Supervisors may be told only what restrictions or accommodations apply, and first-aid and safety staff may be told what is needed for treatment or evacuation.

   Source: Americans with Disabilities Act, confidentiality of medical information (42 U.S.C. 12112(d))Report a problem with this question

7. 7. An HR coordinator believes HIPAA stops her from telling a supervisor about an employee's lifting restriction. Which statement about HIPAA is accurate?

   • A.Its privacy rule covers health information held by the group health plan and providers, not employer records✓ Answer
   • B.Its privacy rule covers every piece of health information an employer learns about any one of its employees
   • C.Its privacy rule applies to an employer only in the case where that employer self-insures its health plan
   • D.Its privacy rule keeps a supervisor from ever being told that an employee is working under a restriction

   An employer acting as an employer is not a HIPAA covered entity; the group health plan, health care providers, and clearinghouses are. Employment records held by HR, including accommodation notes and leave certifications, are protected by the ADA and similar laws rather than by HIPAA.

   Source: HIPAA Privacy Rule, 45 CFR Parts 160 and 164 (covered entities; employment records excluded)Report a problem with this question

8. 8. Sarbanes-Oxley whistleblower protection covers an employee of a publicly traded company who does which of the following?

   • A.Reports a disagreement about a performance rating to the company's human resource department
   • B.Reports an unguarded machine on the production floor to the site's own joint safety committee
   • C.Reports suspected securities fraud or accounting irregularities to management or to a regulator✓ Answer
   • D.Reports a coworker's repeated tardiness to the department manager during an unusually busy quarter

   Sarbanes-Oxley protects employees of public companies who report conduct they reasonably believe violates securities law or defrauds shareholders, and it requires an anonymous channel for such complaints to reach the audit committee. Other kinds of complaints may be protected by different laws, but not by this one.

   Source: Sarbanes-Oxley Act of 2002, Sections 806 and 301Report a problem with this question

9. 9. A supervisor tells an employee that her promotion depends on accepting his repeated dinner invitations. Which concept does this describe?

   • A.Quid pro quo harassment, because a job benefit is conditioned on submitting to sexual conduct✓ Answer
   • B.Retaliation, because the employee's working conditions became worse after she reported a concern
   • C.Hostile work environment harassment, because conduct that is severe or pervasive altered the workplace
   • D.Disparate impact, because a neutral rule fell more heavily on one protected group than on others

   Quid pro quo means this for that: a tangible job benefit or detriment is tied to submission to sexual conduct by someone with authority over the employee. A hostile work environment instead rests on unwelcome conduct severe or pervasive enough to alter the conditions of employment.

   Source: Title VII of the Civil Rights Act of 1964; EEOC guidance on harassmentReport a problem with this question

10. 10. An employee reports that a coworker is harassing her. What should HR do first?

    • A.Open a prompt and impartial investigation and document each step that is taken✓ Answer
    • B.Ask the employee to raise the matter with the coworker herself and then report back
    • C.Wait to see whether a second employee reports the same coworker's behavior as well
    • D.Move the employee who complained to a different shift while the matter is reviewed

    An employer's defense to a harassment claim depends on showing it took reasonable care to prevent harassment and to correct it promptly. A prompt, impartial, documented investigation protects the person who complained, preserves reliable evidence, and avoids retaliation, which transferring the complainant can itself create.

    Source: EEOC enforcement guidance on employer liability for harassment (Faragher and Ellerth defense)Report a problem with this question

11. 11. Which element belongs in a written emergency action plan?

    • A.A summary of the workers' compensation claims filed at the site last year
    • B.A schedule of the yearly performance reviews for the safety committee members
    • C.A list of the vendors that supply protective equipment to the work location
    • D.A procedure for accounting for all employees once the evacuation is complete✓ Answer

    An emergency action plan must cover how emergencies are reported, evacuation procedures and exit route assignments, procedures for employees who stay to run critical operations, accounting for all employees after evacuation, rescue and medical duties, and whom to contact with questions about the plan.

    Source: OSHA emergency action plans standard, 29 CFR 1910.38Report a problem with this question

12. 12. Which behavior should supervisors be trained to report under a workplace violence prevention program?

    • A.An escalating pattern of threats, intimidation, or talk of revenge against coworkers✓ Answer
    • B.A request to change shifts so the employee can care for a family member who is ill
    • C.A habit of taking accrued vacation in single days rather than in complete weeks
    • D.A preference for eating lunch alone instead of with the rest of the work group

    Prevention programs train supervisors to report observable, escalating conduct such as threats, intimidation, harassment, references to weapons, or talk of revenge, and to route it to a threat assessment team. Because no OSHA standard covers workplace violence, employers are held to the general duty clause.

    Source: OSHA guidance on workplace violence prevention; OSH Act Section 5(a)(1)Report a problem with this question

13. 13. How does a business continuity plan differ from a disaster recovery plan?

    • A.Continuity governs statements made to the news media; recovery governs evacuation of the building
    • B.Continuity lists the employees eligible for severance; recovery lists the equipment to be replaced
    • C.Continuity keeps critical business functions operating; recovery restores information systems and data✓ Answer
    • D.Continuity restores information systems and data; recovery keeps critical business functions operating

    A business continuity plan keeps critical functions running through a disruption and is built from a business impact analysis, while a disaster recovery plan is the information technology piece that restores systems and data. An emergency action plan handles life safety in the moment, and crisis management handles command and communication.

    Source: HRCI aPHR Exam Content Outline, Compliance and Risk Management (risk assessment and mitigation)Report a problem with this question

14. 14. An employee with access to confidential personnel data resigns. What should HR make sure happens on the final day?

    • A.The signed confidentiality agreement is treated as void because the employment has ended
    • B.System accounts and building access are revoked and company property and files are returned✓ Answer
    • C.The departing employee forwards work files to a personal address for future reference
    • D.The manager keeps the departing employee's accounts open in case questions come up later

    Offboarding controls are a core mitigation: revoking system and physical access at separation, recovering equipment, badges, and records, and reminding the employee in writing that confidentiality, trade secret, and intellectual property obligations continue after employment ends.

    Source: HRCI aPHR Exam Content Outline, Compliance and Risk Management (protection of employee data and intellectual property)Report a problem with this question

15. 15. Who should be permitted to view an employee's personnel file?

    • A.People with a legitimate business need, following a documented access procedure✓ Answer
    • B.Any coworker on the employee's team who works on the same client accounts
    • C.Any employee of the organization, since personnel records are internal papers
    • D.Any manager in the organization who is considering that employee for a transfer

    Access to personnel records is limited by need to know and controlled through a written procedure that records who looked at a file and why. Broad internal access creates privacy and discrimination exposure, and an employee's own right to inspect the file depends on the law of the state where that person works.

    Source: HRCI aPHR Exam Content Outline, Compliance and Risk Management (records management, storage, and retention)Report a problem with this question

16. 16. Why do employers commonly store Form I-9 separately from the personnel file?

    • A.So the payroll group can verify each employee's tax withholding choices at year's end
    • B.So a hiring manager can review each employee's citizenship before granting a promotion
    • C.So the forms can be produced for a government inspection without exposing other records✓ Answer
    • D.So the forms can be destroyed as soon as the employee completes a first year of work

    Form I-9 is subject to inspection by federal agencies. Keeping the forms in their own file lets the employer hand over only the I-9s, keeps immigration status information out of everyday personnel decisions, and makes the required retention period much easier to manage.

    Source: Immigration Reform and Control Act; USCIS Handbook for Employers (Form I-9 storage and inspection)Report a problem with this question

17. 17. What is the correct principle for disposing of employee records that have passed their retention period?

    • A.Destroy them whenever storage room is needed, since the retention period has already ended
    • B.Destroy them securely under a written schedule, unless a legal hold requires them to be kept✓ Answer
    • C.Keep every record indefinitely, because destroying an employee record is always a legal risk
    • D.Return them to the former employee, because the records describe that person's own employment

    Records management runs on a written retention and destruction schedule applied consistently, with secure destruction such as shredding so personal data cannot be recovered. A legal hold suspends destruction of anything relevant to a claim or investigation, and destroying held records is itself a serious violation.

    Source: HRCI aPHR Exam Content Outline, Compliance and Risk Management (records management, storage, and retention)Report a problem with this question

18. 18. Which employers are covered by the federal Worker Adjustment and Retraining Notification Act?

    • A.Those with 50 or more employees, whenever a single work location is sold to a different owner
    • B.Those with 100 or more employees, when a plant closing or mass layoff meets the Act's size tests✓ Answer
    • C.Those with 20 or more employees, whenever an entire department is eliminated in one fiscal year
    • D.Those with 15 or more employees, whenever any group of workers is separated at a single work site

    WARN reaches employers with 100 or more employees and is triggered by a covered plant closing or mass layoff that meets the Act's size tests. Written notice goes to the affected employees or their union, the state dislocated worker unit, and the chief elected local official, and several states impose stricter rules.

    Source: Worker Adjustment and Retraining Notification (WARN) Act, 29 U.S.C. 2101 and followingReport a problem with this question

19. 19. How does a furlough differ from a layoff during a downsizing?

    • A.A furlough applies only to exempt salaried employees; a layoff applies only to those who are paid hourly
    • B.A furlough is a temporary unpaid absence that keeps employment intact; a layoff is normally permanent✓ Answer
    • C.A furlough is a permanent separation paid out with severance; a layoff is a temporary absence with recall
    • D.A furlough ends the employer's benefit obligations at once; a layoff leaves every benefit unchanged

    A furlough suspends work temporarily while the employment relationship and usually benefits continue, so employees are expected back; a layoff generally ends employment and can be a COBRA qualifying event. Because an exempt employee who works any part of a workweek must be paid the full salary, exempt furloughs are taken in full-week blocks.

    Source: Fair Labor Standards Act salary basis rule; COBRA qualifying eventsReport a problem with this question

20. 20. A manager hands HR a proposed reduction-in-force list. What should HR do before the list is final?

    • A.Notify the selected employees so that they can appeal the manager's ranking first
    • B.Replace the criteria with length of service alone, which removes all legal exposure
    • C.Confirm with each manager that the list names the people they would prefer to keep
    • D.Check that the criteria are job related and analyze the selections for adverse impact✓ Answer

    Selection must rest on objective, documented, job-related criteria, and HR compares selection rates across protected groups, commonly with the four-fifths rule, to spot adverse impact before decisions are announced. Seniority alone is not automatically safe and can produce disparate impact of its own.

    Source: Uniform Guidelines on Employee Selection Procedures (four-fifths rule); HRCI aPHR Exam Content Outline, Compliance and Risk ManagementReport a problem with this question

Practice questions based on the HRCI aPHR Exam Content Outline and on federal employment law. aPHR and HRCI are marks of the HR Certification Institute; this site is not affiliated with or endorsed by HRCI. Employment law changes and much of it varies by state — this bank tests federal structure and durable HR practice, so confirm the rules in effect where you work, and study the official Exam Content Outline before testing. Based on the HRCI aPHR Exam Content Outline