C801 is Health Information Law and Regulations, listed at WGU as HIM 2215 and worth four competency units. It covers managing health information in line with legal requirements and responding to the ethical dilemmas and legal challenges that arise in health information management. The course looks like memorization and is not. Almost every scored question and every task in this subject is a variation of one structure: somebody wants information, there is a rule about whether they can have it, there is usually an exception, and whatever happens has to be documented. Learn to answer in that shape and the material stops being a pile of regulations.
Rule, exception, authority, record
Take a request from a law enforcement officer for a patient's record. The untrained answer is a guess about whether police can have it. The trained answer names the rule that protects the information, identifies the specific circumstance that might permit disclosure, states what the requester must produce for that circumstance to apply, and then says what the organization writes down about the disclosure afterwards.
That fourth step is the one students leave out, and it is often its own scored point. Health information work is accountable work. Access is logged, disclosures are tracked, authorizations are retained, and the ability to show what happened is part of complying rather than an afterthought.
The other habit worth building early is separating the three kinds of permission that people confuse constantly. Consent for treatment is not authorization to disclose. Authorization to disclose is not the same as a permitted disclosure that requires no authorization. And a subpoena, a court order and a warrant are different instruments with different weight. Getting those distinctions straight is most of the difficulty in this course, and once they are straight the answers become predictable.
Building a section plan when the aspects are legal
Scored aspect detail for your course lives in the Course of Study, not the catalog, and each aspect is judged on its own with a two required to pass. In this subject the aspects usually run in pairs: one asks what the law requires, the next asks how you would apply it to a scenario. Answer them separately even where they feel like one thought.
The word budget, worked. Suppose a task of about 1,600 words with eight scored aspects. Take 100 for a short scenario summary, leaving 1,500, or roughly 187 per aspect flat. Legal writing compresses well when it is structured, so aspects asking you to identify a rule can run at 120 words: name the rule, cite it, state the requirement. Aspects asking you to apply the rule to facts need 260, because application means walking through each element and saying whether the facts satisfy it. Four identify aspects at 120 and four apply aspects at 260 totals 1,520, which is close enough to trim from the scenario summary. That arithmetic also tells you something useful: if you are writing 400 words on the history of a regulation, those words came out of an application section.
Write the citation into the sentence as you draft, not afterwards. Retrofitting citations to legal claims is slow, and it is how students end up citing a general overview page for a specific requirement.
A response structure for a records request scenario
Where your task supplies a template, use it. Where it does not, this arrangement answers the way a health information professional actually answers, and it maps cleanly onto how the aspects tend to be written.
| Step | What you write | What it earns |
|---|---|---|
| Identify the request | Who is asking, for what, about whom, and in what capacity | Frames every rule that follows |
| Classify the information | Whether it is protected, and whether any category has extra protection | Prevents a general answer to a special category question |
| State the rule | The governing requirement with its source cited | The accuracy point most often missed |
| Check for an exception | Permitted disclosures, required disclosures, or none applies | The reasoning point that separates strong answers |
| Verify the requester | What identity or authority documentation is needed | Frequently a separate scored element |
| Determine the minimum | The least information that satisfies the purpose | Shows command of a principle, not just a rule |
| Document | What is logged, retained or tracked, and for how long | The step students omit most often |
| Escalate if unclear | When privacy officer or counsel is involved | The professionally correct answer to a genuinely hard case |
Special categories deserve their own note. Substance use disorder records, mental health information, genetic information and minors' records often carry additional restrictions that vary by law and by state, and an answer that applies only the general rule to one of those will be marked as incomplete.
Evidence craft in a regulatory subject
Unsupported legal statements are the easiest thing in this course to write and the easiest to lose points for.
- Cite the regulation or the issuing agency's own guidance rather than a summary article, and quote sparingly.
- Name the jurisdiction whenever state law is involved. Retention periods, minor consent rules and access to certain record types differ by state, and a national answer to a state question is wrong.
- Distinguish what is required from what is permitted from what is prohibited. Those three words carry the whole subject and using them loosely reads as uncertainty.
- Keep the legal health record concept straight, since what an organization discloses is defined by policy within legal limits, not by whatever exists in the system.
- Use professional association ethical guidance where an aspect asks about ethics rather than about law, and treat it as a different source type.
- Follow APA and cite at the sentence carrying the claim.
The professional habit that also scores: say where your answer ends. Writing that the request appears to fall outside permitted disclosures and would be referred to the privacy officer before any release is not a hedge. It is what a health information technician is trained to do, and aspects about handling difficult requests are frequently looking for exactly that step.
What separates Competent from a submission sent back
The common returns are predictable. A rule stated with no source. A scenario answered generally when the information was a special category. An answer that permits or refuses disclosure without addressing verification of the requester. And the missing documentation step, which costs a point on almost every scenario that includes it.
Work that passes on the first read follows the same order every time: request, classification, rule, exception, verification, minimum necessary, documentation, escalation. Repetition of that order across a task is a feature rather than a weakness, because it makes each aspect easy to find and easy to award.
Revision and resubmission of performance assessment work carries no grade penalty at WGU, so the price of a return is calendar time inside a six month flat rate term. In this course a return usually names one scenario, which is quick to rebuild if your answers were structured rather than written as flowing paragraphs.
Where your plan includes a proctored objective assessment for this course, our support is preparation only. We build the study plan, drill the distinctions this subject turns on and give an honest readiness call. We never sit or assist during any proctored assessment and we never ask for portal credentials.
Six mistakes that cost time in C801
- Confusing consent with authorization. They are different documents with different scopes, and mixing them changes the answer.
- Treating a subpoena like a court order. The instrument determines what the organization may release and what it must verify first.
- Ignoring special categories. Substance use, behavioral health, genetic and minors' records frequently carry additional restrictions.
- Skipping verification. Confirming who the requester is and what authority they hold is a step, not an assumption.
- Releasing the whole record. The minimum necessary principle applies to most disclosures and is often scored explicitly.
- No documentation step. Accounting, logging and retention are part of the answer and take one sentence each.
How we work this course with you
Send the task directions and your rubric and you get an answer template built on the eight step order above, a distinction sheet covering consent, authorization, permitted disclosure and legal process so the vocabulary stops slipping, and a section plan with word counts against your scored aspects. On review we check each answer for a cited rule, a verification step and a documentation step, which are the three most commonly missing pieces.
Questions C801 students ask
Do I need to memorize regulation numbers?
How do I answer a scenario where the law seems unclear?
Is this course mostly about one federal privacy rule?
Working C801 scenarios?
Send the HIM 2215 directions. You get an answer template, a distinction sheet and a section plan back.
Where C801 sits in WGU's programs
The July 2026 catalog places this code in 1 current WGU program. Open a program page for the complete standard path and term positions. The live Degree Plan remains authoritative after transfer credit, substitutions, and mentor planning.
The assessments, one by one
The public catalog does not publish this course's PA/OA identity or task count. WGU Tutors publishes at most one PA manual per course and only from a WGU-controlled public rubric. Until that source exists, PA help begins from the student's real Course of Study and OA support remains preparation only.