AAMA HIPAA and Scope of Practice 3 — Questions and Answers
Question 1: Which of the following best describes the medical assistant's scope of practice?
- Tasks defined solely by the medical assistant's personal judgment
- Tasks authorized by state law, employer policy, and physician delegation (Correct answer)
- Any clinical task the physician verbally approves in the moment
- Tasks limited to administrative duties only
Correct answer: Tasks authorized by state law, employer policy, and physician delegation
Scope of practice for medical assistants is defined by state statutes, employer policies, and the supervising physician's delegation.
Question 2: A medical assistant is asked to perform a task that is outside their training. The correct response is to:
- Attempt the task and ask questions afterward
- Refuse and report the request to the supervising physician (Correct answer)
- Perform the task if a colleague demonstrates it first
- Decline only if the patient objects
Correct answer: Refuse and report the request to the supervising physician
Performing tasks outside one's training endangers patient safety; the medical assistant must decline and notify the supervisor.
Question 3: Under HIPAA, which of the following is NOT considered protected health information (PHI)?
- A patient's diagnosis linked to their name
- De-identified health data with all 18 identifiers removed (Correct answer)
- A patient's appointment date linked to their address
- A patient's prescription linked to their date of birth
Correct answer: De-identified health data with all 18 identifiers removed
Data is not PHI once all 18 HIPAA identifiers have been removed through proper de-identification methods.
Question 4: A medical assistant who administers medication without a valid order from a licensed provider is:
- Acting within scope if the medication is over-the-counter
- Practicing outside their scope of practice (Correct answer)
- Permitted if the patient provides written consent
- Compliant if the action is documented in the chart
Correct answer: Practicing outside their scope of practice
Administering medication requires a valid physician order; doing so without one exceeds the medical assistant's scope of practice.
Question 5: HIPAA's Security Rule specifically applies to:
- All forms of PHI including verbal and paper
- Electronic PHI (ePHI) only (Correct answer)
- Paper records stored offsite only
- Verbal communications between providers
Correct answer: Electronic PHI (ePHI) only
The HIPAA Security Rule applies exclusively to electronic protected health information (ePHI).
Question 6: A patient verbally revokes a previously signed authorization for release of records. The medical assistant should:
- Honor the revocation only if it is submitted in writing
- Continue releasing records until the next appointment
- Stop releasing records and document the revocation (Correct answer)
- Inform the requesting party and continue releasing records
Correct answer: Stop releasing records and document the revocation
Patients have the right to revoke an authorization at any time; the medical assistant must stop disclosures and document the revocation.
Question 7: Which action demonstrates proper HIPAA compliance when using a computer workstation?
- Sharing login credentials with trusted colleagues to save time
- Logging off or locking the screen when stepping away (Correct answer)
- Keeping the screen visible to patients for transparency
- Using the same password for multiple healthcare applications
Correct answer: Logging off or locking the screen when stepping away
Locking or logging off the workstation when unattended prevents unauthorized access to ePHI and is required by the Security Rule.
AAMA HIPAA and Scope of Practice 3
Which of the following best describes the medical assistant's scope of practice?