AHIMA Registered Health Information Administrator Exam — Questions and Answers

Question 1: For each report of care delivered to a patient, the health record entry should include the date along with the provider's name and ________________.

department
supervising physician
discipline (Correct answer)
initials

Correct answer: discipline

For every entry in a patient's health record, it is essential to include the date, the provider's name, and their professional discipline. Identifying the discipline (e.g., physician, registered nurse, physical therapist) clarifies the role and scope of practice of the individual who provided the care or made the entry. This ensures accountability and provides context for the documented information.

Question 2: Under HIPAA's Minimum Necessary Standard, a covered entity must:

Obtain separate authorizations for each data field disclosed
Disclose only the minimum amount of PHI needed to accomplish the intended purpose (Correct answer)
Disclose complete records whenever requested by any provider
Redact all demographic information before any disclosure

Correct answer: Disclose only the minimum amount of PHI needed to accomplish the intended purpose

The Minimum Necessary Standard requires that covered entities make reasonable efforts to limit PHI disclosed to the smallest amount necessary to accomplish the intended purpose.

Question 3: In organizing an instructional session for your team about adopting a benchmarking program, you inform your staff that when an organization employs benchmarking, it is crucial to compare your facility's results to __________________.

facilities within your corporation.
nationally known facilities.
facilities with superior performance. (Correct answer)
larger facilities.

Correct answer: facilities with superior performance.

Benchmarking is a strategic process where an organization compares its performance metrics, processes, and practices to those of the best performers in its industry or other industries. The goal is to identify areas for improvement and adopt 'best practices' from those who excel. Therefore, comparing results to facilities with superior performance provides the most valuable insights for enhancing efficiency and quality.

Question 4: What is a claim denial?

A patient refusing treatment
A doctor denying a referral
A hospital closing a department
An insurance company's refusal to pay for a submitted healthcare claim (Correct answer)

Correct answer: An insurance company's refusal to pay for a submitted healthcare claim

Claim denials occur when insurers refuse payment due to errors, lack of authorization, non-covered services, or insufficient documentation.

Question 5: What is the value of professional certification in HIM?

It replaces the need for education
It is only required for hospital work
It is optional and provides no benefit
It demonstrates competency, enhances career opportunities, and validates knowledge to employers (Correct answer)

Correct answer: It demonstrates competency, enhances career opportunities, and validates knowledge to employers

Certifications like RHIA and RHIT validate expertise and are often required for advancement.

Question 6: What is the timeframe a covered entity has to provide a patient access to their own PHI under the HIPAA Access Rule?

14 calendar days
7 business days
60 calendar days
30 calendar days, with one 30-day extension if needed (Correct answer)

Correct answer: 30 calendar days, with one 30-day extension if needed

HIPAA requires covered entities to provide patient access to PHI within 30 calendar days of the request, with the option of a single 30-day extension with written notice.

Question 7: A patient explicitly prohibits the sharing of their substance abuse treatment records through the HIE. Which federal regulation specifically restricts the disclosure of substance abuse treatment records?

45 CFR Part 170
21 CFR Part 11
HIPAA Privacy Rule (45 CFR Part 164)
42 CFR Part 2 (Correct answer)

Correct answer: 42 CFR Part 2

42 CFR Part 2 imposes stricter confidentiality requirements on substance use disorder treatment records than HIPAA, requiring explicit patient consent for most disclosures.

Question 8: In the United States, the ICD-10-CM diagnosis coding system used for quality reporting and reimbursement is officially maintained by:

CMS and the CDC's National Center for Health Statistics (NCHS) (Correct answer)
AHIMA and the AHA jointly through the Cooperating Parties
AHRQ and The Joint Commission
The American Medical Association (AMA)

Correct answer: CMS and the CDC's National Center for Health Statistics (NCHS)

ICD-10-CM is maintained cooperatively by CMS and the NCHS/CDC in the US, with annual updates coordinated through the ICD-10 Coordination and Maintenance Committee.

Question 9: What is 'severity of illness' (SOI) in the context of clinical documentation and reimbursement?

The number of diagnoses assigned to a case
The patient's pain scale score
A Medicare billing modifier
A measure of the extent of physiologic decompensation or organ system loss of function (Correct answer)

Correct answer: A measure of the extent of physiologic decompensation or organ system loss of function

Severity of illness reflects the degree of physiologic decompensation and is used in all-patient refined DRG (APR-DRG) systems to assess resource needs.

Question 10: What is natural language processing (NLP) in health IT?

A patient communication tool
Technology that extracts structured data from unstructured clinical text like physician notes (Correct answer)
A medical dictionary
A language translation service

Correct answer: Technology that extracts structured data from unstructured clinical text like physician notes

NLP enables computers to analyze and extract meaning from free-text clinical documentation, supporting coding, research, and quality measurement.

Question 11: Failure Mode and Effects Analysis (FMEA) differs from root cause analysis (RCA) primarily because FMEA is:

Conducted only after a sentinel event has already occurred
Mandated by CMS for all Medicare-participating hospitals annually
Used exclusively for medication error prevention programs
A proactive tool that identifies potential failures before they cause harm (Correct answer)

Correct answer: A proactive tool that identifies potential failures before they cause harm

FMEA is a prospective risk assessment tool that systematically evaluates processes to identify where and how they might fail before an actual adverse event occurs.

Question 12: What is the role of a Health Information Management (HIM) professional?

Only managing hospital IT systems
Only answering phone calls
Managing patient health information systems, ensuring data quality, privacy compliance, and proper coding (Correct answer)
Only filing paper records

Correct answer: Managing patient health information systems, ensuring data quality, privacy compliance, and proper coding

HIM professionals oversee health information collection, maintenance, and access, ensuring quality, privacy compliance, and supporting the healthcare organization's data needs.

Question 13: Which element is NOT required in a Business Associate Agreement (BAA)?

Obligation to safeguard PHI
Description of permitted uses of PHI
A flat fee schedule for services rendered (Correct answer)
Requirement to report breaches to the covered entity

Correct answer: A flat fee schedule for services rendered

A BAA must address permitted PHI uses, safeguarding obligations, and breach reporting, but pricing or fee arrangements are contractual business terms, not HIPAA-required BAA elements.

Question 14: What is 'query compliance' in CDI practice?

Adherence to established guidelines ensuring queries are non-leading, clinically supported, and properly documented (Correct answer)
The rate at which physicians respond to queries
The number of queries issued per 100 discharges
The percentage of queries that result in a higher MS-DRG

Correct answer: Adherence to established guidelines ensuring queries are non-leading, clinically supported, and properly documented

Query compliance refers to following established industry guidelines to ensure queries are ethical, non-leading, clinically supported, and appropriately formatted.

Question 15: What is an EOB (Explanation of Benefits)?

A hospital discharge summary
A statement from an insurer showing what was billed, what insurance paid, and what the patient owes (Correct answer)
A medical diagnosis summary
A prescription refill notice

Correct answer: A statement from an insurer showing what was billed, what insurance paid, and what the patient owes

The EOB details the claim processing results: services billed, amounts allowed, insurance payment, adjustments, and the patient's remaining financial responsibility.

Question 16: What is the role of a clinical documentation improvement (CDI) specialist?

To work with physicians to improve documentation accuracy and completeness for proper coding (Correct answer)
To write medical notes for doctors
To conduct patient satisfaction surveys
To manage hospital finances

Correct answer: To work with physicians to improve documentation accuracy and completeness for proper coding

CDI specialists review medical records and collaborate with providers to ensure documentation accurately reflects patient acuity, supporting appropriate coding and reimbursement.

Question 17: A health information manager discovers that a physician has been documenting patient encounters using copy-paste from previous visits without updating clinical findings. This practice primarily raises concern related to:

EMTALA non-compliance
Violation of state licensing standards only
Healthcare fraud, documentation integrity, and potential false claims liability (Correct answer)
HIPAA minimum necessary violations

Correct answer: Healthcare fraud, documentation integrity, and potential false claims liability

Cloning or copy-paste documentation without clinical verification constitutes fraudulent documentation, threatens record integrity, and can create false claims liability under the False Claims Act.

Question 18: What is a DRG (Diagnosis-Related Group)?

A patient classification system that groups similar clinical conditions for hospital payment purposes (Correct answer)
A diagnostic test
A type of drug
A department within a hospital

Correct answer: A patient classification system that groups similar clinical conditions for hospital payment purposes

DRGs classify hospital inpatients into groups based on diagnosis, procedures, age, and complications, determining the hospital's Medicare payment for each case.

Question 19: Which scenario represents a violation of the 'minimum necessary' standard under HIPAA?

A nurse accessing a patient's allergy list before administering medication
A billing clerk pulling the entire medical record to verify a single diagnosis code (Correct answer)
A physician reviewing imaging results ordered for the patient
A care coordinator viewing the discharge summary for transition planning

Correct answer: A billing clerk pulling the entire medical record to verify a single diagnosis code

Accessing a complete medical record when only a specific data element (diagnosis code) is needed violates HIPAA's minimum necessary standard.

Question 20: Which quality improvement tool displays process variation over time and distinguishes between common-cause and special-cause variation?

Scatter diagram
Control chart (Correct answer)
Histogram
Pareto chart

Correct answer: Control chart

A control chart plots data points over time with upper and lower control limits, helping identify whether variation is inherent to the process or caused by an unusual event.

Question 21: Which coding quality activity involves reviewing a statistically valid random sample of discharged records to assess overall coder performance across the department?

Random retrospective coding audit (Correct answer)
Case mix monitoring
Deficiency analysis
Concurrent prospective review

Correct answer: Random retrospective coding audit

A random retrospective coding audit samples discharged records across coders and payers to evaluate accuracy and identify education needs without targeting a specific issue.

Question 22: As a new CTR, you want to identify all reportable cancer cases from the preceding year. A crucial resource will be the facility's _____________.

disease index (Correct answer)
physicians’ index
patient index
number control index

Correct answer: disease index

A disease index is a crucial resource for a Certified Tumor Registrar (CTR) because it organizes patient records by diagnosis, including specific cancer codes. By consulting the disease index, the CTR can efficiently identify and track all patients who have been diagnosed and treated for reportable cancer cases within the facility during a given period. This ensures comprehensive case finding for cancer registries.

Question 23: Which CMS program penalizes hospitals for excess readmissions and relies on accurate clinical documentation?

Medicare Shared Savings Program
Hospital Readmissions Reduction Program (HRRP) (Correct answer)
Bundled Payments for Care Improvement (BPCI)
Merit-based Incentive Payment System (MIPS)

Correct answer: Hospital Readmissions Reduction Program (HRRP)

The Hospital Readmissions Reduction Program penalizes hospitals with higher-than-expected readmission rates for specific conditions, making accurate documentation of comorbidities essential.

Question 24: What additional federal protections apply to substance use disorder treatment records beyond standard HIPAA requirements?

Joint Commission accreditation standards
CMS Conditions of Participation
The Mental Health Parity Act
42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records) (Correct answer)

Correct answer: 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records)

42 CFR Part 2 imposes stricter confidentiality requirements on records of patients treated for substance use disorders at federally assisted programs, requiring specific patient consent for most disclosures.

Question 25: What is health information governance?

A type of medical license
A government agency overseeing hospitals
An electronic health record vendor
An organization-wide framework for managing the integrity, confidentiality, and availability of health data (Correct answer)

Correct answer: An organization-wide framework for managing the integrity, confidentiality, and availability of health data

HIG provides the strategic framework for policies, procedures, and oversight ensuring health information is managed properly across the organization.

Question 26: What is a subpoena for health records?

An insurance authorization
A legal order requiring the production of specified health records for legal proceedings (Correct answer)
A referral to a specialist
A prescription request

Correct answer: A legal order requiring the production of specified health records for legal proceedings

A subpoena legally compels the release of specified records, but proper authorization and HIPAA compliance must still be verified.

Question 27: Which document serves as the foundation for CDI query standards in the US?

Joint Commission Accreditation Standards
CMS Conditions of Participation
AHIMA/ACDIS CDI Query Practice Brief (Correct answer)
OIG Work Plan

Correct answer: AHIMA/ACDIS CDI Query Practice Brief

The AHIMA/ACDIS CDI Query Practice Brief provides industry-standard guidelines for compliant, ethical, and clinically appropriate physician queries.

Question 28: What is HIPAA?

A medical procedure
A coding system
The Health Insurance Portability and Accountability Act — federal law protecting patient health information privacy (Correct answer)
A type of health insurance

Correct answer: The Health Insurance Portability and Accountability Act — federal law protecting patient health information privacy

HIPAA establishes national standards for protecting sensitive patient health information from being disclosed without consent.

Question 29: Under the HITECH Act, which incentive program accelerated the adoption of electronic health records and, by extension, Health Information Exchange?

MACRA Quality Payment Program
Stark Law Safe Harbors
Medicare Advantage
Meaningful Use (now Promoting Interoperability) (Correct answer)

Correct answer: Meaningful Use (now Promoting Interoperability)

The Meaningful Use program, established under HITECH, provided financial incentives for EHR adoption and required electronic exchange of clinical information as a core measure.

Question 30: You manage five clerical staff who will be transferred when a new wing of your building is constructed. When you meet with the architect to plan their area, you will request:

300 square feet of room for your clerical workers. (Correct answer)
350 square feet of room for your clerical workers.
200 square feet of room for your clerical workers.
100 square feet of room for your clerical workers.

Correct answer: 300 square feet of room for your clerical workers.

A common guideline for allocating office space for clerical workers is approximately 60 square feet per person. With five clerical staff members, the required space would be 5 workers multiplied by 60 square feet per worker. This calculation results in 300 square feet, providing adequate room for their workstations and movement.

Question 31: Which condition must be documented by the physician for a CDI specialist to query for 'malnutrition' to affect MS-DRG assignment?

Any mention of dietary restrictions
Low albumin level only
BMI below 18.5
Clinical indicators such as poor intake, weight loss, or muscle wasting documented alongside a clinical diagnosis (Correct answer)

Correct answer: Clinical indicators such as poor intake, weight loss, or muscle wasting documented alongside a clinical diagnosis

Malnutrition requires a physician's clinical diagnosis supported by documented indicators; lab values alone are insufficient for coding purposes.

Question 32: What is interoperability in healthcare IT?

Connecting to the internet
All hospitals using the same software
Having multiple computer monitors
The ability of different health IT systems to exchange and use information meaningfully (Correct answer)

Correct answer: The ability of different health IT systems to exchange and use information meaningfully

Interoperability enables different healthcare systems to share data in ways that can be understood and used, supporting coordinated care across organizations.

Question 33: What is a Business Associate Agreement (BAA)?

A patient consent form
A contract between a covered entity and a vendor that ensures PHI protection when shared (Correct answer)
A partnership between hospitals
An insurance agreement

Correct answer: A contract between a covered entity and a vendor that ensures PHI protection when shared

BAAs legally require business associates (vendors handling PHI) to implement appropriate safeguards and comply with HIPAA regulations.

Question 34: What is information lifecycle management?

Only storing current records
Managing data from creation through use, maintenance, and ultimate disposition or destruction (Correct answer)
Only destroying old records
Only creating new records

Correct answer: Managing data from creation through use, maintenance, and ultimate disposition or destruction

ILM addresses all phases of information existence: creation, use, maintenance, archival, and destruction, with appropriate policies for each phase.

Question 35: What is the HIPAA-compliant fee limit concept for providing patients electronic access to their PHI in a readily producible format?

Only a reasonable, cost-based fee limited to labor for copying and supplies; no retrieval or overhead fees allowed for patient access requests (Correct answer)
The same rate charged to attorneys for legal records
A flat fee of $6.50 per record regardless of length
Standard copy fees set by state law only

Correct answer: Only a reasonable, cost-based fee limited to labor for copying and supplies; no retrieval or overhead fees allowed for patient access requests

For patient access requests, HHS guidance limits fees to the actual cost of labor for copying and supplies; facilities cannot charge retrieval, overhead, or other add-on fees.

Question 36: What is ICD-10-CM?

The International Classification of Diseases, 10th Revision, Clinical Modification — used for diagnostic coding (Correct answer)
A hospital department
A type of medical device
A pharmaceutical classification

Correct answer: The International Classification of Diseases, 10th Revision, Clinical Modification — used for diagnostic coding

ICD-10-CM provides standardized codes for diagnoses and conditions, used for billing, research, and health statistics in the United States.

Question 37: A hospital HIE coordinator discovers that patient records from two different facilities are being merged incorrectly, creating 'overlay' errors. What is an overlay error?

A duplicate record where one patient has two separate charts
A record that is missing key demographic fields
A record with incorrect insurance information
One patient's information is written into another patient's record (Correct answer)

Correct answer: One patient's information is written into another patient's record

An overlay error occurs when data from one patient is incorrectly placed into another patient's record, posing serious patient safety risks.

Question 38: What is the minimum necessary standard?

The standard only applies to billing
Access to PHI should be limited to the minimum amount needed to accomplish the intended purpose (Correct answer)
All staff can access all records
PHI should be shared freely

Correct answer: Access to PHI should be limited to the minimum amount needed to accomplish the intended purpose

The minimum necessary principle requires that access to and disclosure of PHI be limited to what is reasonably necessary for the specific purpose.

Question 39: Under HIPAA, the 'right to an accounting of disclosures' allows patients to request a list of disclosures of their PHI made:

For purposes other than treatment, payment, and healthcare operations, covering the prior 6 years (Correct answer)
For any purpose, including treatment, payment, and operations
Only for disclosures made to other covered entities
For disclosures made to government agencies only

Correct answer: For purposes other than treatment, payment, and healthcare operations, covering the prior 6 years

Patients may request an accounting of PHI disclosures made for purposes other than TPO (treatment, payment, healthcare operations), covering disclosures in the prior 6 years from the date of the request.

Question 40: Which type of health record analysis verifies that all required components and signatures are physically present in the medical record?

Prospective review
Qualitative analysis
Utilization review
Quantitative analysis (Correct answer)

Correct answer: Quantitative analysis

Quantitative analysis checks for the physical presence of required record components such as history and physical reports, operative notes, and physician signatures.

Question 41: In the context of health information governance, 'data provenance' refers to:

The encryption algorithm used to secure data
The geographic origin of the patient
The documented history of data origin, movement, and transformation (Correct answer)
The cost associated with data storage

Correct answer: The documented history of data origin, movement, and transformation

Data provenance tracks the origin, custody, and transformation history of data so users can assess its reliability and trustworthiness.

Question 42: Under AHIMA coding quality standards, what is the minimum recommended accuracy rate for principal diagnosis assignment?

99%
90%
95% (Correct answer)
85%

Correct answer: 95%

AHIMA recommends a minimum coding accuracy rate of 95% for principal diagnosis, secondary diagnoses, and procedures to ensure data integrity and appropriate reimbursement.

Question 43: In CDI, what is the 'case mix index' (CMI)?

The percentage of cases with MCCs
The ratio of surgical to medical cases
The average relative weight of all MS-DRGs for a given period (Correct answer)
The average length of stay for all patients

Correct answer: The average relative weight of all MS-DRGs for a given period

The case mix index is the average relative weight of MS-DRGs for a hospital's patient population, reflecting the complexity and resource intensity of cases treated.

Question 44: What is the primary purpose of AHIMA's practice brief on 'Managing the Release of Information'?

To define ICD-10 coding requirements for ROI departments
To provide guidance on compliant, efficient, and patient-centered ROI processes for health information professionals (Correct answer)
To establish IT security standards for EHR vendors
To set Medicare billing rates for copy services

Correct answer: To provide guidance on compliant, efficient, and patient-centered ROI processes for health information professionals

AHIMA practice briefs on ROI provide health information management professionals with best practice guidance for managing disclosures compliantly, efficiently, and with a patient-centered approach.

Question 45: When state law provides greater privacy protections for a patient's mental health records than HIPAA, a covered entity must:

Follow HIPAA because federal law preempts state law
Follow whichever law the patient chooses
Report the conflict to the OCR for resolution
Follow the state law because it is more protective (Correct answer)

Correct answer: Follow the state law because it is more protective

HIPAA sets a federal floor for privacy; when state law is more stringent (more protective of patient rights), the covered entity must comply with the stricter state standard.

Question 46: The primary goal of a sentinel event review under Joint Commission standards is to:

Identify systemic contributing factors and prevent recurrence (Correct answer)
Document the event for malpractice defense purposes
Report findings to state licensing boards
Assign individual accountability for adverse outcomes

Correct answer: Identify systemic contributing factors and prevent recurrence

A sentinel event root cause analysis (RCA) aims to uncover the underlying system failures that allowed the event to occur and implement corrective actions.

Question 47: Which federal law specifically prohibits offering or accepting remuneration to induce referrals for services covered by Medicare or Medicaid?

False Claims Act
Stark Law
EMTALA
Anti-Kickback Statute (Correct answer)

Correct answer: Anti-Kickback Statute

The Anti-Kickback Statute (42 USC 1320a-7b) prohibits knowingly offering, paying, soliciting, or receiving anything of value to induce or reward referrals of federal healthcare program business.

Question 48: Encoding software was deployed at your facility two years ago. The coders are well-trained in it and like utilizing it. It works great and just requires ICD code revisions once a year. In terms of the Information Systems Life Cycle stages, the coding system is probably in the ________________.

operation and maintenance phase (Correct answer)
design phase
implementation phase
obsolescence or decline phase

Correct answer: operation and maintenance phase

The Information Systems Life Cycle (ISLC) describes the stages of an information system. Since the encoding software has been deployed for two years, is well-liked, works effectively, and only requires annual updates, it is actively in use and being maintained. This indicates that the system is currently in the operation and maintenance phase, where it provides value and receives ongoing support.

Question 49: The Stark Law (Physician Self-Referral Law) is primarily a:

State licensure regulation
Voluntary compliance guideline
Criminal statute requiring intent
Civil statute with strict liability (Correct answer)

Correct answer: Civil statute with strict liability

The Stark Law is a civil strict-liability statute, meaning a violation can occur without any intent to violate the law, making compliance programs especially critical.

Question 50: What is clinical decision support (CDS)?

A management consulting firm
An insurance approval system
Technology providing clinicians with knowledge and person-specific information to enhance decision-making (Correct answer)
A patient self-diagnosis tool

Correct answer: Technology providing clinicians with knowledge and person-specific information to enhance decision-making

CDS systems provide alerts, reminders, evidence-based guidelines, and diagnostic support to improve clinical decisions.

Question 51: HL7 FHIR (Fast Healthcare Interoperability Resources) uses which application programming paradigm to enable data exchange?

File Transfer Protocol (FTP)
RESTful API (Correct answer)
EDI batch transactions
SOAP-based web services

Correct answer: RESTful API

FHIR uses RESTful APIs, enabling lightweight, web-based queries and updates to discrete clinical resources using standard HTTP methods.

Question 52: The use of personal signature stamps to authenticate entries in a paper-based record necessitates additional precautions to prevent delegated stamp usage. In a totally computerized patient record system, comparable techniques may be applied to regulate the usage of _____________________.

fingerprint signatures
electronic signatures (Correct answer)
voice recognition systems
expert systems

Correct answer: electronic signatures

In a paper-based system, signature stamps require strict controls to prevent unauthorized use. Similarly, in a fully computerized patient record system, electronic signatures serve the same authentication purpose, verifying the identity of the person making an entry. Therefore, comparable stringent techniques and controls are necessary to regulate the usage of electronic signatures to ensure their integrity, security, and prevent unauthorized access or use.

Question 53: Under HIPAA, which of the following is considered a permissible disclosure without patient authorization?

Marketing a health plan's products
Selling PHI to a pharmaceutical company
Sharing PHI with an employer about an employee's diagnosis
Disclosing PHI to public health authorities for disease surveillance (Correct answer)

Correct answer: Disclosing PHI to public health authorities for disease surveillance

HIPAA permits disclosure of PHI to public health authorities for activities such as disease surveillance, investigation, and intervention without patient authorization.

Question 54: Health data that is collected and available soon enough to support the decision or action for which it is needed demonstrates which quality characteristic?

Timeliness (Correct answer)
Accuracy
Accessibility
Granularity

Correct answer: Timeliness

Timeliness means data is available when it is needed; for example, lab results available before a clinician makes a treatment decision reflect timely health data.

Question 55: What is population health management?

Treating one patient at a time
Managing hospital populations
An approach to improving health outcomes for a defined group by analyzing data and implementing targeted interventions (Correct answer)
Counting census data

Correct answer: An approach to improving health outcomes for a defined group by analyzing data and implementing targeted interventions

Population health management uses data to identify at-risk groups, implement preventive interventions, and monitor outcomes across entire populations.

Question 56: What is the purpose of an 'accounting of disclosures' under HIPAA?

To provide patients a list of certain disclosures of their PHI made without authorization (Correct answer)
To track employee access to the EHR
To bill patients for copies of their records
To report financial transactions involving PHI

Correct answer: To provide patients a list of certain disclosures of their PHI made without authorization

HIPAA grants patients the right to receive an accounting of disclosures of their PHI made without their authorization for purposes other than treatment, payment, and healthcare operations.

Question 57: Which interoperability framework published by the Office of the National Coordinator (ONC) defines the four domains of interoperability—foundational, structural, semantic, and organizational?

Interoperability Standards Advisory (ISA)
FHIR Implementation Guide
CommonWell Health Alliance Charter
TEFCA (Trusted Exchange Framework and Common Agreement) (Correct answer)

Correct answer: TEFCA (Trusted Exchange Framework and Common Agreement)

TEFCA establishes the Trusted Exchange Framework defining governance, technical, and legal requirements, and references the four interoperability domains across its structure.

Question 58: The Joint Commission's ORYX initiative requires accredited hospitals to collect and report data on:

Core performance measures linked to accreditation standards (Correct answer)
Staff credentialing and licensure status
Financial performance metrics and operating costs
Facility infrastructure and safety inspections

Correct answer: Core performance measures linked to accreditation standards

ORYX integrates performance measurement data into the accreditation process, requiring hospitals to report on standardized core measures such as sepsis care, VTE prophylaxis, and perinatal care.

Question 59: What are clinical pathways?

Career development tracks
Standardized care plans for specific conditions outlining expected tests, treatments, and outcomes (Correct answer)
Insurance claim processes
Walking paths in hospitals

Correct answer: Standardized care plans for specific conditions outlining expected tests, treatments, and outcomes

Clinical pathways reduce variation in care by providing step-by-step guides for managing specific conditions.

Question 60: What is benchmarking in healthcare quality?

A type of medical test
Measuring patient height and weight
Setting physical landmarks
Comparing performance metrics with peer organizations or best practices to identify improvement opportunities (Correct answer)

Correct answer: Comparing performance metrics with peer organizations or best practices to identify improvement opportunities

Benchmarking compares your organization's performance against others to identify gaps and improvement opportunities.

Question 61: What is the primary goal of a Clinical Documentation Improvement (CDI) program in a US hospital?

Reduce nursing documentation time
Speed up the discharge process
Ensure clinical documentation accurately reflects patient severity and resource utilization (Correct answer)
Increase the number of coded diagnoses per chart

Correct answer: Ensure clinical documentation accurately reflects patient severity and resource utilization

CDI programs aim to ensure that clinical documentation accurately captures the patient's severity of illness and the resources used in their care.

Question 62: A patient requests amendment of their medical record, claiming a diagnosis is incorrect. The covered entity may deny the request if:

The information was created by another provider and is accurate and complete (Correct answer)
The patient did not submit the request in writing
The diagnosis was entered by a licensed physician
The record was created more than one year ago

Correct answer: The information was created by another provider and is accurate and complete

A covered entity may deny an amendment request if the PHI was not created by the entity and it believes the originating provider is better positioned to assess accuracy.

Question 63: Which standard messaging protocol is most commonly used to exchange clinical data such as lab results, ADT notifications, and radiology reports in Health Information Exchange?

HL7 v2.x (Correct answer)
X12 EDI
DICOM
NCPDP SCRIPT

Correct answer: HL7 v2.x

HL7 version 2.x is the dominant messaging standard for exchanging clinical data like ADT events, lab results, and radiology reports between healthcare systems.

Question 64: Under UHDDS guidelines, which diagnoses should be reported as 'additional diagnoses' for inpatient encounters?

Only diagnoses confirmed by lab results
Only diagnoses present on admission
Conditions that are clinically evaluated, treated, or affect the management of the patient during the stay (Correct answer)
All diagnoses mentioned anywhere in the record

Correct answer: Conditions that are clinically evaluated, treated, or affect the management of the patient during the stay

UHDDS guidelines specify that additional diagnoses are conditions that require clinical evaluation, therapeutic treatment, diagnostic procedures, or affect nursing care/monitoring.

Question 65: What federal law primarily governs the release of protected health information (PHI) by covered entities in the US?

The Freedom of Information Act (FOIA)
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (Correct answer)
The Americans with Disabilities Act (ADA)
The Health Information Technology for Economic and Clinical Health (HITECH) Act only

Correct answer: The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule

The HIPAA Privacy Rule (45 CFR Parts 160 and 164) is the primary federal regulation governing disclosure of PHI by covered entities and business associates.

Question 66: A hospital's compliance officer discovers that a coder has been upcoding DRGs for six months. Under the False Claims Act, which penalty could the hospital face per false claim?

$50,000–$100,000
$13,946–$27,894 (adjusted annually) (Correct answer)
$500–$1,000
$1,000–$5,000

Correct answer: $13,946–$27,894 (adjusted annually)

The False Claims Act imposes civil penalties per false claim; as of recent adjustments these range approximately $13,946 to $27,894 per claim plus treble damages.

Question 67: Which model of care coordination is most directly supported by HIE's ability to send real-time ADT notifications to care managers when high-risk patients are admitted to a hospital?

Utilization Management
Transitions of Care / Care Coordination (Correct answer)
Prospective Payment System auditing
Population Health Reporting

Correct answer: Transitions of Care / Care Coordination

Real-time ADT notifications enable care managers to intervene promptly during transitions of care, reducing readmissions and improving coordination for high-risk patients.

Question 68: What is the False Claims Act?

A law about food labeling
A law about false advertising
A federal law imposing liability on those who submit fraudulent claims to government healthcare programs (Correct answer)
A law about identity theft

Correct answer: A federal law imposing liability on those who submit fraudulent claims to government healthcare programs

The False Claims Act penalizes submitting knowingly false or fraudulent claims for payment to federal programs like Medicare.

Question 69: What is predictive analytics in healthcare?

Guessing patient satisfaction
Using historical data and algorithms to forecast future health events and outcomes (Correct answer)
Predicting weather effects on health
Forecasting hospital construction needs

Correct answer: Using historical data and algorithms to forecast future health events and outcomes

Predictive analytics applies statistical models and machine learning to historical data to predict outcomes like readmission risk, disease progression, or infection probability.

Question 70: The Joint Commission does not authorize automatic authentication of health record inputs. The fundamental argument against this approach is:

it is too simple to delegate the usage of computer passwords
evidence cannot be presented that the physician really reviewed and authorized each report (Correct answer)
tampering happens too often with this type of authentication
electronic signatures are not accepted in all states

Correct answer: evidence cannot be presented that the physician really reviewed and authorized each report

Automatic authentication of health record inputs is problematic because it removes the direct, explicit action of a physician reviewing and approving each entry. Without individual physician action for each input, it becomes difficult to legally and clinically prove that the physician genuinely reviewed and authorized the specific content. This lack of direct evidence undermines accountability and the integrity of the health record.

Question 71: What is the role of HIM in population health?

Ensuring accurate data collection, analysis, and reporting to support population health initiatives (Correct answer)
Only managing individual records
Only providing billing data
HIM has no role in population health

Correct answer: Ensuring accurate data collection, analysis, and reporting to support population health initiatives

Accurate health information is foundational to identifying trends, measuring outcomes, and improving community health.

Question 72: Which of the following best describes the 'qui tam' provision of the False Claims Act?

It permits private individuals to file suits on behalf of the government and share in recovered funds (Correct answer)
It authorizes HHS to exclude providers from Medicare without a hearing
It defines the statute of limitations for healthcare fraud
It allows providers to voluntarily disclose fraud and avoid penalties

Correct answer: It permits private individuals to file suits on behalf of the government and share in recovered funds

The qui tam provision allows private citizens (relators) to file False Claims Act suits on behalf of the U.S. government and receive a portion of any recovered funds as a reward.

Question 73: The Case Mix Index (CMI) in hospital quality and financial management is BEST defined as:

A measure of the relative complexity and resource intensity of a facility's patient mix (Correct answer)
The percentage of total cases billed to government payers
The ratio of Medicare to Medicaid patients treated by a facility
The average patient satisfaction score across all hospital service lines

Correct answer: A measure of the relative complexity and resource intensity of a facility's patient mix

CMI is the average relative weight of all Medicare DRGs assigned to a hospital's patients, reflecting the complexity and resource demands of its overall case mix.

Question 74: A hospital's quality dashboard shows a 3% rise in 30-day readmission rates over the past quarter. What is the BEST immediate next step?

Immediately increase nurse-to-patient staffing ratios
Discipline clinical staff responsible for discharge planning
Conduct a root cause analysis to identify contributing factors (Correct answer)
Report the finding directly to The Joint Commission

Correct answer: Conduct a root cause analysis to identify contributing factors

Before implementing any intervention, a root cause analysis should be performed to understand the specific factors driving the increase in readmissions.

Question 75: The concept of 'incidental disclosure' under HIPAA refers to:

An accidental mailing of records to the wrong address
A disclosure made without the patient's knowledge
Any unauthorized breach of PHI
A secondary disclosure that cannot reasonably be prevented and is limited in nature (Correct answer)

Correct answer: A secondary disclosure that cannot reasonably be prevented and is limited in nature

An incidental disclosure is a by-product of an otherwise permissible disclosure that is limited and cannot reasonably be prevented, such as overhearing staff discuss a patient in a hallway.

Question 76: A healthcare organization implements a zero-tolerance policy against retaliation toward employees who report compliance concerns. This reflects which OIG compliance program element?

Responding to detected offenses
Open lines of communication (Correct answer)
Conducting internal monitoring and auditing
Implementing disciplinary standards

Correct answer: Open lines of communication

Non-retaliation policies encourage employees to report concerns through open communication channels, a core element of OIG's seven-component compliance program framework.

Question 77: A valid authorization for release of PHI under HIPAA must contain which required element?

The Social Security number of the patient
The signature of the treating physician
An expiration date or expiration event (Correct answer)
The facility's Joint Commission accreditation number

Correct answer: An expiration date or expiration event

A HIPAA-compliant authorization must include an expiration date or expiration event (e.g., one year from the date of signature or upon completion of a research study).

Question 78: What does the prefix "99" indicate in the tumor registry accession number "99-0001"?

the total number of primary cancers recorded for that patient
the case's sequence number
the tumor's stage according to the TNM staging method
the year the case was put into the registry's database (Correct answer)

Correct answer: the year the case was put into the registry's database

In tumor registry accession numbers, the initial digits typically indicate the year the case was entered into the registry's database. Therefore, in the accession number '99-0001', the prefix '99' signifies that the case was accessioned or added to the registry in the year 1999. The subsequent numbers usually represent the sequence of cases for that year.

Question 79: A hospital compares its surgical site infection rate against national rates published in the CDC's NHSN database. This is an example of:

Process benchmarking
Internal benchmarking
Functional benchmarking
External benchmarking (Correct answer)

Correct answer: External benchmarking

External benchmarking compares an organization's performance data to national databases, peer groups, or industry leaders outside the organization.

Question 80: Benchmarking in healthcare quality improvement is BEST described as:

Comparing organizational performance against best practices or peer organizations (Correct answer)
Reviewing patient satisfaction surveys on a quarterly basis
Setting internal performance targets based solely on prior-year organizational data
Conducting unannounced audits of departmental processes and workflows

Correct answer: Comparing organizational performance against best practices or peer organizations

Benchmarking uses external reference points — industry best practices or comparable organizations — to set meaningful performance targets and identify improvement gaps.

Question 81: Which governance mechanism is used to resolve disputes between departments about data definitions or ownership?

Chief financial officer ruling
Audit department review
Privacy officer mandate
Data governance council or committee (Correct answer)

Correct answer: Data governance council or committee

A data governance council serves as the authoritative body to adjudicate disagreements about data definitions, standards, and ownership across the organization.

Question 82: When a health system implements a new EHR, which governance document guides the mapping of legacy data fields to the new system's data elements?

Data migration crosswalk or mapping document (Correct answer)
Release of information log
Minimum necessary matrix
Business associate agreement

Correct answer: Data migration crosswalk or mapping document

A data migration crosswalk or mapping document aligns legacy data fields with corresponding elements in the new system to ensure accurate data transfer.

Question 83: A covered entity must provide patients with a Notice of Privacy Practices (NPP):

Annually to all patients on file
At first service delivery and upon request thereafter (Correct answer)
Only when there has been a breach
Only at initial treatment, never again

Correct answer: At first service delivery and upon request thereafter

Covered entities must provide the NPP no later than the first date of service and must make it available upon request at any subsequent time.

Question 84: What are clinical quality measures?

Patient satisfaction surveys only
Financial performance indicators
Hospital decoration standards
Standardized metrics assessing healthcare processes, outcomes, and patient experience (Correct answer)

Correct answer: Standardized metrics assessing healthcare processes, outcomes, and patient experience

Clinical quality measures evaluate whether healthcare services are effective, safe, efficient, patient-centered, equitable, and timely.

Question 85: A covered entity participates in an HIE and shares patient data with network participants. Which agreement ensures that the HIE itself complies with HIPAA as a business associate?

Participation Agreement
Data Sharing Compact
Business Associate Agreement (BAA) (Correct answer)
Memorandum of Understanding (MOU)

Correct answer: Business Associate Agreement (BAA)

A Business Associate Agreement is required when a covered entity shares protected health information with an HIE, as the HIE qualifies as a business associate under HIPAA.

Question 86: What is the primary objective of a Clinical Documentation Improvement (CDI) program?

To transition facilities from paper to electronic health records
To ensure documentation accurately reflects patient severity, complexity, and resource use (Correct answer)
To reduce the total volume of medical records stored on-site
To accelerate medical record coding turnaround time

Correct answer: To ensure documentation accurately reflects patient severity, complexity, and resource use

CDI programs work concurrently with clinicians to clarify ambiguous or incomplete documentation so coded data accurately represents the patient's true clinical picture.

Question 87: What is the correct process when a patient revokes a previously signed HIPAA authorization?

The revocation must be notarized to be valid
Revocation applies only to electronic records
Disclosures that already occurred in reliance on the authorization are not affected, but future disclosures must stop (Correct answer)
The covered entity must immediately stop all disclosures, with no exceptions

Correct answer: Disclosures that already occurred in reliance on the authorization are not affected, but future disclosures must stop

A patient may revoke a HIPAA authorization in writing at any time, but the revocation does not affect disclosures already made in reliance on the authorization.

Question 88: When a covered entity uses PHI for fundraising activities, HIPAA requires that:

Patients must provide written authorization before any PHI is used
No PHI may ever be used for fundraising
Patients must be given an opportunity to opt out of receiving fundraising communications (Correct answer)
Only contact information and dates of service may be used without any notice

Correct answer: Patients must be given an opportunity to opt out of receiving fundraising communications

HIPAA permits limited use of PHI for fundraising but requires that all fundraising communications include a clear description of how to opt out of future contacts.

Question 89: A patient's psychotherapy notes receive special protection under HIPAA because:

They must be stored in a separate facility from other records
They are not considered part of the legal health record
They require a specific authorization separate from general PHI authorization (Correct answer)
They are automatically shared with insurers under coordination of benefits

Correct answer: They require a specific authorization separate from general PHI authorization

Psychotherapy notes (process notes) receive heightened HIPAA protection and require a specific, separate patient authorization for disclosure — they cannot be released under a general PHI authorization.

Question 90: What is the difference between EHR and EMR?

EHR is only for hospitals
They are exactly the same
EMR is newer technology
EMR is a digital version of a single practice's chart; EHR is designed to share information across organizations (Correct answer)

Correct answer: EMR is a digital version of a single practice's chart; EHR is designed to share information across organizations

EMRs are digital records within one practice, while EHRs are designed for interoperability, allowing information sharing across healthcare organizations.

Question 91: What emerging technologies are transforming HIM?

Only electronic health records
Only social media
No new technologies affect HIM
AI, blockchain, cloud computing, natural language processing, and telehealth (Correct answer)

Correct answer: AI, blockchain, cloud computing, natural language processing, and telehealth

Emerging technologies are reshaping how health information is captured, stored, analyzed, and shared.

Question 92: Which act requires healthcare facilities to treat or stabilize patients presenting to emergency departments regardless of their ability to pay?

Medicare Conditions of Participation
Hill-Burton Act
Anti-Kickback Statute
EMTALA (Correct answer)

Correct answer: EMTALA

EMTALA (Emergency Medical Treatment and Labor Act) mandates that hospitals participating in Medicare provide a medical screening exam and stabilizing treatment regardless of insurance or ability to pay.

Question 93: Under HIPAA, what right does a patient have regarding amendments to their health record?

The right to require the covered entity to add their version within 7 days
The right to delete any information they dislike
The right to rewrite the physician's notes
The right to request amendment of PHI they believe is inaccurate or incomplete (Correct answer)

Correct answer: The right to request amendment of PHI they believe is inaccurate or incomplete

HIPAA gives patients the right to request an amendment to their PHI; the covered entity may deny the request if the information is accurate and complete, but must document the denial.

Question 94: Under HIPAA, what is the 'minimum necessary' standard for release of information?

Providing only the discharge summary for all requests
Limiting PHI disclosures to the least amount necessary to accomplish the intended purpose (Correct answer)
Releasing only data from the past 12 months
Releasing only the first and last page of the record

Correct answer: Limiting PHI disclosures to the least amount necessary to accomplish the intended purpose

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI disclosure to what is needed for the specific purpose of the request.

Question 95: The Joint Commission uses 'tracer methodology' during accreditation surveys primarily to:

Audit medical record completeness and deficiency statistics
Inspect facility physical plant and life safety systems
Review hospital financial records and billing compliance documentation
Follow a patient's care experience across departments to evaluate system performance (Correct answer)

Correct answer: Follow a patient's care experience across departments to evaluate system performance

Tracer methodology follows the care journey of selected patients through the organization to identify potential vulnerabilities in care processes, communication, and documentation.

Question 96: Which type of PHI disclosure does NOT require a patient's authorization under HIPAA?

Release to a marketing firm
Release to the patient's employer for personnel decisions
Release for treatment, payment, or healthcare operations (TPO) (Correct answer)
Release to a life insurance company

Correct answer: Release for treatment, payment, or healthcare operations (TPO)

HIPAA permits covered entities to disclose PHI without patient authorization for treatment, payment, and healthcare operations purposes.

Question 97: What is a clinical audit?

An employee performance review
A financial review
A building inspection
A systematic review of clinical practice against defined standards to improve care quality (Correct answer)

Correct answer: A systematic review of clinical practice against defined standards to improve care quality

Clinical audits compare actual practice to evidence-based standards, identifying areas for improvement.

Question 98: What are the penalties for HIPAA violations?

No penalties exist
Only a small fine
Civil fines from $100 to $50,000 per violation, criminal penalties up to $250,000 and imprisonment (Correct answer)
A verbal warning only

Correct answer: Civil fines from $100 to $50,000 per violation, criminal penalties up to $250,000 and imprisonment

HIPAA penalties range from civil monetary penalties to criminal prosecution with imprisonment, depending on the nature and severity of the violation.

Question 99: What is the primary purpose of a fishbone (Ishikawa) diagram in quality improvement?

To track patient outcomes over time
To measure process cycle efficiency
To identify potential root causes of a problem (Correct answer)
To document standard workflow steps

Correct answer: To identify potential root causes of a problem

The fishbone diagram is a cause-and-effect tool used to visually identify and categorize the potential root causes contributing to a specific problem.

Question 100: Which governance document outlines the rules, policies, and obligations that all participants must agree to when joining an HIE network?

Business Associate Agreement (BAA)
Participation Agreement / Data Use Agreement (Correct answer)
Notice of Privacy Practices
Covered Entity Designation Form

Correct answer: Participation Agreement / Data Use Agreement

A Participation or Data Use Agreement defines the legal, operational, and privacy obligations of all entities joining an HIE, governing how data may be accessed and used.

Question 101: The file clerks at your department's main file area report that they were able to locate 400 of the 450 required records over the last month. The primary file contains a total of 4,500 entries. What is the area's accuracy rate?

10.00%
8.90%
88.90% (Correct answer)
1.10%

Correct answer: 88.90%

The accuracy rate is calculated by dividing the number of successfully located records by the total number of records required, then multiplying by 100 to get a percentage. In this case, 400 records were located out of 450 required. Therefore, (400 / 450) * 100% equals approximately 88.88%, which rounds to 88.90%.

Question 102: What is HCPCS?

A hospital management system
A health insurance plan
Healthcare Common Procedure Coding System — codes for services, equipment, and supplies not in CPT (Correct answer)
A patient identifier

Correct answer: Healthcare Common Procedure Coding System — codes for services, equipment, and supplies not in CPT

HCPCS codes cover items and services not included in CPT, such as durable medical equipment, prosthetics, ambulance services, and certain drugs.

Question 103: What is data mapping in health information?

Creating geographic databases
Mapping patient locations
Drawing maps of hospital departments
The process of connecting data fields between different systems to enable information exchange (Correct answer)

Correct answer: The process of connecting data fields between different systems to enable information exchange

Data mapping establishes correspondences between data elements in different systems, enabling meaningful information exchange and system interoperability.

Question 104: What is data governance in health information?

Deleting old data
A type of encryption
Policies and procedures ensuring data quality, security, availability, and proper use across an organization (Correct answer)
Keeping data on government servers

Correct answer: Policies and procedures ensuring data quality, security, availability, and proper use across an organization

Data governance establishes the framework for data management including quality standards, access policies, security measures, and accountability structures.

Question 105: HIPAA's Privacy Rule defines consent as:

Marketing of PHI
Use of PHI (Correct answer)
Treatment
Storage of PHI

Correct answer: Use of PHI

Under HIPAA's Privacy Rule, 'consent' specifically refers to a patient's agreement for the *use* of their protected health information (PHI) for routine purposes like treatment, payment, and healthcare operations. While an 'authorization' is typically required for other disclosures, consent covers these fundamental activities that enable healthcare providers to manage and deliver care effectively.

Question 106: Which state law generally takes precedence when it provides greater privacy protections than HIPAA?

State law prevails when it is more stringent (more protective of patient privacy) than HIPAA (Correct answer)
State law applies only to Medicaid patients
HIPAA always supersedes state law
Federal law always preempts state law for health records

Correct answer: State law prevails when it is more stringent (more protective of patient privacy) than HIPAA

HIPAA establishes a federal floor of privacy protections, but states may enact stricter laws; in such cases, the more stringent state law applies.

Question 107: What is the chargemaster?

A patient's itemized bill
A government price list
A hospital employee who manages billing
A comprehensive listing of all billable items and their prices used by a healthcare facility (Correct answer)

Correct answer: A comprehensive listing of all billable items and their prices used by a healthcare facility

The chargemaster (charge description master) is a hospital's master price list for all services, procedures, supplies, and drugs used for billing purposes.

Question 108: Which federal rule, effective in 2022, prohibits healthcare organizations from blocking patients' access to their own electronic health information?

21st Century Cures Act Information Blocking Rule (Correct answer)
Medicare Access and CHIP Reauthorization Act (MACRA)
Affordable Care Act Section 3001
HIPAA Omnibus Rule

Correct answer: 21st Century Cures Act Information Blocking Rule

The Information Blocking Rule under the 21st Century Cures Act prohibits practices that unreasonably restrict access, exchange, or use of electronic health information (EHI) without a recognized exception.

Question 109: Which LOINC code panel is commonly used in HIE to standardize the transmission of laboratory results?

LOINC 57133-1 (Referral note)
LOINC 11502-2 (Laboratory report) (Correct answer)
LOINC 34133-9 (Summarization of episode note)
LOINC 24357-6 (Urinalysis panel)

Correct answer: LOINC 11502-2 (Laboratory report)

LOINC code 11502-2 represents the laboratory report document type and is widely used in HIE to standardize the header and identification of lab result messages.

Question 110: What is the purpose of a health record?

For marketing purposes only
To track employee schedules
Only for billing purposes
To document patient care, support clinical decisions, and serve as a legal document (Correct answer)

Correct answer: To document patient care, support clinical decisions, and serve as a legal document

Health records serve multiple functions: documenting care, supporting clinical decisions, providing legal evidence, enabling research, and facilitating billing.

Question 111: What is the primary function of a Master Patient Index (MPI) in Health Information Exchange?

To store clinical documents in a central repository
To uniquely identify and match patients across multiple organizations (Correct answer)
To enforce HIPAA privacy rules across exchange participants
To route lab results to ordering physicians

Correct answer: To uniquely identify and match patients across multiple organizations

The MPI uniquely identifies patients and resolves duplicate or overlapping records across different organizations participating in the HIE.

Question 112: A clerical employee describes an event in which the clerk felt the first-line supervisor discriminated against her because of her gender. The greatest step for you to take now is to:

inquire with other clerical personnel whether they have had similar issues.
tell the clerk to give objective proof of the discrimination.
thoroughly explore the situation and record your findings. (Correct answer)
consult the first-line supervisor to discover what occurred.

Correct answer: thoroughly explore the situation and record your findings.

When an employee reports discrimination, the most appropriate initial step for a manager is to conduct a thorough and objective investigation. This involves gathering all relevant facts, interviewing involved parties, and meticulously documenting the findings. This comprehensive approach ensures fairness, helps determine the validity of the claim, and provides a basis for any necessary subsequent actions.

Question 113: The healthcare quality measurement framework of 'structure, process, and outcome' was developed by which pioneer?

W. Edwards Deming
Avedis Donabedian (Correct answer)
Philip Crosby
Joseph Juran

Correct answer: Avedis Donabedian

Avedis Donabedian proposed this three-part framework for evaluating healthcare quality, where structure enables process and process influences outcomes.

Question 114: In FHIR-based HIE, which resource is used to document a patient's consent for or against the sharing of their health information?

AuditEvent
RelatedPerson
Provenance
Consent (Correct answer)

Correct answer: Consent

The FHIR Consent resource records a patient's agreement or refusal related to the use or disclosure of their health information within an HIE.

Question 115: Which ICD-10-CM coding guideline instructs coders to code conditions to the 'highest degree of certainty' for inpatient settings?

The uncertain diagnosis guideline, allowing coding of conditions documented as 'possible' or 'probable' at discharge (Correct answer)
The principal diagnosis selection rule
The present on admission guideline
The UHDDS rule

Correct answer: The uncertain diagnosis guideline, allowing coding of conditions documented as 'possible' or 'probable' at discharge

For inpatient coding, ICD-10-CM guidelines allow coding of conditions documented as 'possible,' 'probable,' or 'suspected' at the time of discharge if no definitive diagnosis is established.

Question 116: A pathologist on the Health Record Committee inquires about the time frame for providing a preliminary diagnosis after an autopsy is done. You answer confidently that this information must be included in the health record within _________________.

3 days (Correct answer)
50 days
10 days
24 hours

Correct answer: 3 days

Hospital regulations and accreditation standards typically require that a preliminary diagnosis following an autopsy be documented in the health record within a specific, short timeframe. A common standard for this is within 3 days of the autopsy being performed. This ensures timely communication of initial findings that may be relevant to the patient's medical history or cause of death.

Question 117: What is the role of the Case Mix Index (CMI) trend in assessing CDI program effectiveness?

A rising CMI always indicates fraud
CMI is unrelated to CDI outcomes
An increasing CMI after CDI implementation may suggest improved documentation capture of patient complexity (Correct answer)
CMI measures only surgical case complexity

Correct answer: An increasing CMI after CDI implementation may suggest improved documentation capture of patient complexity

An upward trend in CMI following CDI program implementation often reflects better documentation of patient severity, not necessarily sicker patients.

Question 118: What is healthcare data analytics?

The systematic use of health data to identify patterns, improve outcomes, and reduce costs (Correct answer)
Organizing medical files
Counting patient visits
Filing insurance claims

Correct answer: The systematic use of health data to identify patterns, improve outcomes, and reduce costs

Healthcare analytics applies statistical and computational methods to health data to support evidence-based decisions, quality improvement, and population health management.

Question 119: A person stole and used another person's insurance information to get medical treatment. This action will be considered:

Fraud and abuse
Abuse
Medical identity theft (Correct answer)
Violation of bioethics

Correct answer: Medical identity theft

Medical identity theft occurs when an individual uses another person's personal identifying information, such as their insurance details, to obtain medical services or goods. In this scenario, stealing and using someone else's insurance information for treatment directly fits this definition. It is a specific form of identity theft focused on accessing healthcare benefits or services fraudulently.

Question 120: Which scenario describes a valid 'incidental disclosure' that does not violate HIPAA?

Emailing unencrypted PHI to the wrong provider
A patient overhearing their name called in a waiting room despite reasonable safeguards being in place (Correct answer)
Faxing a full medical record to a wrong number
Posting a patient's diagnosis on a public bulletin board by mistake

Correct answer: A patient overhearing their name called in a waiting room despite reasonable safeguards being in place

Incidental disclosures that occur as a by-product of a permissible disclosure and despite reasonable safeguards do not violate HIPAA, such as calling a patient's name in a waiting room.

Question 121: What is a patient portal?

A pharmacy drive-through
A secure online platform allowing patients to access their health records, communicate with providers, and manage appointments (Correct answer)
A hospital entrance
An emergency room triage area

Correct answer: A secure online platform allowing patients to access their health records, communicate with providers, and manage appointments

Patient portals empower patients by providing convenient access to their health information and care management tools.

Question 122: In healthcare quality terminology, a 'never event' is defined as:

A serious, largely preventable patient safety incident that should never occur in a well-run system (Correct answer)
An undocumented complication discovered during retrospective record review
A billing error identified during a payer compliance audit
An adverse event that is statistically rare but clinically possible

Correct answer: A serious, largely preventable patient safety incident that should never occur in a well-run system

Never events, as defined by the NQF, are serious reportable events that are clearly identifiable, measurable, largely preventable, and signal a need for immediate investigation.

Question 123: Which of the following illustrates prospective utilization management?

Patient's medical claims are denied.
Surgical treatments require preauthorization from your insurance company. (Correct answer)
The patient's care is evaluated to assess if the degree of treatment is suitable.
As the patient's condition improves, their care is transferred from the ICU to the cardiac unit.

Correct answer: Surgical treatments require preauthorization from your insurance company.

Prospective utilization management involves evaluating the medical necessity and appropriateness of healthcare services *before* they are rendered. Requiring preauthorization from an insurance company for surgical treatments is a prime example of this. This process ensures that services are justified and meet coverage criteria prior to the patient receiving care, helping to control costs and ensure appropriate utilization.

Question 124: How do Hospital-Acquired Conditions (HACs) affect Medicare reimbursement under current CMS policy?

They require hospitals to issue direct refunds to affected patients
They trigger increased payments to cover the cost of additional treatment
They result in reduced or eliminated additional payment for the preventable complication (Correct answer)
They automatically suspend a hospital's billing privileges

Correct answer: They result in reduced or eliminated additional payment for the preventable complication

CMS does not pay the higher DRG rate for cases where a HAC was not present on admission and could reasonably have been prevented, incentivizing hospitals to reduce preventable complications.

Question 125: Which federal program publicly reports hospital quality measure performance data online as a condition of participation in Medicare?

HITECH Act attestation reporting
Hospital Compare / Care Compare (Correct answer)
Medicare Advantage quality ratings
HIPAA Privacy Rule reporting requirements

Correct answer: Hospital Compare / Care Compare

CMS's Care Compare (formerly Hospital Compare) website publicly reports hospital performance on quality measures, enabling consumers to compare hospitals and incentivizing transparency.

Question 126: The HITECH Act strengthened HIPAA enforcement by introducing which of the following changes?

Allowing patients to sell their own PHI
Removing civil money penalties for small providers
Eliminating the minimum necessary standard
Applying HIPAA obligations directly to business associates (Correct answer)

Correct answer: Applying HIPAA obligations directly to business associates

HITECH extended direct HIPAA liability to business associates, requiring them to comply with applicable HIPAA Security Rule safeguards independently of their covered entity contracts.

Question 127: Which organization jointly developed the Official Guidelines for Coding and Reporting used with ICD-10-CM in the US?

AMA and AHA only
CMS, NCHS, AHA, and AHIMA (Correct answer)
CMS and AMA only
WHO and CMS

Correct answer: CMS, NCHS, AHA, and AHIMA

The Official Guidelines are a cooperative effort of four organizations: CMS, NCHS, AHA, and AHIMA.

Question 128: What is master patient index (MPI)?

An insurance company database
A list of the best patients
A database that assigns a unique identifier to each patient and cross-references all their records (Correct answer)
A hospital's main telephone directory

Correct answer: A database that assigns a unique identifier to each patient and cross-references all their records

The MPI ensures each patient has one unique identifier across all systems, preventing duplicate records and enabling accurate record retrieval.

Question 129: Which FHIR resource type is used to represent a patient's longitudinal clinical record summary, including problems, medications, and allergies?

DocumentReference
Composition (used in CCD/C-CDA) (Correct answer)
Encounter
CarePlan

Correct answer: Composition (used in CCD/C-CDA)

The FHIR Composition resource assembles a set of clinical resources into a coherent document, and is the basis for the Consolidated CDA (C-CDA) mapped in FHIR, representing a summary record.

Question 130: Discharge summary documents must contain:

significant results during the hospitalization. (Correct answer)
a complete patient history.
a message from social services or discharge planning.
correct codes for important processes.

Correct answer: significant results during the hospitalization.

A discharge summary is a critical document that provides a concise yet comprehensive overview of a patient's entire hospitalization. It must clearly summarize significant findings, the course of treatment, procedures performed, and the patient's condition at discharge. Including significant results ensures that subsequent healthcare providers have essential information for continuity of care and understanding the patient's medical journey.

Question 131: What is CPT coding?

Current Procedural Terminology — standardized codes for medical procedures and services (Correct answer)
A patient classification system
A coding language for computers
A type of medical test

Correct answer: Current Procedural Terminology — standardized codes for medical procedures and services

CPT codes, maintained by the AMA, describe medical, surgical, and diagnostic procedures for billing and reporting purposes.

Question 132: Which type of Health Information Exchange (HIE) model allows participants to query and retrieve patient data stored at individual provider sites without a centralized repository?

Centralized HIE
Hybrid HIE
Federated HIE (Correct answer)
Consolidated HIE

Correct answer: Federated HIE

A federated HIE model keeps data at the source and enables queries directly to participating organizations rather than storing data in a central repository.

Question 133: What is record retention policy?

Guidelines specifying how long different types of health records must be kept before destruction (Correct answer)
Retention is optional
Destroying records immediately after discharge
Keeping all records forever

Correct answer: Guidelines specifying how long different types of health records must be kept before destruction

Retention policies specify minimum retention periods based on federal/state law, accreditation requirements, and organizational needs, varying by record type and patient age.

Question 134: What is an audit trail in health information?

A patient walking route
A hiking path through a hospital
A chronological record showing who accessed, modified, or deleted data and when (Correct answer)
A financial spreadsheet

Correct answer: A chronological record showing who accessed, modified, or deleted data and when

Audit trails create accountability by tracking all interactions with health data.

Question 135: Which challenge in HIE specifically refers to the difficulty of correctly linking records belonging to the same patient across different systems?

Data normalization
Consent management
Semantic interoperability
Patient identity matching / record linkage (Correct answer)

Correct answer: Patient identity matching / record linkage

Patient identity matching (record linkage) is the process of determining whether records from different systems refer to the same individual, a core challenge in HIE due to inconsistent identifiers.

Question 136: A hospital's health information management department receives a subpoena for a patient's records. The correct first action is to:

Immediately release the records to the court
Release only a summary of the records
Notify the patient and consult legal counsel before releasing (Correct answer)
Refuse the subpoena because HIPAA prohibits court disclosures

Correct answer: Notify the patient and consult legal counsel before releasing

Upon receiving a subpoena, HIM professionals should notify the patient (when required) and consult legal counsel to determine if the subpoena meets HIPAA requirements before releasing records.

Question 137: What is the purpose of a 'physician advisor' in a CDI program?

To review complex clinical documentation issues and support query escalations (Correct answer)
To replace CDI specialists for all queries
To assign final MS-DRGs after discharge
To perform utilization management reviews only

Correct answer: To review complex clinical documentation issues and support query escalations

A physician advisor supports CDI programs by reviewing clinically complex cases, educating physicians, and resolving disputes between CDI specialists and attending physicians.

Question 138: The HIPAA Security Rule applies to which type of health information?

Electronic PHI (ePHI) only (Correct answer)
Paper records only
Verbal communications only
All PHI in any format

Correct answer: Electronic PHI (ePHI) only

The HIPAA Security Rule exclusively governs electronic protected health information (ePHI) — PHI that is created, stored, transmitted, or received in electronic form.

Question 139: Which data quality characteristic refers to whether data values fall within an expected or acceptable range for a given data element?

Completeness
Consistency
Timeliness
Validity (Correct answer)

Correct answer: Validity

Data validity means the data conforms to an expected format, range, or set of permissible values — for example, a patient age of 250 would fail a validity check.

Question 140: Which of the following is a form or view that is commonly seen in the health records of long-term care patients but is uncommon in the records of acute care patients?

pharmacy consultation (Correct answer)
medical consultation
physical exam
emergency record

Correct answer: pharmacy consultation

Pharmacy consultations are much more common and extensively documented in the health records of long-term care patients compared to acute care patients. Long-term care residents often have complex medication regimens due to multiple chronic conditions, making ongoing pharmacy review crucial for medication management, drug interaction prevention, and ensuring patient safety and adherence.

Question 141: Under HIPAA, what is a 'business associate'?

Any vendor that sells products to a hospital
An employee of the covered entity
A person or entity that performs functions or activities on behalf of a covered entity involving PHI (Correct answer)
A health plan member

Correct answer: A person or entity that performs functions or activities on behalf of a covered entity involving PHI

A business associate is a person or organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a function or service.

Question 142: Denial management analysis in a health information quality program is BEST used to:

Measure coder attendance and individual productivity metrics
Schedule concurrent record reviews during patient admissions
Identify patterns in claim denials linked to coding or documentation deficiencies (Correct answer)
Generate project timelines and Gantt charts for HIM leadership

Correct answer: Identify patterns in claim denials linked to coding or documentation deficiencies

Analyzing denial patterns by payer, DRG, or denial reason helps identify systemic coding or documentation issues that can be corrected to improve clean claim rates.

Question 143: A data steward's PRIMARY responsibility in health information governance is to:

Ensure data quality and appropriate use within an assigned domain (Correct answer)
Negotiate payer contracts
Oversee clinical staff credentialing
Approve IT infrastructure purchases

Correct answer: Ensure data quality and appropriate use within an assigned domain

Data stewards are accountable for the quality, integrity, and appropriate use of data elements within their assigned subject area or domain.

Question 144: What must a covered entity include in its Notice of Privacy Practices (NPP)?

A list of all patients' names and diagnoses
The facility's billing codes and fee schedule
A description of how PHI may be used and disclosed, patient rights, and how to file a complaint with HHS (Correct answer)
Employee access log policies only

Correct answer: A description of how PHI may be used and disclosed, patient rights, and how to file a complaint with HHS

The NPP must describe the covered entity's uses and disclosures of PHI, patient rights (access, amendment, accounting), how to exercise those rights, and how to file a complaint with HHS OCR.

Question 145: In the Plan-Do-Study-Act (PDSA) cycle, what occurs during the 'Study' phase?

The change is formally adopted or abandoned
Data is analyzed and compared to predictions (Correct answer)
A change is implemented at full organizational scale
Objectives and predictions are established for the test

Correct answer: Data is analyzed and compared to predictions

The Study phase involves analyzing the data collected during the Do phase and comparing actual results to predicted outcomes to determine what was learned.

Question 146: A Qualified Health Information Network (QHIN) under TEFCA is best described as:

A vendor that sells EHR software certified for interoperability
A federal agency that regulates health data exchange
A nationally recognized network that connects to other QHINs to enable nationwide exchange (Correct answer)
A state-designated entity that operates a regional HIE

Correct answer: A nationally recognized network that connects to other QHINs to enable nationwide exchange

QHINs are designated entities under TEFCA that connect to each other and to the Recognized Coordinating Entity (RCE) to enable trusted, nationwide health information exchange.

Question 147: Under HIPAA, a 'business associate' is best defined as:

A hospital that receives transferred patients
A person or entity that performs functions involving PHI on behalf of a covered entity (Correct answer)
A government agency that audits covered entities
Any employee of a covered entity who accesses PHI

Correct answer: A person or entity that performs functions involving PHI on behalf of a covered entity

A business associate is an external person or organization that performs activities or functions involving PHI on behalf of or for a covered entity, such as billing companies or IT vendors.

Question 148: What is prior authorization?

A doctor's license verification
A patient's signature on a consent form
A hospital's accreditation
Approval from an insurance company required before certain services are provided (Correct answer)

Correct answer: Approval from an insurance company required before certain services are provided

Prior authorization requires providers to obtain insurance company approval before delivering specific services, ensuring medical necessity and coverage.

Question 149: What is patient safety culture?

A patient education program
Hospital decoration standards
An organizational culture that prioritizes safety through open reporting, learning from errors, and systems thinking (Correct answer)
A nursing philosophy

Correct answer: An organizational culture that prioritizes safety through open reporting, learning from errors, and systems thinking

A strong safety culture encourages error reporting without blame, learns from mistakes, and continuously improves systems.

Question 150: Which MS-DRG complication or comorbidity (CC) level carries the highest relative weight and reimbursement impact?

No CC/MCC
CC (Complication or Comorbidity)
Secondary CC
MCC (Major Complication or Comorbidity) (Correct answer)

Correct answer: MCC (Major Complication or Comorbidity)

MCCs (Major Complications or Comorbidities) carry the highest relative weight in MS-DRG grouping, reflecting greater resource utilization.

Question 151: What is a 'concurrent' CDI review?

Review performed after the patient is discharged
Review performed only on surgical cases
Review performed while the patient is still admitted (Correct answer)
Review performed by an external auditor

Correct answer: Review performed while the patient is still admitted

Concurrent CDI review occurs while the patient is still hospitalized, allowing queries to be answered before discharge and the record is coded.

Question 152: The Institute for Healthcare Improvement's 'Triple Aim' framework focuses on simultaneously improving which three dimensions?

Cost, quality, and patient safety
Clinical outcomes, documentation accuracy, and coding quality
Access, efficiency, and staff satisfaction
Population health, patient experience, and per capita cost (Correct answer)

Correct answer: Population health, patient experience, and per capita cost

The Triple Aim targets better health for populations, better care experiences for individuals, and lower per capita costs for healthcare systems.

Question 153: Which statute established the legal authority for Medicare and Medicaid and is the primary source of federal healthcare entitlement law?

The Affordable Care Act
Title XVIII and XIX of the Social Security Act (Correct answer)
HIPAA
The Public Health Service Act

Correct answer: Title XVIII and XIX of the Social Security Act

Medicare (Title XVIII) and Medicaid (Title XIX) were established as amendments to the Social Security Act in 1965 and remain the statutory foundation for these federal healthcare programs.

Question 154: What is the legal health record?

Only the billing records
The documentation of healthcare services maintained by an organization that serves as its business and legal record (Correct answer)
The patient's personal health journal
Any notes a doctor writes

Correct answer: The documentation of healthcare services maintained by an organization that serves as its business and legal record

The legal health record is the subset of all patient data that the organization defines as its official business record, used for legal proceedings, patient requests, and audits.

Question 155: The AHIMA Information Governance Adoption Model (IGAM) is structured around how many core competency areas?

4
16
12
8 (Correct answer)

Correct answer: 8

The AHIMA IGAM is organized around 8 core information governance competency areas that organizations use to assess and advance their IG maturity.

Question 156: What is revenue cycle management in healthcare?

Counting daily patient visits
Setting doctor salaries
The financial process tracking patient service from registration through final payment (Correct answer)
Managing hospital revenue only from grants

Correct answer: The financial process tracking patient service from registration through final payment

RCM encompasses the entire financial lifecycle: patient registration, insurance verification, coding, claim submission, payment posting, and collections.

Question 157: What is meaningful use of EHR?

Federal criteria for using certified EHR technology to improve quality, safety, and efficiency (Correct answer)
Any use of electronic records
A type of health insurance
Using computers meaningfully

Correct answer: Federal criteria for using certified EHR technology to improve quality, safety, and efficiency

Meaningful use (now Promoting Interoperability) sets specific criteria for using EHR technology to improve care quality and earn incentive payments.

Question 158: Ambulatory care professionals are more likely than acute care providers to use the information available in the ______________________.

problem list (Correct answer)
transfer record
discharge summary
interdisciplinary patient care plan

Correct answer: problem list

Ambulatory care professionals, who manage ongoing outpatient visits, rely heavily on a problem list to track a patient's chronic and acute health issues over time. This list provides a concise, longitudinal summary of all active and inactive problems, facilitating continuity of care and informed decision-making across multiple encounters. Acute care, being more episodic, focuses more on the immediate admission and discharge diagnoses.

Question 159: What is informed consent documentation?

A general hospital admission form
A billing authorization
An insurance application
A record showing the patient was informed of risks, benefits, and alternatives before agreeing to treatment (Correct answer)

Correct answer: A record showing the patient was informed of risks, benefits, and alternatives before agreeing to treatment

Informed consent documents demonstrate the patient received sufficient information to make a voluntary, knowledgeable decision about their care.

Question 160: What is accounts receivable in healthcare?

Prepaid insurance premiums
Money in the bank
Government grants received
Money owed to the healthcare organization for services already provided (Correct answer)

Correct answer: Money owed to the healthcare organization for services already provided

Accounts receivable represents outstanding payments for services rendered, tracked by age (30, 60, 90+ days) to monitor collection efficiency.

Question 161: What is data integrity in health information?

The accuracy, completeness, consistency, and reliability of data throughout its lifecycle (Correct answer)
Data encryption only
Backing up files
Having a large database

Correct answer: The accuracy, completeness, consistency, and reliability of data throughout its lifecycle

Data integrity ensures health information is accurate, complete, consistently formatted, and reliable from creation through storage and retrieval.

Question 162: What is HL7 in health IT?

Health Level Seven — a set of international standards for sharing electronic health information (Correct answer)
A drug classification
A vital sign measurement
A hospital floor designation

Correct answer: Health Level Seven — a set of international standards for sharing electronic health information

HL7 standards enable different health IT systems to communicate by defining how data is formatted, transmitted, and interpreted.

Question 163: What is health information exchange (HIE)?

A type of insurance plan
The electronic sharing of health information between organizations according to national standards (Correct answer)
Exchanging paper records between hospitals
Email between doctors

Correct answer: The electronic sharing of health information between organizations according to national standards

HIE enables the electronic movement of health information among disparate healthcare organizations, improving care coordination and reducing duplicate testing.

Question 164: Which CMS program adjusts hospital inpatient payments based on performance on quality, safety, and patient experience measures?

Physician Quality Reporting System (PQRS)
Meaningful Use Incentive Program
Hospital Value-Based Purchasing (VBP) (Correct answer)
Promoting Interoperability Program

Correct answer: Hospital Value-Based Purchasing (VBP)

The Hospital VBP program withholds a percentage of base operating DRG payments and redistributes them based on hospital performance across clinical outcomes, safety, and patient experience domains.

Question 165: Under the HIPAA Privacy Rule, a covered entity's 'workforce' includes:

Only paid, full-time employees
Employees, volunteers, trainees, and others under direct control of the covered entity (Correct answer)
Only individuals with direct patient contact
Only licensed clinical staff

Correct answer: Employees, volunteers, trainees, and others under direct control of the covered entity

HIPAA's definition of workforce broadly includes employees, volunteers, trainees, and other persons under the direct control of a covered entity, regardless of compensation.

Question 166: Under HIPAA, who is considered a 'personal representative' with rights to access a patient's PHI?

Any family member who requests records
A hospital's compliance officer
A patient's primary care physician
A person with legal authority to make health care decisions on behalf of the patient, such as a legal guardian or holder of a healthcare power of attorney (Correct answer)

Correct answer: A person with legal authority to make health care decisions on behalf of the patient, such as a legal guardian or holder of a healthcare power of attorney

HIPAA recognizes personal representatives — those with legal authority to act on a patient's behalf regarding healthcare decisions — as having the same rights as the patient to access PHI.

Question 167: In healthcare compliance, a 'corporate integrity agreement' (CIA) is typically entered into between a provider and:

The Office of Inspector General (OIG) (Correct answer)
CMS
State Medicaid agency
The Joint Commission

Correct answer: The Office of Inspector General (OIG)

Corporate Integrity Agreements are negotiated between the OIG and providers as an alternative to exclusion from federal healthcare programs following fraud or abuse settlements.

Question 168: What is healthcare compliance?

Hospital cleanliness
Adhering to laws, regulations, and ethical standards governing healthcare operations (Correct answer)
Insurance claim processing
Patient compliance with treatment

Correct answer: Adhering to laws, regulations, and ethical standards governing healthcare operations

Healthcare compliance ensures organizations follow all applicable laws, regulations, and standards.

Question 169: What is a release of information (ROI) process?

Releasing new software
The procedure for disclosing patient health information in response to authorized requests (Correct answer)
Announcing hospital policies
Publishing medical research

Correct answer: The procedure for disclosing patient health information in response to authorized requests

ROI involves verifying authorization, identifying requested records, reviewing for compliance, and disclosing only the minimum necessary information.

Question 170: What is a HIPAA breach notification?

A patient complaint form
A system error report
An optional courtesy notification
Required notification to affected individuals and HHS when unsecured PHI is improperly accessed or disclosed (Correct answer)

Correct answer: Required notification to affected individuals and HHS when unsecured PHI is improperly accessed or disclosed

Breach notification rules require covered entities to notify affected individuals, HHS, and sometimes media when a breach of unsecured PHI occurs.

Question 171: A good opening step toward maintaining the security of data included in a health information computer system would be ______________________.

define security levels for various sorts of information based on their sensitivity. (Correct answer)
create a good tracking system.
offer online access to facility records.
offer remote terminals for easier access to the records.

Correct answer: define security levels for various sorts of information based on their sensitivity.

A crucial initial step in maintaining the security of data in a health information computer system is to define security levels based on the sensitivity of various types of information. This allows for the implementation of appropriate access controls and safeguards tailored to the risk associated with different data, ensuring that highly sensitive information receives the strongest protection and preventing unauthorized access.

Question 172: What is data warehousing in healthcare?

A cold storage for vaccines
A pharmacy inventory system
A physical storage facility for medical supplies
A centralized repository storing integrated data from multiple sources for analysis and reporting (Correct answer)

Correct answer: A centralized repository storing integrated data from multiple sources for analysis and reporting

Data warehouses consolidate information from various clinical and administrative systems for comprehensive analysis and reporting.

Question 173: What is Protected Health Information (PHI)?

Any individually identifiable health information including demographics, diagnoses, and treatment records (Correct answer)
Only billing records
Only a patient's name
Only insurance information

Correct answer: Any individually identifiable health information including demographics, diagnoses, and treatment records

PHI includes any information that can identify an individual and relates to their health condition, care, or payment, in any form (paper, electronic, oral).

Question 174: What does 'specificity' mean in the context of ICD-10-CM coding for CDI purposes?

Using the fewest possible codes
Assigning codes based on lab values
Selecting the most detailed code that accurately reflects the documented condition (Correct answer)
Coding only confirmed diagnoses

Correct answer: Selecting the most detailed code that accurately reflects the documented condition

ICD-10-CM requires coding to the highest level of specificity, using the most detailed code available that accurately represents the condition.

Question 175: Which regulation specifically governs the privacy and security of substance use disorder treatment records?

HIPAA Privacy Rule
42 CFR Part 2 (Correct answer)
HITECH Act
CMS Conditions of Participation

Correct answer: 42 CFR Part 2

42 CFR Part 2 provides stricter federal protections for records related to substance use disorder treatment programs.

Question 176: What is the purpose of medical coding?

To create passwords
To translate diagnoses, procedures, and services into universal alphanumeric codes for billing and data analysis (Correct answer)
To encrypt patient records
To organize medical supplies

Correct answer: To translate diagnoses, procedures, and services into universal alphanumeric codes for billing and data analysis

Medical coding converts clinical documentation into standardized codes that support billing, research, public health monitoring, and quality measurement.

Question 177: What does the term 'principal diagnosis' mean in the context of US inpatient coding under UHDDS guidelines?

The condition established after study to be chiefly responsible for the admission (Correct answer)
The first diagnosis listed by the physician
The most severe diagnosis the patient has
The diagnosis that generated the most charges

Correct answer: The condition established after study to be chiefly responsible for the admission

The Uniform Hospital Discharge Data Set (UHDDS) defines the principal diagnosis as the condition established after study to be chiefly responsible for causing the admission.

Question 178: Which of the following is an example of a permitted disclosure of PHI without patient authorization under HIPAA's public interest exceptions?

Disclosing records for employment background checks
Reporting communicable diseases to a state or local public health authority (Correct answer)
Sharing records with a patient's adult child without consent
Providing records to a marketing research firm

Correct answer: Reporting communicable diseases to a state or local public health authority

HIPAA permits disclosure of PHI without authorization to public health authorities authorized by law to collect information for preventing or controlling disease or injury.

Question 179: Which legal doctrine holds that a patient's medical record created during treatment is the property of the healthcare facility?

Stare decisis
Respondeat superior
Custodial ownership doctrine (Correct answer)
Res ipsa loquitur

Correct answer: Custodial ownership doctrine

The custodial ownership doctrine establishes that while the physical medical record belongs to the healthcare facility, the patient retains the right to access the information contained within it.

Question 180: What career paths exist in health information management?

Only hospital administration
Only IT positions
Coding specialist, privacy officer, data analyst, HIM director, compliance officer, and clinical documentation specialist (Correct answer)
Only coding positions

Correct answer: Coding specialist, privacy officer, data analyst, HIM director, compliance officer, and clinical documentation specialist

HIM offers diverse career paths spanning clinical, technical, administrative, and leadership roles.

AHIMA Registered Health Information Administrator Exam

The AHIMA (American Health Information Management Association) administers credentials including the RHIA (Registered Health Information Administrator) and RHIT (Registered Health Information Technician). The exams cover health records management, medical coding and classification, HIPAA privacy and security, healthcare data analytics, revenue cycle management, health information governance, quality improvement, compliance and legal standards, health IT systems, clinical documentation improvement, and release of information.

180

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy