CEHRS - Certified Electronic Health Records Specialist HIPAA and Patient Confidentiality Questions and Answers

Question 1

A CEHRS is working at the registration desk when a patient's friend approaches and asks for an update on the patient's condition.
The friend is not listed on any of the patient's authorization forms.
Which of the following is the MOST appropriate response?

Accepted Answer

"I'm sorry, but due to privacy laws, I cannot confirm or deny whether that person is a patient here."

Answer

"I can confirm they are here, but you will need to speak directly with the patient for any health updates."

Answer

"Let me check the chart quickly to see if I can give you a general update."

Answer

"The patient is doing fine, but for more details, you should wait for the doctor."

Question 2

The HIPAA Security Rule requires covered entities to implement specific safeguards to protect electronic protected health information (ePHI). Which of the following is an example of an administrative safeguard?

Accepted Answer

Implementing policies for sanctioning employees who violate HIPAA.

Answer

Installing encrypted software on all workstations.

Answer

Positioning computer monitors to prevent viewing by the public.

Answer

Using key card access for rooms containing servers with ePHI.

Question 3

A CEHRS receives a request from the billing department for a patient's entire medical record to verify a single service date. Which HIPAA principle should guide the CEHRS's response?

Accepted Answer

Minimum Necessary Standard

Answer

Patient's Right of Access

Answer

Breach Notification Rule

Answer

Notice of Privacy Practices

Question 4

During a busy clinic session, a CEHRS accidentally hands a patient a visit summary belonging to another patient. The patient returns the document immediately. What is the CEHRS's first and most critical action?

Accepted Answer

Report the incident to the designated Privacy Officer.

Answer

Shred the document immediately to destroy the evidence.

Answer

Apologize to the patient and ask them not to tell anyone.

Answer

Wait to see if the patient whose information was disclosed files a complaint.

Question 5

Which of the following is a primary purpose of the Notice of Privacy Practices (NPP) given to patients?

Accepted Answer

To inform patients of their privacy rights and how their PHI may be used.

Answer

To obtain a patient's consent for all future treatments and procedures.

Answer

To serve as a legal waiver protecting the facility from all lawsuits.

Answer

To collect emergency contact and insurance information from the patient.

Question 6

A patient submits a written request for a copy of their electronic health record to be sent to their personal email. According to the HIPAA Privacy Rule's Right of Access, what is the covered entity's obligation?

Accepted Answer

To provide the record in the requested electronic format, after informing the patient of the risks.

Answer

To refuse the request, as email is not a secure method of transmission.

Answer

To mail a paper copy to the patient's home address instead.

Answer

To require the patient to come to the office and view the record on-screen only.