CEHRS CEHRS Interoperability and Health Information Exchange 5 — Questions and Answers
Question 1: A CEHRS professional needs to ensure that a FHIR API endpoint only returns data the requesting application is authorized to access. Which protocol is MOST appropriate for this authorization?
- SAML 2.0
- OAuth 2.0 (Correct answer)
- Kerberos
- LDAP
Correct answer: OAuth 2.0
SMART on FHIR uses OAuth 2.0 as its authorization framework, allowing fine-grained access control for FHIR API resources.
Question 2: Which of the following is an example of a 'patient-mediated' health information exchange?
- A hospital query to an HIE for ED records
- A patient using Apple Health to aggregate and share records (Correct answer)
- A lab sending HL7 results to an EHR
- A provider sending a Direct message referral
Correct answer: A patient using Apple Health to aggregate and share records
Consumer- or patient-mediated exchange puts the patient in control of aggregating and sharing their own health data through apps or personal health records.
Question 3: What does the term 'semantic interoperability' mean in the context of health information exchange?
- Systems can transmit data without errors
- Systems share data using the same transport protocol
- Receiving systems understand the meaning of data the same way the sender intended (Correct answer)
- Patient consent is obtained before data is shared
Correct answer: Receiving systems understand the meaning of data the same way the sender intended
Semantic interoperability ensures that shared data is interpreted with the same clinical meaning at both the sending and receiving ends, enabled by standardized terminologies like SNOMED CT and LOINC.
Question 4: A health system's interface engine receives an HL7 ADT A08 message. What event does this message type signal?
- Patient admission
- Patient discharge
- Patient information update (Correct answer)
- Patient transfer
Correct answer: Patient information update
The HL7 ADT A08 event type is 'Update Patient Information,' used when demographic or other patient details change without a status change.
Question 5: Which regulation requires that patients be provided with access to their electronic health information without special effort, and penalizes information blocking with civil monetary penalties?
- HIPAA Privacy Rule
- 21st Century Cures Act Final Rule (ONC) (Correct answer)
- Meaningful Use Stage 3
- HITECH Breach Notification Rule
Correct answer: 21st Century Cures Act Final Rule (ONC)
The ONC's 21st Century Cures Act Final Rule (2020) established information blocking prohibitions and mandated FHIR-based patient access APIs.
Question 6: In a federated HIE architecture, where does patient data physically reside?
- In a single central HIE repository
- Distributed across each participating organization's own systems (Correct answer)
- In a cloud-only environment managed by the HIE operator
- On patient-owned portable devices only
Correct answer: Distributed across each participating organization's own systems
Federated HIEs leave data at each source organization; queries are routed to member systems on demand rather than pulling data into a central store.
Question 7: A specialist clinic receives a Continuity of Care Document (CCD) from a referring primary care physician. Which section of the CCD contains the patient's current medication list?
- Encounters section
- Medications section (Correct answer)
- Problem List section
- Results section
Correct answer: Medications section
The Medications section of a CCD (a Consolidated-CDA document type) documents active, historical, and administered medications using structured RxNorm codes.
CEHRS CEHRS Interoperability and Health Information Exchange 5
A CEHRS professional needs to ensure that a FHIR API endpoint only returns data the requesting application is authorized to access.
Which protocol is MOST appropriate for this authorization?