CEHRS Patient Portal and Education 2 — Questions and Answers
Question 1: A patient calls to say they cannot access their portal account after three failed login attempts. What is the most appropriate first step?
- Delete and recreate the account
- Walk the patient through the account lockout reset or password recovery process (Correct answer)
- Provide the patient with their password over the phone
- Escalate immediately to the IT department without assisting the patient
Correct answer: Walk the patient through the account lockout reset or password recovery process
Most portals have a built-in lockout reset or password recovery workflow that staff should guide patients through to restore access securely.
Question 2: Which federal rule requires covered entities to provide patients electronic access to their health information upon request?
- HITECH Act amendments to HIPAA (Correct answer)
- Stark Law
- False Claims Act
- Emergency Medical Treatment and Labor Act (EMTALA)
Correct answer: HITECH Act amendments to HIPAA
The HITECH Act strengthened HIPAA by mandating that covered entities grant patients timely electronic access to their designated record sets.
Question 3: A portal message from a patient asks for a refill of a controlled substance. What is the most appropriate response?
- Process the refill immediately through the portal
- Instruct the patient that controlled substance refills require an in-person or telehealth visit per prescribing rules (Correct answer)
- Ignore the message and wait for the patient to call
- Send a generic response saying the portal cannot handle medication requests
Correct answer: Instruct the patient that controlled substance refills require an in-person or telehealth visit per prescribing rules
Controlled substance refills typically require a clinical evaluation and cannot be authorized solely through a portal message per DEA and state regulations.
Question 4: What does 'proxy access' mean in the context of a patient portal?
- A firewall setting that hides patient data from external networks
- Permission granted to a designated person to view or manage another patient's portal account (Correct answer)
- A secondary login used only by clinical staff
- An encrypted backup of portal credentials
Correct answer: Permission granted to a designated person to view or manage another patient's portal account
Proxy access allows an authorized representative, such as a parent or caregiver, to access another patient's portal on their behalf.
Question 5: A patient education document in the portal is written at a 14th-grade reading level. Why is this a concern?
- It violates HIPAA privacy rules
- It exceeds the recommended 6th–8th grade reading level, reducing patient comprehension (Correct answer)
- It is too short to be useful
- High reading levels are preferred for legal compliance
Correct answer: It exceeds the recommended 6th–8th grade reading level, reducing patient comprehension
Health literacy best practices recommend patient education materials be written at a 6th–8th grade reading level to maximize understanding across diverse populations.
Question 6: Which portal feature most directly supports chronic disease self-management by patients?
- Ability to view billing statements
- Secure messaging with care team and access to condition-specific education resources (Correct answer)
- Online appointment scheduling for new patients only
- PDF download of the facility's annual report
Correct answer: Secure messaging with care team and access to condition-specific education resources
Secure messaging and condition-specific education empower patients with chronic conditions to communicate with their care team and understand their disease management.
Question 7: When a patient opts out of the patient portal entirely, what obligation remains for the healthcare organization?
- The organization has no further obligation to provide records
- The organization must still provide access to records through alternative means such as paper copies (Correct answer)
- The patient forfeits all rights to their medical records
- The organization must re-enroll the patient automatically after 90 days
Correct answer: The organization must still provide access to records through alternative means such as paper copies
Opting out of the portal does not waive a patient's legal right to their records; the organization must offer alternative access methods.
CEHRS Patient Portal and Education 2
A patient calls to say they cannot access their portal account after three failed login attempts.
What is the most appropriate first step?