CPHIMS Certification Exam — Questions and Answers

Question 1: Under HIPAA, who bears ultimate accountability for ensuring a covered entity's compliance with security regulations?

The CISO
The organization's leadership/Board (Correct answer)
The Privacy Officer
The IT Department

Correct answer: The organization's leadership/Board

Ultimate accountability for HIPAA compliance rests with the organization's senior leadership and governing board, not individual staff roles.

Question 2: What does HL7 FHIR stand for?

Federal Health Information Repository
Fast Health Interoperability Resources (Correct answer)
Federated Healthcare Integrated Records
Fast Healthcare Information Retrieval

Correct answer: Fast Health Interoperability Resources

FHIR stands for Fast Health Interoperability Resources, a standard developed by HL7 for exchanging healthcare information electronically using modern web technologies.

Question 3: A Chief Information Officer (CIO) wants to demonstrate the value of IT investments beyond just financial metrics. They implement a performance management framework that tracks metrics across four key areas: Financial, Customer (Patient), Internal Processes, and Learning & Growth. This approach allows for a more holistic view of IT's contribution to the organization's strategic goals. Which framework is the CIO using?

ITIL (Information Technology Infrastructure Library)
Project Management Body of Knowledge (PMBOK)
Balanced Scorecard (Correct answer)
COBIT (Control Objectives for Information and Related Technologies)

Correct answer: Balanced Scorecard

The Balanced Scorecard is a strategic performance management framework that provides a comprehensive view of an organization by measuring performance across four key perspectives: Financial, Customer, Internal Processes, and Learning & Growth. This method is specifically designed to move beyond purely financial measures to align initiatives with overall strategy.

Question 4: After a successful EHR go-live, the organization conducts a benefits realization review at six months. Which outcome BEST demonstrates that implementation objectives were achieved?

The vendor has resolved all outstanding defect tickets
Measured improvements in clinical workflow efficiency, medication error reduction, and staff satisfaction align with pre-defined success criteria (Correct answer)
All legacy systems have been fully decommissioned
The project was completed within budget and on schedule

Correct answer: Measured improvements in clinical workflow efficiency, medication error reduction, and staff satisfaction align with pre-defined success criteria

Benefits realization measures actual operational and clinical outcomes against the success criteria defined at project initiation to confirm value delivery.

Question 5: A CPHIMS professional is asked to justify an infrastructure upgrade. Which document best communicates business value to executive leadership?

Risk register
Project charter only
Business case with cost-benefit analysis (Correct answer)
Technical specification document

Correct answer: Business case with cost-benefit analysis

A business case with cost-benefit analysis presents financial justification, strategic alignment, and risk considerations in terms executives can evaluate.

Question 6: Which data exchange framework, developed by CommonWell Health Alliance and Carequality, focuses on establishing trust between different HIE networks to enable broad nationwide data sharing?

The eHealth Exchange
The Strategic Health IT Advanced Research Projects (SHARP)
The Patient Unified Lookup System for Emergencies (PULSE)
The Commonwell-Carequality Bridge (Correct answer)

Correct answer: The Commonwell-Carequality Bridge

The CommonWell-Carequality Bridge connects the two largest national interoperability networks, enabling their combined participants to exchange health information regardless of which network they belong to.

Question 7: A hospital is implementing a new EHR system and wants to test all interfaces between subsystems. Which type of testing is most appropriate?

Unit testing
Regression testing
Integration testing (Correct answer)
Stress testing

Correct answer: Integration testing

Integration testing validates that different subsystems and interfaces work correctly together as a combined system.

Question 8: Which database type is most frequently used in the healthcare sector?

Data warehouse
Operational database
Analytical database
Hierarchical database (Correct answer)

Correct answer: Hierarchical database

Hierarchical databases were among the earliest database models developed and are still prevalent in many legacy healthcare systems due to significant prior investments. This model organizes data in a tree-like structure, which can be efficient for certain types of data retrieval common in older medical record systems. Although newer systems often utilize relational or object-oriented databases, the installed base of older systems means hierarchical databases remain frequently encountered in healthcare.

Question 9: A Chief Information Officer (CIO) wants to present a holistic view of the IT department's performance to the executive board, moving beyond purely technical metrics like server uptime. They want to demonstrate how IT contributes to clinical quality, financial performance, and user satisfaction. Which framework would be most suitable for this purpose?

The System Development Life Cycle (SDLC)
The Balanced Scorecard (Correct answer)
The HIPAA Security Rule
The ITIL Framework

Correct answer: The Balanced Scorecard

The Balanced Scorecard is a strategic management framework used to provide a comprehensive view of organizational performance by measuring it across multiple perspectives, typically including Financial, Customer, Internal Business Processes, and Learning and Growth. This allows the CIO to translate IT activities into tangible contributions to the organization's broader strategic goals.

Question 10: Which of the following is the PRIMARY goal of a structured change management process during the implementation of a new health IT system?

To manage the people side of the change and encourage adoption. (Correct answer)
To document the technical specifications of the new hardware.
To accelerate the project timeline regardless of user readiness.
To negotiate a lower price with the software vendor.

Correct answer: To manage the people side of the change and encourage adoption.

Change management is a structured approach focused on managing the people side of change to achieve the desired project outcomes. Its primary goal is to help employees understand, commit to, and adopt new processes or technologies, thereby minimizing resistance and ensuring a successful transition.

Question 11: Which HIE governance model gives patients direct control over who can access and receive their health information?

Centralized repository model
Opt-out with exceptions model
Directed exchange model
Consumer-mediated exchange model (Correct answer)

Correct answer: Consumer-mediated exchange model

Consumer-mediated exchange empowers patients to aggregate and manage their own health information and control how it is shared with providers.

Question 12: Which metric BEST measures the strategic value of a telehealth platform implementation?

Number of support tickets resolved
Patient access improvement and revenue per virtual visit (Correct answer)
Software license cost reduction
Server uptime percentage only

Correct answer: Patient access improvement and revenue per virtual visit

Patient access improvement and revenue per virtual visit directly tie the technology investment to clinical and financial strategic outcomes.

Question 13: A healthcare organization plans to decommission a legacy system six months after go-live of the new EHR. What is the MOST important consideration for the decommission plan?

Training IT staff on the legacy system for ongoing support
Defining a data archival and retrieval strategy for historical patient records (Correct answer)
Migrating all legacy system code into the new EHR
Ensuring legacy system licenses are renewed during the overlap period

Correct answer: Defining a data archival and retrieval strategy for historical patient records

Decommissioning a legacy system requires a clear plan for archiving and retrieving historical data to meet regulatory retention requirements.

Question 14: A project manager is tracking implementation tasks using a Gantt chart and discovers that a delay in interface build will push the go-live date back by two weeks. The interface task is on the critical path. What should the PM do FIRST?

Notify the vendor that the contract SLA has been breached
Analyze options to crash or fast-track the interface build to recover the schedule (Correct answer)
Immediately reschedule the go-live date
Remove the interface from scope to protect the go-live date

Correct answer: Analyze options to crash or fast-track the interface build to recover the schedule

When a critical path task is delayed, the PM should first explore crashing (adding resources) or fast-tracking (overlapping tasks) before rescheduling go-live.

Question 15: In healthcare IT, a project management office (PMO) is PRIMARILY responsible for:

Negotiating vendor contracts for all departments
Standardizing project governance, methodologies, and oversight across the organization (Correct answer)
Providing direct patient care support tools
Managing the hospital's operational IT help desk

Correct answer: Standardizing project governance, methodologies, and oversight across the organization

A PMO establishes standardized processes, governance frameworks, and oversight to ensure consistent project delivery across the healthcare organization.

Question 16: An Accountable Care Organization (ACO) is a healthcare delivery model that is designed to incentivize providers to:

Focus on delivering high-quality, coordinated care while managing costs for a defined patient population. (Correct answer)
Prioritize specialist care over primary and preventive care services.
Increase the volume of services provided to maximize fee-for-service billing.
Operate exclusively within a single hospital setting without external partners.

Correct answer: Focus on delivering high-quality, coordinated care while managing costs for a defined patient population.

The primary goal of an Accountable Care Organization (ACO) is to tie provider reimbursements to quality metrics and reductions in the total cost of care for an assigned population of patients. This model encourages cooperation among providers to improve care quality and coordination, moving away from a pure fee-for-service model.

Question 17: A new results reporting system was recently unveiled by a local reference lab. Once test results are ready, the pathologist's report is immediately sent to the office of the ordering doctor. A systems analyst should look through the following to address patient care during the systems analysis phase:

report turnaround times (Correct answer)
equipment calibration reports
lab volume trend reports
blood splash/exposure incident reports

Correct answer: report turnaround times

During the systems analysis phase, particularly when a new results reporting system is implemented, evaluating report turnaround times is crucial for patient care. Faster and more reliable delivery of test results directly impacts the speed of diagnosis and treatment decisions, which are critical for patient outcomes. Analyzing these times helps ensure the new system is effectively improving the efficiency and quality of care.

Question 18: A health system's board of directors has established a five-year strategic goal to become a national leader in patient-centric telehealth services. What is the MOST critical first step for the IT governance body to ensure alignment with this goal?

Conduct a comprehensive security audit of all existing network infrastructure to identify vulnerabilities.
Hire additional help desk staff to prepare for the increased volume of user support tickets related to new services.
Immediately purchase the highest-rated telehealth platform available on the market to gain a first-mover advantage.
Develop an IT strategic plan that explicitly maps technology initiatives and resource allocation to the telehealth goal. (Correct answer)

Correct answer: Develop an IT strategic plan that explicitly maps technology initiatives and resource allocation to the telehealth goal.

The primary role of IT governance is to ensure that IT strategy aligns with and supports the overall business strategy. Before any purchasing decisions or tactical hiring occurs, a strategic plan must be developed to outline how IT will enable the organization's goals, ensuring that investments are prioritized and resources are allocated effectively.

Question 19: In a healthcare data governance program, a 'data steward' is PRIMARILY responsible for:

Managing the quality, definitions, and appropriate use of data within a specific domain (Correct answer)
Physically securing servers in the data center
Approving vendor invoices for analytics software
Writing code for the enterprise data warehouse ETL pipelines

Correct answer: Managing the quality, definitions, and appropriate use of data within a specific domain

A data steward is a domain expert accountable for maintaining data quality, definitions, and appropriate usage standards within their area (e.g., clinical, financial, or operational data).

Question 20: Which testing environment best simulates real-world production conditions for final validation before go-live?

Training environment
Quality assurance (QA) environment
Staging/pre-production environment (Correct answer)
Development environment

Correct answer: Staging/pre-production environment

The staging or pre-production environment mirrors the production environment as closely as possible, making it ideal for final validation testing.

Question 21: A clinical informaticist reviewing EHR audit logs notices a user accessed 500 patient records in one shift with no matching clinical assignments. This MOST likely indicates:

A well-functioning population health module
A potential privacy breach requiring investigation (Correct answer)
An EHR performance optimization event
Normal behavior for a night-shift charge nurse

Correct answer: A potential privacy breach requiring investigation

Accessing a high volume of records without clinical justification is a red flag for unauthorized access or data breach that must be investigated under HIPAA.

Question 22: Which of the following does a clinical informatics worker in an acute care setting normally NOT need to have knowledge of or experience with?

clinical medicine
population health
quantitative statistics (Correct answer)
computer science

Correct answer: quantitative statistics

Clinical informatics workers in acute care settings primarily focus on the application of information technology to improve patient care, requiring knowledge of clinical medicine, computer science, and population health to understand data trends and system implementation. While data analysis is involved, deep expertise in advanced quantitative statistics is typically not a core requirement for their day-to-day operational roles, which often lean more towards system design, implementation, and user support.

Question 23: The 'five rights' of clinical decision support (5 Rights of CDS) include delivering the right information to the right person EXCEPT which of the following?

At the right time in workflow
In the right intervention format
Through the right channel
At the right cost to the hospital (Correct answer)

Correct answer: At the right cost to the hospital

The 5 Rights of CDS focus on information, person, format, channel, and workflow timing—cost is not one of the five rights.

Question 24: In IT governance, which committee is typically responsible for prioritizing and approving major health IT investments?

Finance Audit Committee
Medical Staff Committee
IT Steering Committee (Correct answer)
Quality Improvement Committee

Correct answer: IT Steering Committee

The IT Steering Committee brings together clinical, operational, and IT leaders to prioritize investments aligned with strategic objectives.

Question 25: Which of the below phrases best defines the format that information takes when it is entered into a computer system?

Data warehouse
Project organization
Information system strategy
Data dictionary (Correct answer)

Correct answer: Data dictionary

A data dictionary is a centralized repository of information about data, including its definition, format, structure, and relationships. It specifies how data elements are named, what type of data they hold (e.g., text, number, date), their length, and any constraints. This ensures consistency and standardization of information as it is entered and stored within a computer system.

Question 26: Which of the following best describes 'capitation' as a healthcare payment model?

Paying providers a set fee for each service rendered
Paying providers a fixed amount per enrolled patient per month regardless of services used (Correct answer)
Reimbursing providers based on reported outcomes
Paying a lump sum for an episode of care

Correct answer: Paying providers a fixed amount per enrolled patient per month regardless of services used

Capitation pays providers a predetermined monthly fee per patient, shifting financial risk to the provider regardless of how many services are actually delivered.

Question 27: What kind of system is used in the healthcare sector to maintain patient records?

Clinical data repository (Correct answer)
Order-entry systems
Object-oriented databases
results-reporting systems

Correct answer: Clinical data repository

A clinical data repository (CDR) is a centralized database designed to store and manage patient-specific clinical data from various sources within a healthcare organization. It serves as the primary system for maintaining comprehensive patient records, integrating information from different departments like labs, radiology, and physician notes, to provide a unified and accessible view of a patient's health history.

Question 28: When communicating IT strategy to clinical staff, which approach is MOST effective?

Delegate all communication to IT staff
Translate technical goals into patient care impact (Correct answer)
Distribute written memos only
Use technical jargon to demonstrate expertise

Correct answer: Translate technical goals into patient care impact

Clinical staff engage most effectively when IT initiatives are framed around patient care outcomes rather than technology specifications.

Question 29: As part of its HIPAA-mandated contingency plan, a healthcare clinic must regularly test its ability to recover data and resume operations after a simulated disaster. What is the PRIMARY purpose of this requirement?

To satisfy auditor requirements for a yearly review.
To determine the budget for new backup hardware.
To validate the effectiveness of the disaster recovery plan and identify gaps. (Correct answer)
To train new IT staff on emergency procedures.

Correct answer: To validate the effectiveness of the disaster recovery plan and identify gaps.

The primary purpose of regularly testing a disaster recovery plan is to ensure it is effective and will work as intended during an actual emergency. Testing validates procedures, recovery time objectives (RTOs), and the integrity of backed-up data, allowing the organization to identify and address any weaknesses or gaps before a real disaster strikes.

Question 30: A healthcare IT project is considered in 'scope creep' when:

Unauthorized features or work are added without going through change control (Correct answer)
Vendors deliver components earlier than planned
The project finishes ahead of schedule
The budget is reduced mid-project by the sponsor

Correct answer: Unauthorized features or work are added without going through change control

Scope creep occurs when unapproved additions to the project scope accumulate without formal change control evaluation, threatening schedule and budget.

Question 31: During a large-scale EHR implementation, the project team decides to release functional modules in short, two-week cycles. Each cycle includes planning, design, building, and testing, and concludes with a stakeholder demonstration. This iterative and flexible approach to system development is best described as which methodology?

Agile (Correct answer)
V-Model
Waterfall
Spiral

Correct answer: Agile

The Agile methodology is characterized by its iterative and incremental approach. Projects are broken down into short cycles called sprints, which allows for flexibility, continuous feedback from stakeholders, and the ability to adapt to changing requirements throughout the development process.

Question 32: A healthcare analytics firm subscribes to a cloud service that provides a complete, ready-to-use electronic health record (EHR) application, including all updates, maintenance, and infrastructure management. Users access the EHR through a web browser. This cloud service model is best described as:

Platform as a Service (PaaS)
Network as a Service (NaaS)
Software as a Service (SaaS) (Correct answer)
Infrastructure as a Service (IaaS)

Correct answer: Software as a Service (SaaS)

Software as a Service (SaaS) is a cloud computing model where a third-party provider hosts applications and makes them available to customers over the Internet. The provider manages the entire technology stack, including the application, data, runtime, middleware, and servers. The user simply accesses the ready-to-use software, typically through a web browser. An EHR provided in this manner is a prime example of a SaaS offering.

Question 33: A hospital is transitioning from a legacy system using HL7 v2 messaging to a new, modern EHR that needs to support mobile applications and real-time data access for patients. Which interoperability standard is BEST suited for these requirements?

DICOM
CDA (Clinical Document Architecture)
FHIR (Fast Healthcare Interoperability Resources) (Correct answer)
HL7 v3

Correct answer: FHIR (Fast Healthcare Interoperability Resources)

FHIR (Fast Healthcare Interoperability Resources) is the most suitable standard for modern healthcare applications, including mobile and web-based platforms. It uses modern web technologies like RESTful APIs and supports JSON, making it more flexible, easier to implement, and better for real-time data exchange compared to the older, more rigid HL7 v2 and v3 standards.

Question 34: A clinical informaticist is helping to implement a new clinical decision support (CDS) system. To ensure the system effectively improves patient outcomes, which framework should be prioritized during the implementation process?

The DIKW (Data, Information, Knowledge, Wisdom) Pyramid
The Five Rights of Clinical Decision Support (Correct answer)
The Systems Development Life Cycle (SDLC)
The Health Information Technology for Economic and Clinical Health (HITECH) Act

Correct answer: The Five Rights of Clinical Decision Support

The 'Five Rights of Clinical Decision Support' is a foundational framework specifically designed to guide the effective implementation of CDS systems. It ensures that the right information is delivered to the right person, in the right format, through the right channel, and at the right time in the clinical workflow to improve decision-making and patient outcomes.

Question 35: The Leapfrog Group is best known for which activity in the US healthcare environment?

Administering the CPHIMS examination
Setting federal EHR certification standards
Accrediting healthcare information professionals
Publicly reporting hospital safety and quality scores (Correct answer)

Correct answer: Publicly reporting hospital safety and quality scores

The Leapfrog Group is an employer-driven coalition that publicly reports hospital performance data to improve transparency, safety, and quality.

Question 36: A hospital is preparing for a major EHR implementation. The project team identifies respected clinicians and operational staff to receive advanced training. During the go-live, these individuals will provide at-the-elbow assistance to their colleagues, answer workflow questions, and act as a bridge between end-users and the IT project team. This role is best known as a:

Clinical Analyst
Vendor Representative
Project Manager
Super User (Correct answer)

Correct answer: Super User

A Super User is a specially trained end-user from a clinical or operational department who acts as a frontline resource for their peers during a system implementation. Their primary role is to provide immediate support, reinforce correct workflows, and champion the new system. A Project Manager oversees the entire project, a Clinical Analyst is typically an IT professional who helps design and configure the system, and a Vendor Representative is an employee of the software company.

Question 37: Which project management methodology uses iterative sprints and is increasingly adopted in healthcare IT implementations?

PRINCE2
Agile/Scrum (Correct answer)
Critical Path Method
Waterfall

Correct answer: Agile/Scrum

Agile/Scrum uses iterative sprints that allow healthcare IT teams to deliver working software incrementally and adapt to changing requirements.

Question 38: Which framework is MOST commonly used to align IT governance with business objectives in healthcare organizations?

TOGAF
ISO 27001
COBIT (Correct answer)
ITIL

Correct answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) is the most widely adopted framework for IT governance that aligns IT goals with business objectives.

Question 39: Which federal act established the conditions for participation that hospitals must meet to receive Medicare and Medicaid reimbursement?

HITECH Act
Social Security Act (Correct answer)
Health Insurance Portability and Accountability Act
Affordable Care Act

Correct answer: Social Security Act

The Social Security Act established Conditions of Participation (CoPs) that healthcare organizations must meet to receive Medicare and Medicaid payments.

Question 40: A patient's medication list shows 'metoprolol' in one system and 'metoprolol succinate 25 mg oral' in another. Reconciling these requires which type of standard?

SNOMED CT
ICD-10-PCS
CPT
RxNorm (Correct answer)

Correct answer: RxNorm

RxNorm provides normalized names and unique identifiers for clinical drugs, enabling systems to reconcile drug name variations into a single computable representation.

Question 41: According to the HIPAA Security Rule, which of the following is the foundational and first step an organization must take when developing its security compliance program?

Encrypt all electronic protected health information (ePHI)
Conduct a security risk analysis (Correct answer)
Provide security awareness training to all employees
Implement access control policies

Correct answer: Conduct a security risk analysis

The HIPAA Security Rule mandates that a covered entity must first conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. This risk analysis is foundational, as it informs all other security decisions and safeguard implementations.

Question 42: In data quality management, 'data integrity' PRIMARILY means:

Data is encrypted during transmission
Data is accessible only to authorized users
Data is accurate, complete, and consistent across systems (Correct answer)
Data is stored in a relational database format

Correct answer: Data is accurate, complete, and consistent across systems

Data integrity ensures that healthcare data is accurate, complete, and remains consistent whether viewed from the EHR, data warehouse, or reporting system.

Question 43: Key Performance Indicators (KPIs) in a hospital dashboard BEST serve to:

Store raw patient data for future analysis
Track progress toward strategic organizational goals through measurable metrics (Correct answer)
Replace the need for detailed clinical documentation
Automate billing and claims submission

Correct answer: Track progress toward strategic organizational goals through measurable metrics

KPIs are quantifiable metrics aligned to strategic goals that allow hospital leadership to monitor performance and make data-driven decisions.

Question 44: What is the primary function of an IT Steering Committee within a healthcare organization's governance structure?

To write and debug the code for new software applications and system interfaces.
To provide daily, hands-on technical support to end-users across the organization.
To perform detailed security penetration testing on the network.
To ensure IT strategy aligns with business strategy and to approve major IT investments and priorities. (Correct answer)

Correct answer: To ensure IT strategy aligns with business strategy and to approve major IT investments and priorities.

The IT Steering Committee is a high-level governance body composed of senior business and IT leaders. Its primary role is to provide strategic direction, prioritize major IT projects and investments, and ensure that the IT department's efforts are aligned with the overall strategic goals of the healthcare organization.

Question 45: During the final stage of testing for a new telehealth platform, a group of nurses and physicians is asked to use the system in a simulated environment that mirrors their actual clinic workflow. They follow test scripts to schedule appointments, conduct video visits, and document encounters to ensure the system meets their operational needs. This type of testing is called:

User Acceptance Testing (UAT) (Correct answer)
Regression Testing
Unit Testing
Integration Testing

Correct answer: User Acceptance Testing (UAT)

User Acceptance Testing (UAT) is the final phase of testing where end-users validate that the system meets business requirements and is suitable for the production environment. It focuses on real-world scenarios and workflows from the user's perspective. Unit testing checks individual components, integration testing verifies that modules work together, and regression testing ensures new changes haven't broken existing functionality.

Question 46: Which federal program established the framework and incentives for healthcare organizations to adopt and meaningfully use certified EHR technology, including HIE capabilities?

Meaningful Use / Promoting Interoperability Program (Correct answer)
The HITECH Act's Breach Notification Rule
MACRA Quality Payment Program
HIPAA Security Rule

Correct answer: Meaningful Use / Promoting Interoperability Program

The Meaningful Use (now Promoting Interoperability) program under HITECH provided financial incentives for providers to adopt EHRs and demonstrate use of HIE capabilities.

Question 47: A health system is implementing a new laboratory information system (LIS). The project team needs to verify that orders entered in the computerized provider order entry (CPOE) system are correctly transmitted to the LIS and that results from the LIS are correctly filed back into the patient's electronic health record (EHR). Which type of testing specifically addresses this requirement?

Unit Testing
Usability Testing
Stress Testing
Interface Testing (Correct answer)

Correct answer: Interface Testing

Interface testing is a form of integration testing that specifically validates that data is passed correctly between two or more separate systems. In this case, it ensures the CPOE, LIS, and EHR systems can communicate and exchange data as designed.

Question 48: A patient is discharged from a hospital after a cardiac event and receives follow-up care from a home health agency, followed by outpatient rehabilitation services. This coordinated approach to patient care across different healthcare settings is best described as which of the following?

Tertiary Care
Fee-for-Service Model
Continuum of Care (Correct answer)
Integrated Delivery Network (IDN)

Correct answer: Continuum of Care

The Continuum of Care refers to an integrated system of healthcare that guides and tracks a patient over time through a comprehensive array of services spanning all levels of intensity of care. This scenario, involving transition from an acute hospital stay to home health and then to outpatient services, is a classic example of the continuum of care model.

Question 49: A health information management professional is tasked with ensuring that the organization's new electronic health record (EHR) system can exchange data with the local pharmacy's system. Which type of organization is primarily responsible for developing the standards that make this interoperability possible?

Standards Development Organization (SDO) (Correct answer)
Healthcare Insurance Company
Governmental Regulatory Agency
Accreditation Body

Correct answer: Standards Development Organization (SDO)

Standards Development Organizations (SDOs), such as HL7 and ISO, are responsible for creating, maintaining, and publishing standards that enable interoperability between different health information systems. These standards provide the common language and framework for data exchange.

Question 50: During a risk assessment, a hospital's IT department identifies that its primary on-premise data center is located in a region prone to seismic activity. The risk is deemed to have a high potential impact. The organization establishes a contract with a cloud provider for Disaster-Recovery-as-a-Service (DRaaS). This action is an example of which risk response strategy?

Risk Acceptance
Risk Transference
Risk Mitigation (Correct answer)
Risk Avoidance

Correct answer: Risk Mitigation

Risk mitigation involves taking active steps to reduce the likelihood or impact of a potential threat. Implementing a DRaaS solution doesn't eliminate the risk of an earthquake (avoidance) or simply accept the consequences. While it has elements of shifting operational burden, its primary purpose is to reduce the impact (downtime, data loss) of a data center failure, which is a core mitigation activity.

Question 51: During a go-live cutover, the project team discovers that a critical interface between the EHR and pharmacy system is failing. What is the FIRST action the implementation lead should take?

Restart the interface engine server
Roll back to the legacy system immediately
Escalate to the vendor's on-call support line
Activate the downtime procedures and notify clinical staff (Correct answer)

Correct answer: Activate the downtime procedures and notify clinical staff

Activating downtime procedures protects patient safety while the technical issue is investigated.

Question 52: A project sponsor for an EHR implementation is BEST described as:

The executive who champions the project and provides resources (Correct answer)
The project manager who coordinates daily tasks
The lead developer responsible for coding
The vendor's account representative

Correct answer: The executive who champions the project and provides resources

The project sponsor is the senior executive who champions the initiative, secures funding, and removes organizational barriers.

Question 53: SNOMED CT is primarily used in clinical informatics to represent:

Billing codes for reimbursement
Drug interaction rules
Laboratory reference ranges
Clinical concepts and findings in a structured, computable format (Correct answer)

Correct answer: Clinical concepts and findings in a structured, computable format

SNOMED CT (Systematized Nomenclature of Medicine Clinical Terms) is a comprehensive clinical terminology used to encode clinical concepts for interoperability and analysis.

Question 54: Which principle guides the design of clinical informatics systems to ensure they support rather than impede clinical judgment?

Structured data capture
Human factors engineering (Correct answer)
Meaningful use compliance
Data maximalism

Correct answer: Human factors engineering

Human factors engineering applies knowledge of human capabilities and limitations to design systems that reduce errors and cognitive load for clinicians.

Question 55: What does IHE stand for in the context of health informatics standards?

Integrated Health Exchange
International Health Engineering
Information Health Exchange
Integrating the Healthcare Enterprise (Correct answer)

Correct answer: Integrating the Healthcare Enterprise

IHE (Integrating the Healthcare Enterprise) is an initiative that develops implementation frameworks called profiles to guide the use of established standards like HL7 and DICOM.

Question 56: Six months after a new telehealth platform went live, the health IT team is actively monitoring system performance, applying security patches, resolving user-reported help desk tickets, and planning for a minor version upgrade. These ongoing activities are characteristic of which SDLC phase?

Maintenance and Evaluation (Correct answer)
Planning
Implementation
Design

Correct answer: Maintenance and Evaluation

The Maintenance and Evaluation phase begins after the system is deployed. It involves the ongoing support, monitoring, and enhancement of the system throughout its operational life to ensure it continues to function correctly, securely, and effectively.

Question 57: A hospital's IT department has just applied a major security patch to its production EHR system. Which of the following testing methods is most critical to perform immediately after the patch is deployed to ensure that existing functionalities have not been negatively impacted?

User Acceptance Testing
Load Testing
New Feature Testing
Regression Testing (Correct answer)

Correct answer: Regression Testing

Regression testing is the process of re-running tests to ensure that previously developed and tested software still performs correctly after a change or update. Its purpose is to uncover any new bugs (regressions) in existing functionality that may have been inadvertently introduced by the patch.

Question 58: Which HL7 standard is specifically designed for exchanging clinical documents, such as discharge summaries, in a human-readable and machine-processable format?

HL7 v3 RIM
HL7 v2 ADT messages
FHIR R4 Observation resources
Clinical Document Architecture (CDA) (Correct answer)

Correct answer: Clinical Document Architecture (CDA)

HL7 CDA is the standard for structuring clinical documents to be both human-readable and machine-processable.

Question 59: An organization's IT team is evaluating system scalability. Which metric BEST measures a system's ability to handle increased workload without performance degradation?

Throughput under peak load (Correct answer)
Recovery Time Objective (RTO)
Latency at baseline load
Mean Time Between Failures (MTBF)

Correct answer: Throughput under peak load

Throughput under peak load directly measures how well a system handles increased demand without degrading performance.

Question 60: A health IT strategic plan identifies a capability gap between current state and desired future state. What process formally documents this gap?

FMEA
Fishbone diagram
Root cause analysis
Gap analysis (Correct answer)

Correct answer: Gap analysis

Gap analysis compares current capabilities against desired future state to identify what must be addressed in the strategic plan.

Question 61: A hospital's 'case mix index' (CMI) is significant in healthcare finance primarily because it:

Measures patient satisfaction scores across departments
Determines staffing ratios required by state regulators
Tracks the percentage of patients with chronic conditions
Reflects the average relative weight of all patient cases and influences Medicare revenue (Correct answer)

Correct answer: Reflects the average relative weight of all patient cases and influences Medicare revenue

CMI represents the average DRG weight for a hospital's inpatient cases; a higher CMI indicates more complex cases and results in higher Medicare reimbursements.

Question 62: A project kickoff meeting in a healthcare IT implementation serves PRIMARILY to:

Conduct user acceptance testing
Finalize vendor contract negotiations
Align all stakeholders on project goals, roles, and plan (Correct answer)
Present the final system to end users

Correct answer: Align all stakeholders on project goals, roles, and plan

The kickoff meeting unites the project team and stakeholders around common objectives, clarifies roles, and establishes communication norms at the project start.

Question 63: The emergency department (ED) of a healthcare organization continues to report that at least 25% of the time, its system is "down." System downtime was less than 1%, according to operations personnel who have been recording computer and application downtime every day for a month. Every time local IT professionals visited the ED throughout the day, they observed people successfully utilizing the system. Which of the following actions should the CIO take to fix the problem?

Report the findings of the month-long downtime tracking in a formal manner and stop worrying about the problem.
Meet with important ED patients to get firsthand accounts of particular problems. (Correct answer)
Ask ED personnel to record specifics of each experience with downtime in a problem log that is posted on the device.
For a week, station an IT expert in the division to keep an eye on system usage.

Correct answer: Meet with important ED patients to get firsthand accounts of particular problems.

When system logs show minimal downtime but users report frequent issues, it indicates a disconnect that requires direct user engagement. Meeting with key ED personnel (or 'patients' as stated, implying users/stakeholders experiencing the problem) allows the CIO to gather firsthand accounts, understand specific workflow impediments, or identify usability challenges not captured by automated monitoring. This qualitative data is essential for pinpointing the actual root cause of user frustration and addressing the perceived 'downtime' effectively.

Question 64: Which configuration management practice ensures that all changes to a production healthcare IT system are documented, reviewed, and approved before implementation?

Incident management
Capacity planning
Disaster recovery planning
Change control board (CCB) review (Correct answer)

Correct answer: Change control board (CCB) review

A Change Control Board reviews and approves all proposed system changes to minimize unplanned risk to production environments.

Question 65: A healthcare system that is funded by the government through taxes, where the government also manages the delivery of care, is characteristic of which healthcare delivery model?

Beveridge Model (Correct answer)
Bismarck Model
National Health Insurance Model
Out-of-Pocket Model

Correct answer: Beveridge Model

The Beveridge Model is characterized by healthcare that is both funded and delivered by the government, paid for through general taxation. Countries like the United Kingdom and Spain utilize this model.

Question 66: Under value-based purchasing (VBP), Medicare withholds a percentage of DRG payments and redistributes them based on what?

Hospital size and teaching status
Performance scores on quality and patient experience measures (Correct answer)
Percentage of uncompensated care provided
Number of patients served

Correct answer: Performance scores on quality and patient experience measures

CMS withholds a portion of base DRG payments and returns them—potentially with bonuses—based on hospitals' Total Performance Scores across multiple quality domains.

Question 67: Which protocol is used to synchronize clocks across networked devices in a healthcare IT environment?

SNMP
DHCP
LDAP
NTP (Correct answer)

Correct answer: NTP

Network Time Protocol (NTP) synchronizes clocks across networked devices, which is critical for accurate audit logs and timestamps in healthcare.

Question 68: In healthcare IT governance, what does the principle of 'separation of duties' primarily protect against?

Budget overruns
Fraud, errors, and unauthorized system changes (Correct answer)
Staff turnover
Project scope creep

Correct answer: Fraud, errors, and unauthorized system changes

Separation of duties ensures no single individual controls all aspects of a critical process, reducing the risk of fraud, errors, and unauthorized modifications.

Question 69: Which type of system testing verifies that a new software patch applied to the EHR has not broken existing functionality?

Parallel testing
Regression testing (Correct answer)
Smoke testing
Stress testing

Correct answer: Regression testing

Regression testing re-executes existing test cases after a change to confirm that previously working functionality has not been broken.

Question 70: Which federal program incentivized U.S. hospitals to demonstrate 'meaningful use' of certified EHR technology and advance health data analytics capabilities?

Affordable Care Act Marketplace Rule
HITECH Act / Medicare and Medicaid EHR Incentive Programs (Correct answer)
HIPAA Security Rule
Medicare Part D Prescription Drug Program

Correct answer: HITECH Act / Medicare and Medicaid EHR Incentive Programs

The HITECH Act established the Medicare and Medicaid EHR Incentive Programs (Meaningful Use), driving EHR adoption and structured data capture for analytics.

Question 71: Which organization publishes the ICD-10-CM diagnosis coding system used in US clinical documentation?

Centers for Medicare & Medicaid Services and CDC (Correct answer)
The Joint Commission
American Medical Association
American Health Information Management Association

Correct answer: Centers for Medicare & Medicaid Services and CDC

ICD-10-CM is maintained and published jointly by CMS and the CDC's National Center for Health Statistics for use in US clinical settings.

Question 72: A healthcare organization is merging with a regional health system. What is the PRIMARY IT leadership priority during the integration planning phase?

Assessing interoperability of existing systems (Correct answer)
Replacing all hardware before go-live
Immediately decommissioning legacy systems
Migrating all data on day one

Correct answer: Assessing interoperability of existing systems

Interoperability assessment determines how existing systems can communicate and identifies integration risks before any migration or decommissioning occurs.

Question 73: Which of the following is a primary function of the Centers for Medicare & Medicaid Services (CMS) in the United States healthcare environment?

Developing and publishing clinical practice guidelines for physicians.
Accrediting hospitals and other healthcare facilities.
Administering the nation's major federal healthcare programs and setting reimbursement policies. (Correct answer)
Regulating the marketing and use of medical devices.

Correct answer: Administering the nation's major federal healthcare programs and setting reimbursement policies.

The Centers for Medicare & Medicaid Services (CMS) is a federal agency within the U.S. Department of Health and Human Services (HHS) that administers the Medicare program and works in partnership with state governments to administer Medicaid, the Children's Health Insurance Program (CHIP), and health insurance portability standards. Its policies on reimbursement and conditions of participation have a significant impact on the entire healthcare industry.

Question 74: Which document captures the agreed-upon service expectations between the IT department and clinical end users following system implementation, including uptime and response time guarantees?

Business associate agreement (BAA)
Service level agreement (SLA) (Correct answer)
Operational level agreement (OLA)
Memorandum of understanding (MOU)

Correct answer: Service level agreement (SLA)

An SLA formally defines the measurable service standards, such as uptime percentages and support response times, between IT and end users.

Question 75: What is an IT program management office's main responsibility?

Provide executive leadership with a risk-managed enterprise project portfolio to keep them updated on the status of organizational initiatives. (Correct answer)
Assemble an exhaustive list of all IT projects being worked on within an organization, and take responsibility for their execution.
Create a comprehensive list of all IT projects being worked on at the company, and take responsibility for their completion.
Manage resources, oversee project monitoring, and oversee direct administration of all IT projects for an organization.

Correct answer: Provide executive leadership with a risk-managed enterprise project portfolio to keep them updated on the status of organizational initiatives.

An IT Program Management Office (PMO) is responsible for overseeing multiple related projects and programs, ensuring they align with strategic organizational goals. Its primary role is to provide a holistic view of the IT project landscape to executive leadership, including progress, risks, and resource allocation. This strategic oversight helps executives make informed decisions and ensures that IT initiatives support the broader business objectives.

Question 76: An IT steering committee is evaluating several proposed projects, including a CPOE upgrade, a new patient portal, and a data warehouse for analytics. Which of the following criteria is MOST important for prioritizing these projects within the IT portfolio?

The technical complexity and difficulty of each project.
Alignment with the organization's strategic objectives and potential business value. (Correct answer)
The estimated cost and budget requirements of each project in isolation.
The personal preference and influence of the Chief Information Officer (CIO).

Correct answer: Alignment with the organization's strategic objectives and potential business value.

Effective IT portfolio management prioritizes projects based on their alignment with the organization's strategic goals and their potential to deliver business value. While cost, complexity, and leadership input are factors, the primary driver for prioritization in a well-governed organization is ensuring that limited resources are allocated to initiatives that best support the overall mission.

Question 77: The critical path in a project schedule is BEST defined as:

The list of highest-risk activities in the project
Tasks assigned to the most senior team members
The longest duration path of dependent tasks that determines project end date (Correct answer)
The sequence of tasks with the most budget allocated

Correct answer: The longest duration path of dependent tasks that determines project end date

The critical path is the longest sequence of dependent tasks; any delay on these tasks directly delays the overall project completion date.

Question 78: Which approach to EHR governance BEST ensures that clinical documentation templates remain clinically relevant and do not contribute to note bloat?

Allowing each department to create unlimited custom templates
Establishing a formal template review and retirement process with clinical ownership (Correct answer)
Using only vendor-default templates without modification
Eliminating all structured templates in favor of free-text dictation

Correct answer: Establishing a formal template review and retirement process with clinical ownership

A formal governance process with clinical ownership ensures templates are periodically reviewed, updated, and retired when they no longer serve clinical or regulatory needs.

Question 79: Which metric is commonly used to measure defect density during healthcare IT system testing?

Mean time between failures
Percentage of test cases passed
Number of test cases executed per day
Number of defects per thousand lines of code (Correct answer)

Correct answer: Number of defects per thousand lines of code

Defect density, expressed as defects per thousand lines of code (KLOC), is a standard metric for measuring software quality during testing.

Question 80: Which metric is MOST commonly used to evaluate the performance of a predictive model in healthcare analytics?

Net Promoter Score (NPS)
Return on Investment (ROI)
Bed occupancy rate
Area Under the ROC Curve (AUC-ROC) (Correct answer)

Correct answer: Area Under the ROC Curve (AUC-ROC)

AUC-ROC measures a classification model's ability to distinguish between positive and negative cases across all decision thresholds, making it a standard model performance metric.

Question 81: What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

To ensure vendors safeguard PHI they access on behalf of a covered entity (Correct answer)
To eliminate the need for encryption of transmitted data
To allow unlimited data sharing between healthcare organizations
To authorize third parties to sell patient data

Correct answer: To ensure vendors safeguard PHI they access on behalf of a covered entity

A BAA is a contract that requires business associates to appropriately safeguard PHI they create, receive, maintain, or transmit on behalf of a covered entity.

Question 82: Which testing phase verifies that individual components of a healthcare information system work correctly in isolation before integration?

Unit testing (Correct answer)
System testing
Integration testing
User acceptance testing

Correct answer: Unit testing

Unit testing verifies individual components or modules in isolation before they are combined with other system elements.

Question 83: Which committee structure is MOST effective for overseeing healthcare IT governance decisions?

IT-only steering committee
Cross-functional IT governance committee with clinical and administrative representation (Correct answer)
Clinical informatics committee only
External vendor advisory board

Correct answer: Cross-functional IT governance committee with clinical and administrative representation

A cross-functional committee ensures that IT decisions reflect clinical, operational, and financial perspectives across the organization.

Question 84: A large academic medical center is planning to implement a new, enterprise-wide electronic health record (EHR) system. The leadership recognizes this will be a massive cultural and workflow shift for thousands of employees. To manage the human side of this transition, they adopt an 8-step model that includes creating a sense of urgency, forming a powerful guiding coalition, and generating short-term wins. This structured approach is an example of what discipline?

Portfolio Management
Risk Assessment
Change Management (Correct answer)
Systems Analysis

Correct answer: Change Management

Change management is the structured approach to transitioning individuals, teams, and organizations from a current state to a desired future state. The scenario describes key steps from Kotter's 8-Step Change Model, a well-known framework for managing the people side of change to minimize resistance and ensure successful adoption of new initiatives like an EHR implementation.

Question 85: A lab system upgrade causes the medication reconciliation module to malfunction unexpectedly. What testing should have caught this?

Unit testing
User acceptance testing
Regression testing (Correct answer)
Volume testing

Correct answer: Regression testing

Regression testing after the lab system upgrade should have validated that the medication reconciliation module continued to function correctly.

Question 86: In the US healthcare system, what is the primary role of a Federally Qualified Health Center (FQHC)?

To coordinate Medicare Advantage plans
To offer comprehensive primary care to underserved populations regardless of ability to pay (Correct answer)
To provide specialty care to insured patients only
To manage electronic health records for rural hospitals

Correct answer: To offer comprehensive primary care to underserved populations regardless of ability to pay

FQHCs are community-based healthcare providers that receive federal funding to provide primary care services in underserved areas on a sliding-fee scale.

Question 87: Under the HIPAA Privacy Rule, a patient's right to request an amendment to their health record applies when:

The patient disagrees with a clinical diagnosis
The record contains information the patient believes is inaccurate or incomplete (Correct answer)
The covered entity made the record available to a third party
The patient wants to delete all records older than 5 years

Correct answer: The record contains information the patient believes is inaccurate or incomplete

Patients have the right to request amendments to their PHI if they believe information in their record is incorrect or incomplete, though the covered entity may deny the request.

Question 88: A healthcare organization wants to combine patient data from multiple disparate systems into a unified view. This is BEST achieved through:

Master Patient Index (MPI) and enterprise data integration (Correct answer)
Deleting duplicate records manually
Purchasing additional EHR licenses
Restricting data entry to a single application

Correct answer: Master Patient Index (MPI) and enterprise data integration

An MPI combined with enterprise data integration links patient records across systems using matching algorithms to create a single unified patient identity.

Question 89: Which of the following is a decision-support system component?

Model editor (Correct answer)
Database management system
User interface
Model library

Correct answer: Model editor

A Decision Support System (DSS) is designed to aid in complex decision-making, and its core analytical power comes from its models. The Model Editor is a crucial component within the DSS's Model Management System, enabling users or developers to create, modify, and manage these analytical models. This capability allows the DSS to adapt to new scenarios and provide tailored insights, making the model editor integral to the system's ability to support diverse decision processes.

Question 90: In the context of EHR implementation, which strategy BEST reduces unintended consequences related to clinical workflow disruption?

Migrating all legacy data before go-live
Conducting thorough workflow analysis before and after implementation (Correct answer)
Deploying the system in all departments simultaneously
Limiting end-user training to reduce confusion

Correct answer: Conducting thorough workflow analysis before and after implementation

Analyzing workflows before and after implementation identifies gaps and allows optimization that reduces clinical disruption and patient safety risks.

Question 91: Which testing phase verifies that a newly implemented system performs acceptably under expected peak user loads?

User acceptance testing
Unit testing
Integration testing
Performance/load testing (Correct answer)

Correct answer: Performance/load testing

Performance or load testing simulates peak concurrent users to validate system responsiveness under stress.

Question 92: A hospital's population health management program relies MOST on which type of data integration?

Integration of HR and payroll systems
Integration of pharmacy and supply chain data only
Real-time streaming of laboratory instrument results
Aggregation of clinical, claims, social determinants, and patient-generated data across the care continuum (Correct answer)

Correct answer: Aggregation of clinical, claims, social determinants, and patient-generated data across the care continuum

Population health management requires aggregating diverse data—clinical, claims, social determinants, and patient-generated—to identify and manage health needs across a defined population.

Question 93: A Gantt chart is PRIMARILY used in project management to:

Visualize project tasks, durations, and dependencies over time (Correct answer)
Identify and rank project risks
Track budget expenditures against planned costs
Document functional and non-functional requirements

Correct answer: Visualize project tasks, durations, and dependencies over time

A Gantt chart is a horizontal bar chart that displays project tasks, their durations, start/end dates, and dependencies on a timeline.

Question 94: An implementation team is conducting parallel testing by running legacy and new systems simultaneously. What is the PRIMARY goal of this approach?

To reduce the cost of the new system implementation
To compare outputs of both systems and confirm the new system produces accurate results before cutover (Correct answer)
To demonstrate vendor contract compliance
To allow users to choose which system to use during the transition

Correct answer: To compare outputs of both systems and confirm the new system produces accurate results before cutover

Parallel testing compares real-world outputs from both systems to validate accuracy and build confidence before decommissioning the legacy system.

Question 95: A nurse reviews a patient's vital signs in the EHR. The discrete values for heart rate (85 bpm), blood pressure (120/80 mmHg), and temperature (98.6°F) represent which level of the DIKW pyramid?

Knowledge
Information
Data (Correct answer)
Wisdom

Correct answer: Data

In the DIKW (Data, Information, Knowledge, Wisdom) pyramid, raw, discrete facts without context or interpretation are considered 'Data'. The individual vital sign measurements are raw data points. They only become 'Information' when they are organized and given context (e.g., trended over time, compared to normal ranges).

Question 96: Which virtualization concept allows multiple isolated operating system instances to run on a single physical server?

Network address translation
Hypervisor-based virtualization (Correct answer)
Load balancing
Containerization only

Correct answer: Hypervisor-based virtualization

A hypervisor creates and manages multiple virtual machines, each running its own OS on shared physical hardware.

Question 97: After go-live, users report that the clinical decision support alerts are firing too frequently, causing alert fatigue. Which post-implementation activity should address this?

Conduct a system optimization review to tune alert thresholds (Correct answer)
File a formal defect report with the vendor
Disable all CDS alerts until a future upgrade
Retrain all clinical staff on ignoring non-critical alerts

Correct answer: Conduct a system optimization review to tune alert thresholds

Post-implementation optimization reviews adjust configurations such as alert thresholds to improve usability and reduce fatigue.

Question 98: In a traditional Waterfall SDLC model, which phase must be fully completed and signed off on before the 'Development' (or Build) phase can begin?

Maintenance
Testing
Design (Correct answer)
Implementation

Correct answer: Design

The Waterfall model is a strictly sequential process where each phase must be completed before the next one begins. The 'Design' phase, where the system architecture, database schema, and detailed technical specifications are created, serves as the blueprint for the 'Development' phase, where programmers write the code.

Question 99: A healthcare organization's IT strategic plan should be reviewed and updated at minimum how often?

Every 10 years
Annually (Correct answer)
Only when technology changes
Every 5 years

Correct answer: Annually

Annual reviews ensure the IT strategic plan remains aligned with evolving organizational goals, regulatory changes, and technology advancements.

Question 100: A health system's security policy states that a user's access rights and permissions to systems containing ePHI should be limited to only what is strictly required to perform their job responsibilities. What security principle does this policy enforce?

Separation of Duties
Least Privilege Principle (Correct answer)
Security through Obscurity
Defense in Depth

Correct answer: Least Privilege Principle

The Principle of Least Privilege dictates that a user should be given only the minimum levels of access—or permissions—needed to perform their job functions. This is a fundamental concept in information security designed to limit the potential damage from a compromised account or insider threat.

Question 101: A hospital is implementing a Clinical Decision Support (CDS) system. Which type of CDS intervention fires automatically without requiring clinician action?

Active (interruptive) alerts (Correct answer)
Order sets
Passive reference tools
Dashboards

Correct answer: Active (interruptive) alerts

Active or interruptive CDS alerts fire automatically and interrupt clinician workflow to present critical information.

Question 102: When managing a healthcare IT project budget, a cost baseline is BEST described as:

The approved time-phased budget used to measure cost performance (Correct answer)
The vendor's quoted price for software licenses
The initial rough estimate before planning begins
The contingency reserve set aside for unknown risks

Correct answer: The approved time-phased budget used to measure cost performance

The cost baseline is the approved, time-phased project budget used as a reference to measure and report cost performance throughout the project.

Question 103: A hospital's project team is conducting extensive workflow analysis, interviewing clinicians to gather their needs, and documenting detailed functional requirements for a new Computerized Provider Order Entry (CPOE) system. In which phase of the System Development Life Cycle (SDLC) are these activities primarily taking place?

Implementation and Deployment
Planning and Analysis (Correct answer)
Development and Testing
Maintenance and Evaluation

Correct answer: Planning and Analysis

The Planning and Analysis phase is focused on understanding the business problem, defining the project scope, gathering and documenting user requirements, and analyzing existing workflows. These activities are foundational to designing and building a system that meets user needs.

Question 104: In healthcare IT project management, a RACI matrix defines:

Roles as Responsible, Accountable, Consulted, and Informed (Correct answer)
Risk, Assumption, Constraint, and Issue categories
Requirements, Architecture, Coding, and Integration phases
Resource Allocation, Cost, and Integration factors

Correct answer: Roles as Responsible, Accountable, Consulted, and Informed

A RACI matrix clarifies team member roles by designating who is Responsible, Accountable, Consulted, and Informed for each project task.

Question 105: A healthcare organization is discovered to have had a breach of its electronic health record system where the unencrypted PHI of over 600 patients was acquired by an unauthorized party. According to the HIPAA Breach Notification Rule, which of the following MUST be notified?

The affected individuals and the local police department only
The affected individuals, the Secretary of HHS (via OCR), and prominent media outlets (Correct answer)
The Secretary of HHS (via OCR) and the organization's cyber liability insurance carrier
The affected individuals and the FBI

Correct answer: The affected individuals, the Secretary of HHS (via OCR), and prominent media outlets

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay (and within 60 days). For breaches affecting more than 500 individuals in a state or jurisdiction, the entity must also notify the Secretary of Health and Human Services (HHS) and prominent media outlets serving that area.

Question 106: A healthcare organization requires all laptops containing electronic Protected Health Information (ePHI) to use full-disk encryption. Under the HIPAA Security Rule, this measure is an example of which type of safeguard?

Organizational Safeguard
Physical Safeguard
Administrative Safeguard
Technical Safeguard (Correct answer)

Correct answer: Technical Safeguard

Technical Safeguards are the technology and related policies for its use that protect ePHI and control access to it. Encryption is a specific implementation specification under the Technical Safeguards standard used to protect data at rest and in transit.

Question 107: What is the primary objective of the 'Testing' phase within the System Development Life Cycle (SDLC)?

To develop the system's architecture and database schema.
To provide initial training to super-users and clinical champions.
To verify that the system meets the documented requirements and to identify and resolve defects before go-live. (Correct answer)
To deploy the system into the live production environment for end-user access.

Correct answer: To verify that the system meets the documented requirements and to identify and resolve defects before go-live.

The Testing phase is a critical quality assurance step dedicated to verifying that the system functions as specified in the requirements documentation. It involves various types of testing (unit, integration, user acceptance) to find and fix bugs and ensure the system is stable and fit for purpose before deployment.

Question 108: The primary goal of computerized physician order entry (CPOE) in clinical settings is to:

Track physician productivity
Automate insurance prior authorization
Reduce medication errors caused by illegible handwriting and transcription (Correct answer)
Replace nursing documentation

Correct answer: Reduce medication errors caused by illegible handwriting and transcription

CPOE eliminates handwritten orders, reducing transcription errors and enabling real-time CDS checks at the point of ordering.

Question 109: A strategic planning committee wants to evaluate external threats to the organization's IT environment. Which tool is MOST appropriate?

Work breakdown structure
RACI matrix
PESTLE analysis (Correct answer)
Gantt chart

Correct answer: PESTLE analysis

PESTLE (Political, Economic, Social, Technological, Legal, Environmental) analysis systematically evaluates external macro-environmental factors affecting IT strategy.

Question 110: An employee accesses patient records of a celebrity out of curiosity without a treatment purpose. This is an example of which type of HIPAA violation?

Unauthorized access (snooping) (Correct answer)
Willful neglect with correction
Minimum necessary violation
Incidental disclosure

Correct answer: Unauthorized access (snooping)

Accessing patient records without a legitimate treatment, payment, or operations purpose is considered unauthorized access or 'snooping,' a serious HIPAA violation.

Question 111: Which risk management step involves assigning probability and impact scores to identified IT risks?

Risk assessment/analysis (Correct answer)
Risk identification
Risk monitoring
Risk response planning

Correct answer: Risk assessment/analysis

Risk assessment/analysis evaluates each identified risk by assigning probability and impact ratings to prioritize mitigation efforts.

Question 112: A quality assurance analyst is assigned to test a new clinical decision support (CDS) alert module. The analyst is given the functional requirements but has no knowledge of the underlying code, database structure, or internal logic. They proceed to test by providing various inputs and verifying the outputs against the requirements. Which testing approach is being used?

Black-Box Testing (Correct answer)
Alpha Testing
Grey-Box Testing
White-Box Testing

Correct answer: Black-Box Testing

Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings. The tester is only concerned with the inputs and outputs of the software, which aligns with the described scenario.

Question 113: What is the recommended approach when a critical defect is discovered during user acceptance testing (UAT)?

Defer to the next system upgrade cycle
Document, prioritize, resolve, and retest before proceeding (Correct answer)
Proceed to go-live and fix after deployment
Mark as a known issue and inform end users

Correct answer: Document, prioritize, resolve, and retest before proceeding

Critical defects found in UAT must be documented, assigned a priority, resolved by developers, and retested before the system can proceed to go-live.

Question 114: Which of the following is a critical activity performed during the 'Implementation' (or Go-Live) phase of the SDLC?

Executing the data migration and system cutover plan. (Correct answer)
Performing a detailed cost-benefit analysis for the project.
Writing the initial functional requirements document.
Conducting final user acceptance testing (UAT).

Correct answer: Executing the data migration and system cutover plan.

The Implementation phase, also known as go-live or deployment, is when the new system is put into the production environment. Key activities include executing the cutover plan (the switch from the old system to the new one), migrating data, and providing intensive support to end-users.

Question 115: A hospital is implementing a new Bar Code Medication Administration (BCMA) system to reduce medication errors. This is an example of leveraging health information technology to primarily improve which aspect of the healthcare environment?

Financial reimbursement
Supply chain management
Patient safety (Correct answer)
Physician credentialing

Correct answer: Patient safety

Health information technology, such as BCMA, electronic health records (EHRs), and computerized physician order entry (CPOE), plays a crucial role in improving patient safety by reducing the likelihood of human errors, such as medication errors and adverse drug events.

CPHIMS Certification Exam

The CPHIMS (Certified Professional in Healthcare Information and Management Systems) exam validates competency in healthcare IT management, covering technology environments, systems lifecycle, and administration leadership.

115

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

himss.org — Test delivery, eligibility, fees, exam format, retake fee, time limit, score validity · verified Oct 2026
cdn.sanity.io — Passing score, retake policy, score release · verified Oct 2026