CPHIMS Certification Exam — Questions and Answers

Question 1: In the SDLC, 'scope creep' refers to?

Budget increases approved by the sponsor
Security vulnerabilities discovered post-go-live
Unauthorized expansion of project requirements (Correct answer)
Delayed testing phases

Correct answer: Unauthorized expansion of project requirements

Scope creep occurs when unapproved changes gradually expand the project beyond its original boundaries.

Question 2: A 'go/no-go' decision meeting held before a system go-live is used to?

Determine whether the system is ready for production deployment (Correct answer)
Finalize vendor contracts
Assign post-go-live support roles
Complete user acceptance sign-off

Correct answer: Determine whether the system is ready for production deployment

A go/no-go meeting formally evaluates readiness criteria and makes the decision to proceed with or delay the production launch.

Question 3: Six months after a new telehealth platform went live, the health IT team is actively monitoring system performance, applying security patches, resolving user-reported help desk tickets, and planning for a minor version upgrade. These ongoing activities are characteristic of which SDLC phase?

Design
Maintenance and Evaluation (Correct answer)
Planning
Implementation

Correct answer: Maintenance and Evaluation

The Maintenance and Evaluation phase begins after the system is deployed. It involves the ongoing support, monitoring, and enhancement of the system throughout its operational life to ensure it continues to function correctly, securely, and effectively.

Question 4: A hospital's EHR is offline for a planned 6-hour upgrade. During this period, clinicians must revert to paper forms for orders, medication administration, and clinical notes. What is the MOST critical component that must be in place to ensure patient safety and operational continuity?

A communication plan for the local news media
A post-downtime user satisfaction survey
A detailed and well-rehearsed downtime procedure (Correct answer)
An overtime budget for data re-entry

Correct answer: A detailed and well-rehearsed downtime procedure

A comprehensive downtime procedure is essential for maintaining patient safety and continuity of care when an EHR is unavailable. This plan outlines specific manual workflows, documentation methods, and communication protocols. While other items like a re-entry budget and surveys are useful, the immediate safety and operational aspect hinges on a clear, practiced downtime procedure.

Question 5: Which of the following BEST describes the role of a clinical informatics professional during system downtime?

Ensure downtime procedures are in place, practiced, and support safe patient care (Correct answer)
Suspend all clinical operations until the system is restored
Immediately restore from the most recent backup without testing
Redirect all patients to other facilities

Correct answer: Ensure downtime procedures are in place, practiced, and support safe patient care

Informatics professionals must ensure downtime procedures (paper-based or read-only access) are pre-established and tested so patient care continues safely.

Question 6: A project sponsor for an EHR implementation is BEST described as:

The executive who champions the project and provides resources (Correct answer)
The vendor's account representative
The project manager who coordinates daily tasks
The lead developer responsible for coding

Correct answer: The executive who champions the project and provides resources

The project sponsor is the senior executive who champions the initiative, secures funding, and removes organizational barriers.

Question 7: In the context of the SDLC, what is the primary purpose of a data conversion plan?

To establish system downtime windows
To migrate existing data accurately into the new system (Correct answer)
To document interface specifications
To train end users on the new system

Correct answer: To migrate existing data accurately into the new system

A data conversion plan details the process for extracting, transforming, and loading legacy data into the new system accurately.

Question 8: A project kickoff meeting in a healthcare IT implementation serves PRIMARILY to:

Conduct user acceptance testing
Present the final system to end users
Align all stakeholders on project goals, roles, and plan (Correct answer)
Finalize vendor contract negotiations

Correct answer: Align all stakeholders on project goals, roles, and plan

The kickoff meeting unites the project team and stakeholders around common objectives, clarifies roles, and establishes communication norms at the project start.

Question 9: The 'five rights' of clinical decision support (5 Rights of CDS) include delivering the right information to the right person EXCEPT which of the following?

Through the right channel
In the right intervention format
At the right cost to the hospital (Correct answer)
At the right time in workflow

Correct answer: At the right cost to the hospital

The 5 Rights of CDS focus on information, person, format, channel, and workflow timing—cost is not one of the five rights.

Question 10: After go-live, users report that the clinical decision support alerts are firing too frequently, causing alert fatigue. Which post-implementation activity should address this?

File a formal defect report with the vendor
Retrain all clinical staff on ignoring non-critical alerts
Conduct a system optimization review to tune alert thresholds (Correct answer)
Disable all CDS alerts until a future upgrade

Correct answer: Conduct a system optimization review to tune alert thresholds

Post-implementation optimization reviews adjust configurations such as alert thresholds to improve usability and reduce fatigue.

Question 11: Which approach to IT portfolio management BEST balances innovation with operational stability in healthcare?

Focusing exclusively on transformational projects
Investing only in maintenance of existing systems
Prioritizing lowest-cost projects regardless of strategic value
Maintaining a mix of run-the-business, grow-the-business, and transform-the-business investments (Correct answer)

Correct answer: Maintaining a mix of run-the-business, grow-the-business, and transform-the-business investments

A three-horizon portfolio approach balances keeping current systems operational while funding growth and transformational initiatives.

Question 12: Which principle guides the design of clinical informatics systems to ensure they support rather than impede clinical judgment?

Human factors engineering (Correct answer)
Data maximalism
Structured data capture
Meaningful use compliance

Correct answer: Human factors engineering

Human factors engineering applies knowledge of human capabilities and limitations to design systems that reduce errors and cognitive load for clinicians.

Question 13: In a Health Maintenance Organization (HMO), patients typically must:

Enroll only if they are Medicare beneficiaries
Select a primary care physician and obtain referrals for specialist visits (Correct answer)
Pay full cost of care and submit claims for reimbursement
Choose any physician in the country without referrals

Correct answer: Select a primary care physician and obtain referrals for specialist visits

HMOs require members to select a primary care physician (PCP) who acts as a gatekeeper and must provide referrals for specialist care within the network.

Question 14: A hospital seeking Magnet Recognition from the American Nurses Credentialing Center (ANCC) must demonstrate excellence in which domain?

Physician recruitment and retention strategies
Nursing practice, leadership, and patient outcomes (Correct answer)
Financial sustainability and revenue cycle performance
Electronic health record implementation only

Correct answer: Nursing practice, leadership, and patient outcomes

Magnet Recognition designates hospitals that demonstrate excellence in nursing practice, transformational leadership, structural empowerment, and superior patient outcomes.

Question 15: A covered entity receives a subpoena for patient records from an attorney. Under HIPAA, the covered entity may disclose the records without patient authorization if:

The subpoena is from a state court rather than federal court
The attorney represents a major health plan
The records are older than 7 years
Satisfactory assurances are provided that the patient has been notified or a qualified protective order is in place (Correct answer)

Correct answer: Satisfactory assurances are provided that the patient has been notified or a qualified protective order is in place

HIPAA permits disclosure in response to a subpoena without authorization only if the covered entity receives satisfactory assurances that the requesting party has made reasonable efforts to notify the patient or obtain a qualified protective order.

Question 16: Under the ACA's Medicaid expansion, states that opted in extended Medicaid eligibility to adults with incomes up to what percentage of the federal poverty level (FPL)?

250% FPL
100% FPL
133% FPL (effectively 138% with the income disregard) (Correct answer)
200% FPL

Correct answer: 133% FPL (effectively 138% with the income disregard)

The ACA expanded Medicaid to non-elderly adults with incomes up to 133% FPL, and with the standard 5% income disregard, the effective threshold is 138% FPL.

Question 17: A hospital that participates in a Pioneer Accountable Care Organization (ACO) model primarily aims to:

Reduce nurse-to-patient ratios to cut operational costs
Increase patient volume through aggressive marketing
Negotiate higher commercial insurance rates
Improve care coordination and share in savings achieved below a spending benchmark (Correct answer)

Correct answer: Improve care coordination and share in savings achieved below a spending benchmark

ACOs coordinate care for an assigned Medicare population and share in any savings when total spending falls below a set benchmark while meeting quality thresholds.

Question 18: A health system's board of directors has established a five-year strategic goal to become a national leader in patient-centric telehealth services. What is the MOST critical first step for the IT governance body to ensure alignment with this goal?

Develop an IT strategic plan that explicitly maps technology initiatives and resource allocation to the telehealth goal. (Correct answer)
Conduct a comprehensive security audit of all existing network infrastructure to identify vulnerabilities.
Hire additional help desk staff to prepare for the increased volume of user support tickets related to new services.
Immediately purchase the highest-rated telehealth platform available on the market to gain a first-mover advantage.

Correct answer: Develop an IT strategic plan that explicitly maps technology initiatives and resource allocation to the telehealth goal.

The primary role of IT governance is to ensure that IT strategy aligns with and supports the overall business strategy. Before any purchasing decisions or tactical hiring occurs, a strategic plan must be developed to outline how IT will enable the organization's goals, ensuring that investments are prioritized and resources are allocated effectively.

Question 19: Which of the following best describes the role of an Integrated Delivery Network (IDN) in healthcare?

A federal agency that integrates Medicare and Medicaid billing
A group of unaffiliated hospitals that share administrative staff
A software platform that integrates multiple EHR systems
A coordinated network of providers and facilities under common ownership offering a continuum of care (Correct answer)

Correct answer: A coordinated network of providers and facilities under common ownership offering a continuum of care

An IDN is a single organization or system under common ownership that provides a full spectrum of care—from primary to acute to post-acute—often including its own health plan.

Question 20: The emergency department (ED) of a healthcare organization continues to report that at least 25% of the time, its system is "down." System downtime was less than 1%, according to operations personnel who have been recording computer and application downtime every day for a month. Every time local IT professionals visited the ED throughout the day, they observed people successfully utilizing the system. Which of the following actions should the CIO take to fix the problem?

For a week, station an IT expert in the division to keep an eye on system usage.
Report the findings of the month-long downtime tracking in a formal manner and stop worrying about the problem.
Ask ED personnel to record specifics of each experience with downtime in a problem log that is posted on the device.
Meet with important ED patients to get firsthand accounts of particular problems. (Correct answer)

Correct answer: Meet with important ED patients to get firsthand accounts of particular problems.

When system logs show minimal downtime but users report frequent issues, it indicates a disconnect that requires direct user engagement. Meeting with key ED personnel (or 'patients' as stated, implying users/stakeholders experiencing the problem) allows the CIO to gather firsthand accounts, understand specific workflow impediments, or identify usability challenges not captured by automated monitoring. This qualitative data is essential for pinpointing the actual root cause of user frustration and addressing the perceived 'downtime' effectively.

Question 21: During EHR implementation testing, clinical staff report that the system workflow does not match actual clinical processes. This represents which type of issue?

Technical defect
Security vulnerability
Workflow fit gap (Correct answer)
Data integrity error

Correct answer: Workflow fit gap

A workflow fit gap occurs when the system's built-in processes do not align with the organization's actual clinical workflows, requiring configuration or process redesign.

Question 22: A clinical informaticist is helping to implement a new clinical decision support (CDS) system. To ensure the system effectively improves patient outcomes, which framework should be prioritized during the implementation process?

The DIKW (Data, Information, Knowledge, Wisdom) Pyramid
The Systems Development Life Cycle (SDLC)
The Five Rights of Clinical Decision Support (Correct answer)
The Health Information Technology for Economic and Clinical Health (HITECH) Act

Correct answer: The Five Rights of Clinical Decision Support

The 'Five Rights of Clinical Decision Support' is a foundational framework specifically designed to guide the effective implementation of CDS systems. It ensures that the right information is delivered to the right person, in the right format, through the right channel, and at the right time in the clinical workflow to improve decision-making and patient outcomes.

Question 23: A patient is discharged from a hospital after a cardiac event and receives follow-up care from a home health agency, followed by outpatient rehabilitation services. This coordinated approach to patient care across different healthcare settings is best described as which of the following?

Continuum of Care (Correct answer)
Fee-for-Service Model
Integrated Delivery Network (IDN)
Tertiary Care

Correct answer: Continuum of Care

The Continuum of Care refers to an integrated system of healthcare that guides and tracks a patient over time through a comprehensive array of services spanning all levels of intensity of care. This scenario, involving transition from an acute hospital stay to home health and then to outpatient services, is a classic example of the continuum of care model.

Question 24: What is the primary purpose of a Master Patient Index (MPI) in a Health Information Exchange?

To process insurance claims and remittances
To uniquely identify and match patient records across different systems (Correct answer)
To store all clinical documents in a central location
To manage provider credentials and licensing

Correct answer: To uniquely identify and match patient records across different systems

An MPI ensures that records from different organizations belonging to the same patient are correctly linked, preventing duplicate or mismatched records.

Question 25: The Stark Law (Physician Self-Referral Law) prohibits physicians from referring patients to entities with which they have a financial relationship for which of the following services?

Telemedicine consultations only
Any service provided in a foreign country
Designated health services covered by Medicare or Medicaid (Correct answer)
Primary care office visits

Correct answer: Designated health services covered by Medicare or Medicaid

The Stark Law prohibits physician self-referrals to entities in which they have a financial interest for any of 11 'designated health services' billable to Medicare or Medicaid.

Question 26: Which concept describes the ability of a healthcare IT system to increase capacity by adding more servers rather than upgrading existing ones?

Horizontal scaling (Correct answer)
Load balancing
Vertical scaling
Elastic provisioning

Correct answer: Horizontal scaling

Horizontal scaling (scale-out) adds more servers to distribute load, whereas vertical scaling upgrades the existing server's resources.

Question 27: Which testing phase verifies that individual components of a healthcare information system work correctly in isolation before integration?

User acceptance testing
Integration testing
Unit testing (Correct answer)
System testing

Correct answer: Unit testing

Unit testing verifies individual components or modules in isolation before they are combined with other system elements.

Question 28: Which testing environment best simulates real-world production conditions for final validation before go-live?

Development environment
Training environment
Staging/pre-production environment (Correct answer)
Quality assurance (QA) environment

Correct answer: Staging/pre-production environment

The staging or pre-production environment mirrors the production environment as closely as possible, making it ideal for final validation testing.

Question 29: When managing a healthcare IT project budget, a cost baseline is BEST described as:

The approved time-phased budget used to measure cost performance (Correct answer)
The vendor's quoted price for software licenses
The initial rough estimate before planning begins
The contingency reserve set aside for unknown risks

Correct answer: The approved time-phased budget used to measure cost performance

The cost baseline is the approved, time-phased project budget used as a reference to measure and report cost performance throughout the project.

Question 30: What is the difference between change management and project management in IT governance?

They are identical processes
Change management controls modifications to existing systems; project management delivers new capabilities (Correct answer)
Change management only applies to organizational culture
Project management controls system changes; change management delivers new projects

Correct answer: Change management controls modifications to existing systems; project management delivers new capabilities

Change management governs controlled modifications to production systems, while project management coordinates the delivery of new solutions and capabilities.

Question 31: During which SDLC phase is the system's total cost of ownership (TCO) FIRST estimated?

Maintenance
Planning/analysis (Correct answer)
Design
Testing

Correct answer: Planning/analysis

TCO is first estimated during the planning or analysis phase as part of the feasibility study and business case development.

Question 32: Which approach to EHR governance BEST ensures that clinical documentation templates remain clinically relevant and do not contribute to note bloat?

Eliminating all structured templates in favor of free-text dictation
Allowing each department to create unlimited custom templates
Using only vendor-default templates without modification
Establishing a formal template review and retirement process with clinical ownership (Correct answer)

Correct answer: Establishing a formal template review and retirement process with clinical ownership

A formal governance process with clinical ownership ensures templates are periodically reviewed, updated, and retired when they no longer serve clinical or regulatory needs.

Question 33: A healthcare organization is implementing a new EHR system across all its facilities simultaneously over a single weekend. All departments will switch from the legacy system to the new system at the same time. Which implementation strategy is being used?

Parallel conversion
Phased roll-out
Pilot implementation
Big Bang (Correct answer)

Correct answer: Big Bang

The 'Big Bang' approach involves implementing a new system across the entire organization at once, on a specific go-live date. This contrasts with a phased roll-out (implementing module by module or department by department), parallel conversion (running both old and new systems simultaneously for a period), or a pilot implementation (testing the system in a single, contained area before a wider release).

Question 34: In the context of CPHIMS, what is the main goal of system validation in healthcare IT?

Ensure the system meets the intended use and user needs (Correct answer)
Verify all code modules compile without errors
Confirm the system was built according to design specifications
Check network infrastructure meets bandwidth requirements

Correct answer: Ensure the system meets the intended use and user needs

Validation confirms that the system meets user needs and intended use in its operational environment, distinct from verification which checks design conformance.

Question 35: A CPHIMS candidate is reviewing database normalization. Which normal form eliminates partial dependencies, ensuring all non-key attributes depend on the ENTIRE primary key?

First Normal Form (1NF)
Third Normal Form (3NF)
Boyce-Codd Normal Form (BCNF)
Second Normal Form (2NF) (Correct answer)

Correct answer: Second Normal Form (2NF)

2NF eliminates partial dependencies by requiring every non-key attribute to be fully dependent on the entire composite primary key.

Question 36: A healthcare organization is merging with a regional health system. What is the PRIMARY IT leadership priority during the integration planning phase?

Assessing interoperability of existing systems (Correct answer)
Immediately decommissioning legacy systems
Migrating all data on day one
Replacing all hardware before go-live

Correct answer: Assessing interoperability of existing systems

Interoperability assessment determines how existing systems can communicate and identifies integration risks before any migration or decommissioning occurs.

Question 37: During the implementation of a new lab information system, the project team identifies a scope creep request from a department head to add a feature not in the original contract. What should the project manager do FIRST?

Escalate directly to the vendor for a cost estimate
Submit the request through the formal change control process for evaluation (Correct answer)
Implement the feature to maintain stakeholder satisfaction
Reject the request outright to protect the schedule

Correct answer: Submit the request through the formal change control process for evaluation

All scope changes must be evaluated through formal change control to assess impact on schedule, budget, and resources before a decision is made.

Question 38: Which entity is responsible for publishing and maintaining Current Procedural Terminology (CPT) codes?

American Health Information Management Association
National Committee for Quality Assurance
Centers for Medicare & Medicaid Services
American Medical Association (Correct answer)

Correct answer: American Medical Association

CPT codes are owned and maintained by the American Medical Association (AMA) and are used to describe medical, surgical, and diagnostic services for billing purposes.

Question 39: An IT leader notices that two departments have conflicting priorities for a shared system upgrade. What is the BEST approach?

Escalate immediately to the CEO
Let the departments resolve it independently
Defer the upgrade indefinitely
Facilitate a structured negotiation aligned to organizational priorities (Correct answer)

Correct answer: Facilitate a structured negotiation aligned to organizational priorities

Structured negotiation using organizational priority frameworks ensures conflict is resolved in a way that serves the broader mission rather than departmental preferences.

Question 40: Which of the following is a critical activity performed during the 'Implementation' (or Go-Live) phase of the SDLC?

Executing the data migration and system cutover plan. (Correct answer)
Performing a detailed cost-benefit analysis for the project.
Writing the initial functional requirements document.
Conducting final user acceptance testing (UAT).

Correct answer: Executing the data migration and system cutover plan.

The Implementation phase, also known as go-live or deployment, is when the new system is put into the production environment. Key activities include executing the cutover plan (the switch from the old system to the new one), migrating data, and providing intensive support to end-users.

Question 41: Which IT management approach emphasizes continuous service improvement through defined processes, roles, and metrics?

Six Sigma manufacturing
ITIL (Information Technology Infrastructure Library) (Correct answer)
Waterfall development
Agile Scrum

Correct answer: ITIL (Information Technology Infrastructure Library)

ITIL is a framework specifically designed for IT service management that emphasizes process-driven continuous service improvement.

Question 42: What is the most popular method used by the healthcare sector to safeguard private information?

Virus protection
Passwords (Correct answer)
Public key encryption
Data backup and recovery

Correct answer: Passwords

Passwords are the most fundamental and widely used method for controlling access to private information in the healthcare sector. They serve as the primary authentication mechanism, ensuring that only authorized individuals can access electronic health records, systems, and sensitive patient data. While other security measures like encryption and data backup are crucial, passwords are the initial and most common gatekeeper against unauthorized entry.

Question 43: Which framework is MOST commonly used to align IT governance with business objectives in healthcare organizations?

ISO 27001
ITIL
COBIT (Correct answer)
TOGAF

Correct answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) is the most widely adopted framework for IT governance that aligns IT goals with business objectives.

Question 44: A healthcare organization's IT governance model should prioritize which principle when approving new technology investments?

Lowest cost acquisition
Alignment with strategic organizational goals (Correct answer)
Latest available technology
Vendor preference

Correct answer: Alignment with strategic organizational goals

IT governance frameworks consistently emphasize that technology investments must align with and support the organization's strategic objectives.

Question 45: Which SDLC document captures the functional and non-functional requirements agreed upon by stakeholders?

Project charter
Test plan
Functional requirements specification (Correct answer)
Operational readiness checklist

Correct answer: Functional requirements specification

The functional requirements specification documents what the system must do and any performance, security, or usability constraints.

Question 46: What does the term 'payer mix' represent in a hospital's financial context?

The ratio of fixed to variable costs in the hospital's operating budget
The distribution of patient revenue sources (Medicare, Medicaid, commercial, self-pay) in a given period (Correct answer)
The variety of health insurance products offered to hospital employees
The combination of inpatient and outpatient services billed each month

Correct answer: The distribution of patient revenue sources (Medicare, Medicaid, commercial, self-pay) in a given period

Payer mix describes the proportion of revenue or patient volume attributable to each payment source, which directly affects a hospital's overall reimbursement rates and financial health.

Question 47: When evaluating a clinical informatics system's impact on quality, which metric is MOST directly tied to patient outcomes?

Number of structured data fields completed
System uptime percentage
Reduction in preventable adverse drug events (Correct answer)
Time-to-login for clinical staff

Correct answer: Reduction in preventable adverse drug events

Reduction in preventable adverse drug events is a direct patient outcome measure tied to the clinical safety goals of informatics systems.

Question 48: An organization wants to ensure that critical clinical systems remain available during a cyberattack. Which strategy BEST addresses this need?

Conducting annual penetration testing
Encrypting all data at rest and in transit
Increasing firewall rules and blocking all external traffic
Maintaining offline downtime procedures and read-only EHR access (Correct answer)

Correct answer: Maintaining offline downtime procedures and read-only EHR access

Downtime procedures and read-only EHR access ensure clinical continuity even when primary systems are compromised or unavailable.

Question 49: In healthcare IT project management, a RACI matrix defines:

Roles as Responsible, Accountable, Consulted, and Informed (Correct answer)
Resource Allocation, Cost, and Integration factors
Risk, Assumption, Constraint, and Issue categories
Requirements, Architecture, Coding, and Integration phases

Correct answer: Roles as Responsible, Accountable, Consulted, and Informed

A RACI matrix clarifies team member roles by designating who is Responsible, Accountable, Consulted, and Informed for each project task.

Question 50: A hospital performs a vulnerability scan and discovers an unpatched operating system on a workstation accessing the EHR. What is the BEST immediate action?

Isolate the workstation from the network and apply the security patch promptly (Correct answer)
Document the finding and schedule patching during the next maintenance window in 6 months
Disable the EHR system until all workstations are scanned
Notify HHS of the vulnerability

Correct answer: Isolate the workstation from the network and apply the security patch promptly

Isolating the vulnerable workstation prevents potential exploitation while the patch is applied, balancing security risk management with minimal operational disruption.

Question 51: SNOMED CT is primarily used in clinical informatics to represent:

Laboratory reference ranges
Clinical concepts and findings in a structured, computable format (Correct answer)
Drug interaction rules
Billing codes for reimbursement

Correct answer: Clinical concepts and findings in a structured, computable format

SNOMED CT (Systematized Nomenclature of Medicine Clinical Terms) is a comprehensive clinical terminology used to encode clinical concepts for interoperability and analysis.

Question 52: Which federal regulation requires hospitals to maintain electronic medication administration records and bar-code point-of-care verification to reduce medication errors?

HIPAA Security Rule
FDA Bar Code Label Rule (21 CFR Part 801) (Correct answer)
Joint Commission NPSG.03.04.01
CMS Conditions of Participation

Correct answer: FDA Bar Code Label Rule (21 CFR Part 801)

The FDA Bar Code Label Rule requires bar codes on medications, enabling point-of-care scanning to verify the 5 rights of medication administration.

Question 53: A new results reporting system was recently unveiled by a local reference lab. Once test results are ready, the pathologist's report is immediately sent to the office of the ordering doctor. A systems analyst should look through the following to address patient care during the systems analysis phase:

blood splash/exposure incident reports
equipment calibration reports
report turnaround times (Correct answer)
lab volume trend reports

Correct answer: report turnaround times

During the systems analysis phase, particularly when a new results reporting system is implemented, evaluating report turnaround times is crucial for patient care. Faster and more reliable delivery of test results directly impacts the speed of diagnosis and treatment decisions, which are critical for patient outcomes. Analyzing these times helps ensure the new system is effectively improving the efficiency and quality of care.

Question 54: A formal process for reviewing, approving, and documenting changes to a system in production is called?

Incident management
Change management (Correct answer)
Configuration management
Risk management

Correct answer: Change management

Change management provides a structured process for requesting, evaluating, approving, and tracking modifications to production systems.

Question 55: Under HIPAA, which of the following is NOT considered protected health information (PHI)?

A patient's diagnosis documented in the EHR
Insurance claim data linked to a specific individual
Lab results transmitted electronically
De-identified health data meeting Safe Harbor standards (Correct answer)

Correct answer: De-identified health data meeting Safe Harbor standards

De-identified health data that meets HIPAA's Safe Harbor or Expert Determination standards is not considered PHI and is not subject to HIPAA protections.

Question 56: During system evaluation, which framework is most commonly used to assess the overall value of a healthcare IT investment?

Agile Scrum framework
Return on Investment (ROI) analysis (Correct answer)
COBIT
TOGAF

Correct answer: Return on Investment (ROI) analysis

ROI analysis measures the financial return relative to investment costs and is the most widely used framework for evaluating healthcare IT value.

Question 57: A hospital is implementing a new CPOE system using a phased rollout approach. What is the PRIMARY advantage of this strategy?

It guarantees the vendor meets the contract SLA
It eliminates the need for downtime procedures
It allows issues to be identified and resolved before full deployment (Correct answer)
It reduces total training time across all departments

Correct answer: It allows issues to be identified and resolved before full deployment

A phased rollout limits risk exposure and lets teams address problems in earlier phases before broader deployment.

Question 58: What is the role of a certificate authority (CA) in a healthcare organization's public key infrastructure (PKI)?

Stores encrypted copies of user passwords
Manages symmetric encryption keys for database storage
Issues and revokes digital certificates that verify identities (Correct answer)
Routes encrypted traffic between network segments

Correct answer: Issues and revokes digital certificates that verify identities

A CA is a trusted entity that issues digital certificates binding a public key to an identity, enabling verification and secure communications.

Question 59: A hospital's 'case mix index' (CMI) is significant in healthcare finance primarily because it:

Measures patient satisfaction scores across departments
Tracks the percentage of patients with chronic conditions
Reflects the average relative weight of all patient cases and influences Medicare revenue (Correct answer)
Determines staffing ratios required by state regulators

Correct answer: Reflects the average relative weight of all patient cases and influences Medicare revenue

CMI represents the average DRG weight for a hospital's inpatient cases; a higher CMI indicates more complex cases and results in higher Medicare reimbursements.

Question 60: Which federal program incentivized U.S. hospitals to demonstrate 'meaningful use' of certified EHR technology and advance health data analytics capabilities?

HITECH Act / Medicare and Medicaid EHR Incentive Programs (Correct answer)
Medicare Part D Prescription Drug Program
HIPAA Security Rule
Affordable Care Act Marketplace Rule

Correct answer: HITECH Act / Medicare and Medicaid EHR Incentive Programs

The HITECH Act established the Medicare and Medicaid EHR Incentive Programs (Meaningful Use), driving EHR adoption and structured data capture for analytics.

Question 61: The HITECH Act strengthened HIPAA by:

Allowing unlimited secondary use of patient data for research
Removing breach notification requirements for small practices
Extending HIPAA Security Rule obligations directly to business associates and increasing penalties (Correct answer)
Eliminating the need for Business Associate Agreements

Correct answer: Extending HIPAA Security Rule obligations directly to business associates and increasing penalties

The Health Information Technology for Economic and Clinical Health (HITECH) Act extended HIPAA Security Rule requirements directly to business associates and significantly increased civil and criminal penalties for violations.

Question 62: A healthcare CIO must report IT performance to the board. Which type of report is MOST appropriate for this audience?

Detailed technical system logs
Vendor invoice summaries
Executive dashboard with KPIs aligned to strategic objectives (Correct answer)
Full IT project management status reports

Correct answer: Executive dashboard with KPIs aligned to strategic objectives

Executive dashboards present high-level key performance indicators tied to strategic goals, giving board members actionable information without technical complexity.

Question 63: A nurse reports that a medication order placed in the EHR is not appearing in the pharmacy system 30 minutes after entry. Which system component should the support team investigate FIRST?

The EHR's clinical decision support rules
The HL7 interface or integration engine transmitting orders (Correct answer)
The pharmacy system's drug database
The nurse's workstation network connectivity

Correct answer: The HL7 interface or integration engine transmitting orders

A failure to transmit orders between systems most commonly points to an issue in the HL7 interface or integration engine.

Question 64: In healthcare IT, a project management office (PMO) is PRIMARILY responsible for:

Managing the hospital's operational IT help desk
Negotiating vendor contracts for all departments
Standardizing project governance, methodologies, and oversight across the organization (Correct answer)
Providing direct patient care support tools

Correct answer: Standardizing project governance, methodologies, and oversight across the organization

A PMO establishes standardized processes, governance frameworks, and oversight to ensure consistent project delivery across the healthcare organization.

Question 65: A healthcare system that is funded by the government through taxes, where the government also manages the delivery of care, is characteristic of which healthcare delivery model?

Bismarck Model
Out-of-Pocket Model
Beveridge Model (Correct answer)
National Health Insurance Model

Correct answer: Beveridge Model

The Beveridge Model is characterized by healthcare that is both funded and delivered by the government, paid for through general taxation. Countries like the United Kingdom and Spain utilize this model.

Question 66: When a hospital EHR project is experiencing scope creep, the project manager should FIRST:

Evaluate change requests through the formal change control process (Correct answer)
Approve all requested changes immediately to satisfy stakeholders
Halt the project until original scope is restored
Reassign team members to accommodate additional work

Correct answer: Evaluate change requests through the formal change control process

All scope changes must be evaluated through the formal change control process to assess impact on schedule, cost, and quality.

Question 67: A health system's strategic plan identifies patient engagement as a top priority. Which IT initiative BEST supports this goal?

Patient portal with secure messaging and health record access (Correct answer)
Legacy data archival project
Internal staff scheduling system upgrade
Network bandwidth expansion

Correct answer: Patient portal with secure messaging and health record access

A patient portal directly enables patient engagement by giving individuals access to their health information and communication tools.

Question 68: During the final stage of testing for a new telehealth platform, a group of nurses and physicians is asked to use the system in a simulated environment that mirrors their actual clinic workflow. They follow test scripts to schedule appointments, conduct video visits, and document encounters to ensure the system meets their operational needs. This type of testing is called:

Regression Testing
User Acceptance Testing (UAT) (Correct answer)
Integration Testing
Unit Testing

Correct answer: User Acceptance Testing (UAT)

User Acceptance Testing (UAT) is the final phase of testing where end-users validate that the system meets business requirements and is suitable for the production environment. It focuses on real-world scenarios and workflows from the user's perspective. Unit testing checks individual components, integration testing verifies that modules work together, and regression testing ensures new changes haven't broken existing functionality.

Question 69: Which role is MOST responsible for approving that a system meets business requirements before go-live?

Business owner/sponsor (Correct answer)
System developer
Help desk analyst
IT project manager

Correct answer: Business owner/sponsor

The business owner or sponsor signs off on user acceptance testing to confirm the system meets operational needs.

Question 70: A CPHIMS candidate is evaluating storage solutions. Which technology provides the lowest latency for database transactions in a clinical environment?

Network-attached storage (NAS)
Solid-state drive (SSD) storage (Correct answer)
Tape storage arrays
Cloud object storage

Correct answer: Solid-state drive (SSD) storage

SSDs use flash memory with no moving parts, providing significantly lower latency than spinning disk or tape for database transactions.

Question 71: The Leapfrog Group is best known for which activity in the US healthcare environment?

Administering the CPHIMS examination
Accrediting healthcare information professionals
Setting federal EHR certification standards
Publicly reporting hospital safety and quality scores (Correct answer)

Correct answer: Publicly reporting hospital safety and quality scores

The Leapfrog Group is an employer-driven coalition that publicly reports hospital performance data to improve transparency, safety, and quality.

Question 72: Under HIPAA, who bears ultimate accountability for ensuring a covered entity's compliance with security regulations?

The IT Department
The organization's leadership/Board (Correct answer)
The CISO
The Privacy Officer

Correct answer: The organization's leadership/Board

Ultimate accountability for HIPAA compliance rests with the organization's senior leadership and governing board, not individual staff roles.

Question 73: Key Performance Indicators (KPIs) in a hospital dashboard BEST serve to:

Track progress toward strategic organizational goals through measurable metrics (Correct answer)
Replace the need for detailed clinical documentation
Automate billing and claims submission
Store raw patient data for future analysis

Correct answer: Track progress toward strategic organizational goals through measurable metrics

KPIs are quantifiable metrics aligned to strategic goals that allow hospital leadership to monitor performance and make data-driven decisions.

Question 74: Which standard is primarily used to define the structure for exchanging clinical documents such as discharge summaries in healthcare interoperability?

DICOM
X12 EDI
IEEE 11073
HL7 CDA (Clinical Document Architecture) (Correct answer)

Correct answer: HL7 CDA (Clinical Document Architecture)

HL7 CDA defines the structure and semantics of clinical documents for exchange, making it the primary standard for structured clinical document sharing.

Question 75: During the system testing phase of an EHR implementation, testers are provided with documents that contain detailed, step-by-step instructions for each function to be tested, along with the expected outcomes. What are these documents primarily known as?

Test Scripts (Correct answer)
Workflow Diagrams
Project Charters
System Blueprints

Correct answer: Test Scripts

Test scripts are procedural documents that provide a tester with detailed, step-by-step instructions for executing a test case. They define the setup, specific actions, and expected results to ensure consistent and thorough testing.

Question 76: A healthcare system's leadership team is developing a new five-year strategic plan. To ensure the IT strategy is properly aligned, the CIO conducts an analysis that identifies the organization's skilled informatics staff, its aging network infrastructure, the growing regional demand for telehealth services, and the increasing cybersecurity threats from ransomware. Which strategic planning tool is being used?

Change Management Model
Porter's Five Forces
Balanced Scorecard
SWOT Analysis (Correct answer)

Correct answer: SWOT Analysis

A SWOT analysis is a strategic planning technique used to identify an organization's internal Strengths and Weaknesses, as well as its external Opportunities and Threats. In this scenario, the skilled staff (Strength), aging infrastructure (Weakness), telehealth demand (Opportunity), and cybersecurity risks (Threat) directly correspond to the four quadrants of a SWOT analysis.

Question 77: Which technology allows a healthcare application to authenticate users through a trusted third-party identity provider without sharing passwords?

RADIUS
SAML-based federated identity (Correct answer)
CHAP authentication
LDAP directory sync

Correct answer: SAML-based federated identity

SAML (Security Assertion Markup Language) enables federated single sign-on by passing authentication assertions between an identity provider and service provider.

Question 78: What is the role of a Chief Privacy Officer (CPO) in a healthcare organization?

Conducting penetration testing of clinical systems
Overseeing compliance with privacy laws and policies governing patient information (Correct answer)
Managing network security and firewall configurations
Approving all vendor contracts involving data sharing

Correct answer: Overseeing compliance with privacy laws and policies governing patient information

The CPO is responsible for developing, implementing, and maintaining the organization's privacy program, ensuring compliance with applicable privacy laws and regulations.

Question 79: An informatics team is analyzing EHR data to identify patients at high risk for sepsis. By developing and applying a predictive algorithm that combines vital signs, lab results, and patient history, the team is primarily focused on which core principle of clinical informatics?

Facilitating enterprise-wide system interoperability.
Transforming data into actionable knowledge to improve patient safety. (Correct answer)
Managing the lifecycle of health information technology.
Ensuring data standardization through terminology mapping.

Correct answer: Transforming data into actionable knowledge to improve patient safety.

This scenario exemplifies a key function of clinical informatics: using technology and data analysis to move beyond simple data collection. By analyzing multiple data points to predict a clinical event (sepsis), the team is creating new knowledge and providing an actionable insight that can be used to intervene and improve a patient's outcome, directly enhancing patient safety.

Question 80: Which HL7 standard is specifically designed for exchanging clinical documents, such as discharge summaries, in a human-readable and machine-processable format?

FHIR R4 Observation resources
Clinical Document Architecture (CDA) (Correct answer)
HL7 v2 ADT messages
HL7 v3 RIM

Correct answer: Clinical Document Architecture (CDA)

HL7 CDA is the standard for structuring clinical documents to be both human-readable and machine-processable.

Question 81: Which of the below phrases best defines the format that information takes when it is entered into a computer system?

Data warehouse
Information system strategy
Data dictionary (Correct answer)
Project organization

Correct answer: Data dictionary

A data dictionary is a centralized repository of information about data, including its definition, format, structure, and relationships. It specifies how data elements are named, what type of data they hold (e.g., text, number, date), their length, and any constraints. This ensures consistency and standardization of information as it is entered and stored within a computer system.

Question 82: What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

To eliminate the need for encryption of transmitted data
To allow unlimited data sharing between healthcare organizations
To ensure vendors safeguard PHI they access on behalf of a covered entity (Correct answer)
To authorize third parties to sell patient data

Correct answer: To ensure vendors safeguard PHI they access on behalf of a covered entity

A BAA is a contract that requires business associates to appropriately safeguard PHI they create, receive, maintain, or transmit on behalf of a covered entity.

Question 83: When conducting a stakeholder analysis for an EHR implementation, which group should be identified as having HIGH influence but LOW interest?

Patients
Regulatory bodies (Correct answer)
IT staff
Frontline nurses

Correct answer: Regulatory bodies

Regulatory bodies typically have high influence over compliance requirements but low day-to-day interest in operational details, placing them in the 'keep satisfied' quadrant.

Question 84: A hospital deploys a content delivery network (CDN) for its patient education portal. What is the PRIMARY benefit?

Reduced server load and improved page load times for distributed users (Correct answer)
Compliance with HIPAA storage requirements
Centralized audit log collection
Increased data encryption strength

Correct answer: Reduced server load and improved page load times for distributed users

A CDN caches content at geographically distributed edge nodes, reducing latency and origin server load for end users.

Question 85: In a healthcare data governance program, a 'data steward' is PRIMARILY responsible for:

Approving vendor invoices for analytics software
Physically securing servers in the data center
Managing the quality, definitions, and appropriate use of data within a specific domain (Correct answer)
Writing code for the enterprise data warehouse ETL pipelines

Correct answer: Managing the quality, definitions, and appropriate use of data within a specific domain

A data steward is a domain expert accountable for maintaining data quality, definitions, and appropriate usage standards within their area (e.g., clinical, financial, or operational data).

Question 86: What is the purpose of a FORMAL sign-off from clinical leadership at the conclusion of user acceptance testing (UAT)?

To close the project in the project management system
To satisfy HIPAA audit documentation requirements
To authorize vendor payment for the system license
To confirm that the system meets clinical requirements and is approved for go-live (Correct answer)

Correct answer: To confirm that the system meets clinical requirements and is approved for go-live

Clinical leadership sign-off on UAT confirms that the system meets defined clinical requirements and is ready for production deployment.

Question 87: What kind of system is used in the healthcare sector to maintain patient records?

results-reporting systems
Object-oriented databases
Order-entry systems
Clinical data repository (Correct answer)

Correct answer: Clinical data repository

A clinical data repository (CDR) is a centralized database designed to store and manage patient-specific clinical data from various sources within a healthcare organization. It serves as the primary system for maintaining comprehensive patient records, integrating information from different departments like labs, radiology, and physician notes, to provide a unified and accessible view of a patient's health history.

Question 88: A new CMIO and CIO have conflicting visions for the EHR optimization roadmap. What is the MOST effective resolution strategy?

Escalate to the board immediately
Delay all EHR work until agreement is reached
Co-develop a unified roadmap prioritized by patient care and operational outcomes (Correct answer)
Allow each leader to implement their preferred approach separately

Correct answer: Co-develop a unified roadmap prioritized by patient care and operational outcomes

Co-developing a unified roadmap grounded in shared organizational outcomes resolves leadership conflict while maintaining strategic coherence.

Question 89: When building a healthcare analytics report, stratifying patient outcomes by age, gender, and race PRIMARILY supports:

Vendor performance evaluation
Billing accuracy and claim submission rates
Health equity analysis to identify and address disparate outcomes (Correct answer)
Staff scheduling optimization

Correct answer: Health equity analysis to identify and address disparate outcomes

Stratifying outcomes by demographic factors allows organizations to identify disparities in care and take targeted action to promote health equity.

Question 90: A hospital's risk analysis reveals a high-probability, high-impact threat. According to HIPAA Security Rule, what is the appropriate next step?

Immediately report the finding to HHS
Document the risk and revisit it during the next annual review
Notify all patients whose data may be affected
Implement risk management measures to reduce the risk to an acceptable level (Correct answer)

Correct answer: Implement risk management measures to reduce the risk to an acceptable level

The HIPAA Security Rule requires covered entities to implement risk management measures to reduce identified risks and vulnerabilities to a reasonable and appropriate level.

Question 91: A hospital is in the final stages of implementing a new electronic health record (EHR) system. Before the system goes live, a group of nurses, physicians, and registration staff are brought in to perform tasks in a mock environment that mirrors their actual workflows. What is this critical phase of testing called?

Integration Testing
User Acceptance Testing (UAT) (Correct answer)
Regression Testing
Unit Testing

Correct answer: User Acceptance Testing (UAT)

User Acceptance Testing (UAT) is the final phase of testing where end-users validate that the system meets their business requirements and can support their workflows before it is deployed to the production environment.

Question 92: Which data exchange framework, developed by CommonWell Health Alliance and Carequality, focuses on establishing trust between different HIE networks to enable broad nationwide data sharing?

The Strategic Health IT Advanced Research Projects (SHARP)
The Patient Unified Lookup System for Emergencies (PULSE)
The Commonwell-Carequality Bridge (Correct answer)
The eHealth Exchange

Correct answer: The Commonwell-Carequality Bridge

The CommonWell-Carequality Bridge connects the two largest national interoperability networks, enabling their combined participants to exchange health information regardless of which network they belong to.

Question 93: During EHR implementation, a gap analysis reveals that the vendor system cannot support a required state-mandated reporting workflow. What is the BEST next step?

Evaluate workarounds, custom development, or third-party solutions to close the gap (Correct answer)
Terminate the vendor contract immediately
Delay go-live indefinitely until the vendor adds the feature
Accept the gap and eliminate the workflow requirement

Correct answer: Evaluate workarounds, custom development, or third-party solutions to close the gap

A gap analysis finding requires evaluation of feasible options—workarounds, customization, or bolt-on tools—to meet the requirement without necessarily canceling the project.

Question 94: Which healthcare IT infrastructure component is MOST critical for supporting HL7 FHIR-based interoperability between disparate systems?

A shared Oracle database between organizations
A proprietary VPN tunnel between EHR vendors
Dedicated fiber optic cables between facilities
An API gateway or integration engine with FHIR R4 support (Correct answer)

Correct answer: An API gateway or integration engine with FHIR R4 support

An API gateway or integration engine that supports FHIR R4 manages, routes, and transforms FHIR API requests between systems, enabling standards-based interoperability.

Question 95: A hospital's project team is conducting extensive workflow analysis, interviewing clinicians to gather their needs, and documenting detailed functional requirements for a new Computerized Provider Order Entry (CPOE) system. In which phase of the System Development Life Cycle (SDLC) are these activities primarily taking place?

Development and Testing
Maintenance and Evaluation
Planning and Analysis (Correct answer)
Implementation and Deployment

Correct answer: Planning and Analysis

The Planning and Analysis phase is focused on understanding the business problem, defining the project scope, gathering and documenting user requirements, and analyzing existing workflows. These activities are foundational to designing and building a system that meets user needs.

Question 96: A hospital CIO wants to ensure IT investments deliver measurable value. Which governance practice BEST supports this goal?

Migrating all systems to the cloud
Establishing a portfolio management process with defined metrics (Correct answer)
Hiring additional IT staff
Implementing a help desk ticketing system

Correct answer: Establishing a portfolio management process with defined metrics

Portfolio management with defined metrics allows organizations to track and measure the business value delivered by IT investments.

Question 97: During system implementation, which activity ensures that data migrated from a legacy system to a new EHR is complete, accurate, and properly formatted?

Data conversion validation (Correct answer)
Capacity planning review
Interface engine mapping
Disaster recovery testing

Correct answer: Data conversion validation

Data conversion validation confirms that migrated data matches source records in content, format, and completeness.

Question 98: What is the primary goal of a healthcare organization's incident response plan (IRP) for a data breach?

To identify which employees caused the breach and terminate them
To immediately report all incidents to law enforcement
To permanently delete all compromised data to prevent further exposure
To contain the breach, eradicate the threat, recover systems, and fulfill notification obligations (Correct answer)

Correct answer: To contain the breach, eradicate the threat, recover systems, and fulfill notification obligations

An incident response plan guides an organization through contain-eradicate-recover phases while ensuring compliance with HIPAA breach notification and other regulatory obligations.

Question 99: In healthcare IT testing, what is the primary purpose of an end-to-end test scenario?

Confirm that system backups complete successfully
Test a single system module in isolation
Measure system response times under peak load
Validate a complete business process across all integrated systems from start to finish (Correct answer)

Correct answer: Validate a complete business process across all integrated systems from start to finish

End-to-end testing validates that a complete clinical or administrative workflow functions correctly across all integrated systems from initiation to completion.

Question 100: A data dictionary in a healthcare information system PRIMARILY provides:

Encryption keys for securing sensitive fields
Definitions, formats, and allowable values for each data element in a system (Correct answer)
A list of approved medical terminology for clinical notes
An index of all patient records stored in the database

Correct answer: Definitions, formats, and allowable values for each data element in a system

A data dictionary documents the name, definition, data type, format, and allowable values for each field, ensuring consistent interpretation of data across the organization.

Question 101: As part of its strategic planning, a hospital's leadership team is committed to becoming a learning organization. From a health IT perspective, which of the following initiatives would be MOST effective at fostering a culture of continuous learning and improvement?

Establishing a robust clinical decision support (CDS) governance committee that regularly reviews, updates, and refines system alerts and rules based on clinical feedback and outcomes data. (Correct answer)
Restricting access to clinical analytics tools to only senior management and department heads.
Outsourcing the entire IT department to a third-party vendor to reduce internal management overhead.
Implementing a strict policy that penalizes clinicians for medical errors documented in the EHR.

Correct answer: Establishing a robust clinical decision support (CDS) governance committee that regularly reviews, updates, and refines system alerts and rules based on clinical feedback and outcomes data.

A learning organization continuously improves by capturing and applying knowledge. A CDS governance committee that uses feedback and data to refine IT tools embodies this principle. It creates a feedback loop for learning and improvement directly within the clinical workflow. Penalizing errors discourages reporting, restricting data access prevents learning, and outsourcing can distance the IT function from the organization's clinical learning culture.

Question 102: What is the primary distinction between 'incidence' and 'prevalence' in epidemiology as applied to healthcare planning?

Both terms are interchangeable in healthcare informatics
Incidence measures new cases in a time period; prevalence measures total existing cases at a point in time (Correct answer)
Incidence measures total existing cases; prevalence measures new cases in a period
Incidence applies only to infectious diseases; prevalence applies to chronic conditions

Correct answer: Incidence measures new cases in a time period; prevalence measures total existing cases at a point in time

Incidence counts new cases occurring during a specific period, while prevalence counts all existing cases (new and old) at a particular point or over a period.

Question 103: In healthcare, 'utilization management' primarily involves:

Auditing financial statements for regulatory compliance
Managing the physical space and equipment in clinical departments
Reviewing the necessity, appropriateness, and efficiency of healthcare services (Correct answer)
Tracking employee attendance and shift scheduling

Correct answer: Reviewing the necessity, appropriateness, and efficiency of healthcare services

Utilization management evaluates the medical necessity and appropriateness of healthcare services at various stages—before, during, and after care delivery—to ensure efficient resource use.

Question 104: Which procurement document is used to solicit proposals from vendors for a hospital's new health information system?

Service Level Agreement (SLA)
Request for Proposal (RFP) (Correct answer)
Statement of Work (SOW)
Non-Disclosure Agreement (NDA)

Correct answer: Request for Proposal (RFP)

An RFP invites vendors to submit detailed proposals describing their solutions, pricing, and qualifications for a defined healthcare IT need.

Question 105: In a healthcare organization, which process ensures that IT systems meet defined performance standards before go-live?

Capacity planning
Gap analysis
Needs assessment
User acceptance testing (UAT) (Correct answer)

Correct answer: User acceptance testing (UAT)

User acceptance testing validates that a system meets end-user requirements and performance standards before it is deployed into the production environment.

Question 106: When evaluating an EHR vendor using a Request for Proposal (RFP), which element should carry the MOST weight in the functional requirements section?

Lowest total cost of ownership
Vendor market share and number of installed customers
Alignment of system capabilities with the organization's clinical workflow needs (Correct answer)
Speed of implementation timeline

Correct answer: Alignment of system capabilities with the organization's clinical workflow needs

Functional alignment with clinical workflows is paramount because a system that disrupts care delivery undermines adoption and patient safety regardless of other attributes.

Question 107: A health IT strategic plan identifies a capability gap between current state and desired future state. What process formally documents this gap?

Root cause analysis
Gap analysis (Correct answer)
FMEA
Fishbone diagram

Correct answer: Gap analysis

Gap analysis compares current capabilities against desired future state to identify what must be addressed in the strategic plan.

Question 108: Which of the following is an example of an internal escalation path used during a healthcare IT system go-live command center?

Escalating unresolved issues from the help desk tier 1 to application analysts to the implementation director (Correct answer)
Submitting a change request to the vendor's development backlog
Contacting the state health department about system downtime
Posting system status updates to the public hospital website

Correct answer: Escalating unresolved issues from the help desk tier 1 to application analysts to the implementation director

Internal escalation paths route unresolved issues upward through tier 1, application analysts, and leadership for resolution.

Question 109: Which governance control ensures only authorized individuals can access sensitive patient data in an EHR system?

Data backup procedures
Network firewall configuration
System performance monitoring
Role-based access control (RBAC) (Correct answer)

Correct answer: Role-based access control (RBAC)

Role-based access control restricts system access based on a user's organizational role, ensuring only authorized personnel can view or modify sensitive patient data.

Question 110: Which change management model emphasizes creating urgency and building a guiding coalition as early steps?

Kotter's 8-Step Model (Correct answer)
ADKAR Model
McKinsey 7-S Framework
Lewin's 3-Stage Model

Correct answer: Kotter's 8-Step Model

Kotter's 8-Step Model begins with establishing urgency and forming a guiding coalition before moving to vision creation and communication.

Question 111: In the context of US healthcare staffing, what does the term 'privileging' refer to?

Assigning nurses to high-acuity patient units
Granting physicians access to the EHR system
Authorizing specific clinical procedures a provider may perform at a facility (Correct answer)
Verifying a provider's insurance credentials for billing

Correct answer: Authorizing specific clinical procedures a provider may perform at a facility

Privileging is the process by which a healthcare organization authorizes a specific scope of patient care services a licensed practitioner may perform at that institution.

Question 112: Which type of HIE architecture consolidates data from multiple participating organizations into a single shared repository?

Hybrid model
Centralized model (Correct answer)
Peer-to-peer model
Federated model

Correct answer: Centralized model

A centralized HIE model aggregates data from all participating organizations into one repository, enabling faster queries but requiring significant trust and governance.

Question 113: A hospital is transitioning from a legacy system using HL7 v2 messaging to a new, modern EHR that needs to support mobile applications and real-time data access for patients. Which interoperability standard is BEST suited for these requirements?

DICOM
FHIR (Fast Healthcare Interoperability Resources) (Correct answer)
HL7 v3
CDA (Clinical Document Architecture)

Correct answer: FHIR (Fast Healthcare Interoperability Resources)

FHIR (Fast Healthcare Interoperability Resources) is the most suitable standard for modern healthcare applications, including mobile and web-based platforms. It uses modern web technologies like RESTful APIs and supports JSON, making it more flexible, easier to implement, and better for real-time data exchange compared to the older, more rigid HL7 v2 and v3 standards.

Question 114: A CPHIMS-certified professional is asked to recommend an approach for validating that a newly deployed system meets agreed-upon performance benchmarks. Which testing type BEST applies?

Performance/load testing (Correct answer)
Alpha testing
Parallel testing
Smoke testing

Correct answer: Performance/load testing

Performance/load testing validates that a system meets defined benchmarks for response time, throughput, and stability under expected and peak load conditions.

Question 115: Which practice helps prevent unauthorized changes to production code by requiring a second reviewer to approve code before deployment?

Code review/peer review (Correct answer)
Waterfall gating
Regression testing
Pair programming

Correct answer: Code review/peer review

Code peer review requires a second developer to review and approve changes before they are merged or deployed to production.

CPHIMS Certification Exam

The CPHIMS (Certified Professional in Healthcare Information and Management Systems) exam validates competency in healthcare IT management, covering technology environments, systems lifecycle, and administration leadership.

115

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds