NHA Certified Electronic Health Records Specialist (CEHRS) Exam — Questions and Answers

Question 1: What is interoperability in the context of Electronic Health Records (EHR)?

The security measures of EHR systems
The ability of different EHR systems to communicate and exchange patient data (Correct answer)
The ability of EHR systems to conduct financial transactions
The use of EHRs to track insurance claims

Correct answer: The ability of different EHR systems to communicate and exchange patient data

Interoperability refers to the ability of different EHR systems to exchange, interpret, and share patient information accurately and securely. This is crucial for providing coordinated care across different healthcare providers and settings.

Question 2: What is a Diagnosis-Related Group (DRG) primarily used for?

Classifying outpatient visits by complexity
Grouping inpatient cases for prospective payment to hospitals under Medicare (Correct answer)
Organizing EHR problem lists by organ system
Calculating physician fee-for-service payments

Correct answer: Grouping inpatient cases for prospective payment to hospitals under Medicare

DRGs are used by CMS under the Inpatient Prospective Payment System (IPPS) to pay hospitals a fixed amount based on the patient's diagnosis and procedures.

Question 3: A patient moves from one state to another and their new provider cannot access prior records. Which HIE model would BEST address this gap?

Query-based exchange (Correct answer)
Consumer-mediated exchange
Consolidated-CDA only sharing
Directed exchange

Correct answer: Query-based exchange

Query-based exchange allows providers to search and retrieve patient records from other providers on demand, ideal for accessing records across geographic boundaries.

Question 4: Which log type is most useful when troubleshooting a failed EHR interface message between systems?

Database backup log
User login log
HL7 interface transaction log (Correct answer)
Application audit log

Correct answer: HL7 interface transaction log

HL7 interface transaction logs capture message routing and error codes between communicating systems.

Question 5: What does the term 'insurance subscriber' mean in the context of patient registration?

The patient's primary care physician who files claims
The person in whose name the insurance policy is held (Correct answer)
The insurance company's local representative
The billing department contact at the healthcare facility

Correct answer: The person in whose name the insurance policy is held

The subscriber is the individual who holds the insurance contract; the patient may be the subscriber or a dependent on the subscriber's plan.

Question 6: Which 7th character is used in ICD-10-CM to indicate an initial encounter for an acute fracture?

G
S
D
A (Correct answer)

Correct answer: A

The 7th character 'A' designates the initial encounter, meaning the patient is receiving active treatment for the fracture.

Question 7: Under 42 CFR Part 2, which category of records receives STRICTER confidentiality protections than standard HIPAA rules?

Radiology imaging files
Pediatric immunization records
Substance use disorder treatment records (Correct answer)
Workers' compensation injury reports

Correct answer: Substance use disorder treatment records

42 CFR Part 2 provides heightened protections specifically for substance use disorder (SUD) treatment records. Unlike standard HIPAA records, SUD records generally cannot be re-disclosed without a separate written patient consent, even to other treating providers.

Question 8: Which document type requires physician co-signature when documentation is completed by a medical student?

Pharmacy dispensing records
Nursing assessment
Radiology orders
Progress notes authored by medical students (Correct answer)

Correct answer: Progress notes authored by medical students

Medical students are not licensed providers, so their documentation requires co-signature by a supervising physician to be legally valid.

Question 9: Which of the following is a primary reason for collecting detailed patient demographic data in an EHR system?

To ensure compliance with local zoning and building codes.
To create marketing campaigns for the healthcare facility.
To report on community health trends and for research purposes. (Correct answer)
To sell aggregated, de-identified data to pharmaceutical companies.

Correct answer: To report on community health trends and for research purposes.

Detailed demographic data such as age, gender, ethnicity, and location is vital for public health research and identifying health trends within a community. This information, when de-identified, can be used to track disease prevalence, evaluate treatment outcomes, and plan public health initiatives.

Question 10: A registration clerk discovers that a patient has two separate medical record numbers (MRNs) in the system. What process should be initiated?

Delete the older MRN immediately
Assign a third MRN to consolidate the records
Keep both records active to preserve history
Flag the duplicate for an MPI overlay or merge process (Correct answer)

Correct answer: Flag the duplicate for an MPI overlay or merge process

An MPI (Master Patient Index) merge process consolidates duplicate records while preserving clinical history safely.

Question 11: In financial reporting, what does the term 'contractual adjustment' refer to?

The difference between billed charges and the contracted payer rate (Correct answer)
A penalty assessed for late claim submission
A patient's unpaid balance written off as bad debt
A correction made to a previously submitted claim

Correct answer: The difference between billed charges and the contracted payer rate

Contractual adjustments represent the amount a provider agrees to write off based on their negotiated contract with an insurance payer.

Question 12: Under HIPAA, which standard electronic transaction is used to transmit healthcare claim information from a provider to a payer?

ASC X12 270
ASC X12 276
ASC X12 835
ASC X12 837 (Correct answer)

Correct answer: ASC X12 837

The ASC X12 837 transaction set is the HIPAA-mandated standard for submitting healthcare claims electronically to payers.

Question 13: A patient is being registered in the emergency department and is unconscious and without identification. What is the standard practice for entering the patient into the EHR system?

Refuse to treat the patient until their identity can be confirmed.
Wait until the patient regains consciousness to register them.
Create a new record using a temporary generic name, like 'John Doe' or 'Jane Doe'. (Correct answer)
Use the name of the person who brought the patient to the hospital.

Correct answer: Create a new record using a temporary generic name, like 'John Doe' or 'Jane Doe'.

In emergency situations with unidentified patients, the standard protocol is to register them under a temporary or alias name (e.g., 'John Doe') to create a medical record and begin treatment immediately. This allows for documentation of care while efforts are made to identify the patient. Once the patient is identified, the temporary record is merged with their permanent record or updated with the correct information.

Question 14: What is the purpose of a 'downtime procedure' in EHR support?

To train new staff on the EHR
To maintain patient care workflows when the EHR is unavailable (Correct answer)
To permanently migrate data to a new system
To delete outdated patient records

Correct answer: To maintain patient care workflows when the EHR is unavailable

Downtime procedures ensure clinical operations continue safely when the EHR system is offline.

Question 15: Which of the following actions constitutes fraudulent billing under the False Claims Act?

Submitting a claim for a service that was medically necessary
Billing for services that were never rendered (Correct answer)
Appealing a denied claim
Correcting a coding error before resubmission

Correct answer: Billing for services that were never rendered

Submitting claims for services not performed is a violation of the False Claims Act and can result in significant civil and criminal penalties.

Question 16: When a CEHRS enters diagnosis and procedure codes into the EHR for a Medicare patient, the system should be able to check these codes against which of the following to verify that the service is covered for the given diagnosis?

The American Medical Association (AMA) CPT codebook.
National and Local Coverage Determinations (NCDs/LCDs). (Correct answer)
The hospital's internal charge description master (CDM).
The patient's previous billing history.

Correct answer: National and Local Coverage Determinations (NCDs/LCDs).

National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs) are policies developed by Medicare and its regional contractors that specify the circumstances under which a particular service or procedure is considered medically necessary and therefore covered. Modern EHRs can integrate these rules to provide real-time feedback on the likelihood of a service being covered for a specific diagnosis code.

Question 17: The ONC's Cures Act Final Rule prohibits which practice related to EHR data access?

Requiring patient portals
Charging for data storage
Information blocking (Correct answer)
Using certified EHR technology

Correct answer: Information blocking

The 21st Century Cures Act Final Rule prohibits information blocking practices that interfere with the access, exchange, or use of electronic health information.

Question 18: What is the primary purpose of a patient’s “Notice of Privacy Practices” under HIPAA?

To request consent for medical treatments
To explain how patient data will be used and shared (Correct answer)
To offer patients discounts on medical services
To notify patients about their insurance coverage

Correct answer: To explain how patient data will be used and shared

Under HIPAA, healthcare providers must give patients a "Notice of Privacy Practices" that outlines how their health information will be used, shared, and protected. This ensures that patients understand their rights and how their data will be handled within the healthcare system.

Question 19: What does 'role-based access control' (RBAC) mean in the context of EHR systems?

Requiring multi-factor authentication for all users
Assigning system permissions based on a user's job function (Correct answer)
Encrypting data based on the user's department
Granting access based on a user's physical location

Correct answer: Assigning system permissions based on a user's job function

RBAC restricts EHR access to the functions and data necessary for each user's defined role.

Question 20: What is the purpose of a 'sandbox' or 'training' environment in EHR support?

To provide a safe space for testing changes and training without affecting live data (Correct answer)
To host the EHR's backup database
To manage external lab interfaces
To store archived patient records

Correct answer: To provide a safe space for testing changes and training without affecting live data

A sandbox environment mirrors production settings so changes and training can occur without risk to real patient data.

Question 21: In population health reporting, which data element would be most useful for identifying patients overdue for colorectal cancer screening?

Most recent A1C level
Most recent blood pressure reading
Date of last colonoscopy or FOBT (Correct answer)
Current medication list

Correct answer: Date of last colonoscopy or FOBT

Tracking the date of last colonoscopy or fecal occult blood test (FOBT) allows identification of patients due for colorectal cancer screening based on age and screening intervals.

Question 22: A health system's interface engine receives an HL7 ADT A08 message. What event does this message type signal?

Patient information update (Correct answer)
Patient admission
Patient discharge
Patient transfer

Correct answer: Patient information update

The HL7 ADT A08 event type is 'Update Patient Information,' used when demographic or other patient details change without a status change.

Question 23: Which implementation strategy rolls out the EHR to one department or location at a time rather than the entire organization simultaneously?

Phased rollout (Correct answer)
Big bang cutover
Shadow charting
Parallel implementation

Correct answer: Phased rollout

A phased rollout deploys the EHR incrementally across departments or sites, reducing risk and allowing lessons from earlier phases to inform later ones.

Question 24: Which of the following is NOT considered a breach of patient privacy under HIPAA?

Sharing patient data without consent
Accessing a patient’s medical records without a valid reason
Disposing of medical records properly (Correct answer)
Disclosing patient health information in response to a legal request

Correct answer: Disposing of medical records properly

Proper disposal of medical records is an important part of maintaining privacy and security. Breaches of patient privacy under HIPAA typically involve unauthorized access, sharing, or disclosure of health information, but properly discarding records when they are no longer needed is not considered a breach.

Question 25: When a patient updates their medication list through the portal's self-reporting feature, what must staff do before the information affects clinical care?

Reconcile and verify the patient-entered medications with the clinician before updating the official medication list (Correct answer)
Charge the patient an administrative fee for the update
Publish the changes immediately to all care team members
Delete patient-entered data as it is unreliable

Correct answer: Reconcile and verify the patient-entered medications with the clinician before updating the official medication list

Patient-reported medication data must be clinically reconciled to ensure accuracy and safety before becoming part of the official record.

Question 26: What is the purpose of an EHR 'audit trail'?

To back up the database automatically
To record who accessed or modified patient records and when (Correct answer)
To generate patient billing statements
To schedule provider shifts

Correct answer: To record who accessed or modified patient records and when

Audit trails log all user interactions with patient records to support compliance, security investigations, and accountability.

Question 27: When conducting an internal audit of EHR documentation, which metric best measures the completeness of medical records?

Coder productivity per hour
Deficiency rate per record (Correct answer)
Claims denial rate
Average length of stay

Correct answer: Deficiency rate per record

The deficiency rate per record measures how frequently medical records are incomplete, directly indicating documentation completeness quality.

Question 28: A clinic wants to track which users are printing patient records. Which EHR feature supports this?

Audit logging with print event tracking (Correct answer)
Population health module
Revenue cycle dashboard
Clinical decision support

Correct answer: Audit logging with print event tracking

Audit logs can be configured to capture print events, identifying the user, patient record, and timestamp.

Question 29: A hospital's HIM department notices that electronic records are being accessed by clinical staff outside their care team. Which HIPAA safeguard addresses this issue?

Technical safeguards — audit controls (Correct answer)
Administrative safeguards — workforce training
Organizational safeguards — business associate agreements
Physical safeguards — workstation security

Correct answer: Technical safeguards — audit controls

Technical safeguard audit controls (45 CFR 164.312(b)) require covered entities to implement hardware, software, and procedural mechanisms to record and examine EHR access activity.

Question 30: Which federal program created the framework for a nationwide network of Health Information Exchanges (HIEs)?

HITECH Act (Correct answer)
The Stark Law
The Affordable Care Act
MACRA

Correct answer: HITECH Act

The HITECH Act of 2009 established the legal and financial framework for HIE development and incentivized adoption of interoperable EHR systems.

Question 31: In EHR project management, a Gantt chart is primarily used to:

Map clinical workflows before and after implementation
Visualize project tasks, timelines, and dependencies (Correct answer)
Document configuration settings for each system module
Track user login activity and system access

Correct answer: Visualize project tasks, timelines, and dependencies

A Gantt chart is a project management tool that displays tasks along a timeline, showing durations, start/end dates, and dependencies between activities.

Question 32: When a payer sends an Electronic Remittance Advice (ERA) with a CO-45 adjustment reason code, what does this indicate?

The claim was denied for a missing modifier
The service requires prior authorization
The charge exceeds the fee schedule/maximum allowable amount (Correct answer)
The patient's coverage has been terminated

Correct answer: The charge exceeds the fee schedule/maximum allowable amount

CO-45 is a contractual obligation adjustment indicating the charge exceeds the payer's fee schedule or maximum allowable amount.

Question 33: Under HITECH, business associates are directly liable for HIPAA compliance. Which of the following is a business associate?

A health insurance exchange navigator
A patient's family member helping manage care
A billing company that processes claims containing PHI (Correct answer)
A hospital board member who never accesses PHI

Correct answer: A billing company that processes claims containing PHI

A billing company that handles PHI on behalf of a covered entity is a business associate and must sign a Business Associate Agreement.

Question 34: What is the function of an EHR 'master patient index' (MPI)?

Uniquely identifies each patient across the healthcare system to prevent duplicate records (Correct answer)
Manages provider scheduling templates
Tracks medication refill requests
Stores billing codes for all procedures

Correct answer: Uniquely identifies each patient across the healthcare system to prevent duplicate records

The MPI assigns a unique identifier to each patient, ensuring accurate record matching across departments and facilities.

Question 35: A provider wants to view a patient's records from an outside hospital within their EHR. Which technology facilitates this?

Electronic remittance advice (ERA)
Local area network (LAN)
Health Information Exchange (HIE) (Correct answer)
Charge capture module

Correct answer: Health Information Exchange (HIE)

A Health Information Exchange (HIE) connects participating organizations so providers can access patient records from external facilities.

Question 36: Under HIPAA, a covered entity must respond to a patient's request to access their PHI within how many days?

90 days
30 days
15 days
60 days (Correct answer)

Correct answer: 60 days

HIPAA requires covered entities to act on a patient's access request within 30 days, with a possible 30-day extension (60 days total).

Question 37: In EHR terminology, a 'flag' or 'alert' attached to a patient's chart to warn all staff of a latex allergy is an example of:

Referral authorization
Diagnostic code entry
Patient safety alert (Correct answer)
Insurance eligibility check

Correct answer: Patient safety alert

A patient safety alert prominently displays critical clinical information—such as severe allergies—to every provider who opens the chart.

Question 38: Which standard messaging format is most commonly used for exchanging clinical data between healthcare systems in the US?

HTML (HyperText Markup Language)
XML (eXtensible Markup Language)
CSV (Comma-Separated Values)
HL7 (Health Level Seven) (Correct answer)

Correct answer: HL7 (Health Level Seven)

HL7 is the primary standard for exchanging, integrating, sharing, and retrieving electronic health information between clinical applications.

Question 39: Which document establishes the legal relationship between a covered entity and a vendor that handles PHI on its behalf?

Business Associate Agreement (BAA) (Correct answer)
Data Use Agreement (DUA)
Memorandum of Understanding (MOU)
Notice of Privacy Practices (NPP)

Correct answer: Business Associate Agreement (BAA)

A Business Associate Agreement contractually requires the vendor to protect PHI and comply with HIPAA obligations on behalf of the covered entity.

Question 40: A pharmacy calls the clinic because a controlled substance e-prescription lacks evidence of two-factor authentication. What does this MOST likely indicate?

The DEA number on the provider record has expired
The prescription was routed through the wrong pharmacy network
The patient has an outstanding balance on a previous prescription
The prescribing provider did not complete EPCS identity proofing or logical access controls (Correct answer)

Correct answer: The prescribing provider did not complete EPCS identity proofing or logical access controls

EPCS regulations require that prescribers complete identity proofing and use two-factor authentication each time they sign a controlled substance prescription electronically. Missing authentication is a sign that the EPCS setup was not completed or bypassed, making the prescription invalid.

Question 41: Which risk is most directly associated with migrating historical patient data to a new EHR system?

Loss of network connectivity during peak usage hours
Data corruption or incomplete transfer of clinical records (Correct answer)
Unauthorized access by external parties during migration
Increased licensing costs due to expanded data storage needs

Correct answer: Data corruption or incomplete transfer of clinical records

Data corruption or incomplete transfer is the primary risk during data migration, as errors can result in missing or inaccurate patient records that affect care quality.

Question 42: What is the principle of 'minimum necessary' access in EHR security?

Passwords must meet a minimum length of 8 characters
Users should only access the minimum amount of PHI needed to perform their job functions (Correct answer)
Audit logs must capture the minimum data elements required by HIPAA
EHR systems must use the minimum required encryption standards

Correct answer: Users should only access the minimum amount of PHI needed to perform their job functions

The minimum necessary principle requires that access to PHI be limited to only what is needed for an employee to perform their specific job duties.

Question 43: What is a Health Information Exchange (HIE)?

A federal database storing all US patient records
A patient-facing portal for viewing personal health records
A billing clearinghouse for insurance claims
An organization that enables the electronic sharing of health information among providers (Correct answer)

Correct answer: An organization that enables the electronic sharing of health information among providers

An HIE is an organization that enables the electronic movement of health-related information among organizations according to nationally recognized standards.

Question 44: Under the HIPAA Security Rule, which of the following is an 'addressable' implementation specification rather than 'required'?

Emergency access procedure
Audit controls
Unique user identification
Automatic logoff (Correct answer)

Correct answer: Automatic logoff

Automatic logoff is an addressable implementation specification, meaning covered entities must assess whether it is reasonable and appropriate for their environment.

Question 45: When a patient opts out of the patient portal entirely, what obligation remains for the healthcare organization?

The patient forfeits all rights to their medical records
The organization must re-enroll the patient automatically after 90 days
The organization must still provide access to records through alternative means such as paper copies (Correct answer)
The organization has no further obligation to provide records

Correct answer: The organization must still provide access to records through alternative means such as paper copies

Opting out of the portal does not waive a patient's legal right to their records; the organization must offer alternative access methods.

Question 46: A patient reports they recently changed their legal name due to marriage. Which document should the EHR specialist request to update the record?

A utility bill showing the new name
A note from the patient's physician
An updated insurance card only
Legal documentation such as a marriage certificate or court order (Correct answer)

Correct answer: Legal documentation such as a marriage certificate or court order

Legal documentation is required to validate a name change before updating the official medical record.

Question 47: Which feature within an EHR system is specifically designed to help prevent coding and billing errors, such as unbundling or using incorrect code combinations, before a claim is submitted?

Patient portal messaging
Claims scrubbing and edits (Correct answer)
Electronic prescribing functionality
Clinical decision support alerts

Correct answer: Claims scrubbing and edits

EHR and practice management systems often include 'claims scrubbers' or built-in edits, such as the National Correct Coding Initiative (NCCI) edits. These tools automatically check claims for common errors, such as mutually exclusive procedures being billed together (unbundling) or invalid diagnosis/procedure links, before they are sent to the payer, thereby reducing denial rates.

Question 48: Which ONC certification criterion requires EHRs to support patient access to their data via APIs?

§170.315(c)(1) Clinical Quality Measures
§170.315(b)(1) Transitions of Care
§170.315(a)(1) Computerized Provider Order Entry
§170.315(g)(10) Standardized API for Patient and Population Services (Correct answer)

Correct answer: §170.315(g)(10) Standardized API for Patient and Population Services

ONC criterion §170.315(g)(10) requires certified EHRs to provide a standardized FHIR-based API allowing patients to access their health data.

Question 49: Which financial report shows the amount owed to a practice by patients and insurers at a specific point in time?

Accounts receivable aging report (Correct answer)
Cash flow statement
Balance sheet
Income statement

Correct answer: Accounts receivable aging report

The accounts receivable aging report categorizes outstanding balances by how long they have been unpaid, helping practices track money owed to them.

Question 50: What is the primary function of the electronic medication administration record (eMAR)?

To create initial prescriptions for provider review
To document that a medication was administered to the patient (Correct answer)
To generate pharmacy invoices for dispensed drugs
To calculate insurance reimbursement for drug costs

Correct answer: To document that a medication was administered to the patient

The eMAR is the official record nurses use to document when, how, and by whom each medication dose was administered, supporting the five rights of medication administration.

Question 51: When coding an outpatient encounter in ICD-10-CM, which guideline applies to unconfirmed conditions?

Query the physician and hold the claim indefinitely
Code only confirmed diagnoses; for unconfirmed conditions, code signs and symptoms (Correct answer)
Use Z codes for all unconfirmed diagnoses
Code probable or suspected conditions as confirmed

Correct answer: Code only confirmed diagnoses; for unconfirmed conditions, code signs and symptoms

Outpatient coding guidelines prohibit coding 'probable,' 'suspected,' or 'rule out' diagnoses; only confirmed diagnoses or presenting signs and symptoms should be coded.

Question 52: A provider documents 'GERD with esophagitis.' How should an EHR-based coder approach this in ICD-10-CM?

Use the combination code K21.0 (GERD with esophagitis) (Correct answer)
Code GERD and esophagitis separately
Code only esophagitis as the more specific condition
Query the physician before coding either condition

Correct answer: Use the combination code K21.0 (GERD with esophagitis)

ICD-10-CM provides combination code K21.0 for GERD with esophagitis, which should be used instead of two separate codes.

Question 53: A CEHRS is assisting the billing manager in analyzing the practice's revenue cycle performance. Which of the following is a key performance indicator (KPI) that measures the average number of days it takes to collect payment after a service has been provided?

Net Collection Rate
Clean Claim Rate
Denial Rate
Days in Accounts Receivable (A/R) (Correct answer)

Correct answer: Days in Accounts Receivable (A/R)

'Days in A/R' is a critical KPI that measures the average time it takes for a practice to receive payment from payers and patients. A lower number indicates a more efficient revenue cycle, while a high number signals potential problems in the billing process.

Question 54: Why is timely resolution of MPI duplicate records considered a patient SAFETY priority, not merely an administrative one?

Providers making clinical decisions may be working from an incomplete medical history, leading to medication errors, repeated tests, or missed diagnoses (Correct answer)
Duplicate records prevent the patient from accessing the patient portal
Duplicate records increase cloud storage costs significantly
Regulatory agencies levy fines for each duplicate record discovered during audits

Correct answer: Providers making clinical decisions may be working from an incomplete medical history, leading to medication errors, repeated tests, or missed diagnoses

When a patient has two MRNs, their medical history is split across both records. A provider viewing only one record may miss critical allergies, existing diagnoses, or current medications — leading to dangerous clinical decisions. This is why MPI integrity is classified as a patient safety issue in accreditation and HIM standards.

Question 55: In EHR documentation, what is an 'interval history'?

A list of all medications prescribed in the past year
A record of vital signs taken at regular intervals
Documentation of changes in the patient's condition since the last encounter (Correct answer)
A summary of the patient's entire past medical history

Correct answer: Documentation of changes in the patient's condition since the last encounter

An interval history captures what has changed in the patient's condition, symptoms, or treatment response since the previous visit, providing continuity between encounters.

Question 56: Which of the following is a REQUIRED element of a valid HIPAA authorization for the release of medical records?

The signature of the treating physician
The date of the patient's next scheduled appointment
The patient's insurance policy number
A description of the information to be used or disclosed (Correct answer)

Correct answer: A description of the information to be used or disclosed

A valid HIPAA authorization must include a description of the information to be used or disclosed, the name of the person/entity authorized to make the disclosure, the purpose of the disclosure, an expiration date or event, the patient's signature, and the date signed. The physician's signature and insurance number are not required elements.

Question 57: Which type of EHR testing is performed to verify that a new software update has not broken previously working system functions?

Regression testing (Correct answer)
Unit testing
Smoke testing
Stress testing

Correct answer: Regression testing

Regression testing re-runs prior test cases after an update to confirm that existing functionality still works correctly and no new defects were introduced.

Question 58: The HIPAA Security Rule requires covered entities to implement specific safeguards to protect electronic protected health information (ePHI). Which of the following is an example of an administrative safeguard?

Implementing policies for sanctioning employees who violate HIPAA. (Correct answer)
Installing encrypted software on all workstations.
Using key card access for rooms containing servers with ePHI.
Positioning computer monitors to prevent viewing by the public.

Correct answer: Implementing policies for sanctioning employees who violate HIPAA.

Administrative safeguards are defined as 'administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect ePHI...' A sanction policy is a required administrative action. Encrypted software is a technical safeguard, monitor positioning is a physical safeguard, and key card access is a physical safeguard.

Question 59: The process of converting paper health records into digital format using a scanner is called:

Interface mapping
Data migration
Optical character recognition
Document imaging (Correct answer)

Correct answer: Document imaging

Document imaging captures paper records as digital images stored within or linked to the EHR system.

Question 60: Which go-live strategy involves running both the old and new EHR systems simultaneously for a period of time?

Parallel implementation (Correct answer)
Pilot deployment
Phased rollout
Big bang cutover

Correct answer: Parallel implementation

Parallel implementation runs both legacy and new systems simultaneously, allowing staff to compare outputs and ensuring continuity if the new system fails.

Question 61: Which federal initiative established the framework for nationwide health information exchange in the US?

Nationwide Health Information Network (NwHIN) (Correct answer)
Consolidated Omnibus Budget Reconciliation Act (COBRA)
Health Insurance Portability and Accountability Act (HIPAA)
Medicare Access and CHIP Reauthorization Act (MACRA)

Correct answer: Nationwide Health Information Network (NwHIN)

The Nationwide Health Information Network (NwHIN) was established to create standards and services for secure health information exchange across the US.

Question 62: A practice wants to increase portal enrollment among elderly patients. Which strategy is most effective?

Removing elderly patients from the eligible portal population
Sending only email invitations without follow-up
Requiring portal use to schedule appointments
Offering in-person portal enrollment assistance during office visits and providing printed step-by-step instructions (Correct answer)

Correct answer: Offering in-person portal enrollment assistance during office visits and providing printed step-by-step instructions

Hands-on enrollment support during visits combined with simple printed guides addresses the digital literacy and access barriers common among elderly patients.

Question 63: What is the PRIMARY function of a Master Patient Index (MPI) in a healthcare organization?

To manage provider credentials and DEA license renewals
To uniquely identify each patient and link all their records across the health system (Correct answer)
To store clinical diagnoses and treatment histories for billing purposes
To track outstanding patient account balances

Correct answer: To uniquely identify each patient and link all their records across the health system

The MPI serves as the central patient identity registry for a healthcare organization. It assigns a unique medical record number (MRN) to each patient and links all encounters, records, and data across facilities or departments to the correct person — preventing misidentification and fragmentation of care.

Question 64: What is the purpose of a 'downtime procedure' in clinical workflow?

Archiving old patient records to free up server space
Reducing the number of daily logins required by clinical staff
Using paper-based backup processes to maintain care delivery when the EHR is unavailable (Correct answer)
Shutting down the EHR for maintenance without affecting clinical operations

Correct answer: Using paper-based backup processes to maintain care delivery when the EHR is unavailable

Downtime procedures are paper-based or offline protocols that ensure patient care and documentation can continue safely when the EHR system is temporarily unavailable.

Question 65: Which HIPAA rule specifically requires covered entities to implement technical, administrative, and physical safeguards for electronic PHI?

Enforcement Rule
Security Rule (Correct answer)
Breach Notification Rule
Privacy Rule

Correct answer: Security Rule

The HIPAA Security Rule requires covered entities and business associates to implement safeguards specifically to protect electronic PHI (ePHI).

Question 66: A practice uses a waitlist to fill appointment slots when cancellations occur. Which criterion should take HIGHEST priority when selecting the next patient from the waitlist?

The patient with the highest outstanding balance
The patient who lives closest to the practice
The patient who has been waiting the longest on the list
The patient whose clinical urgency or appointment type best matches the opening (Correct answer)

Correct answer: The patient whose clinical urgency or appointment type best matches the opening

While length of wait is a fairness consideration, matching the appointment slot (duration, visit type, provider) to the opening and the patient's clinical need ensures the slot is used appropriately and that the patient receives the correct level of care. Clinical appropriateness supersedes wait time.

Question 67: Under the 21st Century Cures Act's information blocking rule, withholding EHR data from a patient's portal without a valid exception is considered:

Standard practice for protecting sensitive diagnoses
Acceptable if clinically justified
Information blocking, which is prohibited and subject to penalties (Correct answer)
A HIPAA-only violation with no additional consequences

Correct answer: Information blocking, which is prohibited and subject to penalties

The 21st Century Cures Act prohibits information blocking and imposes significant penalties on healthcare providers, health IT developers, and networks that improperly restrict data access.

Question 68: A provider writes off the difference between billed charges and the insurance-allowed amount. This is called a:

Contractual adjustment (Correct answer)
Bad debt write-off
Small balance write-off
Courtesy discount

Correct answer: Contractual adjustment

A contractual adjustment reflects the difference between a provider's billed charges and the contracted allowed amount, which cannot be billed to the patient.

Question 69: A patient who is a minor requests access to their own reproductive health records, which they paid for privately. The parent also requests the same records. What should the EHR specialist do?

Follow state law, which may grant the minor control over these records (Correct answer)
Provide records to the parent as the legal guardian without question
Deny both requests until a court order is obtained
Provide records to whoever requests first

Correct answer: Follow state law, which may grant the minor control over these records

HIPAA defers to state law on minors' rights; many states grant minors the right to control records for services they can consent to independently, such as reproductive health.

Question 70: What is the purpose of an EHR audit log?

To record who accessed patient records, what was viewed, and when (Correct answer)
To track billing codes entered by medical coders
To log network traffic for IT infrastructure management
To document system downtime and maintenance windows

Correct answer: To record who accessed patient records, what was viewed, and when

EHR audit logs create a chronological record of all user access to patient records, including who accessed information, what was viewed or changed, and the timestamp.

Question 71: Which federal program financially incentivized providers to adopt and demonstrate meaningful use of certified EHR technology?

Federal Health IT Strategic Plan
National Health IT Collaborative
Patient Protection and Affordable Care Act incentives
Medicare and Medicaid EHR Incentive Programs (now Promoting Interoperability) (Correct answer)

Correct answer: Medicare and Medicaid EHR Incentive Programs (now Promoting Interoperability)

The Medicare and Medicaid EHR Incentive Programs, now called Promoting Interoperability, provided financial incentives for providers to adopt and meaningfully use certified EHR technology.

Question 72: What is the primary purpose of a Master Patient Index (MPI) in health information exchange?

Generate Consolidated-CDAs automatically
Encrypt patient data during transmission
Uniquely identify and match patient records across different systems (Correct answer)
Standardize medication codes

Correct answer: Uniquely identify and match patient records across different systems

An MPI assigns unique identifiers and uses matching algorithms to link records belonging to the same patient across disparate systems.

Question 73: What is 'social engineering' in the context of EHR cybersecurity?

Manipulating employees into revealing credentials or access information through deception (Correct answer)
Using social media platforms to market EHR software to healthcare organizations
Connecting social determinants of health data into the EHR system
Engineering social workflows to improve EHR adoption rates among staff

Correct answer: Manipulating employees into revealing credentials or access information through deception

Social engineering involves psychological manipulation of people into performing actions or divulging confidential information, such as passwords or login credentials.

Question 74: A patient's EHR record shows a mismatch between their insurance ID on file and the number on their current insurance card. What is the appropriate action?

Update the EHR with the current card number after verifying with the patient and/or insurer (Correct answer)
Submit the claim using both ID numbers
Bill using the number on file to maintain historical consistency
Flag the record for fraud investigation

Correct answer: Update the EHR with the current card number after verifying with the patient and/or insurer

Updating the insurance ID after verification prevents claim rejections and ensures accurate billing to the correct payer.

Question 75: A practice's first-pass claim acceptance rate is 78%. This means:

78% of submitted claims were paid without rejection or denial on initial submission (Correct answer)
78% of denied claims were successfully appealed
78% of charges were collected within 30 days
78% of patients paid their co-pays at time of service

Correct answer: 78% of submitted claims were paid without rejection or denial on initial submission

First-pass acceptance rate measures the percentage of claims accepted and paid by payers on the initial submission without needing correction or resubmission.

Question 76: A CEHRS is working in the EHR to finalize an encounter form (superbill). The physician performed a standard office visit (CPT 99213) and a separate, significant procedure on the same day. To ensure both services are billed correctly, the CEHRS should verify that the physician has linked which of the following to the CPT codes?

The time spent on each service.
A specific diagnosis for each procedure and an appropriate modifier. (Correct answer)
A referral from another physician.
The patient's consent form for the procedure.

Correct answer: A specific diagnosis for each procedure and an appropriate modifier.

When multiple procedures are performed, each must be supported by a diagnosis demonstrating medical necessity. Additionally, a modifier (like modifier 25 for a significant, separately identifiable E/M service on the same day of a procedure) is often required to indicate to the payer that the services were distinct. The EHR must be capable of capturing both the linked diagnosis and the necessary modifier.

Question 77: Which action best prevents a 'wrong patient' registration error in a busy emergency department?

Entering data from the triage sheet without confirming with the patient
Using barcode wristbands tied to temporary MRNs immediately upon patient arrival (Correct answer)
Relying on nursing staff to verify identity after registration
Registering patients in batches after the rush period

Correct answer: Using barcode wristbands tied to temporary MRNs immediately upon patient arrival

Barcode wristbands linked to unique MRNs at arrival create an immediate physical tie between the patient and their record, reducing misidentification risk.

Question 78: Which user activity would most likely trigger an EHR security audit review?

Documenting a patient's vital signs during a routine visit
Accessing records of a celebrity patient with no documented care relationship (Correct answer)
Updating a patient's insurance information at registration
Printing a patient's medication list for a care transition

Correct answer: Accessing records of a celebrity patient with no documented care relationship

Accessing the records of high-profile patients without a documented care relationship is a common indicator of a privacy violation and triggers audit scrutiny.

Question 79: Under the 21st Century Cures Act, which practice is prohibited when health IT vendors or providers restrict access, exchange, or use of EHR data?

Consent revocation
Information blocking (Correct answer)
Data minimization
Selective disclosure

Correct answer: Information blocking

The 21st Century Cures Act explicitly prohibits 'information blocking'—practices that interfere with the access, exchange, or use of electronic health information.

Question 80: Which type of clinical note summarizes a patient's hospital stay and is required before discharge in most accreditation standards?

Discharge summary (Correct answer)
History and physical
Operative report
Progress note

Correct answer: Discharge summary

The discharge summary provides a comprehensive overview of the patient's hospital course and must typically be completed within 30 days of discharge.

Question 81: Which standard body establishes medical record completion requirements that hospitals must meet for accreditation?

CMS only
The American Medical Association
The Joint Commission (TJC) (Correct answer)
The Office of Inspector General

Correct answer: The Joint Commission (TJC)

The Joint Commission sets record completion standards as part of its hospital accreditation requirements.

Question 82: During an EHR upgrade, a custom report stops returning data. What is the most likely cause?

Database schema changes that altered table or column names (Correct answer)
Browser cookie settings
Increased network latency
User password expiration

Correct answer: Database schema changes that altered table or column names

Upgrades often modify database schemas, breaking queries that reference renamed or removed columns.

Question 83: Under HIPAA, which of the following is NOT a required element in an authorization to release medical records?

Patient's insurance policy number (Correct answer)
Description of information to be disclosed
Expiration date or event
Purpose of the disclosure

Correct answer: Patient's insurance policy number

HIPAA authorizations require specific elements including description of PHI, purpose, and expiration, but not an insurance policy number.

Question 84: Which of the following best describes the purpose of a deficiency analysis in health information management?

To audit billing codes for accuracy
To schedule follow-up appointments for patients
To identify missing or incomplete documentation in medical records (Correct answer)
To review patient satisfaction surveys

Correct answer: To identify missing or incomplete documentation in medical records

Deficiency analysis identifies gaps in documentation to ensure records are complete and legally compliant.

Question 85: When a patient pays out-of-pocket in full for a service, HIPAA gives them the right to:

Have the covered entity delete the information from their records
Request that the covered entity not share that service's information with a health plan (Correct answer)
Receive a discount on services rendered
Obtain a second opinion at no additional cost

Correct answer: Request that the covered entity not share that service's information with a health plan

Under the 2013 Omnibus Rule, patients who pay out-of-pocket in full may restrict disclosure of that specific service to a health plan, and covered entities must honor this restriction.

Question 86: In quality management, a fishbone (Ishikawa) diagram is used to:

Identify root causes of a quality problem (Correct answer)
Monitor key performance indicators
Map the flow of patients through a department
Track patient satisfaction scores over time

Correct answer: Identify root causes of a quality problem

A fishbone diagram visually organizes potential causes of a problem into categories, helping teams identify root causes during quality improvement investigations.

Question 87: A health records specialist receives a Direct message containing a patient's care summary. What document standard is most likely used in this attachment?

NCPDP SCRIPT
X12 270/271
CDA (Clinical Document Architecture) (Correct answer)
DICOM SR

Correct answer: CDA (Clinical Document Architecture)

Direct messaging typically carries Consolidated-CDA documents, which are based on the HL7 CDA standard for structured clinical documents.

Question 88: Which of the following best describes a 'minimum necessary' determination when releasing PHI?

Release only information that is less than one page in length
Release information only after legal counsel reviews each request
Release only the information reasonably needed to accomplish the intended purpose (Correct answer)
Release the complete medical record to avoid missing relevant details

Correct answer: Release only the information reasonably needed to accomplish the intended purpose

The minimum necessary standard requires covered entities to limit PHI to the least amount needed to fulfill the specific purpose of the disclosure.

Question 89: A patient is registered as 'John Smith' but their insurance card shows 'Jonathan Smith.' What is the correct action?

Change the EHR name to match the insurance card without asking the patient
Submit claims under both names to ensure payment
Create two separate patient records for each name
Verify with the patient which name is correct and update accordingly (Correct answer)

Correct answer: Verify with the patient which name is correct and update accordingly

Patient confirmation ensures the legal name is recorded accurately, which affects both identity verification and claims processing.

Question 90: Which SNOMED CT concept domain would be most appropriate for documenting a clinical finding such as 'pain in right knee' in an EHR?

Clinical finding domain (Correct answer)
Procedure domain
Pharmaceutical domain
Body structure domain

Correct answer: Clinical finding domain

SNOMED CT's clinical finding domain encompasses signs, symptoms, and diagnoses observed or reported during patient care.

Question 91: When documenting a patient cancellation in the EHR scheduling system, what is the BEST practice?

Record the cancellation reason and add the patient to the waitlist if clinically appropriate (Correct answer)
Delete the appointment slot so it can be immediately reused
Reschedule the patient automatically without further documentation
Mark the appointment as a no-show regardless of the reason

Correct answer: Record the cancellation reason and add the patient to the waitlist if clinically appropriate

Proper cancellation documentation preserves an accurate audit trail, supports continuity of care, and allows the practice to track cancellation patterns. Adding the patient to a waitlist when clinically appropriate ensures timely rescheduling and maximizes schedule utilization.

Question 92: When reviewing a remittance advice, a CEHRS specialist sees reason code PR-1. What does this code indicate?

The patient is responsible for the deductible amount (Correct answer)
The claim was denied due to duplicate submission
The service is not covered under the patient's plan
The provider is not in-network

Correct answer: The patient is responsible for the deductible amount

PR-1 is a patient responsibility code indicating the amount applied to the patient's deductible, which the patient owes.

Question 93: What is the primary purpose of an EHR implementation 'cutover plan'?

To outline procedures for switching from the legacy system to the new EHR at go-live (Correct answer)
To describe the vendor's support contract terms
To schedule post-implementation user feedback surveys
To document how staff will be terminated if they refuse to use the new system

Correct answer: To outline procedures for switching from the legacy system to the new EHR at go-live

The cutover plan details the exact sequence of steps, responsibilities, and timing for transitioning operations from the old system to the new EHR.

Question 94: Which process involves systematically reviewing EHR audit logs to identify unauthorized access to patient records?

Downtime recovery drill
System performance monitoring
Access audit review (Correct answer)
Patch management

Correct answer: Access audit review

Access audit reviews analyze EHR audit logs to detect unusual or unauthorized access patterns, which is required under the HIPAA Security Rule.

Question 95: Which of the following describes a 'tethered' patient portal?

A portal accessible only on a mobile device
A portal that requires a physical token for each login
A portal tied to a specific provider's or health system's EHR, limiting data to that organization's records (Correct answer)
A portal that aggregates data from all providers a patient has seen

Correct answer: A portal tied to a specific provider's or health system's EHR, limiting data to that organization's records

A tethered portal is linked to one specific EHR or health system, so patients can only view data generated within that organization.

Question 96: What is the primary purpose of a 'care summary' or 'after-visit summary' made available in the patient portal?

To serve as a legal contract between the patient and provider
To replace the need for discharge planning by nursing staff
To automatically schedule follow-up appointments
To give patients a plain-language overview of their visit, diagnoses, medications, and follow-up instructions (Correct answer)

Correct answer: To give patients a plain-language overview of their visit, diagnoses, medications, and follow-up instructions

After-visit summaries improve care transitions and patient understanding by summarizing key visit details in accessible language.

Question 97: An EHR specialist notices that a physician has been copying and pasting the same physical exam note into every patient encounter. This practice is best described as:

Templating
Macros
Point-of-care documentation
Cloning (Correct answer)

Correct answer: Cloning

Cloning, or copy-forward documentation, involves duplicating previous notes without updating them, which can misrepresent the patient's current condition and create compliance risks.

Question 98: A physician performs a new patient office visit and also administers a vaccine during the same encounter. To bill both services correctly, which modifier should be appended to the E&M code?

-25 (Correct answer)
-57
-59
-51

Correct answer: -25

Modifier -25 indicates that a significant, separately identifiable E&M service was performed by the same physician on the same day as a procedure or other service.

Question 99: Which approach best supports EHR adoption among resistant clinical staff?

Provide role-specific training, super-user support, and incorporate workflow feedback (Correct answer)
Limit EHR access to reduce complaints
Replace all clinical staff with EHR-trained hires
Mandate use with penalties for non-compliance

Correct answer: Provide role-specific training, super-user support, and incorporate workflow feedback

Targeted training combined with super-users and workflow feedback addresses real barriers to adoption without creating resentment.

Question 100: Under the Medicare Access and CHIP Reauthorization Act (MACRA), MIPS stands for:

Managed Integrated Payment Structure
Medical Information and Performance Standards
Merit-based Incentive Payment System (Correct answer)
Medicare Incentive for Provider Services

Correct answer: Merit-based Incentive Payment System

MIPS (Merit-based Incentive Payment System) is a value-based payment program under MACRA that adjusts Medicare payments based on quality, cost, and other performance categories.

Question 101: A provider uses voice recognition software to dictate a clinical note directly into the EHR. The resulting text is reviewed and signed. This workflow is known as:

Speech-to-text or voice recognition documentation (Correct answer)
Structured data capture
Point-of-care scanning
Transcription outsourcing

Correct answer: Speech-to-text or voice recognition documentation

Speech-to-text (voice recognition) documentation converts spoken dictation directly into EHR text in real time, reducing transcription lag while maintaining narrative flexibility.

NHA Certified Electronic Health Records Specialist (CEHRS) Exam

The NHA CEHRS examination certifies professionals who manage electronic health record systems, covering EHR software navigation, clinical and non-clinical documentation, revenue cycle operations, regulatory compliance including HIPAA, and healthcare reporting.

100

Questions

110 min

Time Limit

78%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

nhanow.com — Test delivery, eligibility, renewal, passing score, retake policy, score release, score validity, time limit · verified Oct 2026
store.nhanow.com — Fees · verified Oct 2026