RHIT - Registered Health Information Technician Healthcare Compliance and Regulations Questions and Answers

Question 1

A hospital discovers that an unencrypted laptop containing the protected health information (PHI) of 600 patients was stolen. According to the HITECH Act Breach Notification Rule, which of the following actions is required?

Accepted Answer

Notify affected individuals, the Secretary of HHS, and prominent media outlets within 60 days.

Answer

The HITECH Act Breach Notification Rule requires covered entities to notify affected individuals, the Secretary of HHS, and prominent media outlets serving the relevant state or jurisdiction without unreasonable delay, and in no case later than 60 calendar days, following the discovery of a breach affecting more than 500 individuals.

Question 2

Which federal law specifically prohibits a physician from referring Medicare patients for designated health services to an entity where the physician or an immediate family member has a financial interest?

Accepted Answer

The Stark Law (Physician Self-Referral Law)

Answer

The Stark Law is a strict liability statute that specifically prohibits physicians from making referrals for certain "designated health services" (DHS) payable by Medicare to an entity with which they or an immediate family member have a financial relationship, unless a specific exception applies.

Question 3

A healthcare organization is conducting a risk analysis as part of its HIPAA Security Rule compliance. Which of the following is an example of a required technical safeguard?

Accepted Answer

Implementing audit controls to record and examine activity in information systems containing ePHI.

Answer

Technical safeguards under the HIPAA Security Rule involve the technology and the policies for its use to protect electronic PHI (ePHI). Audit controls, which are mechanisms to record and examine system activity, are a required technical safeguard. Security training and contingency plans are administrative safeguards, while monitor positioning is a physical safeguard.

Question 4

An attorney presents a subpoena duces tecum for a patient's medical records for a civil lawsuit. The subpoena is not accompanied by a court order or patient authorization. What is the most appropriate initial action for the HIM professional?

Accepted Answer

Do not release the records until 'satisfactory assurances' are met or a court order is provided.

Answer

Under HIPAA, a subpoena that is not signed by a judge (i.e., not a court order) is insufficient on its own to compel the release of PHI. The covered entity must first receive 'satisfactory assurances' from the party seeking the information that reasonable efforts were made to notify the patient of the request or that a qualified protective order has been secured. Without these assurances, a court order, or a valid patient authorization, the records cannot be released.

Question 5

In the absence of a more stringent state law, the CMS Conditions of Participation require hospitals to retain medical records for a minimum of how many years?

Accepted Answer

5 years

Answer

The Centers for Medicare & Medicaid Services (CMS) Conditions of Participation for Hospitals (42 CFR §482.24) mandate that medical records must be retained in their original or a legally reproduced form for at least 5 years. State laws may require a longer period, in which case the stricter rule must be followed.

RHIT - Registered Health Information Technician Practice Test

RHIT - Registered Health Information Technician Practice Test

RHIT - Registered Health Information Technician Healthcare Compliance and Regulations Questions and Answers