Health Information Management Exam COMPLETE EXAM
QUESTIONS AND VERIFIED ANSWERS | 2026–2027 LATEST
UPDATE | GUARANTEED PASS | DETAILED RATIONALES |
FULL STUDY GUIDE | EXAM PREP | PRACTICE TEST |
CERTIFICATION PREPARATION
1. A patient requests a copy of their medical records but explicitly states they do not want their
HIV test results included. Under HIPAA, what is the most appropriate action for the Health
Information Management (HIM) professional to take?
A. Honor the patient's request to exclude the HIV results from the copy to respect their privacy.
B. Provide a complete copy of the record, as the patient has a right to all their information.
C. Provide the full record but ask the patient to sign a separate release form for the HIV results.
D. Provide the record but redact the HIV results based on the patient's written request.
Correct Answer: B. Provide a complete copy of the record, as the patient has a right to all their
information.
Rationale: Under HIPAA, an individual has a right of access to inspect and obtain a copy of their
protected health information (PHI) in a designated record set, including laboratory results. The
Privacy Rule does not permit a patient to selectively exclude portions of their record during an access
request; they are entitled to the full designated record set unless a specific, valid exception applies.
2. Which of the following is the primary purpose of the master patient index (MPI)?
A. To link a patient's medical record numbers across different facilities.
B. To index diseases and procedures for statistical reporting.
C. To serve as the primary source for billing and reimbursement.
D. To track the location of a patient's physical paper chart.
Correct Answer: A. To link a patient's medical record numbers across different facilities.
Rationale: The primary purpose of the MPI is to maintain a unique identifier for each patient and to
link all encounters, medical record numbers, and demographic information for that patient, ensuring
a complete and accurate view of their healthcare history. Option B describes a disease index or
registry, Option C describes the chargemaster or billing system, and Option D is an outdated function
for manual chart tracking.
3. In the context of a record retention schedule, which of the following documents should typically
have the longest retention period?
A. A routine nursing shift assessment.
B. An operative report for a cholecystectomy.
C. The patient's advance directive.
D. A fetal heart monitor strip.
Correct Answer: D. A fetal heart monitor strip.
Rationale: Fetal heart monitor strips and other perinatal records are often subject to longer retention
periods, frequently until the child reaches the age of majority (e.g., 18 or 21 years) plus the applicable
,statute of limitations. While operative reports and advance directives have important retention
periods, they do not typically span the length of a minor's age of majority plus the statute of
limitations.
4. A physician is reviewing a record and notices a discrepancy between the medication dosage
documented in the nursing notes and the dosage listed on the medication administration record
(MAR). What is the most appropriate first step for the HIM professional to take?
A. Immediately correct the nursing notes to match the MAR.
B. Flag the record for the nursing supervisor to review and reconcile the discrepancy.
C. Contact the physician to ask which dosage is correct and document their verbal order.
D. Identify the discrepancy and notify the appropriate clinical leadership for review and correction.
Correct Answer: D. Identify the discrepancy and notify the appropriate clinical leadership for
review and correction.
Rationale: HIM professionals are responsible for identifying discrepancies and facilitating their
resolution, but they do not have the clinical authority to correct clinical documentation themselves.
The appropriate step is to escalate the issue to the clinical leadership (e.g., nurse manager, clinical
documentation specialist) who can investigate and oversee the proper correction per facility policy.
HIM plays a key role in ensuring the integrity of the health record as a legal document.
5. When a covered entity (CE) uses a business associate (BA) to perform a function involving PHI,
what is the primary obligation of the CE regarding the BA?
A. To provide the BA with a copy of its own privacy policies.
B. To perform periodic on-site audits of the BA's security practices.
C. To obtain a written Business Associate Agreement (BAA) from the BA.
D. To ensure the BA's employees have completed HIPAA training.
Correct Answer: C. To obtain a written Business Associate Agreement (BAA) from the BA.
Rationale: The Privacy and Security Rules require a covered entity to obtain a written Business
Associate Agreement (BAA) that specifies the permitted and required uses and disclosures of PHI by
the BA. The BAA also requires the BA to implement appropriate safeguards and report breaches.
While the CE is responsible for oversight, the BAA is the fundamental contractual mechanism that
establishes the BA's legal obligations.
6. Which of the following is the most accurate definition of "data integrity" within the context of
an electronic health record (EHR)?
A. The assurance that data is available only to authorized users.
B. The characteristic that data has not been altered or destroyed in an unauthorized manner.
C. The ability to track every action taken on a specific data element.
D. The guarantee that the data is an accurate representation of the patient's clinical status.
Correct Answer: B. The characteristic that data has not been altered or destroyed in an
unauthorized manner.
Rationale: Data integrity refers to the accuracy, completeness, and consistency of data over its entire
lifecycle. In the context of information security, it specifically focuses on the protection against
unauthorized modification or destruction, ensuring that the data is authentic and reliable. Option A
,describes confidentiality, Option C describes an audit trail, and Option D is a broader definition of
data quality.
7. A hospital is transitioning from a paper-based record system to an EHR. What is the most critical
step to ensure the continued legal validity of the historical paper records?
A. Scanning all paper records into the new EHR and verifying their integrity.
B. Storing the original paper records in a secure off-site facility.
C. Creating a comprehensive index of all paper records prior to scanning.
D. Notifying all patients that their records are being converted to an electronic format.
Correct Answer: A. Scanning all paper records into the new EHR and verifying their integrity.
Rationale: To ensure the legal validity of scanned records, the process must create accurate,
complete, and reliable reproductions of the original paper documents. This typically involves
following established scanning standards (e.g., AHIMA's guidelines) and verifying the quality and
integrity of the scanned images against the original source documents. This process is critical for
admissibility in court and to ensure the electronic version can be used for ongoing patient care.
8. A patient is treated for a minor laceration in the Emergency Department (ED). What is the
minimum content required for the medical record to be considered "complete" for this encounter?
A. The History and Physical (H&P), operative report, and discharge summary.
B. The provider's diagnosis, treatment orders, and progress notes.
C. The Chief Complaint, History of Present Illness, Physical Examination, and Medical Decision
Making.
D. The provider's attestation that they have reviewed the record and agree with its contents.
Correct Answer: C. The Chief Complaint, History of Present Illness, Physical Examination, and
Medical Decision Making.
Rationale: For a complete medical record, the documentation must support the medical necessity of
the services provided. For an ED visit, this minimally requires documentation of the chief complaint,
history of present illness, physical exam findings, and the provider's medical decision-making. This is
the foundation for coding, billing, and continuity of care. Options A and D are not typically required
for a minor, single ED encounter.
9. Which of the following constitutes a "breach" of unsecured PHI under the HIPAA Breach
Notification Rule?
A. A covered entity's employee accidentally views a patient's record without a work-related reason.
B. The unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises its
security or privacy.
C. An internal policy violation regarding the handling of a patient's PHI that is immediately reported
and corrected.
D. The disclosure of PHI to a public health authority as required by law.
Correct Answer: B. The unauthorized acquisition, access, use, or disclosure of unsecured PHI that
compromises its security or privacy.
Rationale: The Breach Notification Rule defines a breach as the unauthorized acquisition, access, use,
or disclosure of unsecured PHI which compromises the security or privacy of the PHI. This is the core
definition. Option A is an impermissible internal access, but a breach also requires that the PHI is
, "unsecured" (i.e., not encrypted or destroyed) and that it poses a risk to the individual. Option C, if
immediately corrected with no compromise, may not meet the threshold. Option D is a permitted
disclosure.
10. In the inpatient prospective payment system (IPPS), which of the following is the basis for the
Medicare Severity-Diagnosis Related Group (MS-DRG) assignment?
A. The patient's primary insurance plan.
B. The total length of stay.
C. The patient's principal diagnosis, secondary diagnoses, and procedures.
D. The patient's age, sex, and discharge disposition.
Correct Answer: C. The patient's principal diagnosis, secondary diagnoses, and procedures.
Rationale: In the IPPS, the MS-DRG assignment is determined by a grouper software program that
uses the coded data from the inpatient stay. The principal diagnosis is the primary condition after
study; secondary diagnoses (especially those identified as complications or comorbidities) and
significant procedures are the key variables that determine the specific DRG and its associated
payment weight.
11. A patient who is a minor seeks mental health treatment without parental consent, as
permitted by state law. The minor's parent later requests the treatment records. Under HIPAA,
what is the most appropriate course of action?
A. Provide the parent with the full record, as they are the parent of a minor.
B. Deny the parent access to the record as the minor is the one who consented.
C. Release the record to the parent unless the minor objects or the provider determines it would be
harmful.
D. Release the record only if the parent obtains a court order.
Correct Answer: C. Release the record to the parent unless the minor objects or the provider
determines it would be harmful.
Rationale: When a minor is treated without parental consent under state law, the minor is generally
considered the "individual" for HIPAA purposes. However, the Privacy Rule allows a covered entity to
disclose PHI to a parent in these situations, provided they are acting as a personal representative. The
best practice is to follow state law and facility policy, but the Privacy Rule does not require disclosure;
it permits it unless the minor objects or the provider believes it would be harmful.
12. Which of the following is the primary responsibility of a Clinical Documentation Improvement
(CDI) specialist?
A. To assign ICD-10-CM and CPT codes to patient records.
B. To review the medical record for completeness and ensure all required forms are present.
C. To facilitate accurate and complete documentation in the health record to reflect the patient's
clinical status.
D. To audit the HIM department's coding accuracy and productivity.
Correct Answer: C. To facilitate accurate and complete documentation in the health record to
reflect the patient's clinical status.
Rationale: The CDI specialist's primary role is to improve the quality of clinical documentation,
ensuring it accurately reflects the severity of illness, risk of mortality, and complexity of care provided.
QUESTIONS AND VERIFIED ANSWERS | 2026–2027 LATEST
UPDATE | GUARANTEED PASS | DETAILED RATIONALES |
FULL STUDY GUIDE | EXAM PREP | PRACTICE TEST |
CERTIFICATION PREPARATION
1. A patient requests a copy of their medical records but explicitly states they do not want their
HIV test results included. Under HIPAA, what is the most appropriate action for the Health
Information Management (HIM) professional to take?
A. Honor the patient's request to exclude the HIV results from the copy to respect their privacy.
B. Provide a complete copy of the record, as the patient has a right to all their information.
C. Provide the full record but ask the patient to sign a separate release form for the HIV results.
D. Provide the record but redact the HIV results based on the patient's written request.
Correct Answer: B. Provide a complete copy of the record, as the patient has a right to all their
information.
Rationale: Under HIPAA, an individual has a right of access to inspect and obtain a copy of their
protected health information (PHI) in a designated record set, including laboratory results. The
Privacy Rule does not permit a patient to selectively exclude portions of their record during an access
request; they are entitled to the full designated record set unless a specific, valid exception applies.
2. Which of the following is the primary purpose of the master patient index (MPI)?
A. To link a patient's medical record numbers across different facilities.
B. To index diseases and procedures for statistical reporting.
C. To serve as the primary source for billing and reimbursement.
D. To track the location of a patient's physical paper chart.
Correct Answer: A. To link a patient's medical record numbers across different facilities.
Rationale: The primary purpose of the MPI is to maintain a unique identifier for each patient and to
link all encounters, medical record numbers, and demographic information for that patient, ensuring
a complete and accurate view of their healthcare history. Option B describes a disease index or
registry, Option C describes the chargemaster or billing system, and Option D is an outdated function
for manual chart tracking.
3. In the context of a record retention schedule, which of the following documents should typically
have the longest retention period?
A. A routine nursing shift assessment.
B. An operative report for a cholecystectomy.
C. The patient's advance directive.
D. A fetal heart monitor strip.
Correct Answer: D. A fetal heart monitor strip.
Rationale: Fetal heart monitor strips and other perinatal records are often subject to longer retention
periods, frequently until the child reaches the age of majority (e.g., 18 or 21 years) plus the applicable
,statute of limitations. While operative reports and advance directives have important retention
periods, they do not typically span the length of a minor's age of majority plus the statute of
limitations.
4. A physician is reviewing a record and notices a discrepancy between the medication dosage
documented in the nursing notes and the dosage listed on the medication administration record
(MAR). What is the most appropriate first step for the HIM professional to take?
A. Immediately correct the nursing notes to match the MAR.
B. Flag the record for the nursing supervisor to review and reconcile the discrepancy.
C. Contact the physician to ask which dosage is correct and document their verbal order.
D. Identify the discrepancy and notify the appropriate clinical leadership for review and correction.
Correct Answer: D. Identify the discrepancy and notify the appropriate clinical leadership for
review and correction.
Rationale: HIM professionals are responsible for identifying discrepancies and facilitating their
resolution, but they do not have the clinical authority to correct clinical documentation themselves.
The appropriate step is to escalate the issue to the clinical leadership (e.g., nurse manager, clinical
documentation specialist) who can investigate and oversee the proper correction per facility policy.
HIM plays a key role in ensuring the integrity of the health record as a legal document.
5. When a covered entity (CE) uses a business associate (BA) to perform a function involving PHI,
what is the primary obligation of the CE regarding the BA?
A. To provide the BA with a copy of its own privacy policies.
B. To perform periodic on-site audits of the BA's security practices.
C. To obtain a written Business Associate Agreement (BAA) from the BA.
D. To ensure the BA's employees have completed HIPAA training.
Correct Answer: C. To obtain a written Business Associate Agreement (BAA) from the BA.
Rationale: The Privacy and Security Rules require a covered entity to obtain a written Business
Associate Agreement (BAA) that specifies the permitted and required uses and disclosures of PHI by
the BA. The BAA also requires the BA to implement appropriate safeguards and report breaches.
While the CE is responsible for oversight, the BAA is the fundamental contractual mechanism that
establishes the BA's legal obligations.
6. Which of the following is the most accurate definition of "data integrity" within the context of
an electronic health record (EHR)?
A. The assurance that data is available only to authorized users.
B. The characteristic that data has not been altered or destroyed in an unauthorized manner.
C. The ability to track every action taken on a specific data element.
D. The guarantee that the data is an accurate representation of the patient's clinical status.
Correct Answer: B. The characteristic that data has not been altered or destroyed in an
unauthorized manner.
Rationale: Data integrity refers to the accuracy, completeness, and consistency of data over its entire
lifecycle. In the context of information security, it specifically focuses on the protection against
unauthorized modification or destruction, ensuring that the data is authentic and reliable. Option A
,describes confidentiality, Option C describes an audit trail, and Option D is a broader definition of
data quality.
7. A hospital is transitioning from a paper-based record system to an EHR. What is the most critical
step to ensure the continued legal validity of the historical paper records?
A. Scanning all paper records into the new EHR and verifying their integrity.
B. Storing the original paper records in a secure off-site facility.
C. Creating a comprehensive index of all paper records prior to scanning.
D. Notifying all patients that their records are being converted to an electronic format.
Correct Answer: A. Scanning all paper records into the new EHR and verifying their integrity.
Rationale: To ensure the legal validity of scanned records, the process must create accurate,
complete, and reliable reproductions of the original paper documents. This typically involves
following established scanning standards (e.g., AHIMA's guidelines) and verifying the quality and
integrity of the scanned images against the original source documents. This process is critical for
admissibility in court and to ensure the electronic version can be used for ongoing patient care.
8. A patient is treated for a minor laceration in the Emergency Department (ED). What is the
minimum content required for the medical record to be considered "complete" for this encounter?
A. The History and Physical (H&P), operative report, and discharge summary.
B. The provider's diagnosis, treatment orders, and progress notes.
C. The Chief Complaint, History of Present Illness, Physical Examination, and Medical Decision
Making.
D. The provider's attestation that they have reviewed the record and agree with its contents.
Correct Answer: C. The Chief Complaint, History of Present Illness, Physical Examination, and
Medical Decision Making.
Rationale: For a complete medical record, the documentation must support the medical necessity of
the services provided. For an ED visit, this minimally requires documentation of the chief complaint,
history of present illness, physical exam findings, and the provider's medical decision-making. This is
the foundation for coding, billing, and continuity of care. Options A and D are not typically required
for a minor, single ED encounter.
9. Which of the following constitutes a "breach" of unsecured PHI under the HIPAA Breach
Notification Rule?
A. A covered entity's employee accidentally views a patient's record without a work-related reason.
B. The unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises its
security or privacy.
C. An internal policy violation regarding the handling of a patient's PHI that is immediately reported
and corrected.
D. The disclosure of PHI to a public health authority as required by law.
Correct Answer: B. The unauthorized acquisition, access, use, or disclosure of unsecured PHI that
compromises its security or privacy.
Rationale: The Breach Notification Rule defines a breach as the unauthorized acquisition, access, use,
or disclosure of unsecured PHI which compromises the security or privacy of the PHI. This is the core
definition. Option A is an impermissible internal access, but a breach also requires that the PHI is
, "unsecured" (i.e., not encrypted or destroyed) and that it poses a risk to the individual. Option C, if
immediately corrected with no compromise, may not meet the threshold. Option D is a permitted
disclosure.
10. In the inpatient prospective payment system (IPPS), which of the following is the basis for the
Medicare Severity-Diagnosis Related Group (MS-DRG) assignment?
A. The patient's primary insurance plan.
B. The total length of stay.
C. The patient's principal diagnosis, secondary diagnoses, and procedures.
D. The patient's age, sex, and discharge disposition.
Correct Answer: C. The patient's principal diagnosis, secondary diagnoses, and procedures.
Rationale: In the IPPS, the MS-DRG assignment is determined by a grouper software program that
uses the coded data from the inpatient stay. The principal diagnosis is the primary condition after
study; secondary diagnoses (especially those identified as complications or comorbidities) and
significant procedures are the key variables that determine the specific DRG and its associated
payment weight.
11. A patient who is a minor seeks mental health treatment without parental consent, as
permitted by state law. The minor's parent later requests the treatment records. Under HIPAA,
what is the most appropriate course of action?
A. Provide the parent with the full record, as they are the parent of a minor.
B. Deny the parent access to the record as the minor is the one who consented.
C. Release the record to the parent unless the minor objects or the provider determines it would be
harmful.
D. Release the record only if the parent obtains a court order.
Correct Answer: C. Release the record to the parent unless the minor objects or the provider
determines it would be harmful.
Rationale: When a minor is treated without parental consent under state law, the minor is generally
considered the "individual" for HIPAA purposes. However, the Privacy Rule allows a covered entity to
disclose PHI to a parent in these situations, provided they are acting as a personal representative. The
best practice is to follow state law and facility policy, but the Privacy Rule does not require disclosure;
it permits it unless the minor objects or the provider believes it would be harmful.
12. Which of the following is the primary responsibility of a Clinical Documentation Improvement
(CDI) specialist?
A. To assign ICD-10-CM and CPT codes to patient records.
B. To review the medical record for completeness and ensure all required forms are present.
C. To facilitate accurate and complete documentation in the health record to reflect the patient's
clinical status.
D. To audit the HIM department's coding accuracy and productivity.
Correct Answer: C. To facilitate accurate and complete documentation in the health record to
reflect the patient's clinical status.
Rationale: The CDI specialist's primary role is to improve the quality of clinical documentation,
ensuring it accurately reflects the severity of illness, risk of mortality, and complexity of care provided.
