Alabama Certified Health Information
Technician Test Bank & Study Guide
2026/2027 – Fully Solved Exam-Style
Questions with Bolded Answers & In-Depth
Rationales | Accurate & Trusted
1. A health system discovers that different departments use
different definitions for “active patient,” producing inconsistent
reports. Which information-governance activity should address
this problem first?
A. Data encryption
B. Data definition standardization
C. Record retention
D. User authentication
The correct answer is B because standardized definitions
establish consistent meaning for data elements across the
organization. Encryption and authentication protect
information, while retention governs how long records are
maintained; neither resolves conflicting definitions.
,2. An HIM department is designing a master patient index (MPI)
quality-monitoring program. Which indicator would most
directly measure duplicate-record risk?
A. Average chart completion time
B. Percentage of records released electronically
C. Number of duplicate medical record numbers identified per
1,000 registrations
D. Percentage of claims submitted within 72 hours
The correct answer is C because duplicate medical record
numbers directly indicate MPI integrity problems. The other
measures concern record completion, disclosure, and revenue-
cycle performance rather than patient-identity management.
3. A patient portal allows patients to view laboratory results
before discussing them with a provider. Which principle should
HIM staff recognize when evaluating access?
A. Patients may access only information specifically approved
by the physician.
B. Portal access eliminates the need for identity verification.
C. Access controls should authenticate the user and limit
access according to authorized information and system
permissions.
,D. Portal information is not considered protected health
information because the patient accesses it personally.
The correct answer is C because electronic patient access still
requires appropriate authentication and authorization controls.
Patient portals do not remove privacy and security obligations,
and PHI remains PHI regardless of the access method.
4. Which documentation practice best supports the integrity of
an electronic health record?
A. Allowing users to overwrite prior entries without an audit
trail
B. Deleting erroneous entries permanently
C. Preserving the original entry while recording a dated,
attributable correction
D. Allowing another employee to correct documentation under
the original user's credentials
The correct answer is C because corrections should preserve the
original information and establish who made the change and
when. Overwriting, deleting, or using another person's
credentials undermines record integrity and accountability.
, 5. An organization wants to determine whether a proposed
secondary use of patient data is consistent with its information-
governance policies. Which activity is most appropriate?
A. Increase the database storage capacity
B. Change the patient's diagnosis codes
C. Evaluate the proposed use against applicable policies, legal
requirements, data stewardship responsibilities, and
authorized purposes
D. Remove all identifiers regardless of the intended use
The correct answer is C because information governance
addresses the appropriate use, stewardship, quality, security,
and lifecycle of information. De-identification can be important
in some circumstances but is not automatically the only
requirement.
6. A physician's note contains an incorrect medication dosage.
The physician identifies the error after signing the note. What is
the most appropriate EHR correction method?
A. Delete the entire note and replace it.
B. Ask the HIM clerk to change the dosage.
C. Enter a compliant correction or addendum that preserves
the original documentation and identifies the author and
Technician Test Bank & Study Guide
2026/2027 – Fully Solved Exam-Style
Questions with Bolded Answers & In-Depth
Rationales | Accurate & Trusted
1. A health system discovers that different departments use
different definitions for “active patient,” producing inconsistent
reports. Which information-governance activity should address
this problem first?
A. Data encryption
B. Data definition standardization
C. Record retention
D. User authentication
The correct answer is B because standardized definitions
establish consistent meaning for data elements across the
organization. Encryption and authentication protect
information, while retention governs how long records are
maintained; neither resolves conflicting definitions.
,2. An HIM department is designing a master patient index (MPI)
quality-monitoring program. Which indicator would most
directly measure duplicate-record risk?
A. Average chart completion time
B. Percentage of records released electronically
C. Number of duplicate medical record numbers identified per
1,000 registrations
D. Percentage of claims submitted within 72 hours
The correct answer is C because duplicate medical record
numbers directly indicate MPI integrity problems. The other
measures concern record completion, disclosure, and revenue-
cycle performance rather than patient-identity management.
3. A patient portal allows patients to view laboratory results
before discussing them with a provider. Which principle should
HIM staff recognize when evaluating access?
A. Patients may access only information specifically approved
by the physician.
B. Portal access eliminates the need for identity verification.
C. Access controls should authenticate the user and limit
access according to authorized information and system
permissions.
,D. Portal information is not considered protected health
information because the patient accesses it personally.
The correct answer is C because electronic patient access still
requires appropriate authentication and authorization controls.
Patient portals do not remove privacy and security obligations,
and PHI remains PHI regardless of the access method.
4. Which documentation practice best supports the integrity of
an electronic health record?
A. Allowing users to overwrite prior entries without an audit
trail
B. Deleting erroneous entries permanently
C. Preserving the original entry while recording a dated,
attributable correction
D. Allowing another employee to correct documentation under
the original user's credentials
The correct answer is C because corrections should preserve the
original information and establish who made the change and
when. Overwriting, deleting, or using another person's
credentials undermines record integrity and accountability.
, 5. An organization wants to determine whether a proposed
secondary use of patient data is consistent with its information-
governance policies. Which activity is most appropriate?
A. Increase the database storage capacity
B. Change the patient's diagnosis codes
C. Evaluate the proposed use against applicable policies, legal
requirements, data stewardship responsibilities, and
authorized purposes
D. Remove all identifiers regardless of the intended use
The correct answer is C because information governance
addresses the appropriate use, stewardship, quality, security,
and lifecycle of information. De-identification can be important
in some circumstances but is not automatically the only
requirement.
6. A physician's note contains an incorrect medication dosage.
The physician identifies the error after signing the note. What is
the most appropriate EHR correction method?
A. Delete the entire note and replace it.
B. Ask the HIM clerk to change the dosage.
C. Enter a compliant correction or addendum that preserves
the original documentation and identifies the author and
