RHIT Exam Review Domain 2 Newest 2026/2027
Questions and Correct Detailed Answers Already
Graded A+
Typically, the record custodian can testify about which of the following when a
party in a legal proceeding is attempting to admit a health record as evidence?
a. Identification of the record as the one subpoenaed
b. The care provided to the patient
c. The qualifications of the treating physician
d. Identification of the standard of care used to treat the patient - CORRECT
ANSWER-a. Identification of the record as the one subpoenaed
Original health records may be required by subpoena to be produced in person
and the custodian of records is required to authenticate those records through
testimony.
The Medical Record Committee is reviewing the privacy policies for a large
outpatient clinic. One of the members of the committee remarks that he feels the
clinic's practice of calling out a patient's full name in the waiting room is not in
compliance with HIPAA regulations and that only the patient's first name should
,be used. Other committee members disagree with this assessment. What should
the HIM director advise the committee?
a. HIPAA does not allow a patient's name to be announced in a waiting room.
b. There is no violation of HIPAA in announcing a patient's name, but the
committee may want to consider implementing a change that might reduce this
practice.
c. HIPAA allows only the use of the patient's first name.
d. HIPAA requires that patients be given numbers and only the number be
announced. - CORRECT ANSWER-b. There is no violation of HIPAA in
announcing a patient's name, but the committee may want to consider
implementing a change that might reduce this practice.
The HIPAA Privacy Rule allows communications to occur for treatment purposes.
The preamble repeatedly states the intent of the rule is to not interfere with
customary and necessary communications in the healthcare of the individual.
Calling out a patient's name in a waiting room, or even on the facility's paging
system, is considered an incidental disclosure, and therefore, allowed in the
Privacy Rule.
,An employee accesses PHI on a computer system that does not relate to her job
functions. What security mechanism should have been implemented to minimize
this security breach?
a. Access controls
b. Audit controls
c. Contingency controls
d. Security incident controls - CORRECT ANSWER-a. Access controls
Establishing access controls is a fundamental security strategy. Basically, the term
access Control means being able to identify which employees should have access
to what data. The general practice is that employees should have access only to
data they need to do their jobs. For example, an admitting clerk and a healthcare
provider would not have access to the same kinds of data.
Which of the following is true about health information retention?
a. Retention depends only on accreditation requirements
b. Retention periods differ among healthcare facilities
c. The operational needs of a healthcare facility cannot be considered
, d. Retention periods are frequently shorter for health information about minors -
CORRECT ANSWER-b. Retention periods differ among healthcare facilities
The HIM professional must consider multiple factors when developing health
record retention policies that determine how long health records are to be kept.
These factors include applicable federal and state statutes and regulations;
accreditation standards; operational needs of the organization; and the type of
organization, thus retention policies differ among healthcare facilities.
Sally has requested an accounting of PHI disclosures from Community Hospital.
Which of the following must be included in an accounting of disclosures to comply
with this request?
a. PHI related to treatment, payment, and operations
b. PHI provided to meet national security or intelligence requirements
c. PHI sent to a physician who has not treated Sally
d. PHI released to Sally's attorney upon her request - CORRECT ANSWER-c. PHI
sent to a physician who has not treated Sally
Maintaining some type of accounting procedure for monitoring and tracking PHI
disclosures has been a common practice in departments that manage health
information. However, the Privacy Rule has a specific standard with respect to
Questions and Correct Detailed Answers Already
Graded A+
Typically, the record custodian can testify about which of the following when a
party in a legal proceeding is attempting to admit a health record as evidence?
a. Identification of the record as the one subpoenaed
b. The care provided to the patient
c. The qualifications of the treating physician
d. Identification of the standard of care used to treat the patient - CORRECT
ANSWER-a. Identification of the record as the one subpoenaed
Original health records may be required by subpoena to be produced in person
and the custodian of records is required to authenticate those records through
testimony.
The Medical Record Committee is reviewing the privacy policies for a large
outpatient clinic. One of the members of the committee remarks that he feels the
clinic's practice of calling out a patient's full name in the waiting room is not in
compliance with HIPAA regulations and that only the patient's first name should
,be used. Other committee members disagree with this assessment. What should
the HIM director advise the committee?
a. HIPAA does not allow a patient's name to be announced in a waiting room.
b. There is no violation of HIPAA in announcing a patient's name, but the
committee may want to consider implementing a change that might reduce this
practice.
c. HIPAA allows only the use of the patient's first name.
d. HIPAA requires that patients be given numbers and only the number be
announced. - CORRECT ANSWER-b. There is no violation of HIPAA in
announcing a patient's name, but the committee may want to consider
implementing a change that might reduce this practice.
The HIPAA Privacy Rule allows communications to occur for treatment purposes.
The preamble repeatedly states the intent of the rule is to not interfere with
customary and necessary communications in the healthcare of the individual.
Calling out a patient's name in a waiting room, or even on the facility's paging
system, is considered an incidental disclosure, and therefore, allowed in the
Privacy Rule.
,An employee accesses PHI on a computer system that does not relate to her job
functions. What security mechanism should have been implemented to minimize
this security breach?
a. Access controls
b. Audit controls
c. Contingency controls
d. Security incident controls - CORRECT ANSWER-a. Access controls
Establishing access controls is a fundamental security strategy. Basically, the term
access Control means being able to identify which employees should have access
to what data. The general practice is that employees should have access only to
data they need to do their jobs. For example, an admitting clerk and a healthcare
provider would not have access to the same kinds of data.
Which of the following is true about health information retention?
a. Retention depends only on accreditation requirements
b. Retention periods differ among healthcare facilities
c. The operational needs of a healthcare facility cannot be considered
, d. Retention periods are frequently shorter for health information about minors -
CORRECT ANSWER-b. Retention periods differ among healthcare facilities
The HIM professional must consider multiple factors when developing health
record retention policies that determine how long health records are to be kept.
These factors include applicable federal and state statutes and regulations;
accreditation standards; operational needs of the organization; and the type of
organization, thus retention policies differ among healthcare facilities.
Sally has requested an accounting of PHI disclosures from Community Hospital.
Which of the following must be included in an accounting of disclosures to comply
with this request?
a. PHI related to treatment, payment, and operations
b. PHI provided to meet national security or intelligence requirements
c. PHI sent to a physician who has not treated Sally
d. PHI released to Sally's attorney upon her request - CORRECT ANSWER-c. PHI
sent to a physician who has not treated Sally
Maintaining some type of accounting procedure for monitoring and tracking PHI
disclosures has been a common practice in departments that manage health
information. However, the Privacy Rule has a specific standard with respect to
