NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
NHA CCMA Test 1
(Answered) 2026/2027 Edition — Certified Clinical Medical Assistant
100 Questions • Multiple Choice • Comprehensive Blueprint Coverage
Examination Overview: This 100-question comprehensive exam is aligned with the 2026–2027 NHA CCMA
(Certified Clinical Medical Assistant) Test 1 blueprint and reflects current clinical practice guidelines published by the
National Healthcareer Association. Each question includes a complete correct answer and a detailed rationale that
doubles as study-guide content, providing clinical reasoning, procedural steps, safety considerations, and NHA blueprint
alignment. The cognitive distribution is approximately 35% recall (terminology, anatomy, procedural facts), 45%
application (scenario-based clinical decision-making and procedures), and 20% analysis (prioritization,
problem-solving, and critical thinking), mirroring the actual NHA CCMA Test 1 form. Questions are distributed across
nine content domains: Foundational Knowledge, Law, and Ethics (HIPAA, Scope of Practice, and Patient Rights);
Communication and Customer Service (Therapeutic Communication and Cultural Competence); Medical Terminology,
Anatomy, and Physiology; Infection Control and Asepsis (Precautions, Sterilization, and Disinfection); Vital Signs,
Physical Examination, and Patient Preparation; Phlebotomy, Specimen Collection, and Laboratory Procedures;
Pharmacology and Medication Administration; Medical Office Administration and Financial Management; and Clinical
Procedures and Emergency Response. Distractors are designed to reflect the most common NHA CCMA Test 1 pitfalls:
incorrect order of draw, improper PPE sequence, wrong medication calculations, misidentifying normal versus
abnormal vital signs, incorrect sterilization methods, HIPAA violations, improper patient positioning, and wrong
specimen handling. Mastering both the correct answer and the reasoning behind each distractor is the key to scoring at
or above the NHA CCMA passing standard.
Section 1: Foundational Knowledge, Law, and Ethics (HIPAA, Scope of Practice,
& Patient Rights) — Q1–Q12
Q1: A medical assistant (MA) is asked by a longtime patient's neighbor to share the results of the patient's
recent HIV test because the neighbor is “worried about her.” Which action by the MA is MOST
appropriate under the HIPAA Privacy Rule?
A. Share the results verbally only, because the neighbor is personally acquainted with the patient
B. Politely decline to disclose any protected health information (PHI) and explain that disclosure requires
the patient's written authorization unless another specific exception applies [CORRECT]
C. Share the results because HIV status is not protected under HIPAA
D. Tell the neighbor to ask the patient directly, then call the patient to confirm the disclosure
Correct Answer: B
Rationale: Under the HIPAA Privacy Rule, HIV status, like all individually identifiable health information, is protected
health information (PHI). Disclosure to a neighbor — even one claiming concern — requires the patient's written
authorization unless another specific exception applies (e.g., treatment, payment, healthcare operations, public health
reporting, or court order). Verbal disclosure is still a breach. Option A violates the Privacy Rule. Option C is incorrect
because HIV status is explicitly covered PHI. Option D still constitutes an unauthorized disclosure. The correct response is to
decline, document the request, and notify the privacy officer if a breach is suspected.
Page 1
,NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
Q2: A clinical medical assistant working in a primary care office is asked by a patient to remove sutures
from a recent surgical incision. The MA's training included suture removal during the MA program, but
the supervising physician has not authorized the procedure for this patient. Which statement BEST
defines the MA's scope of practice in this scenario?
A. The MA may proceed because suture removal was taught in the MA program
B. The MA may proceed only if the patient signs a consent form
C. The MA must not perform the procedure unless it falls within state law, the MA's training and
competency, and the delegating provider's specific order or standing protocol for this patient
[CORRECT]
D. The MA may proceed if a coworker observes the procedure
Correct Answer: C
Rationale: Scope of practice for a medical assistant is defined by three intersecting authorities: state law (which varies by
state and may restrict certain tasks), the MA's education, training, and demonstrated competency, and the delegating licensed
provider's order or approved protocol. Even if a procedure was taught in the MA program, the MA cannot perform it without
specific authorization for that patient encounter. Option A is wrong because training alone is insufficient. Option B is wrong
because a consent form does not authorize the procedure — provider delegation does. Option D is wrong because observation
does not create authority. Performing the procedure without delegation could constitute practicing without a license and
expose the MA and provider to liability.
Q3: A patient files a malpractice lawsuit against a physician and the medical assistant who assisted with a
procedure. To establish malpractice, the plaintiff must prove four elements. Which combination correctly
lists those elements?
A. Intent, motive, opportunity, and conspiracy
B. Duty, breach of duty, causation, and damages [CORRECT]
C. Assault, battery, false imprisonment, and emotional distress
D. Negligence, fraud, defamation, and invasion of privacy
Correct Answer: B
Rationale: Medical malpractice is a form of professional negligence. The four required elements are: (1) Duty — a
provider-patient relationship existed, establishing a duty of care; (2) Breach of duty — the provider failed to meet the
applicable standard of care; (3) Causation — the breach directly caused the injury (proximate cause); (4) Damages — actual
harm or injury resulted. Without all four elements, malpractice cannot be established. Option A describes criminal law
elements (intent, motive). Option C lists intentional torts. Option D is a mix of torts but not the malpractice elements. The
standard of care is what a reasonably prudent practitioner with similar training would do under similar circumstances.
Page 2
,NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
Q4: Which statement BEST describes informed consent and the medical assistant's role in obtaining it?
A. Informed consent is a formality; any staff member can sign on the patient's behalf if the patient is unavailable
B. Informed consent requires that the patient receive and understand information about the procedure's
purpose, risks, benefits, and alternatives; the MA may witness the signature but cannot be the person who
obtains consent for an invasive procedure — that responsibility lies with the performing licensed provider
[CORRECT]
C. Informed consent only applies to surgical procedures performed in a hospital
D. The MA is responsible for explaining all risks and benefits because the MA is at the front desk
Correct Answer: B
Rationale: Informed consent is both an ethical and legal requirement based on the patient's autonomy. It must include
disclosure of the procedure's purpose, risks, benefits, and alternatives; the patient must have capacity and must voluntarily
consent. The performing licensed provider (physician, NP, or PA) is responsible for the disclosure discussion; the medical
assistant may witness the patient's signature, confirm identity, and ensure the form is complete, but cannot obtain consent for
invasive procedures. Option A is wrong: consent cannot be signed by staff. Option C is wrong: consent applies to many
procedures, not just hospital surgeries. Option D is wrong: the disclosure discussion is the provider's responsibility. A signed
form without a meaningful discussion is not valid informed consent.
Q5: A 16-year-old patient presents alone requesting treatment for a sexually transmitted infection (STI).
Under most state laws, which statement is MOST accurate regarding consent and confidentiality?
A. Minors cannot consent to any medical treatment without a parent or guardian
B. Many states allow minors to consent to diagnosis and treatment of STIs without parental notification;
the MA should follow state law and office policy and consult the provider before proceeding [CORRECT]
C. The MA must call the parents immediately regardless of state law
D. The MA must report the minor to law enforcement
Correct Answer: B
Rationale: All fifty states and the District of Columbia have laws allowing minors to consent to STI testing and treatment
without parental consent or notification, although the specific age and scope vary by state. This exception exists to encourage
minors to seek treatment for conditions with public health implications. The MA must follow state law and office policy,
verify the patient's age and identity, and consult the supervising provider before proceeding. Option A is incorrect: most states
have minor consent exceptions for STIs, contraception, prenatal care, substance abuse, and mental health. Option C is
incorrect because state law may explicitly prohibit parental notification. Option D is incorrect because STIs in minors are
reportable to public health (not law enforcement) under mandatory reporting laws. HIV and AIDS reporting varies by state.
Page 3
, NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
Q6: Under the HIPAA Security Rule, which of the following is the BEST example of an administrative
safeguard?
A. Installing a firewall on the office network
B. Designating a privacy officer, conducting workforce training on PHI, and implementing
access-management policies that limit employee access to the minimum necessary PHI [CORRECT]
C. Encrypting backup tapes stored offsite
D. Requiring badge access to the medical records room
Correct Answer: B
Rationale: The HIPAA Security Rule classifies safeguards into three categories: administrative, physical, and technical.
Administrative safeguards are policies, procedures, and training that govern workforce conduct — designating a
privacy/security officer, conducting training, role-based access management, sanction policies, and contingency planning.
Option A (firewall) is a technical safeguard. Option C (encryption of backup tapes) is a technical safeguard. Option D (badge
access) is a physical safeguard. The Security Rule applies specifically to electronic PHI (ePHI). Knowing which safeguard
category a control falls into is a common NHA CCMA Test 1 item.
Q7: A medical assistant discovers that a laptop containing unencrypted patient scheduling information
was stolen from a provider's car. Under the HIPAA Breach Notification Rule, which statement BEST
describes the practice's obligation?
A. No notification is required because the device was not in the office
B. The practice must conduct a risk assessment to determine whether the breach poses a significant risk
of financial, reputational, or other harm to affected individuals; if so, individual notification is required
within 60 days, and breach of 500+ individuals requires notification of HHS and the media [CORRECT]
C. The practice must notify only the local police
D. Notification is required only if the patient specifically requests it
Correct Answer: B
Rationale: The HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) requires a covered entity to notify affected
individuals in writing without unreasonable delay and no later than 60 days from discovery of a breach of unsecured PHI.
Breaches affecting 500 or more individuals also require notification to the U.S. Department of Health and Human Services
(HHS) and prominent media outlets serving the affected area. Breaches affecting fewer than 500 individuals require annual
log notification to HHS. The covered entity must first conduct a risk assessment to determine whether the breach poses a
significant risk of harm; if the risk is low, notification may not be required. Option A is wrong: location does not exempt the
practice. Option C is wrong: police notification is separate. Option D is wrong: notification is mandatory, not patient-initiated.
Encryption renders PHI “secured” and exempts the breach from notification.
Page 4
NHA CCMA Test 1
(Answered) 2026/2027 Edition — Certified Clinical Medical Assistant
100 Questions • Multiple Choice • Comprehensive Blueprint Coverage
Examination Overview: This 100-question comprehensive exam is aligned with the 2026–2027 NHA CCMA
(Certified Clinical Medical Assistant) Test 1 blueprint and reflects current clinical practice guidelines published by the
National Healthcareer Association. Each question includes a complete correct answer and a detailed rationale that
doubles as study-guide content, providing clinical reasoning, procedural steps, safety considerations, and NHA blueprint
alignment. The cognitive distribution is approximately 35% recall (terminology, anatomy, procedural facts), 45%
application (scenario-based clinical decision-making and procedures), and 20% analysis (prioritization,
problem-solving, and critical thinking), mirroring the actual NHA CCMA Test 1 form. Questions are distributed across
nine content domains: Foundational Knowledge, Law, and Ethics (HIPAA, Scope of Practice, and Patient Rights);
Communication and Customer Service (Therapeutic Communication and Cultural Competence); Medical Terminology,
Anatomy, and Physiology; Infection Control and Asepsis (Precautions, Sterilization, and Disinfection); Vital Signs,
Physical Examination, and Patient Preparation; Phlebotomy, Specimen Collection, and Laboratory Procedures;
Pharmacology and Medication Administration; Medical Office Administration and Financial Management; and Clinical
Procedures and Emergency Response. Distractors are designed to reflect the most common NHA CCMA Test 1 pitfalls:
incorrect order of draw, improper PPE sequence, wrong medication calculations, misidentifying normal versus
abnormal vital signs, incorrect sterilization methods, HIPAA violations, improper patient positioning, and wrong
specimen handling. Mastering both the correct answer and the reasoning behind each distractor is the key to scoring at
or above the NHA CCMA passing standard.
Section 1: Foundational Knowledge, Law, and Ethics (HIPAA, Scope of Practice,
& Patient Rights) — Q1–Q12
Q1: A medical assistant (MA) is asked by a longtime patient's neighbor to share the results of the patient's
recent HIV test because the neighbor is “worried about her.” Which action by the MA is MOST
appropriate under the HIPAA Privacy Rule?
A. Share the results verbally only, because the neighbor is personally acquainted with the patient
B. Politely decline to disclose any protected health information (PHI) and explain that disclosure requires
the patient's written authorization unless another specific exception applies [CORRECT]
C. Share the results because HIV status is not protected under HIPAA
D. Tell the neighbor to ask the patient directly, then call the patient to confirm the disclosure
Correct Answer: B
Rationale: Under the HIPAA Privacy Rule, HIV status, like all individually identifiable health information, is protected
health information (PHI). Disclosure to a neighbor — even one claiming concern — requires the patient's written
authorization unless another specific exception applies (e.g., treatment, payment, healthcare operations, public health
reporting, or court order). Verbal disclosure is still a breach. Option A violates the Privacy Rule. Option C is incorrect
because HIV status is explicitly covered PHI. Option D still constitutes an unauthorized disclosure. The correct response is to
decline, document the request, and notify the privacy officer if a breach is suspected.
Page 1
,NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
Q2: A clinical medical assistant working in a primary care office is asked by a patient to remove sutures
from a recent surgical incision. The MA's training included suture removal during the MA program, but
the supervising physician has not authorized the procedure for this patient. Which statement BEST
defines the MA's scope of practice in this scenario?
A. The MA may proceed because suture removal was taught in the MA program
B. The MA may proceed only if the patient signs a consent form
C. The MA must not perform the procedure unless it falls within state law, the MA's training and
competency, and the delegating provider's specific order or standing protocol for this patient
[CORRECT]
D. The MA may proceed if a coworker observes the procedure
Correct Answer: C
Rationale: Scope of practice for a medical assistant is defined by three intersecting authorities: state law (which varies by
state and may restrict certain tasks), the MA's education, training, and demonstrated competency, and the delegating licensed
provider's order or approved protocol. Even if a procedure was taught in the MA program, the MA cannot perform it without
specific authorization for that patient encounter. Option A is wrong because training alone is insufficient. Option B is wrong
because a consent form does not authorize the procedure — provider delegation does. Option D is wrong because observation
does not create authority. Performing the procedure without delegation could constitute practicing without a license and
expose the MA and provider to liability.
Q3: A patient files a malpractice lawsuit against a physician and the medical assistant who assisted with a
procedure. To establish malpractice, the plaintiff must prove four elements. Which combination correctly
lists those elements?
A. Intent, motive, opportunity, and conspiracy
B. Duty, breach of duty, causation, and damages [CORRECT]
C. Assault, battery, false imprisonment, and emotional distress
D. Negligence, fraud, defamation, and invasion of privacy
Correct Answer: B
Rationale: Medical malpractice is a form of professional negligence. The four required elements are: (1) Duty — a
provider-patient relationship existed, establishing a duty of care; (2) Breach of duty — the provider failed to meet the
applicable standard of care; (3) Causation — the breach directly caused the injury (proximate cause); (4) Damages — actual
harm or injury resulted. Without all four elements, malpractice cannot be established. Option A describes criminal law
elements (intent, motive). Option C lists intentional torts. Option D is a mix of torts but not the malpractice elements. The
standard of care is what a reasonably prudent practitioner with similar training would do under similar circumstances.
Page 2
,NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
Q4: Which statement BEST describes informed consent and the medical assistant's role in obtaining it?
A. Informed consent is a formality; any staff member can sign on the patient's behalf if the patient is unavailable
B. Informed consent requires that the patient receive and understand information about the procedure's
purpose, risks, benefits, and alternatives; the MA may witness the signature but cannot be the person who
obtains consent for an invasive procedure — that responsibility lies with the performing licensed provider
[CORRECT]
C. Informed consent only applies to surgical procedures performed in a hospital
D. The MA is responsible for explaining all risks and benefits because the MA is at the front desk
Correct Answer: B
Rationale: Informed consent is both an ethical and legal requirement based on the patient's autonomy. It must include
disclosure of the procedure's purpose, risks, benefits, and alternatives; the patient must have capacity and must voluntarily
consent. The performing licensed provider (physician, NP, or PA) is responsible for the disclosure discussion; the medical
assistant may witness the patient's signature, confirm identity, and ensure the form is complete, but cannot obtain consent for
invasive procedures. Option A is wrong: consent cannot be signed by staff. Option C is wrong: consent applies to many
procedures, not just hospital surgeries. Option D is wrong: the disclosure discussion is the provider's responsibility. A signed
form without a meaningful discussion is not valid informed consent.
Q5: A 16-year-old patient presents alone requesting treatment for a sexually transmitted infection (STI).
Under most state laws, which statement is MOST accurate regarding consent and confidentiality?
A. Minors cannot consent to any medical treatment without a parent or guardian
B. Many states allow minors to consent to diagnosis and treatment of STIs without parental notification;
the MA should follow state law and office policy and consult the provider before proceeding [CORRECT]
C. The MA must call the parents immediately regardless of state law
D. The MA must report the minor to law enforcement
Correct Answer: B
Rationale: All fifty states and the District of Columbia have laws allowing minors to consent to STI testing and treatment
without parental consent or notification, although the specific age and scope vary by state. This exception exists to encourage
minors to seek treatment for conditions with public health implications. The MA must follow state law and office policy,
verify the patient's age and identity, and consult the supervising provider before proceeding. Option A is incorrect: most states
have minor consent exceptions for STIs, contraception, prenatal care, substance abuse, and mental health. Option C is
incorrect because state law may explicitly prohibit parental notification. Option D is incorrect because STIs in minors are
reportable to public health (not law enforcement) under mandatory reporting laws. HIV and AIDS reporting varies by state.
Page 3
, NHA CCMA Test 1 | 2026/2027 Answered Edition | Clinical Medical Assistant Certification Prep 100-Question Comprehensive Exam
Q6: Under the HIPAA Security Rule, which of the following is the BEST example of an administrative
safeguard?
A. Installing a firewall on the office network
B. Designating a privacy officer, conducting workforce training on PHI, and implementing
access-management policies that limit employee access to the minimum necessary PHI [CORRECT]
C. Encrypting backup tapes stored offsite
D. Requiring badge access to the medical records room
Correct Answer: B
Rationale: The HIPAA Security Rule classifies safeguards into three categories: administrative, physical, and technical.
Administrative safeguards are policies, procedures, and training that govern workforce conduct — designating a
privacy/security officer, conducting training, role-based access management, sanction policies, and contingency planning.
Option A (firewall) is a technical safeguard. Option C (encryption of backup tapes) is a technical safeguard. Option D (badge
access) is a physical safeguard. The Security Rule applies specifically to electronic PHI (ePHI). Knowing which safeguard
category a control falls into is a common NHA CCMA Test 1 item.
Q7: A medical assistant discovers that a laptop containing unencrypted patient scheduling information
was stolen from a provider's car. Under the HIPAA Breach Notification Rule, which statement BEST
describes the practice's obligation?
A. No notification is required because the device was not in the office
B. The practice must conduct a risk assessment to determine whether the breach poses a significant risk
of financial, reputational, or other harm to affected individuals; if so, individual notification is required
within 60 days, and breach of 500+ individuals requires notification of HHS and the media [CORRECT]
C. The practice must notify only the local police
D. Notification is required only if the patient specifically requests it
Correct Answer: B
Rationale: The HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) requires a covered entity to notify affected
individuals in writing without unreasonable delay and no later than 60 days from discovery of a breach of unsecured PHI.
Breaches affecting 500 or more individuals also require notification to the U.S. Department of Health and Human Services
(HHS) and prominent media outlets serving the affected area. Breaches affecting fewer than 500 individuals require annual
log notification to HHS. The covered entity must first conduct a risk assessment to determine whether the breach poses a
significant risk of harm; if the risk is low, notification may not be required. Option A is wrong: location does not exempt the
practice. Option C is wrong: police notification is separate. Option D is wrong: notification is mandatory, not patient-initiated.
Encryption renders PHI “secured” and exempts the breach from notification.
Page 4
