RHIA Domain 2
You are reviewing your privacy and security policies, procedures, training program, and so on, and
comparing them to the HIPAA and ARRA regulations. You are conducting a - answer risk assessment
Which of the following can be released without consent or authorization? - answer de-identified
health information
Kyle, the HIM Director, has received a request to amend a patient's medical record. The appropriate
action for him to take is - answer route the request to the physician who wrote the note in question
to determine the appropriateness of the amendment.
An employee in the admission department took the patient's name, social security number, and
other information and used it to get a charge card in the patient's name. This is an example of -
answer identity theft
A patient has submitted an authorization to release information to a physician office for continued
care. The release of information clerk wants to limit the information provided because of the
minimum necessary rule. What should the supervisor tell the clerk? - answer The patient is an
exception to the minimum necessary rule, so process the request as written
Patricia is processing a request for medical records. The record contains an operative note and a
discharge summary from another hospital. The records are going to another physician for patient
care. What should Patricia do? - answer Include the documents from the other hospital
Before a user is allowed to access protected health information, the system confirm that the patient
is who he or she says they are. This is known as - answer authentication
Contingency planning includes which of the following processes? - answer disaster planning
Which of the following disclosures would require patient authorization? - answer release to
patient's family
I have been asked if I want to be in the directory. The admission clerk explains that if I am in the
directory, - answer my friends and family can find out my room number
, Which of the following techniques would a facility employ for access control?
1. automatic logoff
2. authentication
3. integrity controls
4. unique user identification - answer 1 and 4 only
Which of the following statements is true about a requested restriction? - answer ARRA mandates
that a CE must comply with a requested restriction unless it meets one of the exceptions
Which of the following is an example of administrative safeguards under the security rule? - answer
monitoring the computer access activity of the user
Someone accessed the covered entity's electronic health record and sold the information that was
accessed. This person is known as which of the following? - answer a hacker
Intentional threats to security could include - answer data theft (unauthorized downloading of files).
Which of the following would be a business associate? - answer release of information company
Which of the following statements demonstrates a violation of protected health information? -
answer "Mary, at work yesterday I saw that Susan had a hysterectomy."
You are a nurse who works on 3West during the day shift. One day, you had to work the night shift
because they were shorthanded. However, you were unable to access the EHR. What type of access
control (s) are being used? - answer context-based
In case your system crashes, your facility has defined the policies and procedures necessary to keep
your business going after a disaster. This is known as: - answer business continuity plan
You are defining the designated record set for South Beach Healthcare Center. Which of the
following should be included? - answer discharge summary
You are reviewing your privacy and security policies, procedures, training program, and so on, and
comparing them to the HIPAA and ARRA regulations. You are conducting a - answer risk assessment
Which of the following can be released without consent or authorization? - answer de-identified
health information
Kyle, the HIM Director, has received a request to amend a patient's medical record. The appropriate
action for him to take is - answer route the request to the physician who wrote the note in question
to determine the appropriateness of the amendment.
An employee in the admission department took the patient's name, social security number, and
other information and used it to get a charge card in the patient's name. This is an example of -
answer identity theft
A patient has submitted an authorization to release information to a physician office for continued
care. The release of information clerk wants to limit the information provided because of the
minimum necessary rule. What should the supervisor tell the clerk? - answer The patient is an
exception to the minimum necessary rule, so process the request as written
Patricia is processing a request for medical records. The record contains an operative note and a
discharge summary from another hospital. The records are going to another physician for patient
care. What should Patricia do? - answer Include the documents from the other hospital
Before a user is allowed to access protected health information, the system confirm that the patient
is who he or she says they are. This is known as - answer authentication
Contingency planning includes which of the following processes? - answer disaster planning
Which of the following disclosures would require patient authorization? - answer release to
patient's family
I have been asked if I want to be in the directory. The admission clerk explains that if I am in the
directory, - answer my friends and family can find out my room number
, Which of the following techniques would a facility employ for access control?
1. automatic logoff
2. authentication
3. integrity controls
4. unique user identification - answer 1 and 4 only
Which of the following statements is true about a requested restriction? - answer ARRA mandates
that a CE must comply with a requested restriction unless it meets one of the exceptions
Which of the following is an example of administrative safeguards under the security rule? - answer
monitoring the computer access activity of the user
Someone accessed the covered entity's electronic health record and sold the information that was
accessed. This person is known as which of the following? - answer a hacker
Intentional threats to security could include - answer data theft (unauthorized downloading of files).
Which of the following would be a business associate? - answer release of information company
Which of the following statements demonstrates a violation of protected health information? -
answer "Mary, at work yesterday I saw that Susan had a hysterectomy."
You are a nurse who works on 3West during the day shift. One day, you had to work the night shift
because they were shorthanded. However, you were unable to access the EHR. What type of access
control (s) are being used? - answer context-based
In case your system crashes, your facility has defined the policies and procedures necessary to keep
your business going after a disaster. This is known as: - answer business continuity plan
You are defining the designated record set for South Beach Healthcare Center. Which of the
following should be included? - answer discharge summary
