RHIT Domain :RHIT:RHIT Package Deal: RHIT Domain 2:RHIT
Domain 3
Who owns the health record?
a. Patient
b. Provider who generated the information
c. Insurance company who paid for the care recorded in the record
d. No one - ANSWER:B
Community Hospital is terminating its business associate relationship with a medical transcription
company. The transcription company has no further need for any identifiable information that it may
have obtained in the course of its business with the hospital. The CFO of the hospital believes that to be
HIPAA compliant, all that is necessary is for the termination to be in a formal letter signed by the CEO. In
this case, how should the director of HIM advise the CFO?
a. Determine that a formal letter of termination meets HIPAA requirements and no further action is
required.
b. Confirm that a formal letter of termination meets HIPAA requirements and no further action is
required except that the termination notice needs to be retained for seven years.
c. Confirm that a formal letter of termination is required and that the transcription company must
provide the hospital with a certification that all PHI that it had in - ANSWER:C
What does the term access control mean?
a. Identifying the greatest security risks
b. Identifying which data employees should have a right to use
c. Implementing safeguards that protect physical media
d. Restricting access to computer rooms and facilities - ANSWER:B
Under HIPAA, which of the following is not named as a covered entity?
a. Attending physician
b. Healthcare clearinghouse
c. Health plan
d. Outsourced transcription company - ANSWER:D
Which of the following is an organization's planned response to protect its information in the case of a
natural disaster?
a. Administrative controls
,b. Contingency plan
c. Audit trail
d. Physical controls - ANSWER:B
A secretary in the Nursing Office was recently hospitalized with ketoacidosis. She comes to the HIM
department and requests to review her health record. Of the options here, what is the best course of
action?
a. Allow her to review her record after obtaining authorization from her.
b. Refer the patient to her physician for the information.
c. Tell her to go through her supervisor for the information.
d. Tell her that hospital employees cannot access their own medical records. - ANSWER:A
Which of the following provide the objective and scope for the HIPAA Security Rule as a whole?
a. Administrative provisions
b. General rules
c. Physical safeguards
d. Technical safeguards - ANSWER:B
he release of information function requires the HIM professional to have knowledge of:
a. Clinical coding principles
b. Database development
c. Federal and state confidentiality laws
d. Human resource management - ANSWER:C
A health information technician receives a subpoena ad testificandum. To respond to the subpoena,
which of the following should the technician do?
a. Review the subpoena to determine what documents must be produced
b. Review the subpoena and notify the hospital administrator
c. Review the subpoena and appear at the time and place supplied to give testimony
d. Review the subpoena and alert the hospital's risk management department - ANSWER:C
Which of the following is an example of a business associate?
a. Contract coder
b. Environmental services department
c. Hospital security officer
, d. Employee with access to e-PHI - ANSWER:A
The medical record of Kathy Smith, the plaintiff, has been subpoenaed for a deposition. The plaintiff's
attorney wishes to use the records as evidence to prove his client's case. In this situation, although the
record constitutes hearsay, it may be used as evidence based on the:
a. Admissibility exception
b. Discovery exception
c. Direct evidence exception
d. Business records exception - ANSWER:D
Release of birth and death information to public health authorities:
a. Is prohibited without patient consent
b. Is prohibited without patient authorization
c. Is a public interest and benefit disclosure that does not require patient authorization
d. Requires both patient consent and authorization - ANSWER:C
When an individual requests a copy of the PHI or agrees to accept summary or explanatory information,
the covered entity may:
a. Impose a reasonable cost-based fee
b. Not charge the individual
c. Impose any fee authorized by state statute
d. Charge only for the cost of the paper on which the information is printed - ANSWER:A
The right of an individual to keep personal health information from being disclosed to anyone is a
definition of:
a. Confidentiality
b. Integrity
c. Privacy
d. Security - ANSWER:C
An HIT using her password can access and change data in the hospital's master patient index. A billing
clerk, using his password, cannot perform the same function. Limiting the class of information and
functions that can be performed by these two employees is managed by:
a. Network controls
b. Audit trails
c. Administrative controls
Domain 3
Who owns the health record?
a. Patient
b. Provider who generated the information
c. Insurance company who paid for the care recorded in the record
d. No one - ANSWER:B
Community Hospital is terminating its business associate relationship with a medical transcription
company. The transcription company has no further need for any identifiable information that it may
have obtained in the course of its business with the hospital. The CFO of the hospital believes that to be
HIPAA compliant, all that is necessary is for the termination to be in a formal letter signed by the CEO. In
this case, how should the director of HIM advise the CFO?
a. Determine that a formal letter of termination meets HIPAA requirements and no further action is
required.
b. Confirm that a formal letter of termination meets HIPAA requirements and no further action is
required except that the termination notice needs to be retained for seven years.
c. Confirm that a formal letter of termination is required and that the transcription company must
provide the hospital with a certification that all PHI that it had in - ANSWER:C
What does the term access control mean?
a. Identifying the greatest security risks
b. Identifying which data employees should have a right to use
c. Implementing safeguards that protect physical media
d. Restricting access to computer rooms and facilities - ANSWER:B
Under HIPAA, which of the following is not named as a covered entity?
a. Attending physician
b. Healthcare clearinghouse
c. Health plan
d. Outsourced transcription company - ANSWER:D
Which of the following is an organization's planned response to protect its information in the case of a
natural disaster?
a. Administrative controls
,b. Contingency plan
c. Audit trail
d. Physical controls - ANSWER:B
A secretary in the Nursing Office was recently hospitalized with ketoacidosis. She comes to the HIM
department and requests to review her health record. Of the options here, what is the best course of
action?
a. Allow her to review her record after obtaining authorization from her.
b. Refer the patient to her physician for the information.
c. Tell her to go through her supervisor for the information.
d. Tell her that hospital employees cannot access their own medical records. - ANSWER:A
Which of the following provide the objective and scope for the HIPAA Security Rule as a whole?
a. Administrative provisions
b. General rules
c. Physical safeguards
d. Technical safeguards - ANSWER:B
he release of information function requires the HIM professional to have knowledge of:
a. Clinical coding principles
b. Database development
c. Federal and state confidentiality laws
d. Human resource management - ANSWER:C
A health information technician receives a subpoena ad testificandum. To respond to the subpoena,
which of the following should the technician do?
a. Review the subpoena to determine what documents must be produced
b. Review the subpoena and notify the hospital administrator
c. Review the subpoena and appear at the time and place supplied to give testimony
d. Review the subpoena and alert the hospital's risk management department - ANSWER:C
Which of the following is an example of a business associate?
a. Contract coder
b. Environmental services department
c. Hospital security officer
, d. Employee with access to e-PHI - ANSWER:A
The medical record of Kathy Smith, the plaintiff, has been subpoenaed for a deposition. The plaintiff's
attorney wishes to use the records as evidence to prove his client's case. In this situation, although the
record constitutes hearsay, it may be used as evidence based on the:
a. Admissibility exception
b. Discovery exception
c. Direct evidence exception
d. Business records exception - ANSWER:D
Release of birth and death information to public health authorities:
a. Is prohibited without patient consent
b. Is prohibited without patient authorization
c. Is a public interest and benefit disclosure that does not require patient authorization
d. Requires both patient consent and authorization - ANSWER:C
When an individual requests a copy of the PHI or agrees to accept summary or explanatory information,
the covered entity may:
a. Impose a reasonable cost-based fee
b. Not charge the individual
c. Impose any fee authorized by state statute
d. Charge only for the cost of the paper on which the information is printed - ANSWER:A
The right of an individual to keep personal health information from being disclosed to anyone is a
definition of:
a. Confidentiality
b. Integrity
c. Privacy
d. Security - ANSWER:C
An HIT using her password can access and change data in the hospital's master patient index. A billing
clerk, using his password, cannot perform the same function. Limiting the class of information and
functions that can be performed by these two employees is managed by:
a. Network controls
b. Audit trails
c. Administrative controls
