[COMPREHENSIVE HIM2410-Health Information
Law & Ethics] EXAM with Questions and
Answers/Plus a Rationale Updated 2026 A+/Instant
Download PDF
Table of Contents
1. HIPAA Privacy and Security Rules
2. Legal Health Record and Documentation Standards
3. Ethical Decision-Making in Health Information Management
4. Release of Information and Patient Rights
5. Compliance, Fraud, and Abuse
6. Data Governance and Information Privacy
1. A hospital's compliance officer discovers that an unauthorized third-party vendor accessed
Protected Health Information (PHI) through a misconfigured cloud storage bucket. Under the
HIPAA Breach Notification Rule, what is the primary factor the organization must evaluate to
determine if the incident requires mandatory notification to the Secretary of HHS and affected
individuals?
A. The number of records compromised regardless of sensitivity.
B. Whether the incident constitutes a reportable breach based on the risk assessment of PHI
compromise.
C. The financial cost associated with credit monitoring services for affected patients.
D. Whether the breach was intentional or the result of simple negligence.
, CORRECT ANSWER : B
Rationale: The HIPAA Breach Notification Rule requires a four-factor risk assessment to
determine if there is a low probability that PHI has been compromised. Option B is correct
because the risk assessment determines notification requirements, not just the volume of records
(A), financial cost (C), or intent (D), which may impact penalty tiers but not the threshold for
notification itself.
2. A physician is accused of "upcoding" by consistently using a higher-level evaluation and
management (E/M) code than the documentation supports. Which federal statute is most directly
implicated by this pattern of behavior, which results in improper claims to federal healthcare
programs?
A. The Anti-Kickback Statute.
B. The Sherman Antitrust Act.
C. The False Claims Act.
D. The Emergency Medical Treatment and Labor Act (EMTALA).
CORRECT ANSWER : C
Rationale: The False Claims Act (FCA) imposes liability on persons and companies that defraud
governmental programs, such as Medicare, by submitting false or fraudulent claims for payment.
Upcoding is a classic example of a false claim; the Anti-Kickback Statute (A) concerns referrals,
the Sherman Act (B) concerns competition, and EMTALA (D) concerns patient transfers.
3. A patient requests a complete copy of their medical record, including psychotherapy notes kept
separately from the rest of the clinical file. Under HIPAA, how must the HIM department
process this request?
A. Provide all requested records including the psychotherapy notes because the patient has a
right to their entire legal health record.
B. Deny the request for the entire record until a court order is obtained.
C. Provide the clinical record but deny access to the psychotherapy notes, as they are explicitly
excluded from the right of access.
D. Provide the psychotherapy notes only if the physician provides written authorization.
CORRECT ANSWER : C
Rationale: HIPAA specifically excludes psychotherapy notes from the right of access. While
patients have a broad right to access their medical records, psychotherapy notes are maintained
, separately and do not fall under this mandate. Options A, B, and D misinterpret the specific
legal status of psychotherapy notes under the Privacy Rule.
4. A health system is implementing a new HIE (Health Information Exchange) protocol. What is
the most significant legal risk regarding "Patient Matching" in a shared HIE environment?
A. Increased operational costs for the IT department.
B. Potential for commingling patient data leading to clinical errors and HIPAA privacy
violations.
C. Reduced physician productivity due to interface complexity.
D. Incompatibility with legacy EMR software versions.
CORRECT ANSWER : B
Rationale: Patient matching errors in an HIE can lead to the records of two different patients
being merged or displayed incorrectly, which causes significant patient safety risks and HIPAA
violations regarding the integrity and privacy of PHI. Options A, C, and D are operational or
technical challenges, but they do not pose the same level of legal and ethical risk as a data
integrity breach.
5. A researcher requests access to PHI for a study but does not want to obtain individual HIPAA
authorizations. Under which condition may an Institutional Review Board (IRB) or Privacy
Board grant a waiver of authorization?
A. The researcher is a close colleague of the Chief Medical Officer.
B. The research is of significant commercial value to the hospital.
C. The research involves no more than minimal risk to the privacy of individuals and the waiver
will not adversely affect the rights and welfare of the individuals.
D. The data is de-identified according to the safe harbor method, but the researcher prefers raw
data.
CORRECT ANSWER : C
Rationale: A waiver of authorization is permitted only if specific criteria are met, primarily
focusing on minimal risk to patient privacy and feasibility. Option C is the standard regulatory
requirement. Options A and B are irrelevant to HIPAA compliance, and D describes a situation
where a waiver is not needed because the data should already be de-identified.
, 6. In a legal proceeding, a patient's attorney serves a subpoena on the HIM department. The
subpoena is not accompanied by a court order or a patient authorization. How should the HIM
department respond?
A. Release the records immediately to avoid a charge of contempt of court.
B. Provide the records directly to the attorney to ensure legal cooperation.
C. Notify the patient or seek a qualified protective order before releasing any PHI.
D. Ignore the subpoena as it is legally invalid.
CORRECT ANSWER : C
Rationale: A subpoena alone is insufficient to release PHI under HIPAA; the entity must receive
satisfactory assurance that the patient has been notified or that a protective order is in place.
Releasing records (A, B) without these safeguards violates the Privacy Rule, and ignoring the
subpoena (D) without legal consultation is improper.
7. A nurse practitioner inadvertently emails PHI of 500 patients to a personal account. This is
discovered during a routine audit. What is the standard of "Harm" used to determine if a breach
occurred?
A. A presumption of breach exists unless the covered entity demonstrates a low probability that
the PHI was compromised based on a risk assessment.
B. A breach only occurs if the PHI was actually read or exfiltrated by a third party.
C. A breach only occurs if the patient suffers financial identity theft.
D. A breach only occurs if the information is leaked to the media.
CORRECT ANSWER : A
Rationale: Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of
PHI is presumed to be a breach unless the covered entity performs a risk assessment and
demonstrates a low probability of compromise. Options B, C, and D set the threshold far higher
than the actual regulatory requirement.
8. When a healthcare organization uses a "Business Associate" for billing, what is the most critical
legal document that must be in place to ensure compliance?
A. A non-disclosure agreement.
B. A service level agreement (SLA).
Law & Ethics] EXAM with Questions and
Answers/Plus a Rationale Updated 2026 A+/Instant
Download PDF
Table of Contents
1. HIPAA Privacy and Security Rules
2. Legal Health Record and Documentation Standards
3. Ethical Decision-Making in Health Information Management
4. Release of Information and Patient Rights
5. Compliance, Fraud, and Abuse
6. Data Governance and Information Privacy
1. A hospital's compliance officer discovers that an unauthorized third-party vendor accessed
Protected Health Information (PHI) through a misconfigured cloud storage bucket. Under the
HIPAA Breach Notification Rule, what is the primary factor the organization must evaluate to
determine if the incident requires mandatory notification to the Secretary of HHS and affected
individuals?
A. The number of records compromised regardless of sensitivity.
B. Whether the incident constitutes a reportable breach based on the risk assessment of PHI
compromise.
C. The financial cost associated with credit monitoring services for affected patients.
D. Whether the breach was intentional or the result of simple negligence.
, CORRECT ANSWER : B
Rationale: The HIPAA Breach Notification Rule requires a four-factor risk assessment to
determine if there is a low probability that PHI has been compromised. Option B is correct
because the risk assessment determines notification requirements, not just the volume of records
(A), financial cost (C), or intent (D), which may impact penalty tiers but not the threshold for
notification itself.
2. A physician is accused of "upcoding" by consistently using a higher-level evaluation and
management (E/M) code than the documentation supports. Which federal statute is most directly
implicated by this pattern of behavior, which results in improper claims to federal healthcare
programs?
A. The Anti-Kickback Statute.
B. The Sherman Antitrust Act.
C. The False Claims Act.
D. The Emergency Medical Treatment and Labor Act (EMTALA).
CORRECT ANSWER : C
Rationale: The False Claims Act (FCA) imposes liability on persons and companies that defraud
governmental programs, such as Medicare, by submitting false or fraudulent claims for payment.
Upcoding is a classic example of a false claim; the Anti-Kickback Statute (A) concerns referrals,
the Sherman Act (B) concerns competition, and EMTALA (D) concerns patient transfers.
3. A patient requests a complete copy of their medical record, including psychotherapy notes kept
separately from the rest of the clinical file. Under HIPAA, how must the HIM department
process this request?
A. Provide all requested records including the psychotherapy notes because the patient has a
right to their entire legal health record.
B. Deny the request for the entire record until a court order is obtained.
C. Provide the clinical record but deny access to the psychotherapy notes, as they are explicitly
excluded from the right of access.
D. Provide the psychotherapy notes only if the physician provides written authorization.
CORRECT ANSWER : C
Rationale: HIPAA specifically excludes psychotherapy notes from the right of access. While
patients have a broad right to access their medical records, psychotherapy notes are maintained
, separately and do not fall under this mandate. Options A, B, and D misinterpret the specific
legal status of psychotherapy notes under the Privacy Rule.
4. A health system is implementing a new HIE (Health Information Exchange) protocol. What is
the most significant legal risk regarding "Patient Matching" in a shared HIE environment?
A. Increased operational costs for the IT department.
B. Potential for commingling patient data leading to clinical errors and HIPAA privacy
violations.
C. Reduced physician productivity due to interface complexity.
D. Incompatibility with legacy EMR software versions.
CORRECT ANSWER : B
Rationale: Patient matching errors in an HIE can lead to the records of two different patients
being merged or displayed incorrectly, which causes significant patient safety risks and HIPAA
violations regarding the integrity and privacy of PHI. Options A, C, and D are operational or
technical challenges, but they do not pose the same level of legal and ethical risk as a data
integrity breach.
5. A researcher requests access to PHI for a study but does not want to obtain individual HIPAA
authorizations. Under which condition may an Institutional Review Board (IRB) or Privacy
Board grant a waiver of authorization?
A. The researcher is a close colleague of the Chief Medical Officer.
B. The research is of significant commercial value to the hospital.
C. The research involves no more than minimal risk to the privacy of individuals and the waiver
will not adversely affect the rights and welfare of the individuals.
D. The data is de-identified according to the safe harbor method, but the researcher prefers raw
data.
CORRECT ANSWER : C
Rationale: A waiver of authorization is permitted only if specific criteria are met, primarily
focusing on minimal risk to patient privacy and feasibility. Option C is the standard regulatory
requirement. Options A and B are irrelevant to HIPAA compliance, and D describes a situation
where a waiver is not needed because the data should already be de-identified.
, 6. In a legal proceeding, a patient's attorney serves a subpoena on the HIM department. The
subpoena is not accompanied by a court order or a patient authorization. How should the HIM
department respond?
A. Release the records immediately to avoid a charge of contempt of court.
B. Provide the records directly to the attorney to ensure legal cooperation.
C. Notify the patient or seek a qualified protective order before releasing any PHI.
D. Ignore the subpoena as it is legally invalid.
CORRECT ANSWER : C
Rationale: A subpoena alone is insufficient to release PHI under HIPAA; the entity must receive
satisfactory assurance that the patient has been notified or that a protective order is in place.
Releasing records (A, B) without these safeguards violates the Privacy Rule, and ignoring the
subpoena (D) without legal consultation is improper.
7. A nurse practitioner inadvertently emails PHI of 500 patients to a personal account. This is
discovered during a routine audit. What is the standard of "Harm" used to determine if a breach
occurred?
A. A presumption of breach exists unless the covered entity demonstrates a low probability that
the PHI was compromised based on a risk assessment.
B. A breach only occurs if the PHI was actually read or exfiltrated by a third party.
C. A breach only occurs if the patient suffers financial identity theft.
D. A breach only occurs if the information is leaked to the media.
CORRECT ANSWER : A
Rationale: Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of
PHI is presumed to be a breach unless the covered entity performs a risk assessment and
demonstrates a low probability of compromise. Options B, C, and D set the threshold far higher
than the actual regulatory requirement.
8. When a healthcare organization uses a "Business Associate" for billing, what is the most critical
legal document that must be in place to ensure compliance?
A. A non-disclosure agreement.
B. A service level agreement (SLA).
