CRIS TEST
Comprehensive Resource To Help You Ace 2026-2027
Exams Includes Frequently Tested Questions With
ELABORATED 100% Correct COMPLETE SOLUTIONS
Guaranteed Pass First Attempt!! Current Update!!
1. Ownership of a patient's chart, as opposed to the health information
contained within it, legally belongs to:
a) the patient, since they generated the health information
b) the physician who documented the care
c) the health care facility that created and maintains the record
d) the federal government, per HIPAA - Correct Answer: c
2. To pull together a patient's complete medical record across multiple visits
or departments, an HIM professional would primarily rely on the:
a) Notice of Privacy Practices
b) Conditions of Admission form
c) Information Management Plan
d) Master Patient Index - Correct Answer: d
3. Which statement best captures the overall purpose of the medical record?
a) it exists solely to support billing and reimbursement
b) it serves research/education, legal protection for patient and facility, and
evaluation of care given — all at once
c) it exists only to satisfy state licensing requirements
d) it is maintained exclusively for physician reference - Correct Answer:
b
,4. A release of information clerk sends a patient's records to an attorney's
office without a signed authorization on file. Separately, a different clerk
sends the correct authorization but attaches another patient's chart by
mistake. And in a third case, a clerk discloses dates of service that fall
outside what the authorization actually covers. Which of these three
scenarios constitutes improper disclosure of PHI?
a) only the first scenario
b) only the second scenario
c) only the third scenario
d) all three scenarios - Correct Answer: d
5. An HIM director is reviewing a stack of authorization forms for HIPAA
compliance. Which of the following, if missing, would NOT by itself
invalidate the authorization?
a) the name or class of the healthcare provider disclosing the records
b) a description of the information to be disclosed
c) a listing of the fees charged for the disclosure
d) an expiration date or expiration event - Correct Answer: c
6. A patient who recently had a biopsy wants to understand exactly what was
found during the procedure and what happened to the tissue sample. The
most appropriate single document to direct him toward is the:
a) complete legal health record
b) Operative and Pathology Report
c) History and Physical
d) discharge summary - Correct Answer: b
7. Scenario: An attorney sends your office a courtesy letter announcing an
upcoming deposition, days before the actual subpoena arrives. Based on
, that letter alone, can records legally be released without patient
authorization?
a) Yes, the courtesy letter functions the same as a subpoena
b) No, a courtesy deposition letter alone does not authorize release -
Correct Answer: b
8. True or False: A single authorization form can lawfully cover HIPAA-
protected information alongside more sensitive categories like chemical
dependency, HIV status, and genetic testing, as long as all required
elements are present.
a) True
b) False - Correct Answer: a
9. A patient fills out an authorization but leaves the "purpose of disclosure"
line reading only "at the request of the patient." Is that phrasing sufficient
to satisfy the form's requirements?
a) Yes, that phrasing alone is acceptable
b) No, a more specific purpose must be documented - Correct Answer:
a
10.A judge has signed and issued a court order compelling release of a
patient's records. Does HIM still need a signed patient authorization before
complying?
a) Yes, a court order does not replace the authorization requirement
b) No, a valid court order removes the need for separate patient
authorization - Correct Answer: b
11.Four staff members each attempt to view a patient's chart without a signed
authorization. Which one is acting outside their permitted access?
a) the nursing unit, because the patient was just readmitted
, b) a medical staff physician with no treatment or consulting relationship,
reviewing only because the person is a former patient
c) a quality management employee pulling performance improvement data
d) risk management reviewing the chart due to a threatened lawsuit -
Correct Answer: b
12.A CMS-contracted PRO/QIO requests copies of records for a patient whose
diagnosis includes schizophrenia. Because mental health information is
involved, does the PRO/QIO still need a signed authorization to receive the
records?
a) No, PRO/QIO review is permitted without patient authorization even for
mental health records
b) Yes, mental health diagnoses always require separate authorization
regardless of requester - Correct Answer: a
13.How would you explain the distinction between a "request" and an
"authorization" to a new HIM employee?
a) they're interchangeable terms for the same document
b) a request is always verbal, while an authorization must be in writing
c) a request is a written ask for records to be disclosed, while an
authorization is the patient's written permission granting that disclosure -
Correct Answer: c
14.If protected health information is breached, what enforcement path(s)
could follow?
a) civil liability only
b) criminal liability only
c) either civil or criminal action, or both, depending on the breach
d) neither, since breaches are handled internally - Correct Answer: c
Comprehensive Resource To Help You Ace 2026-2027
Exams Includes Frequently Tested Questions With
ELABORATED 100% Correct COMPLETE SOLUTIONS
Guaranteed Pass First Attempt!! Current Update!!
1. Ownership of a patient's chart, as opposed to the health information
contained within it, legally belongs to:
a) the patient, since they generated the health information
b) the physician who documented the care
c) the health care facility that created and maintains the record
d) the federal government, per HIPAA - Correct Answer: c
2. To pull together a patient's complete medical record across multiple visits
or departments, an HIM professional would primarily rely on the:
a) Notice of Privacy Practices
b) Conditions of Admission form
c) Information Management Plan
d) Master Patient Index - Correct Answer: d
3. Which statement best captures the overall purpose of the medical record?
a) it exists solely to support billing and reimbursement
b) it serves research/education, legal protection for patient and facility, and
evaluation of care given — all at once
c) it exists only to satisfy state licensing requirements
d) it is maintained exclusively for physician reference - Correct Answer:
b
,4. A release of information clerk sends a patient's records to an attorney's
office without a signed authorization on file. Separately, a different clerk
sends the correct authorization but attaches another patient's chart by
mistake. And in a third case, a clerk discloses dates of service that fall
outside what the authorization actually covers. Which of these three
scenarios constitutes improper disclosure of PHI?
a) only the first scenario
b) only the second scenario
c) only the third scenario
d) all three scenarios - Correct Answer: d
5. An HIM director is reviewing a stack of authorization forms for HIPAA
compliance. Which of the following, if missing, would NOT by itself
invalidate the authorization?
a) the name or class of the healthcare provider disclosing the records
b) a description of the information to be disclosed
c) a listing of the fees charged for the disclosure
d) an expiration date or expiration event - Correct Answer: c
6. A patient who recently had a biopsy wants to understand exactly what was
found during the procedure and what happened to the tissue sample. The
most appropriate single document to direct him toward is the:
a) complete legal health record
b) Operative and Pathology Report
c) History and Physical
d) discharge summary - Correct Answer: b
7. Scenario: An attorney sends your office a courtesy letter announcing an
upcoming deposition, days before the actual subpoena arrives. Based on
, that letter alone, can records legally be released without patient
authorization?
a) Yes, the courtesy letter functions the same as a subpoena
b) No, a courtesy deposition letter alone does not authorize release -
Correct Answer: b
8. True or False: A single authorization form can lawfully cover HIPAA-
protected information alongside more sensitive categories like chemical
dependency, HIV status, and genetic testing, as long as all required
elements are present.
a) True
b) False - Correct Answer: a
9. A patient fills out an authorization but leaves the "purpose of disclosure"
line reading only "at the request of the patient." Is that phrasing sufficient
to satisfy the form's requirements?
a) Yes, that phrasing alone is acceptable
b) No, a more specific purpose must be documented - Correct Answer:
a
10.A judge has signed and issued a court order compelling release of a
patient's records. Does HIM still need a signed patient authorization before
complying?
a) Yes, a court order does not replace the authorization requirement
b) No, a valid court order removes the need for separate patient
authorization - Correct Answer: b
11.Four staff members each attempt to view a patient's chart without a signed
authorization. Which one is acting outside their permitted access?
a) the nursing unit, because the patient was just readmitted
, b) a medical staff physician with no treatment or consulting relationship,
reviewing only because the person is a former patient
c) a quality management employee pulling performance improvement data
d) risk management reviewing the chart due to a threatened lawsuit -
Correct Answer: b
12.A CMS-contracted PRO/QIO requests copies of records for a patient whose
diagnosis includes schizophrenia. Because mental health information is
involved, does the PRO/QIO still need a signed authorization to receive the
records?
a) No, PRO/QIO review is permitted without patient authorization even for
mental health records
b) Yes, mental health diagnoses always require separate authorization
regardless of requester - Correct Answer: a
13.How would you explain the distinction between a "request" and an
"authorization" to a new HIM employee?
a) they're interchangeable terms for the same document
b) a request is always verbal, while an authorization must be in writing
c) a request is a written ask for records to be disclosed, while an
authorization is the patient's written permission granting that disclosure -
Correct Answer: c
14.If protected health information is breached, what enforcement path(s)
could follow?
a) civil liability only
b) criminal liability only
c) either civil or criminal action, or both, depending on the breach
d) neither, since breaches are handled internally - Correct Answer: c
