Certified Release of Information Specialist (CRIS)
COMPLETE EXAM LATEST VERSION 2026-2027
QUESTIONS AND ANSWERS
what is the function of the office for civil rights (OCR) in relation to privacy complaints pertaining to
PHI?
A. investigating complaints alleging violations of HIPAA privacy and security
B. providing legal representation to covered entities accused of privacy breaches
C. offering counseling services to individuals affected by privacy breaches - answer>>A. investigating
complaints alleging violations of HIPAA privacy and security
which of the following is a condition under HIPAA for covered entity not directly involved in litigation
to disclose protected health information in response to a subpoena not signed by a judge discovery
request, or other lawful process?
A. the covered entity must secure a court order before making any disclosure
B. the covered entity is allowed to disclose information without any assurances from the requesting
party
C. the covered entity must receive satisfactory assurances and a written statement demonstrating the
requestor's efforts to notify individuals or obtain a protective order
D. the covered entity can disclose information if it believes the disclosure is necessary without
following any specific guidelines - answer>>C. the covered entity must receive satisfactory
assurances and a written statement demonstrating the requestor's efforts to notify individuals or
obtain a protective order
What is a Subpoena Duces Tecum?
A. a legal order requiring a witness to produce documents or evidence at a specified time and place
B. a government request to provide records for criminal procedure
,C. a writ ordering a person to turn themselves into the sheriff
D. a writ ordering someone to be released from jail - answer>>A. a legal order requiring a witness to
produce documents or evidence at a specified time and place
a state specific period of time you must legally wait to process most civil subpoena requests for
medical records is called.
A. wait time
B. wait period
C. quash period
D. downtime - answer>>C. quash period
what should you do if you receive a motion to quash a subpoena?
A. ensure the records for the subpoena are not sent and await further instruction from the court
relating to the subpoena
B. process the subpoena with expediency
C. notify the issuing counsel of the motion to quash - answer>>A. ensure the records for the subpoena
are not sent and await further instruction from the court relating to the subpoena
which of the following is true regarding release of PHI without a patient authorization
A. a un-served subpoena signed by an attorney is acceptable for record release
B. an unsigned court court order is acceptable for record release
C. a court order signed by judge and containing the judge seal is acceptable
D. all of the above - answer>>C. a court order signed by judge and containing the judge seal is
acceptable
A subpoena duces cecum always requires someone to testify in court
, A. true
B. false - answer>>B. false
You receive a request from a Workers Compensation carrier representing the patient's employer
requesting a copy of the patient's recent HIV test, but there is no authorization attached. You review
the records and discover that the patient is a police officer who was recently stuck with a needle while
searching a suspect and that is the reason she filed the claim. What should you do?
A. Reject the request since patient authorization is required
B. Reject the request because health information can never be disclosed to a patient's employer
C. Disclose the records since the HIV test is directly related to the Workers Compensation claim and no
authorization is required per state law
D. Disclose the records since HIV tests are not specifically covered by HIPAA - answer>>C. Disclose the
records since the HIV test is directly related to the Workers Compensation claim and no
authorization is required per state law
is a health care provider allowed to share a child's immunization records directly with a school without
a HIPAA authorization
A. no, it is never permitted without explicit HIPAA authorization
B. yes, only if the child is an adult or emancipated minor
C. yes, provided the school is legally required to have proof of immunization in order to admit the
child, and a parent, guardian, or other authorized person has agreed to the disclosure - answer>>C.
yes, provided the school is legally required to have proof of immunization in order to admit the
child, and a parent, guardian, or other authorized person has agreed to the disclosure
you work in a state that requires reporting certain sexually transmitted disease results to the state
health department. do you need authorization from the patient to report the information?
A. Yes
COMPLETE EXAM LATEST VERSION 2026-2027
QUESTIONS AND ANSWERS
what is the function of the office for civil rights (OCR) in relation to privacy complaints pertaining to
PHI?
A. investigating complaints alleging violations of HIPAA privacy and security
B. providing legal representation to covered entities accused of privacy breaches
C. offering counseling services to individuals affected by privacy breaches - answer>>A. investigating
complaints alleging violations of HIPAA privacy and security
which of the following is a condition under HIPAA for covered entity not directly involved in litigation
to disclose protected health information in response to a subpoena not signed by a judge discovery
request, or other lawful process?
A. the covered entity must secure a court order before making any disclosure
B. the covered entity is allowed to disclose information without any assurances from the requesting
party
C. the covered entity must receive satisfactory assurances and a written statement demonstrating the
requestor's efforts to notify individuals or obtain a protective order
D. the covered entity can disclose information if it believes the disclosure is necessary without
following any specific guidelines - answer>>C. the covered entity must receive satisfactory
assurances and a written statement demonstrating the requestor's efforts to notify individuals or
obtain a protective order
What is a Subpoena Duces Tecum?
A. a legal order requiring a witness to produce documents or evidence at a specified time and place
B. a government request to provide records for criminal procedure
,C. a writ ordering a person to turn themselves into the sheriff
D. a writ ordering someone to be released from jail - answer>>A. a legal order requiring a witness to
produce documents or evidence at a specified time and place
a state specific period of time you must legally wait to process most civil subpoena requests for
medical records is called.
A. wait time
B. wait period
C. quash period
D. downtime - answer>>C. quash period
what should you do if you receive a motion to quash a subpoena?
A. ensure the records for the subpoena are not sent and await further instruction from the court
relating to the subpoena
B. process the subpoena with expediency
C. notify the issuing counsel of the motion to quash - answer>>A. ensure the records for the subpoena
are not sent and await further instruction from the court relating to the subpoena
which of the following is true regarding release of PHI without a patient authorization
A. a un-served subpoena signed by an attorney is acceptable for record release
B. an unsigned court court order is acceptable for record release
C. a court order signed by judge and containing the judge seal is acceptable
D. all of the above - answer>>C. a court order signed by judge and containing the judge seal is
acceptable
A subpoena duces cecum always requires someone to testify in court
, A. true
B. false - answer>>B. false
You receive a request from a Workers Compensation carrier representing the patient's employer
requesting a copy of the patient's recent HIV test, but there is no authorization attached. You review
the records and discover that the patient is a police officer who was recently stuck with a needle while
searching a suspect and that is the reason she filed the claim. What should you do?
A. Reject the request since patient authorization is required
B. Reject the request because health information can never be disclosed to a patient's employer
C. Disclose the records since the HIV test is directly related to the Workers Compensation claim and no
authorization is required per state law
D. Disclose the records since HIV tests are not specifically covered by HIPAA - answer>>C. Disclose the
records since the HIV test is directly related to the Workers Compensation claim and no
authorization is required per state law
is a health care provider allowed to share a child's immunization records directly with a school without
a HIPAA authorization
A. no, it is never permitted without explicit HIPAA authorization
B. yes, only if the child is an adult or emancipated minor
C. yes, provided the school is legally required to have proof of immunization in order to admit the
child, and a parent, guardian, or other authorized person has agreed to the disclosure - answer>>C.
yes, provided the school is legally required to have proof of immunization in order to admit the
child, and a parent, guardian, or other authorized person has agreed to the disclosure
you work in a state that requires reporting certain sexually transmitted disease results to the state
health department. do you need authorization from the patient to report the information?
A. Yes
