RHIA Exam Questions
An audit trail is a good tool for which of the following? - answer Reconstructing electronic events
The kids foundation related to children's hospital is mailing fundraising information to the families of
all patients who have been treated at children's in the past three years. based on the facts given: -
answer children's hospital must have notified the patients or patients guardians of this disclosure in
the notice of privacy practices
A hospital employee destroyed a health record so that its contents - which would be damaging to
the employee - could not be used at trial. In legal terms, the employee's action constitutes: - answer
Spoliation
A breach occurs when unsecured protected health information is accessed or released. The
secretary of HHS and local media must be notified if this threshold of patient records breached has
been met or exceeded - answer 500
The security rule leaves the method for conducting the security risk analysis to the discretion of the
healthcare entity. The first consideration for a healthcare facility should be - answer its own
characteristics and environment
Mary Smith has been asked to work on the development of a hospital trauma data registry. Which of
the following data sets would be most helpful in developing this registry? - answer DEEDS- Data
Elements for ER Department
Who owns the health records of patients treated in a healthcare facility? - answer the facility
In figuring a drug dosage, it is unacceptable to round up to the nearest gram if the drug is to be
dosed in milligrams. Which dimension of data quality is being applied in this situation? - answer
Precision
The HIM manager is concerned with a backlog in transcription of surgical reports. The medical staff
rules and regulations stipulate that the surgeon should: - answer Write a detailed postoperative
progress note about the procedure performed.
,The discharge summary must be completed within _ after discharge for most patients but within _
for patients transferred to other facilities. Discharge summaries are not always required for patients
who were hospitalized for less than _ hours. - answer 30 days, 24 hours, 48 hours
Which of the following statements does not pertain to paper-based health records? - answer They
have a built in access control mechanism.
A number assigned to patients in a cancer registry in the order that the patients are entered in the
registry every year (for ex 03-0001) is a _ number - answer Accession
Two clerks are abstracting data for a registry. When their work is checked, discrepancies are found
between similar data abstracted by the two clerks. Which data quality component is lacking? -
answer Reliability
In ICD 10 CM this note means "not coded here"? - answer Excludes 1
When an entity relational diagram is implemented as a relational database, an entity will become an:
- answer Table
A procedure that attempts to obstruct the blood flow to a malignant tumor would be coded to
which root operation in ICD 10 PCS? - answer Occlusion
Under what access security mechanism would an individual be allowed access to ePHI if he or she
has a proper login and password, belongs to a specified group, and his or her workstation is located
in a specific place within the facility? - answer Context-based
Which of the following is a rule established by an administrative agency of government? - answer
Regulation
The computer notified the compliance officer that a user accessed the PHI of a patient with the same
last name as the user. This is an example of a - answer Trigger
The Security Incident Procedures Standard has one required implementation specification centered
on: - answer Identifying and responding to security events
, Dr. Smith an OB-GYN specialist has just become a staff member at Medical Center Hospital, where
she may offer care and treatment related to obstetrics and gynecology including performing
deliveries and gynecological surgery. The process of defining what services she may perform is
called: - answer Granting privileges
Under the HIPAA privacy standard, which of the following types of protected health information PHI
must be specifically identified in an authorization? - answer Psychotherapy notes
If a data breach caused by willful neglect is corrected within 30 days from the date of the covered
entity or business associate becoming aware of it, what level of violation of the HIPAA Omnibus Rule
is this breach? - answer Tier 3
Per the HIPAA Privacy Rule, which of the following requires authorization for research purpose? -
answer Use of Mary's individually identifiable information related to her asthma treatments
City Hospitals HIPAA committee is considering a change in policy to allow hospital employees who
are also hospital patients to access their own patient information in the hospitals EHR system. A
committee member notes that HIPAA provides rights to patients to view their own health
information. However, another member wonders if this action might present other problems. In this
situation what suggestion should the HIM director provide? - answer Allowing employees to access
their own records using their job-based access rights appears to violate HIPAAs minimum necessary
requirement; therefore, allow employees to access their records through normal procedures.
An employee forgot his user ID badge at home and uses another employees badge to access the
computer system. What control should have been in place to minimize this security breach? -
answer Security incident procedures
A visitor walks through the work area and picks up a flash drive from an employees desk. What
security controls should have been implemented to prevent this security breach? - answer Facility
access controls
The nursing staff in the cardiac unit has noticed that a significant number of health records do not
have informed consents prior to the performance of procedures. Obtaining informed consent is the
responsibility of the: - answer Physician
Susan is completing her required high school community service hours by serving as a volunteer at
the local hospital. Relative to the hospital, Susan is a - answer Workforce member
An audit trail is a good tool for which of the following? - answer Reconstructing electronic events
The kids foundation related to children's hospital is mailing fundraising information to the families of
all patients who have been treated at children's in the past three years. based on the facts given: -
answer children's hospital must have notified the patients or patients guardians of this disclosure in
the notice of privacy practices
A hospital employee destroyed a health record so that its contents - which would be damaging to
the employee - could not be used at trial. In legal terms, the employee's action constitutes: - answer
Spoliation
A breach occurs when unsecured protected health information is accessed or released. The
secretary of HHS and local media must be notified if this threshold of patient records breached has
been met or exceeded - answer 500
The security rule leaves the method for conducting the security risk analysis to the discretion of the
healthcare entity. The first consideration for a healthcare facility should be - answer its own
characteristics and environment
Mary Smith has been asked to work on the development of a hospital trauma data registry. Which of
the following data sets would be most helpful in developing this registry? - answer DEEDS- Data
Elements for ER Department
Who owns the health records of patients treated in a healthcare facility? - answer the facility
In figuring a drug dosage, it is unacceptable to round up to the nearest gram if the drug is to be
dosed in milligrams. Which dimension of data quality is being applied in this situation? - answer
Precision
The HIM manager is concerned with a backlog in transcription of surgical reports. The medical staff
rules and regulations stipulate that the surgeon should: - answer Write a detailed postoperative
progress note about the procedure performed.
,The discharge summary must be completed within _ after discharge for most patients but within _
for patients transferred to other facilities. Discharge summaries are not always required for patients
who were hospitalized for less than _ hours. - answer 30 days, 24 hours, 48 hours
Which of the following statements does not pertain to paper-based health records? - answer They
have a built in access control mechanism.
A number assigned to patients in a cancer registry in the order that the patients are entered in the
registry every year (for ex 03-0001) is a _ number - answer Accession
Two clerks are abstracting data for a registry. When their work is checked, discrepancies are found
between similar data abstracted by the two clerks. Which data quality component is lacking? -
answer Reliability
In ICD 10 CM this note means "not coded here"? - answer Excludes 1
When an entity relational diagram is implemented as a relational database, an entity will become an:
- answer Table
A procedure that attempts to obstruct the blood flow to a malignant tumor would be coded to
which root operation in ICD 10 PCS? - answer Occlusion
Under what access security mechanism would an individual be allowed access to ePHI if he or she
has a proper login and password, belongs to a specified group, and his or her workstation is located
in a specific place within the facility? - answer Context-based
Which of the following is a rule established by an administrative agency of government? - answer
Regulation
The computer notified the compliance officer that a user accessed the PHI of a patient with the same
last name as the user. This is an example of a - answer Trigger
The Security Incident Procedures Standard has one required implementation specification centered
on: - answer Identifying and responding to security events
, Dr. Smith an OB-GYN specialist has just become a staff member at Medical Center Hospital, where
she may offer care and treatment related to obstetrics and gynecology including performing
deliveries and gynecological surgery. The process of defining what services she may perform is
called: - answer Granting privileges
Under the HIPAA privacy standard, which of the following types of protected health information PHI
must be specifically identified in an authorization? - answer Psychotherapy notes
If a data breach caused by willful neglect is corrected within 30 days from the date of the covered
entity or business associate becoming aware of it, what level of violation of the HIPAA Omnibus Rule
is this breach? - answer Tier 3
Per the HIPAA Privacy Rule, which of the following requires authorization for research purpose? -
answer Use of Mary's individually identifiable information related to her asthma treatments
City Hospitals HIPAA committee is considering a change in policy to allow hospital employees who
are also hospital patients to access their own patient information in the hospitals EHR system. A
committee member notes that HIPAA provides rights to patients to view their own health
information. However, another member wonders if this action might present other problems. In this
situation what suggestion should the HIM director provide? - answer Allowing employees to access
their own records using their job-based access rights appears to violate HIPAAs minimum necessary
requirement; therefore, allow employees to access their records through normal procedures.
An employee forgot his user ID badge at home and uses another employees badge to access the
computer system. What control should have been in place to minimize this security breach? -
answer Security incident procedures
A visitor walks through the work area and picks up a flash drive from an employees desk. What
security controls should have been implemented to prevent this security breach? - answer Facility
access controls
The nursing staff in the cardiac unit has noticed that a significant number of health records do not
have informed consents prior to the performance of procedures. Obtaining informed consent is the
responsibility of the: - answer Physician
Susan is completing her required high school community service hours by serving as a volunteer at
the local hospital. Relative to the hospital, Susan is a - answer Workforce member
