RHIA Exam 393 Questions with Verified Answers,100% CORRECT

RHIA Exam 393 Questions with Verified Answers Where can you find guidelines for the retention and destruction of healthcare information? a. Institute of Medicine b. Municipal regulations c. HIPAA d. Accreditation standards - CORRECT ANSWER d. Accreditation standards This functionality can result in confusion from incessant repetition of irrelevant clinical data. a. Change b. Amendment c. Copy and paste d. Deletion - CORRECT ANSWER c. Copy and paste Which of the following indexes would be used to compare the number and quality of treatments for patients who underwent the same operation with different surgeons? a. Physician b. Master patient c. Procedure d. Disease and operation - CORRECT ANSWER a. Physician A diagnosis described as "possible," "probable," "likely," or "rule out" is reported as if present for which type of patient records? a. Outpatient b. Emergency room c. Physician office d. Inpatient - CORRECT ANSWER d. Inpatient Who is responsible for ensuring the quality of health record documentation? a. Board of directors b. Administrator c. Provider d. Health information management professional - CORRECT ANSWER c. Provider Which of the following represents data flow for a hospital inpatient admission? a. Registration > diagnostic and procedure codes assigned > services performed > charges recorded b. Registration > services performed > charges recorded > diagnostic and procedure codes assigned c. Services performed > charges recorded > registration > diagnostic and procedure codes assigned d. Diagnostic and procedure codes assigned > registration > services performed > charges recorded - CORRECT ANSWER b. Registration > services performed > charges recorded > diagnostic and procedure codes assigned Which of the following is the goal of quantitative analysis performed by health information management (HIM) professionals? a. Ensuring the record is legible b. Identifying deficiencies early so they can be corrected c. Verifying that health professionals are providing appropriate care d. Checking to ensure bills are correct - CORRECT ANSWER b. Identifying deficiencies early so they can be corrected The process of providing proof of the authorship of health record documentation is called: a. Identification b. Standardization of data capture c. Standardization of abbreviations d. Authentication - CORRECT ANSWER d. Authentication Which of the following data sets would be most useful in developing a matrix for identification of components of the legal health record? a. Document name, media type, source system, electronic storage start date, stop printing start date b. Document name, media type c. Document name, medical record number, source system d. Document name, source system - CORRECT ANSWER a. Document name, media type, source system, electronic storage start date, stop printing start date According to the UHDDS definition, ethnicity should be recorded on a patient record as: a. Race of mother b. Race of father c. Hispanic, non-Hispanic d. Free-text descriptor as reported by patient - CORRECT ANSWER c. Hispanic, non-Hispanic Which of the following is a graphical display of the relationships between tables in a database? a. RDMS b. SQL c. ERD d. SAS - CORRECT ANSWER c. ERD The purpose of the data dictionary is to ________ definitions and ensure consistency of use. a. Identify b. Standardize c. Create d. Organize - CORRECT ANSWER b. Standardize It is important for a healthcare entity to have ________ addressing how to deal with corrections made to erroneous entries in health records. a. Training sessions b. Policies and procedures c. Verbally communicated instructions d. A supervisory committee - CORRECT ANSWER b. Policies and procedures Quality has several components, including appropriateness, technical excellence, ________, and acceptability. a. Accuracy of diagnosis b. Continuous improvement c. Connectivity d. Accessibility - CORRECT ANSWER d. Accessibility Assign the correct CPT code for the following procedure: Patient is admitted to move the skin pocket for their pacemaker. a. 33223, Relocation of skin pocket for implantable defibrillator b. 33210, Insertion or replacement of temporary transvenous single chamber cardiac electrode or pacemaker catheter (separate procedure) c. 33212, Insertion of pacemaker pulse generator only; with existing single lead d. 33222, Relocation of skin pocket for pacemaker - CORRECT ANSWER d. 33222, Relocation of skin pocket for pacemaker Bloodwork results from the laboratory information system, mammogram reports and films from the radiology information system, and a listing of chemotherapy agents administered to the patient from the pharmacy information system are all delivered into the patient's EHR. These different information systems that feed information into the EHR are known as: a. Interoperability b. Source systems c. Continuity of care records d. Clinical decision support systems - CORRECT ANSWER b. Source systems Of the following, what is the most likely to happen to the health records of a physician's patient when that physician leaves an office practice? a. It will be sent to the state department of health. b. It will be sent to outside storage. c. It will be destroyed. d. It will be retained by the practice. - CORRECT ANSWER d. It will be retained by the practice. Reviewing a health record for missing signatures and medical reports is called: a. Analysis b. Coding c. Assembly d. Indexing - CORRECT ANSWER a. Analysis A barrier to effective computer-assisted coding is the: a. Resistance of physicians b. Resistance of HIM professionals c. Poor quality of documentation d. Reduction of consistency without human coders - CORRECT ANSWER c. Poor quality of documentation To complete a comprehensive assessment and collect information for the Minimum Data Set for Long-Term Care, the coordinator must use which of the following? a. Core measure b. Resident Assessment Instrument c. Precertification d. Record of transfer - CORRECT ANSWER b. Resident Assessment Instrument What is a legal document that is used to specify whether the patient would like to be kept on artificial life support if they become permanently unconscious or is otherwise dying and unable to speak for themselves? a. Durable power of attorney b. Living consent form c. Informed consent d. Advance directive - CORRECT ANSWER d. Advance directive A patient with a diagnosis of ventral hernia is admitted to undergo a laparotomy with ventral hernia repair. The patient undergoes a laparotomy and develops bradycardia. The operative site is closed without the repair of the hernia. What is the correct code assignment? I97.191 Other postprocedural cardiac functional disturbances following other surgery K43.9 Ventral hernia without obstruction or gangrene R00.1 Bradycardia, unspecified Z53.09 Procedure and treatment not carried out because of other contraindication SectionBody SystemRootOperationBody PartApproachDeviceQualifierMedicalandSurgicalAnatomicalRegions,GeneralRepairAbdominalWallOpenNo DeviceNo Qualifier 0WQF0ZZ SectionBody SystemRootOperationBody PartApproachDeviceQualifierMedicalandSurgicalAnatomicalRegions,GeneralInspectionPeritonealCavityOpenNo DeviceNo Qualifier 0WJG0ZZ a. K43.9, R00.1, Z53.09, 0WJG0ZZ b. K43.9, I97.191, R00.1, 0WJG0ZZ c. K43.9, 0WQF0ZZ d. K43.9, Z53.09, 0WQF0ZZ - CORRECT ANSWER a. K43.9, R00.1, Z53.09, 0WJG0ZZ A patient was admitted to the hospital with symptoms of a stroke and secondary diagnoses of chronic obstructive pulmonary disease (COPD) and hypertension. The patient was subsequently discharged from the hospital with a principal diagnosis of cerebral vascular accident and secondary diagnoses of catheter-associated urinary tract infection, COPD, and hypertension. Which of the following diagnoses should not be reported as POA? a. Catheter-associated urinary tract infection b. Cerebral vascular accident c. COPD d. Hypertension - CORRECT ANSWER a. Catheter-associated urinary tract infection A pediatrician would report the fact that he or she administered the MMR vaccine to a toddler on a(n): a. Diabetes registry b. Cancer registry c. Immunization registry d. Trauma registry - CORRECT ANSWER c. Immunization registry A nurse tried to enter a temperature of 134 degrees and the system would not accept it. What is this an example of? a. Data collection b. Edit check c. Data reliability d. Hot spot - CORRECT ANSWER b. Edit check Which of the following are considered dimensions of data quality? a. Relevancy, granularity, timeliness, currency, accuracy, precision, and consistency b. Relevancy, granularity, timeliness, currency, atomic, precision, and consistency c. Relevancy, granularity, timeliness, concurrent, atomic, precision, and consistency d. Relevancy, granularity, equality, currency, precision, accuracy, and consistency - CORRECT ANSWER a. Relevancy, granularity, timeliness, currency, accuracy, precision, and consistency The statement "All patients admitted with a diagnosis falling into ICD-10-CM code numbers S00 through T88" represents a possible case definition for what type of registry? a. Birth defect registry b. Cancer registry c. Diabetes registry d. Trauma registry - CORRECT ANSWER d. Trauma registry Mrs. Bolton is an angry patient who resents her physician "bossing her around." She refuses to take a portion of the medications the nurses bring to her pursuant to physician orders and is verbally abusive to the patient care assistants. Of the following options, the most appropriate way to document Mrs. Bolton's behavior in the patient health record is: a. Mean b. Noncompliant and hostile toward staff c. Belligerent and out of line d. A pain in the neck - CORRECT ANSWER b. Noncompliant and hostile toward staff When data is taken from the health record and entered into registries and databases, the data in the registries or databases is then considered a(n): a. Secondary data source b. Reliable data source c. Primary data source d. Unreliable data source - CORRECT ANSWER a. Secondary data source Because a health record contains patient-specific data and information about a patient that has been documented by the professionals who provided care or services to that patient, it is considered: a. Secondary data source b. Aggregate data source c. Primary data source d. Reliable data source - CORRECT ANSWER c. Primary data source A 65-year-old woman was admitted to the hospital. She was diagnosed with sepsis secondary to methicillin susceptible Staphylococcus aureus and abdominal pain secondary to diverticulitis of the colon. What is the correct code assignment? A41.01 Sepsis due to Methicillin susceptible Staphylococcus aureus A41.89 Other specified sepsis A41.9 Sepsis, unspecified organism B95.61 Methicillin susceptible Staphylococcus aureus infection as the cause of diseases classified elsewhere K57.32 Diverticulitis of large intestine without perforation or abscess without bleeding R10.9 Unspecified abdominal pain a. A41.89, K57.32, R10.9 b. A41.01, K57.32 c. A41.89, K57.32, B95.61 d. A41.9, K57.32 - CORRECT ANSWER b. A41.01, K57.32 A patient had a radical resection of soft tissue sarcoma of the left thigh. In ICD-10-PCS what would the root operation be for this procedure? a. Excision b. Repair c. Resection d. Destruction - CORRECT ANSWER a. Excision The data that describe other data in order to facilitate data quality are found in the: a. Data definition language b. Data dictionary c. Data standards d. Data definition - CORRECT ANSWER b. Data dictionary A patient returns during a 90-day postoperative period from a ventral hernia repair; the patient is now complaining of eye pain. What modifier would you use with the evaluation and management code for professional fee reporting? a. -79, Unrelated procedure or service by the same physician or other qualified health care professional during the postoperative period b. -25, Significant, separately identifiable evaluation and management service by the same physician or other qualified health care professional on the same day of the procedure or other service c. -59, Distinct procedural service d. -24, Unrelated evaluation and management service by the same physician or other qualified health care professional during a postoperative period - CORRECT ANSWER d. -24, Unrelated evaluation and management service by the same physician or other qualified health care professional during a postoperative period A computer software program that supports a coder in assigning correct codes is called a(n): a. Encoder b. Grouper c. Automated coder d. Decision support system - CORRECT ANSWER a. Encoder The name of the government agency that has led the development of basic data sets for health records and computer databases is: a. The Centers for Medicare and Medicaid Services b. The National Committee on Vital and Health Statistics c. The American National Standards Institute d. The National Institute of Health - CORRECT ANSWER b. The National Committee on Vital and Health Statistics A regular review of LHR policies and procedures to ensure a healthcare entity remains in compliance with legal requirements is generally called an LHR ________. a. maintenance plan b. management plan c. attribute plan d. strategic plan - CORRECT ANSWER a. maintenance plan An alteration of the health information by modification, correction, addition, or deletion is known as a(n): a. Change b. Amendment c. Copy and paste d. Deletion - CORRECT ANSWER b. Amendment A patient born with a neural tube defect would be included in which type of registry? a. Birth defects b. Cancer c. Diabetes d. Trauma - CORRECT ANSWER a. Birth defects The leadership and organizational structures, policies, procedures, technology, and controls that ensure that patient and other enterprise data and information sustain and extend the entity's mission and strategies, deliver value, comply with laws and regulations, minimize risk to all stakeholders, and advance the public good is called: a. Information asset management b. Information management c. Information governance d. Enterprise information management - CORRECT ANSWER c. Information governance Dr. Jones dies while still in active medical practice. He leaves incomplete records at Medical Center Hospital. The best way for the HIM department to handle these incomplete records is to: a. Have the administrator of the hospital complete them b. Have the charge nurse on the respective nursing units complete them c. Ask the chief of staff to complete them d. File the incomplete records with a notation about the physician's death - CORRECT ANSWER d. File the incomplete records with a notation about the physician's death What is a primary purpose for documenting and maintaining health records? a. Effective communication among caregivers for continuity of care b. Substantiate claims for reimbursement c. Provide evidence for malpractice lawsuits d. Contribute to medical science - CORRECT ANSWER a. Effective communication among caregivers for continuity of care The inpatient data set incorporated into federal law and required for Medicare reporting is the: a. Ambulatory Care Data Set b. Uniform Hospital Discharge Data Set c. Minimum Data Set for Long-term Care d. Health Plan Employer Data and Information Set - CORRECT ANSWER b. Uniform Hospital Discharge Data Set A database contains two tables: physicians and patients. If a physician may be linked to many patients and patients may only be related to one physician, what is the cardinality of the relationship between the two tables? a. One-to-one b. One-to-many c. Many-to-many d. One-to-two - CORRECT ANSWER b. One-to-many The Joint Commission has published a list of abbreviations classified as "Do Not Use" for the purpose of: a. Assisting coders to read physician handwriting b. Preventing potential medication errors due to misinterpretation c. Making terminology consistent in preparation for electronic records d. Identifying physicians who are dispensing large quantities of drugs - CORRECT ANSWER b. Preventing potential medication errors due to misinterpretation Unstructured data may be preferred over structured data because: a. It does not require processing b. It provides greater detail c. Clinicians know how to enter it d. It is more complete - CORRECT ANSWER b. It provides greater detail A collection of data that is organized so its contents can be easily accessed, managed, and updated is called a: a. Spreadsheet b. Database c. File d. Data table - CORRECT ANSWER b. Database Regardless of the healthcare setting, accreditation and regulatory standards require a separate healthcare record for each: a. Family b. Individual patient c. Encounter with the facility d. Day of treatment - CORRECT ANSWER b. Individual patient A patient has HIV with disseminated candidiasis. What is the correct code assignment? B20 Human immunodeficiency virus [HIV] disease B37.0 Candidal stomatitis Oral thrush B37.7 Candidal sepsis Disseminated candidiasis Systemic candidiasis B37.89 Other sites of candidiasisCandidal osteomyelitis a. B20, B37.0 b. B37.7, B20 c. B20, B37.7 d. B20, B37.89, B37.7 - CORRECT ANSWER c. B20, B37.7 In long-term care, the resident's comprehensive assessment is based on data collected in the: a. UHDDS b. OASIS c. MDS d. HEDIS - CORRECT ANSWER c. MDS Changes and updates to ICD-10-CM are managed by the ICD-10-CM Coordination and Maintenance Committee, a federal committee cochaired by representatives from the NCHS and: a. AMA b. OIG c. CMS d. WHO - CORRECT ANSWER c. CMS What document is a snapshot of a patient's status and includes everything from social issues to disease processes as well as critical paths and clinical pathways that focus on a specific disease process or pathway in a long-term care hospital (LTCH)? a. Face sheet b. Care plan c. Diagnosis plan d. Flow sheet - CORRECT ANSWER b. Care plan Which of the following is an example of a 1:1 relationship? a. Patients to hospital admissions b. Patients to consulting physicians c. Patients to clinics d. Patients to hospital beds - CORRECT ANSWER d. Patients to hospital beds What term refers to information that provides physicians with pertinent health information beyond the health record itself used to determine treatment options? a. Core measures b. Enhanced discharge planning c. Data mining d. Clinical practice guidelines - CORRECT ANSWER d. Clinical practice guidelines Which document is used in the long-term care setting that is not used in the acute-care setting? a. Progress notes b. Monthly summary c. Physician consultations d. Physician orders - CORRECT ANSWER b. Monthly summary Review of disease indexes, pathology reports, and radiation therapy reports is part of which function in the cancer registry? a. Case definition b. Case finding c. Follow-up d. Reporting - CORRECT ANSWER b. Case finding Which of the following personnel should be authorized, per hospital policy, to take a physician's verbal order for the administration of medication? a. Unit secretary working on the unit where the patient is located b. Nurse working on the unit where the patient is located c. Health information director d. Admissions registrars - CORRECT ANSWER b. Nurse working on the unit where the patient is located While the focus of inpatient data collection is on the principal diagnosis, the focus of outpatient data collection is on the: a. Reason for admission b. Activities of daily living c. Discharge diagnosis d. Reason for encounter - CORRECT ANSWER d. Reason for encounter The legal health record for disclosure consists of: a. Any and all protected health information data collected or used by a healthcare entity when delivering care b. Only the protected health information requested by an attorney for a legal proceeding c. The data, documents, reports, and information that comprise the formal business records of any healthcare entity that are to be utilized during legal proceedings d. All of the data and information included in the HIPAA Designated Record Set - CORRECT ANSWER c. The data, documents, reports, and information that comprise the formal business records of any healthcare entity that are to be utilized during legal proceedings Records that are not completed by the physician within the time frame specified in the healthcare organization policies are called: a. Default records b. Delinquent records c. Loose records d. Suspended records - CORRECT ANSWER b. Delinquent records When a healthcare entity destroys health records after the acceptable retention period has been met, a certificate of destruction is created. How long must the healthcare entity maintain the certificate of destruction? a. Two years b. Five years c. Ten years d. Permanently - CORRECT ANSWER d. Permanently A critical early step in designing an EHR in which the characteristics of each data element are defined is to develop a(n): a. Accreditation manual b. Core content c. Continuity of care record d. Data dictionary - CORRECT ANSWER d. Data dictionary What term is used in reference to the systematic review of sample health records to determine whether documentation standards are being met? a. Qualitative analysis b. Legal record review c. Utilization analysis d. Ongoing record review - CORRECT ANSWER a. Qualitative analysis A patient was admitted to the hospital and diagnosed with Type 1 diabetic gangrene. What is the correct code assignment? E08.52 Diabetes mellitus due to underlying condition with diabetic peripheral angiopathy with gangrene E10.52 Type 1 diabetes mellitus with diabetic peripheral angiopathy with gangrene E10.8 Type 1 diabetes mellitus with unspecified complications I96 Gangrene, not elsewhere classified a. E08.52, I96 b. E10.52, I96 c. E10.8 d. E10.52 - CORRECT ANSWER d. E10.52 How do healthcare providers use the administrative data they collect? a. For regulatory, operational, and financial purposes b. For statistical data purposes c. For electronic health record tracking purposes d. For continuity of patient care purposes - CORRECT ANSWER a. For regulatory, operational, and financial purposes Which of the following is not an appropriate method for destroying paper-based health records? a. Burning b. Shredding c. Pulverizing d. Degaussing - CORRECT ANSWER d. Degaussing To ensure authentication of data entries, which type of signature is the most secure? a. Digital b. Electronic c. Handwritten d. Virtual - CORRECT ANSWER a. Digital Which of the following is the appropriate method for destroying electronic data? a. Burning b. Shredding c. Pulverizing d. Degaussing - CORRECT ANSWER d. Degaussing Personal information about patients such as their names, ages, and addresses is considered what type of information? a. Clinical b. Administrative c. Operational d. Accreditation - CORRECT ANSWER b. Administrative Which of the following keywords precedes the listing of variables to be returned from an SQL query? a. SELECT b. SET c. DATA d. BY - CORRECT ANSWER a. SELECT Which data set would be used to document an elective surgical procedure that does not require an overnight hospital stay? a. Uniform Hospital Discharge Data Set b. Data Elements for Emergency Department Systems c. Uniform Ambulatory Care Data Set d. Essential Medical Data Set - CORRECT ANSWER c. Uniform Ambulatory Care Data Set Assign the correct CPT code for the following: A 58-year-old male was seen in the outpatient surgical center for insertion of a self-contained inflatable penile prosthesis for impotence. a. 54401, Insertion of penile prosthesis; inflatable (self-contained) b. 54405, Insertion of multicomponent, inflatable penile prosthesis, including placement of pump, cylinders, and reservoir c. 54440, Plastic operation of penis for injury d. 54400, Insertion of penile prosthesis, non-inflatable (semi-rigid) - CORRECT ANSWER a. 54401, Insertion of penile prosthesis; inflatable (self-contained) What tool is used to sort data in a variety of ways to assist in the study of certain data elements? a. Registries b. Indexes c. Clinical trials d. Statistical reports - CORRECT ANSWER b. Indexes Which type of data consists of factual details aggregated or summarized from a group of health records that provides no means to identify specific patients? a. Original b. Source c. Protected d. Derived - CORRECT ANSWER d. Derived Data content standards are used to: a. Share data in the same way the users interpret data b. Share data is a unique way c. Share data between disparate systems d. Modify data - CORRECT ANSWER a. Share data in the same way the users interpret data What is the first consideration in determining how long records must be retained? a. The amount of space allocated for record filing b. The number of records c. The most stringent law or regulation in the state d. The cost of filing space - CORRECT ANSWER c. The most stringent law or regulation in the state Which of the following is a concept designed to help standardize clinical content for sharing between providers? a. Continuity of care record b. Interoperability c. Personal health record d. SNOMED - CORRECT ANSWER a. Continuity of care record A strategic plan that identifies applications, technology, and operational elements needed for the overall information technology program in a healthcare entity is a(n): a. Implementation plan b. Information technology plan c. Migration path d. Transition strategy - CORRECT ANSWER c. Migration path Identify the level in the data model that describes how the data is stored within the database: a. Conceptual data model b. Physical data model c. Logical data model d. Data manipulation language - CORRECT ANSWER b. Physical data model According to the Medicare Conditions of Participation, how long must health records be retained? a. Two years b. Five years c. Ten years d. Permanently - CORRECT ANSWER b. Five years Which of the following data management domains would be responsible for establishing standards for data retention and storage? a. Data architecture management b. Metadata management c. Data life cycle management d. Master data management - CORRECT ANSWER c. Data life cycle management Ensuring that only the most recent report is available for viewing is known as: a. Documentation integrity b. Authorship c. Validation d. Version control - CORRECT ANSWER d. Version control Which of the following makes the indexing of scanned health records more efficient by entering metadata automatically? a. Barcodes b. Backscanning c. OCE d. CPOE - CORRECT ANSWER a. Barcodes Assign the correct CPT code for the following: A 63-year-old female had a temporal artery biopsy completed in the outpatient surgical center. a. 32405, Biopsy, lung or mediastinum, percutaneous needle b. 37609, Ligation or biopsy, temporal artery c. 20206, Biopsy, muscle, percutaneous needle d. 31629, Bronchoscopy, rigid or flexible, including fluoroscopic guidance when performed; with transbronchial needle aspiration biopsy(s), trachea, main stem and/or lobar bronchus(i) - CORRECT ANSWER b. 37609, Ligation or biopsy, temporal artery The practices or methods that defend against charges questioning the integrity of the data and documents are called: a. Authentication b. Security c. Accuracy d. Nonrepudiation - CORRECT ANSWER d. Nonrepudiation The EHR indicates that Dr. Anderson wrote the January 12 progress note at 11:04 a.m. We know Dr. Anderson wrote this progress note due to which of the following? a. Authorship b. Validation c. Integrity d. Identification - CORRECT ANSWER a. Authorship What are LOINC codes used for? a. Identifying test results b. Reporting test results c. Identifying tests unique to a specific company d. Reporting a code for reimbursement - CORRECT ANSWER a. Identifying test results Name of element, definition, application in which the data element is found, locator key, ownership, entity relationships, date first entered system, date terminated from system, and system of origin are all examples of: a. Auto-authentication fields b. Metadata c. Data d. Information fields - CORRECT ANSWER b. Metadata Appropriate documentation of health record destruction must be maintained permanently no matter how the process is carried out. This documentation usually takes the form of a: a. Policy of destruction b. Retention schedule c. Regulation schedule d. Certificate of destruction - CORRECT ANSWER d. Certificate of destruction Which of the following plans address how information can be documented in the health record during down time or a catastrophic event? a. Disaster b. E-discovery response c. Business continuity d. Emergency documentation - CORRECT ANSWER a. Disaster Which of the following is a component of the resident assessment instrument? a. The resident's health record b. A standard Minimum Data Set (MDS) c. Preadmission Screening Assessment d. Annual Resident Review - CORRECT ANSWER b. A standard Minimum Data Set (MDS) A patient was admitted for removal of the left lobe of the liver via laparotomy due to metastasis from a colon carcinoma. What is the correct ICD-10-PCS procedure code for this operation? SectionBody SystemRootOperationBody PartApproachDeviceQualifierMedicalandSurgicalHepatobiliarySystem andPancreasExcisionLiver, LeftLobeOpenNo DeviceNo Qualifier 0FB20ZZ SectionBody SystemRootOperationBody PartApproachDeviceQualifierMedicalandSurgicalHepatobiliarySystem andPancreasExcisionLiver, LeftLobePercutaneousEndoscopicNo DeviceNo Qualifier 0FB24ZZ SectionBody SystemRootOperationBody PartApproachDeviceQualifierMedicalandSurgicalHepatobiliarySystem andPancreasResectionLiver, LeftLobeOpenNo DeviceNo Qualifier 0FT20ZZ SectionBody SystemRootOperationBody PartApproachDeviceQualifierMedicalandSurgicalHepatobiliarySystem andPancreasResectionLiver, LeftLobePercutaneousEndoscopicNo DeviceNo Qualifier 0FT24ZZ a. 0FB20ZZ b. 0FB24ZZ c. 0FT20ZZ d. 0FT24ZZ - CORRECT ANSWER c. 0FT20ZZ The basic component of a(n) ________ is an object that contains both data and their relationships in a single structure. a. Object-oriented database b. Relational database c. Access database d. Structured database - CORRECT ANSWER a. Object-oriented database Secondary data sources provide information that is ________ available by looking at individual health records. a. not easily b. easily c. often d. never - CORRECT ANSWER a. not easily A staghorn calculus of the left renal pelvis was treated earlier in the week by lithotripsy. The patient returns now for removal of the calculus via a percutaneous nephrostomy tube. What is the correct root operation? a. Destruction b. Extirpation c. Fragmentation d. Release - CORRECT ANSWER b. Extirpation What term is used in reference to raw facts generally stored as characters, words, symbols, measurements, or statistics? a. Data b. Information c. Knowledge d. Notices - CORRECT ANSWER a. Data The first deliverable from a legal health record (LHR) definition project is a: a. List of LHR stakeholders b. Document matrix of LHR components c. Letter of support from management d. Master source system matrix - CORRECT ANSWER a. List of LHR stakeholders The patient has a biopsy of the colon followed by a hemicolectomy. In the ICD-10-PCS coding system, which procedure(s) are coded? a. The hemicolectomy only b. The biopsy only c. Both the biopsy and the hemicolectomy d. It depends on the results of the biopsy - CORRECT ANSWER c. Both the biopsy and the hemicolectomy Which of the following processes is an ancillary function of the health record? a. Admitting and registration information b. Billing and reimbursement c. Patient assessment and care planning d. Biomedical research - CORRECT ANSWER d. Biomedical research Which health record format is arranged in chronological order with documentation from various sources intermingled? a. Electronic b. Source-oriented c. Problem-oriented d. Integrated - CORRECT ANSWER d. Integrated Mary Smith, RHIA, has been charged with the responsibility of designing a data collection form to be used on admission of patients to the acute-care hospital in which she works. What is the first resource she should use? a. UHDDS b. UACDS c. MDS d. ORYX - CORRECT ANSWER a. UHDDS Automated insertion of clinical data using templates or similar tools with predetermined components using uncontrolled and uncertain clinical relevance is an example of a potential breach of: a. Patient identification and demographic accuracy b. Authorship integrity c. Documentation integrity d. Auditing integrity - CORRECT ANSWER c. Documentation integrity Which of the following is a business role with major responsibilities that include identifying the specific data needed to operate business processes, recording metadata, and identifying and enforcing quality standards? a. Chief data officer b. Data definition steward c. Data production steward d. Subject matter expert - CORRECT ANSWER b. Data definition steward Which of the following terms is used for the process of scanning past health records into the information system so there is an existing database of patient information, making the information system valuable to the user from the first day of implementation? a. CPOE b. OCR c. Backscanning d. Barcoding - CORRECT ANSWER c. Backscanning Records consisting of multiple electronic systems that do not communicate or are not logically architected for record management are called: a. Electronic medical records b. Electronic health records c. Hybrid health records d. Computerized health records - CORRECT ANSWER c. Hybrid health records What is the most constant threat to health information integrity? a. Natural threats b. Environmental threats c. Internal disaster d. Humans - CORRECT ANSWER d. Humans Lane Hospital has a contract with Ready-Clean, a local company, to come into the hospital to pick up all the facility's linens for off-site laundering. Ready-Clean is: a. A business associate because Lane Hospital has a contract with it b. Not a business associate because it is a local company c. A business associate because its employees may see PHI d. Not a business associate because it does not use or disclose individually identifiable health information - CORRECT ANSWER d. Not a business associate because it does not use or disclose individually identifiable health information Which standard in the Security Rule provides guidance for covered entities to secure laptops and other small portable mobile technologies used within the healthcare facility? a. Workstation security standard b. Technical safeguard standard c. Device and media controls standard d. Facility access control standard - CORRECT ANSWER c. Device and media controls standard The Latin phrase meaning "let the master answer" that puts responsibility for negligent actions of employees on the employer is called: a. Res ipsa locquitor b. Res judicata c. Respondeat superior d. Restitutio in integrum - CORRECT ANSWER c. Respondeat superior The Privacy Rule establishes that a patient has the right of access to inspect and obtain a copy of his or her PHI: a. For as long as it is maintained b. For six years c. Forever d. For 12 months - CORRECT ANSWER a. For as long as it is maintained Many states have mandatory reporting requirements for suspected abuse or mistreatment of the following categories of individuals: a. Children, competent adults, and nursing home residents b. Competent adults, residents of mental health facilities, and nursing home residents c. Nursing home residents, the elderly, and residents of state mental health facilities d. Residents of state mental health facilities, the elderly, and competent adults - CORRECT ANSWER c. Nursing home residents, the elderly, and residents of state mental health facilities Debbie, an HIM professional, was recently hired as the privacy officer at a large physician practice. She observes the following practices. Which is a violation of the HIPAA Privacy Rule? a. Dr. Graham recommends a medication to a patient with asthma. b. Dr. Herman gives a patient a pen with the name of a pharmaceutical company on it. c. Dr. Martin recommends acupuncture to a patient. d. Dr. Lawson gives names of asthma patients to a pharmaceutical company. - CORRECT ANSWER d. Dr. Lawson gives names of asthma patients to a pharmaceutical company. According to HIPAA standards, designated individuals responsible for data security: a. Must be identified by every covered entity b. Are only required in large facilities c. Are only required in hospitals d. Are not required in small physician practices - CORRECT ANSWER a. Must be identified by every covered entity Central City Clinic has requested that Ghent Hospital send its hospital records from Susan Hall's most recent admission to the clinic for her follow-up appointment. Which of the following statements is true? a. The Privacy Rule requires that Susan Hall complete a written authorization. b. The hospital may send only discharge summary, history, and physical and operative report. c. The Privacy Rule's minimum necessary requirement does not apply. d. This "public interest and benefit" disclosure does not require the patient's authorization. - CORRECT ANSWER c. The Privacy Rule's minimum necessary requirement does not apply. Identifying appropriate users of specific information is a function of: a. Access control b. Nosology c. Data modeling d. Workflow modeling - CORRECT ANSWER a. Access control An original goal of HIPAA Administrative Simplification was to standardize: a. Privacy notices given to patients b. The electronic transmission of health data c. Disclosure of information for treatment purposes d. The definition of PHI - CORRECT ANSWER b. The electronic transmission of health data Health Insurance Portability and Accountability Act's Privacy Rule states that "________ used for the purposes of treatment, payment, or healthcare operations does not require patient authorization to allow providers access, use, or disclosure." However, only the ________ information needed to satisfy the specified purpose can be used or disclosed. a. Demographic information, minimum necessary b. Protected health information, minimum necessary c. Protected health information, diagnostic d. Demographic information, diagnostic - CORRECT ANSWER b. Protected health information, minimum necessary Community Hospital is terminating its business associate relationship with a medical transcription company. The transcription company has no further need for any identifiable information that it may have obtained in the course of its business with the hospital. The CFO of the hospital believes that to be HIPAA compliant all that is necessary is for the termination to be in a formal letter signed by the CEO. In this case, how should the director of HIM advise the CFO? a. Confirm that a formal letter of termination meets HIPAA requirements and no further action is required b. Confirm that a formal letter of termination meets HIPAA requirements and no further action is required except that the termination notice needs to be retained for seven years c. Confirm that a formal letter of termination is required and that the transcription company must provide the hospital with a certification that all PHI that it had in its possession has been destroyed or returned d. Inform the CFO that business associate agreements cannot be terminated - CORRECT ANSWER c. Confirm that a formal letter of termination is required and that the transcription company must provide the hospital with a certification that all PHI that it had in its possession has been destroyed or returned E-discovery rules were created in response to the tremendous volume of evidence maintained in electronic format that is pertinent to lawsuits and amended which legislation? a. Federal Rules of Evidence b. State Rules of Evidence c. Federal Rules of Civil Procedure d. State Rules of Civil Procedure - CORRECT ANSWER c. Federal Rules of Civil Procedurec. Federal Rules of Civil Procedure The federal physician self-referral statute is also known as the: a. Sherman Anti-Trust Act b. Deficit Reduction Act c. False Claims Act d. Stark Law - CORRECT ANSWER d. Stark Law Which of the following is a kind of technology that focuses on data security? a. Clinical decision support b. Bitmapped data c. Firewalls d. Smart cards - CORRECT ANSWER c. Firewalls Under HIPAA, when is the patient's written authorization required to release his or her healthcare information? a. For purposes related to treatment b. For purposes related to payment c. For administrative healthcare operations d. For any purpose unrelated to treatment, payment, or healthcare operations - CORRECT ANSWER d. For any purpose unrelated to treatment, payment, or healthcare operations Which of the following must be reported to the medical examiner? a. Burns b. Accidental deaths c. Causes of injury d. Morbidity - CORRECT ANSWER b. Accidental deaths A federal confidentiality statute specifically addresses confidentiality of health information about ________ patients. a. Developmentally disabled b. Elderly c. Drug and alcohol recovery d. Cancer - CORRECT ANSWER c. Drug and alcohol recovery Regarding an individual's right of access to their own PHI, per HIPAA, a covered entity: a. Must act on the request within 90 days b. May extend its response by 60 days if it gives the reasons for the delay c. May require individuals to make their requests in writing d. Does not have limits regarding what it can charge individuals for copies of their health records - CORRECT ANSWER c. May require individuals to make their requests in writing The HIM manager received notification that a user accessed the PHI of a patient with the same last name as the user. This is an example of a(n): a. Encryption b. Trigger flag c. Transmission security d. Redundancy - CORRECT ANSWER b. Trigger flag In Medical Center Hospital's clinical information system, nurses may write nursing notes and may read all parts of the patient health record for patients on the unit in which they work. This type of authorized use is called: a. Password limitation b. Security clearance c. Role-based access d. User grouping - CORRECT ANSWER c. Role-based access A subpoena duces tecum compels the recipient to: a. Serve on a jury b. Answer a complaint c. Testify at a trial d. Bring records to a legal proceeding - CORRECT ANSWER d. Bring records to a legal proceeding Per HITECH, an accounting of disclosures must include disclosures made during the previous: a. 10 years b. 6 years c. 3 years d. 1 year - CORRECT ANSWER c. 3 years When a patient revokes authorization for release of information after a healthcare entity has already released the information, the healthcare entity in this case: a. May be prosecuted for invasion of privacy b. Has become subject to civil action c. Has violated the security regulations of HIPAA d. Is protected by the Privacy Act - CORRECT ANSWER d. Is protected by the Privacy Act The hospital's public relations department in conjunction with the local high school is holding a job shadowing day. The purpose of this event is to allow high school seniors an opportunity to observe the various jobs in the hospital and to help the students with career planning. The public relations department asks for input on this event from the standpoint of HIPAA compliance. In this case, what should the HIM department advise? a. Job shadowing is allowed by HIPAA under the provision of allowing students and trainees to practice. b. Job shadowing should be limited to areas in which the likelihood of exposure to PHI is very limited, such as administrative areas. c. Job shadowing is allowed by HIPAA under the provision of volunteers. d. Job shadowing is specifically prohibited by HIPAA. - CORRECT ANSWER b. Job shadowing should be limited to areas in which the likelihood of exposure to PHI is very limited, such as administrative areas. When a competent adult refuses treatment, a court may be required to balance the individual's privacy interests against the: a. Patient's level of pain b. Physician's right to keep the patient alive c. Government's interests in protecting human life d. Provider's liability concerns - CORRECT ANSWER c. Government's interests in protecting human life A patient requests that disclosures made from her medical record be limited to specific clinical notes and reports. Given HIPAA requirements, how must the hospital respond? a. The hospital must accept the request but does not have to agree to it. b. The hospital must honor the request. c. The hospital must guarantee that the request will be followed. d. The hospital must agree to the request, providing that state or federal law does not prohibit it. - CORRECT ANSWER a. The hospital must accept the request but does not have to agree to it. Which of the following is a best practice for protecting information that is text messaged? a. Send a text message to more than one person b. Enter a person's telephone number each time a text message is sent c. Encrypt text messages during transmission d. Presume that telephone numbers stored in memory remain valid - CORRECT ANSWER c. Encrypt text messages during transmission City Hospital has implemented a procedure that allows inpatients to decide whether they want to be listed in the hospital's directory. The directory information includes the patient's name, location in the hospital, and general condition. If a patient elects to be in the directory, this information is used to inform callers who know the patient's name. Some patients have requested that they be listed in the directory but information is to be released to only a list of specific people the patient provides. A hospital committee is considering changing the policy to accommodate these types of patients. In this case, what type of advice should the HIM director provide? a. Approve the requests because this is a patient right under HIPAA regulations b. Deny these requests because screening of calls is difficult to manage and if information is given in error, this would be considered a violation of HIPAA c. Develop two different types of directories—one directory for provision of all information and one directory for provision of information to selected friends and family of the patient d. Deny these requests and seek approval from the Office of Civil Rights - CORRECT ANSWER b. Deny these requests because screening of calls is difficult to manage and if information is given in error, this would be considered a violation of HIPAA Which of the following is a mechanism that records and examines activity in information systems? a. eSignature laws b. Security audits c. Minimum necessary rules d. Access controls - CORRECT ANSWER b. Security audits Which of the following statements is true with regard to responding to requests from individuals for access to their PHI? a. A cost-based fee may be charged for retrieval of the PHI. b. A cost-based fee may be charged for making a copy of the PHI. c. No fees of any type may be charged. d. A minimal fee may be charged for retrieval and copying of PHI. - CORRECT ANSWER b. A cost-based fee may be charged for making a copy of the PHI. Authorization management involves: a. The process used to protect the reliability of a database b. Limiting user access to a database c. Allowing unlimited use of the database d. Developing definitions for database elements - CORRECT ANSWER b. Limiting user access to a database Which landmark legal case established the responsibility of the hospital for the quality of care given by its physicians? a. Roe v. Wade b. Darling v. Charleston Community Memorial Hospital c. Brown v. Board of Education d. Marbury v. Madison - CORRECT ANSWER b. Darling v. Charleston Community Memorial Hospital An employee accesses ePHI that does not relate to her job functions. What security mechanism should have been implemented to minimize this security breach? a. Access controls b. Audit controls c. Contingency controls d. Security incident controls - CORRECT ANSWER a. Access controls Which of the following is an administrative safeguard action? a. Facility access control b. Documentation retention guidelines c. Maintenance record d. Media reuse - CORRECT ANSWER b. Documentation retention guidelines Ensuring that data have been accessed or modified only by those authorized to do so is a function of: a. Data integrity b. Data quality c. Data granularity d. Logging functions - CORRECT ANSWER a. Data integrity An employee received an email that he thought was from the information technology department. He provided his personal information at the sender's request. The employee was tricked by: a. Phishing b. Ransomware c. Virus d. Bot - CORRECT ANSWER a. Phishing Caitlin has been experiencing abdominal pain. Removal of her gallbladder was recommended. Who is responsible to obtain Caitlin's informed consent? a. The anesthesiologist who will be administering general anesthesia b. The surgical nurse who will assist during surgery c. The physician who will be performing the surgery d. The administrator in the surgery department - CORRECT ANSWER c. The physician who will be performing the surgery Which of the following statements about a firewall is false? a. It is a system or combination of systems that supports an access control policy between two networks. b. The most common place to find a firewall is between the healthcare entity's internal network and the Internet. c. Firewalls are effective for preventing all types of attacks on a healthcare system. d. A firewall can limit internal users from accessing various portions of the Internet. - CORRECT ANSWER c. Firewalls are effective for preventing all types of attacks on a healthcare system. Which of the following statements is true in regard to training in protected health information (PHI) policies and procedures? a. Every member of the covered entity's workforce must be trained. b. Only individuals employed by the covered entity must be trained. c. Training only needs to occur when there are material changes to the policies and procedures. d. Documentation of training is not required. - CORRECT ANSWER a. Every member of the covered entity's workforce must be trained. The age of majority in most states is: a. 16 and older b. 17 and older c. 18 and older d. 21 and older - CORRECT ANSWER c. 18 and older An employer has contacted the HIM department and requested health information on one of his employees. Of the options listed here, what is the best course of action? a. Provide the information requested b. Refer the request to the attending physician c. Request the employee's written authorization for release of information d. Request the employer's written authorization for release of the employee's information - CORRECT ANSWER c. Request the employee's written authorization for release of information Kay Denton wrote to Mercy Hospital requesting an amendment to her PHI. She states that her record incorrectly lists her weight at 180 lbs. instead of her actual 150 lbs., and amending it would look better on her record. The information is present on a copy of a history and physical that General Hospital sent to Mercy Hospital. Mercy Hospital may decline to grant her request based on which privacy rule provision? a. Individuals do not have the right to make amendment requests. b. The history and physical was not created by Mercy Hospital. c. A history and physical is not part of the designated record set. d. Mercy Hospital must grant her request. - CORRECT ANSWER b. The history and physical was not created by Mercy Hospital. Notices of privacy practices must be available at the site where the individual is treated and: a. Must be posted next to the entrance b. Must be posted in a prominent place where it is reasonable to expect that patients will read them c. May be posted anywhere at the site d. Do not have to be posted at the site - CORRECT ANSWER b. Must be posted in a prominent place where it is reasonable to expect that patients will read them A visitor sign-in sheet to a computer area is an example of what type of control? a. Administrative b. Audit c. Facility access d. Workstation - CORRECT ANSWER c. Facility access The confidentiality of incident reports is generally protected in cases when the report is filed in: a. The nursing notes b. The patient's health record c. The physician's progress notes d. The hospital risk manager's office - CORRECT ANSWER d. The hospital risk manager's office Mary Jones has been declared legally incompetent by the court. Mrs. Jones's sister has been appointed her legal guardian. Her sister requested a copy of Mrs. Jones's health records. Of the options listed here, what is the best course of action? a. Comply with the sister's request but first request documentation from the sister that she is Mary Jones's legal guardian b. Provide the information as requested by the sister c. Require that Mary Jones authorize the release of her health information to the sister d. Refer the sister to Mary Jones's doctor - CORRECT ANSWER a. Comply with the sister's request but first request documentation from the sister that she is Mary Jones's legal guardian Which of the following would be included in an accounting of disclosures? a. Incidental to an otherwise permitted or required use disclosure b. Disclosures to the individual about whom the information pertains c. Disclosures made pursuant to an authorization d. Patient information faxed to the bank - CORRECT ANSWER d. Patient information faxed to the bank Per the HITECH breach notification requirements, which of the following is the threshold in which the media and the Secretary of Health and Human Services should be notified of the breach? a. more than 1,000 individuals affected b. more than 500 individuals affected c. more than 250 individuals affected d. Any number of individuals affected requires notification - CORRECT ANSWER b. more than 500 individuals affected HITECH specifically includes all of the following as business associates except: a. Patient safety organizations b. Health information exchanges c. E-prescribing gateways d. Facility housekeeping staff - CORRECT ANSWER d. Facility housekeeping staff In all of the following situations PHI may be disclosed without providing the opportunity for an individual to object or to provide an authorization except: a. For disclosures for public health purposes as required by law b. For disclosures to health oversight agencies as required by law c. For reporting certain types of wounds or other physical injuries as required by law d. For including the individual's name in the facility directory - CORRECT ANSWER d. For including the individual's name in the facility directory HIPAA was designed to accomplish all of the following except: a. Designate HIM professionals as privacy officers b. Establish a consistent set of privacy and security rules for healthcare information nationwide c. Simplify the sharing of health information for legitimate purposes d. Authorize that only the minimum necessary should be released upon proper authorization - CORRECT ANSWER a. Designate HIM professionals as privacy officers The outpatient clinic of a large hospital is reviewing its patient sign-in procedures. The registration clerks say it is essential that they know if the patient has health insurance and the reason for the patient's visit. The clerks maintain that having this information on a sign-in sheet will make their jobs more efficient and reduce patient waiting time in the waiting room. What should the HIM director advise in this case? a. To be HIPAA compliant, sign-in sheets should contain the minimal information necessary such as patient name. b. Patient name, insurance status, and diagnoses are permitted by HIPAA. c. Patient name, insurance status, and reason for visit would be considered incidental disclosures if another patient saw this information. d. Any communication overheard by another patient is considered an incidental disclosure. - CORRECT ANSWER a. To be HIPAA compliant, sign-in sheets should contain the minimal information necessary such as patient name. Which of the following is not an identifier under the Privacy Rule? a. Visa account b. Vehicle license plate BZ LITYR c. Age 75 d. Street address 265 Cherry Valley Road - CORRECT ANSWER c. Age 75 Community Hospital is planning implementation of various elements of the EHR in the next six months. Physicians have requested the ability to access the EHR from their offices and from home. What advice should the HIM director provide? a. HIPAA regulations do not allow this type of access. b. This access would be covered under the release of PHI for treatment purposes and poses no security or confidentiality threats. c. Access can be permitted providing that appropriate safeguards are put in place to protect against threats to security. d. Access cannot be permitted because the physicians would not be accessing information for treatment purposes. - CORRECT ANSWER c. Access can be permitted providing that appropriate safeguards are put in place to protect against threats to security. Ted and Mary are the adoptive parents of Susan, a minor. What is the best way for them to obtain a copy of Susan's operative report? a. Wait until Susan is 18 b. Present an authorization signed by the court that granted the adoption c. Present an authorization signed by Susan's natural (birth) parents d. Present an authorization that at least one of them (Ted or Mary) has signed - CORRECT ANSWER d. Present an authorization that at least one of them (Ted or Mary) has signed What is the legal term used to define the protection of health information in a patient-provider relationship? a. Access b. Confidentiality c. Privacy d. Security - CORRECT ANSWER b. Confidentiality Mr. Martin has asked his physician's office to review a copy of his PHI. His request must be responded to no later than ________ after the request was made. a. 90 days b. 60 days c. 30 days d. 6 weeks - CORRECT ANSWER c. 30 days Which of the following does not have to be included in a covered entity's notice of privacy practices? a. Description with one example of disclosures made for treatment purposes b. Description of all the other purposes for which a covered entity is permitted or required to disclose PHI without consent or authorization c. Statement of individual's rights with respect to PHI and how the individual can exercise those rights d. Patient's signature and e-mail address - CORRECT ANSWER d. Patient's signature and e-mail address The privacy officer was conducting training for new employees and posed the following question to the trainees to help them understand the rule regarding breach notification: "If a breach occurs, which of the following must be provided to the individual whose PHI has been breached?" a. The facility's notice of privacy practices b. An authorization to release the individual's PHI c. The types of unsecured PHI that were involved d. A promise to never do it again - CORRECT ANSWER c. The types of unsecured PHI that were involved A valid subpoena duces tecum seeking health records does not have to: a. Be signed by the plaintiff and defendant b. Include the date, time, and place of the requested appearance c. Include the case docket number d. The name of the issuing attorney - CORRECT ANSWER a. Be signed by the plaintiff and defendant The process that encodes textual material, converting it to scrambled data that must be decoded is a(n): a. Audit trail b. Encryption c. Password d. Physical safeguard - CORRECT ANSWER b. Encryption The technology, along with the policies and procedures for its use, that protects and controls access to ePHI are: a. Administrative safeguards b. Technical safeguards c. Physical safeguards d. Integrity controls - CORRECT ANSWER b. Technical safeguards Which of the following is required in a risk analysis according to the Security Rule? a. Determine the likelihood of threat occurrence and the potential impact b. Focus on improved efficiency c. Implement successful system migration and interoperability d. Develop a sustainable business plan - CORRECT ANSWER a. Determine the likelihood of threat occurrence and the potential impact Community Hospital wants to provide transcription services for transcription of office notes of the private patients of physicians. All of these physicians have medical staff privileges at the hospital. This will provide an essential service to the physicians as well as provide additional revenue for the hospital. In preparing to launch this service, the HIM director is asked whether a business associate agreement is necessary. Which of the following should the hospital HIM director advise to comply with HIPAA regulations? a. Each physician practice should obtain a business associate agreement with the hospital. b. The hospital should obtain a business associate agreement with each physician practice. c. Because the physicians all have medical staff privileges, no business associate agreement is necessary. d. Because the physicians are part of an Organized Health Care Arrangement (OHCA) with the hospital, no business associate agreement is necessary. - CORRECT ANSWER a. Each physician practice should obtain a business associate agreement with the hospital. Dr. Williams is on the medical staff of Sutter Hospital, and he has asked to see the health record of his wife, who was recently hospitalized. Dr. Jones was the patient's physician. Of the options listed here, which is the best course of action? a. Refer Dr. Williams to Dr. Jones and release the record if Dr. Jones agrees b. Inform Dr. Williams that he cannot access his wife's health information unless she authorizes access through a written release of information c. Request that Dr. Williams ask the hospital administrator for approval to access his wife's record d. Inform Dr. Williams that he may review his wife's health record in the presence of the privacy officer - CORRECT ANSWER b. Inform Dr. Williams that he cannot access his wife's health information unless she authorizes access through a written release of information The privacy officer was conducting training for new employees and posed the following question to the trainees to help them understand the rule regarding protected health information (PHI): "Which of the following is an element that makes information 'PHI' under the HIPAA Privacy Rule?" a. Identifies an attending physician b. Specifies the insurance provider for the patient c. Contained within a personnel file d. Relates to one's health condition - CORRECT ANSWER d. Relates to one's health condition Which of the following controls external access to a network? a. Access controls b. Alarms c. Encryption d. Firewall - CORRECT ANSWER d. Firewall A competent adult female has a diagnosis of ovarian cancer and while on the operating table suffers a stroke and is in a coma. Her son would like to access her health records from a clinic she recently visited for pain in her right arm. The patient is married and lives with her husband and two grown children. According to the Uniform Health Care Decisions Act (UHCDA), who is the logical person to request and sign an authorization to access the woman's health records from the clinic? a. Adult child making request b. Oldest adult child c. Patient d. Spouse - CORRECT ANSWER d. Spouse John Smith was seen in his primary care physician's office. When the provider attempted to call him with his laboratory results, he inadvertently called the incorrect John Smith and verbally provided him the lab result. Which of the following would apply to this situation in the context of b