I85PREP
⌘ K
CEHRS study materials
CEHRS study resources

CEHRS practice questions

One question at a time. Build your CEHRS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Records Management, Documentation, and Auditing

In a hospital, which item is generally part of the legal health record?

  1. Billing office internal emails
  2. Provider care documentation Correct answer.
  3. The complete system audit trail
  4. The hospital staffing schedule

Explanation

The legal health record consists of documentation created during patient care that records decisions, services, and outcomes. Operational files such as audit trails, staffing schedules, and internal emails are maintained separately and are not routinely part of that record.

Question 2Records Management, Documentation, and Auditing

A state law requires records be kept 10 years. Facility policy says 7 years. Which retention period should be followed?

  1. 10 years, the legal minimum Correct answer.
  2. The shorter of the two periods
  3. 17 years, adding both periods
  4. 7 years, because policy applies

Explanation

Retention policy must meet or exceed the legal minimum; a shorter internal policy cannot override a longer statutory requirement. The facility should follow the 10-year period and update its policy if needed.

Question 3Records Management, Documentation, and Auditing

Which action authenticates an EHR progress note?

  1. Signing with a unique credential Correct answer.
  2. Having a colleague verbalize approval
  3. Using a shared unit password
  4. Applying a paper stamp later

Explanation

Authentication attributes an entry to a specific authorized user, usually through a unique login and electronic signature. Shared passwords, stamps, and verbal approval do not provide reliable attribution.

Question 4Records Management, Documentation, and Auditing

A clinician finds a factual error in a previously signed note. What is the best documentation practice?

  1. Overwrite the text without a trace
  2. Delete the original note and re-enter it
  3. Ask an administrator to alter it quietly
  4. Add a dated, signed addendum Correct answer.

Explanation

Corrections should preserve the original entry and add a clear, dated, signed amendment or addendum. Deleting, overwriting, or quietly altering a signed note compromises the record's integrity and audit trail.

Question 5Records Management, Documentation, and Auditing

Under HIPAA, which disclosure must be tracked in an accounting of disclosures?

  1. A disclosure for claims payment
  2. A disclosure made directly to the patient
  3. A disclosure for the patient's treatment
  4. A disclosure to public health Correct answer.

Explanation

The accounting of disclosures generally excludes disclosures for treatment, payment, and health care operations, and disclosures made directly to the patient. Public health reporting is a disclosure that must be tracked unless a specific exception applies.

Question 6Records Management, Documentation, and Auditing

What is the primary purpose of the master patient index?

  1. To schedule operating rooms
  2. To identify patients uniquely Correct answer.
  3. To calculate payer reimbursement
  4. To store scanned progress notes

Explanation

The master patient index links patient identifiers and medical record numbers so that records are retrieved for the correct person. It helps prevent duplicate records and misidentification but does not store progress notes or handle scheduling or reimbursement.

Question 7Records Management, Documentation, and Auditing

A facility requires history and physicals be completed within 24 hours of admission. Which practice best demonstrates compliance?

  1. Timestamping on-time completion Correct answer.
  2. Asking a colleague to sign later
  3. Backdating the note to admission day
  4. Waiting until discharge to document

Explanation

Timely documentation should be entered when care occurs and carry an accurate electronic timestamp. Backdating or having a colleague sign later misrepresents when the record was created.

Question 8Records Management, Documentation, and Auditing

When may paper health records be destroyed?

  1. After retention and approval Correct answer.
  2. Whenever storage space is needed
  3. After the patient's next visit
  4. At the end of the calendar year

Explanation

Records should be destroyed only after the retention period ends, legal holds are cleared, and required approvals are documented. Destroying records for storage convenience or on an arbitrary date creates legal and compliance risk.

Question 9Records Management, Documentation, and Auditing

A billing clerk needs information to process a claim. Which approach best follows the minimum necessary standard?

  1. Release every lab result to date
  2. Provide only the claim data needed Correct answer.
  3. Send the entire longitudinal record
  4. Include all provider progress notes

Explanation

The minimum necessary standard limits disclosures to the information reasonably needed for the purpose. A claim generally requires demographic, coding, and service data, not the entire chart or every result.

Question 10Records Management, Documentation, and Auditing

A patient's attorney sends a signed authorization for records. What should release-of-information staff verify first?

  1. The attorney's office location
  2. The presence of lab results
  3. The patient's unpaid balance
  4. The authorization's validity Correct answer.

Explanation

A valid HIPAA authorization must include required elements such as patient identification, description of information, purpose, recipient, expiration, signature, and right to revoke. Staff should validate those elements before releasing records.

Question 11Records Management, Documentation, and Auditing

An audit trail shows a user opened a celebrity's chart 20 times in one shift without a treatment relationship. What does this most likely indicate?

  1. A system backup failure
  2. A coding productivity metric
  3. A potential privacy breach Correct answer.
  4. Routine documentation review

Explanation

Access without a treatment, payment, or operations relationship can violate privacy rules and should be investigated. Repeated viewing of a celebrity's chart outside a business need is a common audit red flag.

Question 12Records Management, Documentation, and Auditing

Which statement distinguishes a HIPAA authorization from a general consent for treatment?

  1. Consent replaces the privacy notice
  2. Consent is required for every disclosure
  3. Authorization is purpose-specific Correct answer.
  4. Authorization is only for minors

Explanation

A HIPAA authorization is a detailed permission that specifies the information, purpose, recipient, expiration, and right to revoke. General consent for treatment covers routine care activities and does not replace an authorization for non-routine disclosures.

Question 13Records Management, Documentation, and Auditing

A nurse remembers a patient assessment from two days ago and enters it now. What should be documented?

  1. The actual date of the entry Correct answer.
  2. The date of the next shift
  3. No date, because it is late
  4. The date the care occurred only

Explanation

Late entries should be clearly labeled as late and include the date the entry is actually made. Recording only the care date without indicating the delay can make the record appear contemporaneous.

Question 14Records Management, Documentation, and Auditing

A facility receives notice of a lawsuit involving a patient. What should happen to that patient's records?

  1. They should be moved to active files
  2. They should be purged on schedule
  3. They can be edited to remove errors
  4. Preserve them under legal hold Correct answer.

Explanation

A legal hold suspends routine destruction and requires preserving potentially relevant records in their original form. Editing or purging records after litigation notice can result in sanctions.

Question 15Records Management, Documentation, and Auditing

A progress note contains an identical paragraph from a prior visit, including outdated findings. What is the documentation concern?

  1. The font is inconsistent
  2. Copied text may be inaccurate Correct answer.
  3. The note lacks a payer number
  4. The note uses structured data

Explanation

Copy-paste can carry forward stale findings and create a note that does not reflect the current encounter. Providers should verify and edit copied content so the record remains accurate.

Question 16Records Management, Documentation, and Auditing

Under HIPAA, who generally may authorize release of a minor's protected health information when the parent has legal custody?

  1. The minor's school nurse
  2. The family attorney automatically
  3. The parent or legal guardian Correct answer.
  4. Any adult sibling

Explanation

For an unemancipated minor, the parent or legal guardian generally serves as the personal representative under HIPAA, subject to state-law exceptions. Other individuals need separate legal authority or patient authorization.

Question 17Records Management, Documentation, and Auditing

An insurer asks for records to audit a paid claim. What is the most appropriate response?

  1. Send the full chart for the past decade
  2. Release claim-relevant records Correct answer.
  3. Refuse because payment was already made
  4. Release records without any review

Explanation

Payment-related disclosures remain subject to the minimum necessary standard, so only information relevant to the audited claim should be released. A blanket refusal ignores permissible payment activities.

Question 18Records Management, Documentation, and Auditing

Which statement is accurate about psychotherapy notes under HIPAA?

  1. Separate authorization is needed Correct answer.
  2. They are part of the designated record set
  3. They can be released for treatment automatically
  4. They are the same as medication orders

Explanation

Psychotherapy notes are maintained separately by a mental health professional and generally require a specific authorization for disclosure. They are not part of the routine designated record set used for treatment, payment, and operations disclosures.

Question 19Records Management, Documentation, and Auditing

Who generally can authorize release of a deceased patient's health information?

  1. Any former coworker
  2. Any hospital volunteer
  3. The nearest pharmacy technician
  4. A legal representative Correct answer.

Explanation

HIPAA protects a deceased patient's health information for 50 years after death, and the personal representative or executor generally may authorize release. Unrelated staff and others without legal authority cannot consent.

Question 20Records Management, Documentation, and Auditing

After a breach affecting 600 individuals, what documentation must the covered entity maintain?

  1. Only the IT repair ticket
  2. The risk assessment and log Correct answer.
  3. A list of employee birthdays
  4. Only the press release

Explanation

Breach documentation must include the risk assessment, investigative findings, and notifications, and it must be retained for six years. A press release or repair ticket alone does not demonstrate compliance.

Question 21Records Management, Documentation, and Auditing

During e-discovery, how should an EHR audit log be treated?

  1. As the patient's own property
  2. As a temporary file to delete
  3. As discoverable metadata Correct answer.
  4. As exempt because it is system data

Explanation

Audit logs are metadata that can show who accessed a record and when, making them potentially relevant in litigation. They should be preserved under legal hold and produced when properly requested.

Question 22Records Management, Documentation, and Auditing

An audit report shows many chart accesses at 2:00 a.m. by one user who works day shifts. What is the best first step?

  1. Ignore it because audits are routine
  2. Immediately terminate the employee
  3. Delete the audit log to avoid bias
  4. Verify the business purpose Correct answer.

Explanation

Anomalous access should be investigated by confirming the user's role, assignment, and business purpose before any disciplinary action. Deleting logs destroys evidence and is never appropriate.

Question 23Records Management, Documentation, and Auditing

A facility is merging with another organization that uses a longer retention schedule. Which approach best manages the records?

  1. Adopt the longer retention period Correct answer.
  2. Let each department choose freely
  3. Apply the shorter schedule to save space
  4. Destroy older records before the merger

Explanation

When retention schedules conflict, following the longer period generally satisfies both the legal minimum and the stricter organizational standard. Premature destruction or inconsistent department practice increases compliance risk.

Question 24Records Management, Documentation, and Auditing

A report shows the same patient with two medical record numbers. What is the best corrective action?

  1. Delete both records and start over
  2. Merge after verifying identity Correct answer.
  3. Leave both active to avoid data loss
  4. Use the newer number for all visits

Explanation

Duplicate medical record numbers fragment the chart and can cause treatment errors, so staff should verify identity and merge the records under policy. Deleting records or choosing one number alone can lose history and leave the duplicate unresolved.

Question 25Records Management, Documentation, and Auditing

A valid subpoena requests records without patient authorization. What should ROI staff do first?

  1. Refuse all subpoenas categorically
  2. Send records to any fax number listed
  3. Check legal sufficiency and notice Correct answer.
  4. Release the records immediately

Explanation

A subpoena must be reviewed for legal sufficiency, patient notice, and any protective order or state-law requirement before records are disclosed. Immediate release and blanket refusal are both inappropriate.

Question 26Records Management, Documentation, and Auditing

Which set of documents generally makes up a patient's legal health record?

  1. Only records the patient has signed a release to disclose
  2. Records used by providers to document care and treatment Correct answer.
  3. Only the billing claim and payment history
  4. Every email, draft, sticky note, and informal comment that mentions the patient

Explanation

The legal health record consists of records created and used by providers to document care, treatment, and clinical decisions. Incidental drafts, informal notes, and business records are not automatically part of that record unless the facility designates them.

Question 27Records Management, Documentation, and Auditing

Under HIPAA, which records are included in a designated record set?

  1. Medical, billing, and decision-making records about the individual Correct answer.
  2. Only records a patient has requested
  3. Only records stored in the EHR
  4. Only records the privacy officer has reviewed and approved for release

Explanation

A designated record set includes medical and billing records and other information used to make decisions about the individual. It is not limited to records kept in an electronic system or records already reviewed for release.

Question 28Records Management, Documentation, and Auditing

Which practice best supports contemporaneous documentation?

  1. Writing a summary at the end of each month
  2. Recording care at the time it is provided Correct answer.
  3. Entering notes only after billing is complete
  4. Waiting until discharge to record all assessments

Explanation

Contemporaneous documentation is created at or near the time of the event, while details are still fresh and accurate. Delaying entries increases the risk of omissions and memory errors.

Question 29Records Management, Documentation, and Auditing

Which method is acceptable for authenticating an EHR entry?

  1. Using a generic department login
  2. Signing with the patient's name
  3. Using the provider's unique user credentials Correct answer.
  4. Sharing a colleague's password with permission

Explanation

Each user must authenticate with unique credentials so entries can be attributed to the correct person. Shared or generic logins defeat accountability and audit trail reliability.

Question 30Records Management, Documentation, and Auditing

Which method is appropriate for disposing of paper records containing protected health information?

  1. Tearing them into four pieces
  2. Discarding them in regular trash after removing covers
  3. Cross-cut shredding or certified destruction Correct answer.
  4. Placing them in an unlocked recycling bin

Explanation

Paper records with protected health information must be rendered unreadable and unrecoverable before disposal. Shredding or using a certified destruction vendor meets that requirement.

Question 31Records Management, Documentation, and Auditing

Which activity is part of quantitative record analysis?

  1. Reviewing the narrative for consistency
  2. Judging whether the overall clinical plan is appropriate and well supported
  3. Comparing the diagnosis with the treatment plan
  4. Checking for missing signatures and required forms Correct answer.

Explanation

Quantitative analysis checks completeness and presence of required elements, such as signatures, dates, and forms. Qualitative analysis evaluates the content and clinical adequacy of documentation.

Question 32Records Management, Documentation, and Auditing

Which information should a certificate of destruction include?

  1. The records destroyed, date, method, and witness Correct answer.
  2. The names of all treating providers
  3. The insurance policy number and claim amount
  4. The patient's diagnosis, treatment dates, and discharge plan

Explanation

A certificate of destruction documents what was destroyed, when, by what method, and who witnessed the destruction. It supports accountability and compliance with the retention and disposal policy.

Question 33Records Management, Documentation, and Auditing

What is the purpose of indexing health records?

  1. To set the retention period for each record type and format
  2. To identify and locate records by patient and encounter Correct answer.
  3. To encrypt records during transmission
  4. To summarize the patient's clinical history

Explanation

Indexing provides consistent identifiers so records can be retrieved for the correct patient and encounter. Accurate indexing supports care, release of information, and auditing.

Question 34Records Management, Documentation, and Auditing

A facility is deciding how long to keep adult patient records. What should guide the decision?

  1. The number of volumes in the paper chart
  2. The patient's request for a copy
  3. The facility retention schedule and applicable state law Correct answer.
  4. The billing department's annual audit cycle and payer mix

Explanation

Retention periods are set by state law, facility policy, and applicable contractual or regulatory requirements. Patient requests and chart size do not determine the retention period.

Question 35Records Management, Documentation, and Auditing

A patient was treated at age 10. Which retention rule generally applies to the record?

  1. Destroy at the patient's 18th birthday or when the parent requests
  2. Destroy when the patient turns 21 regardless of state law
  3. Retain until the age of majority plus the statute of limitations Correct answer.
  4. Retain for one year after the last visit

Explanation

Records for minors are commonly retained until the patient reaches the age of majority plus the statute of limitations. This preserves the record for a period in which the patient could bring a claim.

Question 36Records Management, Documentation, and Auditing

A clinician remembers a missing assessment two days later. How should the late entry be documented?

  1. Ask a colleague to add the entry under their own login without comment
  2. Overwrite the original note with the new information
  3. Backdate the entry to the original date without a note
  4. Enter it now with the current date, time, and a late-entry notation Correct answer.

Explanation

Late entries must be clearly identified as late and dated when actually entered while preserving the original record. Backdating or overwriting destroys the integrity of the documentation.

Question 37Records Management, Documentation, and Auditing

After signing a note, a provider realizes an important finding was omitted. What is the appropriate action?

  1. Delete the signed note and re-enter a corrected version
  2. Add the finding without indicating it is later
  3. Add a dated addendum that identifies the addition Correct answer.
  4. Use correction fluid on the paper record

Explanation

An addendum preserves the original entry while documenting the later addition and its date. Deleting, altering, or silently adding information compromises record integrity.

Question 38Records Management, Documentation, and Auditing

A physician gives a verbal order by phone. What should the nurse do?

  1. Write the order on a sticky note for later entry
  2. Ask another nurse to sign the physician's name to the order
  3. Read back the order and document it with the prescriber's name Correct answer.
  4. Accept the order and document it after the shift

Explanation

Verbal orders should be verified by read-back and documented with the order, date, time, and prescriber. This reduces medication and treatment errors.

Question 39Records Management, Documentation, and Auditing

Which approach best supports a facility's audit log review program?

  1. Keep logs for 30 days and then delete them
  2. Review logs routinely and document follow-up on anomalies Correct answer.
  3. Review logs only when a patient complains
  4. Allow managers to edit logs before review to remove false alarms

Explanation

Audit logs should be reviewed on a routine schedule, with anomalies investigated and follow-up documented. Logs must remain intact and be retained according to policy.

Question 40Records Management, Documentation, and Auditing

A registration clerk needs to verify insurance but does not need clinical notes. What access should be assigned?

  1. Access to all records in the facility
  2. Temporary access to clinical notes for one year to cover absences
  3. Role-based access limited to registration information Correct answer.
  4. Full EHR access for all patients

Explanation

Access should follow the minimum necessary standard and the user's job role. A registration clerk needs registration and insurance data, not the full clinical record.

Question 41Records Management, Documentation, and Auditing

A progress note contains a copied paragraph that includes an old medication list. What should the clinician do?

  1. Leave it because the note was signed and the prior medication list is close enough
  2. Copy the paragraph into the next note as well
  3. Correct the note with an addendum and verify current information Correct answer.
  4. Delete the entire note to hide the error

Explanation

Copied text must be verified for accuracy before it is used, and inaccurate information should be corrected through an addendum. Copying forward outdated information can compromise patient safety and record integrity.

Question 42Records Management, Documentation, and Auditing

A physician has several unsigned records past the facility's completion deadline. What is the standard progression?

  1. Send reminders, then suspend admitting privileges per medical staff policy Correct answer.
  2. Allow the physician to sign with another provider's credentials to close the chart
  3. Delete the unsigned records after 30 days
  4. Release the records without signatures

Explanation

Incomplete records typically trigger reminders and, if unresolved, suspension of admitting or other privileges under medical staff policy. Records are not deleted, released unsigned, or signed by someone else.

Question 43Records Management, Documentation, and Auditing

A patient requests an accounting of disclosures. Which element must the accounting include?

  1. The patient's full billing history
  2. The name of every clinician who accessed the record
  3. The names of other patients in the same encounter
  4. The date, recipient, and purpose of each disclosure Correct answer.

Explanation

An accounting of disclosures must describe the date, recipient, and purpose of each disclosure, along with a description of the information disclosed. Internal access by clinicians for treatment is not the same as a disclosure requiring accounting.

Question 44Records Management, Documentation, and Auditing

A patient asks to amend a diagnosis in the record. What must the facility do first?

  1. Immediately change the record as requested
  2. Review the request and respond within the applicable time frame Correct answer.
  3. Delete the original diagnosis before review
  4. Refuse all amendment requests automatically because the record is the facility's property

Explanation

The facility must review the amendment request and respond within the applicable HIPAA time frame, either making the amendment or providing a written denial. The original record is not deleted before review.

Question 45Records Management, Documentation, and Auditing

A patient requests an electronic copy of records maintained in an EHR. What is the appropriate response?

  1. Require the patient to come in person with no alternative
  2. Provide the copy in the requested electronic format if readily producible Correct answer.
  3. Provide only a paper printout and charge for staff time and supplies used
  4. Refuse because the records belong to the facility

Explanation

Patients have a right to access their records, including an electronic copy when the information is maintained electronically and the format is readily producible. Fees must be reasonable and cost-based.

Question 46Records Management, Documentation, and Auditing

During an EHR downtime, staff record care on paper forms. What is the best practice after systems are restored?

  1. Enter the data promptly and note the original time and downtime source Correct answer.
  2. Discard the paper forms after the EHR is back online
  3. Enter the data under the current time only
  4. Ask the patient to confirm the entries verbally instead of entering them

Explanation

Downtime documentation remains part of the legal health record and should be entered promptly after restoration. The entry should preserve the original event time and indicate that it came from downtime documentation.

Question 47Records Management, Documentation, and Auditing

A patient falls, and the nurse completes an incident report. How should the incident report be handled?

  1. Give a copy to the patient with the discharge instructions
  2. Keep it in a separate risk-management file Correct answer.
  3. Destroy it after the patient is discharged
  4. File it in the health record as a progress note so the fall is documented

Explanation

Incident reports are risk-management documents and are generally kept separate from the legal health record. The clinical facts of the fall should be documented in the health record, but the incident report itself is not filed there.

Question 48Records Management, Documentation, and Auditing

A committee reviews cases for quality improvement. How should those records generally be managed?

  1. Destroy them immediately after the meeting to avoid discovery
  2. Keep them separate under state privilege rules Correct answer.
  3. File them in each patient's legal health record for easy access
  4. Post them in the staff break room for learning and discussion

Explanation

Quality improvement records are generally maintained separately from the legal health record and may be protected by state peer review or quality improvement privilege. Retention and access should follow those legal rules.

Question 49Records Management, Documentation, and Auditing

A facility denies a patient's amendment request because the record is accurate. What should the facility do?

  1. Change the record to avoid conflict with the patient
  2. Remove the patient's original request from the file after the denial is issued
  3. Provide a written denial and permit a statement of disagreement Correct answer.
  4. Tell the patient no explanation is required

Explanation

When an amendment is denied, the facility must provide a written denial with the reason and inform the patient of review rights. The patient may submit a statement of disagreement for inclusion in the record.

Question 50Records Management, Documentation, and Auditing

Which practice best protects record availability under the HIPAA Security Rule?

  1. Rely on staff memory and paper notes to recreate records after a crash
  2. Store backups only on the same server as the live data
  3. Delete backups weekly to save storage
  4. Maintain retrievable exact copies of EHR data and test restoration Correct answer.

Explanation

The contingency plan requires data backup, disaster recovery, and emergency mode operations, including exact retrievable copies of data. Restoration should be tested so the facility knows the backups work.