I85PREP
⌘ K
CHCSP study materials
CHCSP study resources

CHCSP practice questions

One question at a time. Build your CHCSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Compliance Program Structure and Governance

A healthcare organization is building a compliance program from scratch. Which element should be established first because every other element depends on it?

  1. An annual employee satisfaction survey
  2. Adoption of written standards of conduct and policies by senior leadership Correct answer.
  3. A vendor price-comparison matrix
  4. A documented grievance procedure for patients

Explanation

Written standards of conduct and policies are the foundation of a compliance program; auditing, training, and discipline all reference them. Without adopted standards, other elements have no benchmark to enforce.

Question 2Compliance Program Structure and Governance

Which individual is expected to have day-to-day operational responsibility for a healthcare compliance program?

  1. The outside legal counsel
  2. The director of marketing
  3. The chair of the board audit committee
  4. The compliance officer Correct answer.

Explanation

The compliance officer runs the program day to day, including monitoring, training coordination, and reporting to leadership. The board oversees, and outside counsel advises, but neither operates the program.

Question 3Compliance Program Structure and Governance

A compliance officer reports to the chief financial officer, who also oversees the billing department that is under audit. What governance weakness does this structure create?

  1. It creates a conflict of interest that can compromise independence Correct answer.
  2. It increases the compliance officer's access to billing data
  3. It shortens the reporting cycle for audit findings
  4. It eliminates the need for a board audit committee

Explanation

Compliance independence is undermined when the compliance officer reports to an executive whose own area is being monitored. Independence is best preserved through a reporting line to the CEO, board, or a committee with authority over that executive.

Question 4Compliance Program Structure and Governance

Which activity best demonstrates that a governing board is exercising oversight of the compliance program?

  1. Approving the annual marketing budget
  2. Attending the organization's holiday events
  3. Receiving periodic compliance reports and asking substantive questions about risk Correct answer.
  4. Delegating all compliance decisions permanently to the compliance officer

Explanation

Board oversight is evidenced by receiving regular compliance reports, reviewing risk areas, and challenging management's responses. Passive delegation or unrelated activities do not show oversight.

Question 5Compliance Program Structure and Governance

An organization assigns compliance duties to a senior manager who already has a full-time operations role and no compliance training. Which principle is most at risk?

  1. The principle that compliance duties require adequate authority, resources, and competence Correct answer.
  2. The principle that all policies must be reviewed annually
  3. The principle that patients must receive written notice of privacy practices
  4. The principle that vendors must be competitively bid

Explanation

Compliance responsibilities must be paired with sufficient authority, time, and training to be effective. A manager without training or capacity cannot credibly carry out the function.

Question 6Compliance Program Structure and Governance

Which document typically establishes the compliance officer's authority and reporting relationship within an organization?

  1. The compliance program charter or written program description Correct answer.
  2. The patient consent form
  3. The annual financial statement
  4. The employee handbook's dress code section

Explanation

A charter or written program description formally defines the compliance officer's authority, duties, and reporting lines. This document anchors accountability and independence.

Question 7Compliance Program Structure and Governance

A compliance committee includes the compliance officer, the chief medical officer, nursing leadership, and the revenue cycle director. What is the primary governance value of this composition?

  1. It reduces the number of policies the organization must write
  2. It removes the need for board reporting
  3. It brings cross-functional authority and perspective to compliance decisions Correct answer.
  4. It guarantees that no compliance violations will occur

Explanation

A cross-functional committee gives compliance decisions credibility and reach across departments. Members can commit their areas to corrective actions and surface risks the compliance officer might not see alone.

Question 8Compliance Program Structure and Governance

Which statement best describes the relationship between a compliance program and an organization's code of conduct?

  1. The code of conduct is a core written standard within the compliance program Correct answer.
  2. The code of conduct applies only to executives
  3. The code of conduct is separate from and unrelated to the compliance program
  4. The code of conduct replaces the need for compliance training

Explanation

The code of conduct is one of the written standards that anchor the compliance program and set expectations for all workforce members. Training, monitoring, and discipline all reference it.

Question 9Compliance Program Structure and Governance

Senior leadership signs a memo stating that compliance is everyone's responsibility and that no business goal justifies a compliance violation. Which program element does this best illustrate?

  1. A vendor due diligence program
  2. A claims auditing protocol
  3. Visible leadership commitment and a culture of compliance Correct answer.
  4. A records retention schedule

Explanation

Tone at the top, expressed through clear messaging from leadership, is a recognized indicator of program commitment. It shapes culture and signals that compliance takes precedence over business targets.

Question 10Compliance Program Structure and Governance

A compliance officer wants to strengthen program governance after a series of small policy breaches in one department. Which action most directly addresses accountability?

  1. Shortening the patient intake form
  2. Adding more vendors to the approved list
  3. Applying consistent, documented disciplinary measures for violations Correct answer.
  4. Publishing the annual budget

Explanation

Enforcement and discipline are the program element that makes standards meaningful. Consistent, documented consequences show that violations carry real results regardless of seniority or revenue impact.

Question 11Compliance Program Structure and Governance

Which approach best supports effective communication of compliance standards across a large, multi-site healthcare system?

  1. Distributing the code of conduct only during onboarding
  2. Communicating standards only when a violation occurs
  3. Relying solely on a single intranet posting at headquarters
  4. Using multiple channels and languages tailored to the workforce and repeating key messages Correct answer.

Explanation

Effective compliance communication is ongoing, uses varied channels, and is adapted to the audience, including language and literacy needs. One-time or single-channel distribution is insufficient for a dispersed workforce.

Question 12Compliance Program Structure and Governance

A hospital wants to ensure employees can raise concerns without fear of retaliation. Which program feature is most directly designed for this purpose?

  1. A quarterly newsletter on financial performance
  2. A confidential or anonymous reporting hotline with a non-retaliation policy Correct answer.
  3. A supplier scorecard
  4. A mandatory overtime schedule

Explanation

Confidential reporting channels paired with explicit anti-retaliation protections encourage workforce members to raise concerns. Retaliation protection is essential for the channel to be trusted and used.

Question 13Compliance Program Structure and Governance

After a hotline report alleges that a manager falsified time records, what is the most appropriate first governance step?

  1. Immediately terminating the manager based on the report alone
  2. Conducting a documented, impartial investigation before determining consequences Correct answer.
  3. Forwarding the report to the manager's spouse for comment
  4. Ignoring the report because it came from an anonymous source

Explanation

Reports must be investigated promptly and impartially, with findings documented, before discipline is decided. Acting on an allegation alone risks unfairness, and disregarding anonymous reports undermines the channel.

Question 14Compliance Program Structure and Governance

A compliance officer presents an annual risk assessment to leadership that ranks billing accuracy, privacy, and vendor relationships by likelihood and impact. Which program element is being performed?

  1. Patient satisfaction measurement
  2. Periodic risk assessment used to prioritize compliance resources Correct answer.
  3. Board election of officers
  4. Disciplinary enforcement

Explanation

A risk assessment identifies and ranks compliance risks so that monitoring, training, and auditing can be targeted. It is a governance tool that directs limited resources to the highest-exposure areas.

Question 15Compliance Program Structure and Governance

An organization discovers that its compliance program has not been updated despite entering a new service line with different billing rules. What governance failure does this most directly represent?

  1. Failure to maintain the program as the organization's risk profile changes Correct answer.
  2. Failure to publish an annual newsletter
  3. Failure to reduce the number of vendors
  4. Failure to conduct employee satisfaction surveys

Explanation

Compliance programs must evolve with changes in services, regulations, and risk. Entering a new service line without updating policies, training, and monitoring leaves the program misaligned with actual risk.

Question 16Compliance Program Structure and Governance

Which arrangement best supports the compliance officer's ability to report serious issues directly to the board?

  1. Requiring all board contact to be pre-approved by the operations director
  2. Limiting the compliance officer to written memos filtered by marketing
  3. Providing a direct reporting channel to the board or its audit committee Correct answer.
  4. Requiring the compliance officer to route concerns through the billing manager

Explanation

Direct access to the board or audit committee protects the compliance officer's independence when issues involve senior management. Filtered or pre-approved channels can suppress serious concerns.

Question 17Compliance Program Structure and Governance

A compliance program description states that the compliance officer has authority to review any department's records and to require corrective action. Which governance attribute does this establish?

  1. A marketing approval workflow
  2. A facilities maintenance schedule
  3. A patient billing discount policy
  4. Delegated operational authority for the compliance function Correct answer.

Explanation

Granting the compliance officer access to records and power to require corrective action establishes the authority needed to function effectively. Authority must be documented so it can be exercised and defended.

Question 18Compliance Program Structure and Governance

A board audit committee receives compliance reports only once every three years. What is the most significant governance concern?

  1. The committee is receiving too much detail to review
  2. The compliance officer is overstepping authority
  3. The reporting frequency is too infrequent to provide meaningful oversight Correct answer.
  4. The reports should be sent to patients instead

Explanation

Oversight requires regular, timely information so the board can detect and respond to emerging risks. A three-year interval leaves long gaps in which serious issues could go unaddressed.

Question 19Compliance Program Structure and Governance

Which factor most strongly supports a culture in which employees raise compliance concerns early?

  1. Frequent changes to the compliance officer's reporting line
  2. Leaders who visibly model and reward compliant behavior Correct answer.
  3. Annual reminders that retaliation is prohibited but never enforced
  4. A policy library that is difficult to search

Explanation

Culture is shaped most by what leaders do and reward. Visible modeling and recognition of compliant behavior build trust and encourage early reporting.

Question 20Compliance Program Structure and Governance

An organization wants to document that its compliance program is operational rather than merely written. Which evidence is most persuasive?

  1. A list of planned future initiatives
  2. A signed policy manual without implementation records
  3. Training completion logs, monitoring reports, and documented corrective actions Correct answer.
  4. A statement that compliance is important in the annual report

Explanation

Operational effectiveness is shown by evidence of activity: who was trained, what was monitored, and what was fixed. Written policies and aspirational statements alone do not demonstrate that the program functions.

Question 21Compliance Program Structure and Governance

A compliance officer identifies that the same billing error keeps recurring despite annual training. Which governance response is most appropriate?

  1. Transfer the compliance officer to billing
  2. Discontinue monitoring of that billing area
  3. Analyze the root cause and adjust controls, monitoring, or training accordingly Correct answer.
  4. Repeat the same training and take no other action

Explanation

Recurring problems signal that the existing controls or training are not working. A root-cause analysis followed by targeted changes to controls or education addresses the underlying issue.

Question 22Compliance Program Structure and Governance

A compliance committee has no authority to require changes and can only make suggestions. Which governance weakness does this present?

  1. The committee is duplicating the board's fiduciary duties
  2. The committee has too much authority over clinical decisions
  3. The committee is improperly conducting patient care
  4. The committee cannot drive corrective action and may be ineffective Correct answer.

Explanation

A committee that can only suggest changes lacks the authority to ensure corrective action is implemented. Effective governance assigns clear authority and accountability for follow-through.

Question 23Compliance Program Structure and Governance

Which practice best protects the integrity of a compliance hotline in a small organization where everyone knows one another?

  1. Requiring callers to identify themselves to their direct supervisor
  2. Posting caller names on a shared bulletin board
  3. Limiting reports to written submissions signed by two witnesses
  4. Offering anonymous reporting and routing calls to an independent intake function Correct answer.

Explanation

In small organizations, fear of identification suppresses reporting. Anonymous intake routed to an independent function reduces that fear and protects confidentiality.

Question 24Compliance Program Structure and Governance

A new chief executive wants to demonstrate commitment to compliance in the first 90 days. Which action most credibly signals that commitment?

  1. Renaming the compliance department
  2. Delegating all compliance matters to the chief financial officer
  3. Issuing a one-time email that compliance matters
  4. Meeting with the compliance officer, reviewing the risk assessment, and funding priority remediation Correct answer.

Explanation

Credible commitment is shown through engagement and resource allocation: meeting the compliance officer, reviewing risks, and funding remediation. Symbolic gestures without resources are easily seen as hollow.

Question 25Compliance Program Structure and Governance

An organization's compliance program has strong policies and training but no mechanism to detect violations. Which element is missing?

  1. A code of conduct
  2. Monitoring, auditing, and reporting systems Correct answer.
  3. A board resolution
  4. A compliance committee charter

Explanation

Detection depends on monitoring, auditing, and reporting systems that surface problems. Policies and training set expectations but do not by themselves reveal noncompliance.

Question 26Compliance Program Structure and Governance

A regional clinic group adopts a compliance program built on the seven elements commonly used in healthcare compliance guidance. Which element requires the governing body to exercise reasonable oversight of the program's implementation and effectiveness?

  1. A process for responding to detected offenses and developing corrective action
  2. Ongoing auditing and monitoring of coding and billing activities
  3. Board and senior management oversight of the compliance program Correct answer.
  4. Written standards of conduct and policies describing compliance expectations

Explanation

The seven-element framework includes governing-body and senior-management oversight as a distinct element, meaning the board must exercise reasonable oversight rather than delegate the program entirely. Written standards, auditing and monitoring, and corrective action are separate elements that support but do not replace oversight.

Question 27Compliance Program Structure and Governance

A compliance officer position is funded at 0.4 full-time equivalent and the incumbent also manages the health information management department. Which governance concern does this arrangement raise most directly?

  1. The organization will be required to disclose the arrangement in its annual cost report
  2. The compliance officer may lack sufficient independence and resources to operate the program effectively Correct answer.
  3. The compliance officer will be unable to understand clinical documentation workflows
  4. The compliance officer cannot lawfully serve on any organizational committee

Explanation

Effective programs require a compliance officer with sufficient authority, resources, and independence from the operational areas being monitored. Combining the role with leadership of a department subject to compliance review creates a conflict of interest and limits available time.

Question 28Compliance Program Structure and Governance

A compliance committee charter states that the committee meets only when a member requests it, keeps no minutes, and reports to the compliance officer rather than to the board. Which revision would most improve governance?

  1. Establish a scheduled meeting cadence, require documented minutes, and route reporting to the board Correct answer.
  2. Require the compliance officer to approve all committee agendas in advance
  3. Allow the committee to set its own meeting frequency while leaving reporting lines unchanged
  4. Replace the committee with ad hoc workgroups convened by department managers

Explanation

Governance bodies need predictable meeting schedules, documented deliberations, and a reporting line that reaches the board so oversight is visible and continuous. Without minutes and a board reporting path, the committee cannot demonstrate that it functions as an oversight body.

Question 29Compliance Program Structure and Governance

A compliance officer at a mid-sized physician practice wants to demonstrate that the governing body is actively engaged in program oversight rather than merely receiving an annual packet. Which practice provides the strongest evidence of active board engagement?

  1. Distributing the compliance plan to board members once a year with a signature page
  2. Having the compliance officer present regular reports that include metrics, risk trends, and open issues for board discussion Correct answer.
  3. Posting the compliance plan on the organization's intranet for board access
  4. Inviting the board to attend the same annual compliance training required of all staff

Explanation

Active oversight is shown by recurring, substantive reporting that lets the board question metrics, risk trends, and unresolved issues. Passive distribution of documents or shared training does not demonstrate that the board exercises judgment about program effectiveness.

Question 30Compliance Program Structure and Governance

A health system's compliance officer reports to the general counsel, who also supervises the departments under compliance review and sets the legal strategy for responding to government inquiries. Which structural change best addresses the resulting governance risk?

  1. Adding a second compliance officer to share the reporting burden with the general counsel
  2. Requiring the general counsel to approve all compliance work plans before they begin
  3. Creating an independent reporting line from the compliance officer to the board or its audit committee Correct answer.
  4. Moving the compliance function into the finance department to separate it from legal

Explanation

When the compliance officer reports through an executive who controls the areas under review and shapes response strategy, the program's independence is compromised. An independent reporting line to the board or audit committee preserves objectivity and gives the officer a channel that bypasses conflicting operational authority.

Question 31Regulatory Compliance and Risk Assessment

Under the HIPAA Security Rule, which safeguard category specifically requires covered entities to implement policies for authorizing access to ePHI and for security incident response?

  1. Organizational requirements
  2. Physical safeguards
  3. Technical safeguards
  4. Administrative safeguards Correct answer.

Explanation

Administrative safeguards are the framework of policies and procedures managing ePHI protection, including the access authorization and security incident procedures implementation specifications. Physical safeguards address facility and device controls, while technical safeguards address the technology itself.

Question 32Regulatory Compliance and Risk Assessment

A covered entity discovers a breach of unsecured PHI affecting 300 individuals in one state. Which notification obligation applies under the HIPAA Breach Notification Rule?

  1. Notify affected individuals within 60 days and the Secretary only at the next annual filing
  2. Notify the Secretary annually only if the breach exceeds 500 individuals in the state
  3. Notify only affected individuals within 30 days and take no further action
  4. Notify affected individuals, the Secretary, and prominent media outlets without unreasonable delay and no later than 60 days after discovery Correct answer.

Explanation

Breaches affecting 500 or more residents of a state or jurisdiction require individual notice, Secretary notice, and prominent media notice, all without unreasonable delay and no later than 60 days after discovery. The 500-resident threshold triggers the media and immediate Secretary reporting duties.

Question 33Regulatory Compliance and Risk Assessment

Which element is required for an authorization to use or disclose PHI for research under the HIPAA Privacy Rule?

  1. A guarantee that the data will be destroyed after the study
  2. A notarized signature from the subject
  3. A description of the information to be used or disclosed Correct answer.
  4. A statement waiving all future revocation rights

Explanation

A valid HIPAA authorization must describe the PHI to be used or disclosed, state the purpose, identify recipients, and include expiration and revocation statements. It does not require notarization, permanent waiver of revocation, or a destruction guarantee.

Question 34Regulatory Compliance and Risk Assessment

A researcher wants to use a limited data set for a study. What must accompany the data to satisfy the Privacy Rule?

  1. A covered entity certification filed with the Secretary
  2. A business associate agreement with each subject
  3. A data use agreement with the recipient Correct answer.
  4. A full IRB waiver of authorization

Explanation

A limited data set may be disclosed for research, public health, or operations only with a data use agreement that restricts further use and disclosure. A full authorization or IRB waiver is not required for a limited data set when the data use agreement is in place.

Question 35Regulatory Compliance and Risk Assessment

Under the Common Rule, which statement correctly describes the requirement for obtaining legally effective informed consent?

  1. Consent is unnecessary whenever the study poses no more than minimal risk
  2. Consent must always be documented with a signed form even when the IRB waives documentation
  3. Consent must give the subject sufficient opportunity to discuss and consider whether to participate Correct answer.
  4. Consent may be obtained after the research intervention begins if the subject agrees verbally

Explanation

The Common Rule requires that consent provide sufficient opportunity to consider participation and minimize coercion, typically through adequate discussion. Documentation may be waived by the IRB in specified circumstances, and minimal risk alone does not eliminate the consent requirement.

Question 36Regulatory Compliance and Risk Assessment

Which criterion is NOT part of the Common Rule's criteria for IRB approval of research involving human subjects?

  1. Risks to subjects are minimized and reasonable in relation to anticipated benefits
  2. Informed consent will be sought and documented as required
  3. The sponsor's financial interests have been fully disclosed to all subjects Correct answer.
  4. Selection of subjects is equitable

Explanation

The Common Rule approval criteria address risk minimization, risk-benefit balance, equitable selection, consent, data monitoring, and privacy protections. Disclosure of sponsor financial interests to subjects is not one of the enumerated approval criteria, though conflict-of-interest rules may apply separately.

Question 37Regulatory Compliance and Risk Assessment

A study involving prisoners as subjects is proposed. Under the Common Rule, which additional condition must be satisfied for IRB approval?

  1. The sponsor must be a government agency
  2. The research presents no more than minimal risk to prisoners
  3. Prisoners must be enrolled only after release from custody
  4. Any possible advantages to prisoners are not of a magnitude that would impair their ability to weigh risks Correct answer.

Explanation

Subpart C requires that possible advantages to prisoners not be so large as to impair their ability to weigh risks and that risks be commensurate with risks accepted by nonprisoners. Minimal risk is not the governing threshold, and enrollment is not limited to post-release.

Question 38Regulatory Compliance and Risk Assessment

Under FDA regulations, which category of device study is exempt from the requirement for an investigational device exemption?

  1. A study of a device used to support a new marketing application
  2. A study of a significant risk device without prior approval
  3. A study of a device that is not yet legally marketed and presents significant risk
  4. A study of a nonsignificant risk device conducted under abbreviated requirements Correct answer.

Explanation

Nonsignificant risk device studies may proceed under abbreviated IDE requirements without a full IDE approval. Significant risk device studies require an approved IDE before initiation.

Question 39Regulatory Compliance and Risk Assessment

Which statement accurately describes the role of an institutional review board under FDA regulations for clinical investigations?

  1. The IRB serves as the sponsor's agent for monitoring investigator compliance
  2. The IRB reviews and has authority to approve, require modifications in, or disapprove research activities Correct answer.
  3. The IRB guarantees the safety of every investigational product
  4. The IRB issues marketing approval for the investigational product

Explanation

An IRB has authority to approve, require modifications in, or disapprove research, and to require progress reports. It does not act as the sponsor's agent, guarantee product safety, or grant marketing approval.

Question 40Regulatory Compliance and Risk Assessment

Under 21 CFR Part 50, when may an investigator obtain informed consent without the subject's signature?

  1. When the investigator determines the risk is minimal
  2. When the subject requests an oral consent process
  3. When the IRB waives the requirement for documentation of informed consent Correct answer.
  4. When the sponsor provides a waiver letter

Explanation

Documentation of informed consent may be waived only when the IRB approves a waiver under the specified criteria, such as minimal risk and no adverse effects on rights and welfare. Investigator, subject, or sponsor preference alone cannot waive documentation.

Question 41Regulatory Compliance and Risk Assessment

Which regulation governs the protection of human subjects in research conducted or supported by most federal departments under the Common Rule?

  1. 45 CFR 164
  2. 45 CFR 46 Subpart A Correct answer.
  3. 21 CFR Part 312
  4. 42 CFR Part 2

Explanation

The Common Rule is codified at 45 CFR 46 Subpart A and applies to federally conducted or supported human subjects research. 21 CFR Part 312 governs IND drug investigations, 45 CFR 164 contains HIPAA rules, and 42 CFR Part 2 covers substance use disorder records.

Question 42Regulatory Compliance and Risk Assessment

A covered entity's workforce member accesses a celebrity patient's record out of curiosity without a treatment, payment, or operations purpose. What is the most accurate characterization under HIPAA?

  1. A permitted disclosure because the patient is a public figure
  2. An impermissible disclosure and likely breach of unsecured PHI requiring risk assessment Correct answer.
  3. A minor incident that requires no documentation
  4. A permissible use because the workforce member is authorized to access the system

Explanation

Access without a treatment, payment, operations, or other permitted purpose is an impermissible use or disclosure. The entity must perform a breach risk assessment and document the incident, and celebrity status does not create a permitted purpose.

Question 43Regulatory Compliance and Risk Assessment

Which is a core element of the HIPAA Privacy Rule's minimum necessary standard?

  1. Requiring encryption of all PHI at rest
  2. Requiring patient consent for every internal use of PHI
  3. Prohibiting all disclosures to public health authorities
  4. Limiting PHI use and disclosure to the least amount reasonably necessary for the intended purpose Correct answer.

Explanation

The minimum necessary standard requires reasonable efforts to limit PHI to the least needed for the purpose, with exceptions such as treatment disclosures to providers. It does not require consent for every internal use, ban public health reporting, or mandate encryption.

Question 44Regulatory Compliance and Risk Assessment

A research subject's PHI will be shared with a contract research organization performing data analysis for the study. What agreement is generally required?

  1. A data use agreement
  2. A material transfer agreement
  3. A certificate of confidentiality
  4. A business associate agreement Correct answer.

Explanation

A contract research organization performing functions on behalf of a covered entity involving PHI is a business associate, so a business associate agreement is required. Data use agreements apply to limited data sets, and certificates of confidentiality address compelled disclosure protections.

Question 45Regulatory Compliance and Risk Assessment

Which statement best describes the risk assessment requirement under the HIPAA Security Rule?

  1. It must be filed with the Secretary annually
  2. It must be accurate and thorough, assessing potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability Correct answer.
  3. It must be performed by an external auditor to satisfy the rule
  4. It must be completed once and never repeated

Explanation

The Security Rule requires an accurate and thorough risk assessment of potential risks and vulnerabilities to ePHI, and it is an ongoing process rather than a one-time event. The rule does not mandate external auditors or annual filing with the Secretary.

Question 46Regulatory Compliance and Risk Assessment

Under the Common Rule, which research activity is likely to be exempt from IRB review?

  1. Research involving children as subjects
  2. Research involving prisoners
  3. Research involving a new drug requiring an IND
  4. Research involving survey procedures with adults where responses are recorded without identifiers and disclosure could not reasonably place subjects at risk Correct answer.

Explanation

Certain survey and interview research involving adults is exempt when identifiers are not recorded and disclosure would not reasonably place subjects at risk. Prisoner research, IND drug research, and research involving children are not exempt on those grounds.

Question 47Regulatory Compliance and Risk Assessment

Which element must a certificate of confidentiality provide to research subjects?

  1. A statement that the certificate does not prevent voluntary disclosure by the subject Correct answer.
  2. A guarantee that the data can never be subpoenaed under any circumstance
  3. A waiver of the subject's right to withdraw
  4. An authorization to disclose PHI for marketing

Explanation

Certificates of confidentiality protect against compelled disclosure of identifiable research information but do not prevent subjects from voluntarily disclosing their own information. They do not waive withdrawal rights or authorize marketing uses.

Question 48Regulatory Compliance and Risk Assessment

A researcher plans to enroll a child in a study that offers no prospect of direct benefit and involves more than minimal risk. Under Subpart D, which condition must be met for IRB approval?

  1. The research must offer a prospect of direct benefit to the child
  2. The research must be approved by the sponsor's medical monitor
  3. The research must present no more than minimal risk
  4. The research must present only a minor increase over minimal risk and likely yield generalizable knowledge about the subject's disorder or condition Correct answer.

Explanation

Under Subpart D, research without direct benefit that presents a minor increase over minimal risk may be approved if it is likely to yield generalizable knowledge about the subject's disorder or condition. Research involving more than minimal risk without benefit and beyond a minor increase requires additional federal review.

Question 49Regulatory Compliance and Risk Assessment

Which practice best supports compliance with the HIPAA Security Rule's audit controls standard?

  1. Requiring annual workforce training
  2. Implementing mechanisms that record and examine activity in systems containing or using ePHI Correct answer.
  3. Encrypting all ePHI backups
  4. Conducting an annual facility walkthrough

Explanation

Audit controls require hardware, software, or procedural mechanisms that record and examine activity in information systems containing or using ePHI. Encryption, training, and facility walkthroughs support other safeguards but do not satisfy audit controls.

Question 50Regulatory Compliance and Risk Assessment

Under the HIPAA Breach Notification Rule, which factor is part of the four-factor risk assessment used to determine whether an acquisition, access, use, or disclosure is a breach?

  1. The number of employees in the covered entity's workforce
  2. The state in which the covered entity is incorporated
  3. The covered entity's annual revenue
  4. The extent to which the risk to PHI has been mitigated Correct answer.

Explanation

The four-factor assessment considers the nature and extent of PHI involved, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent to which risk has been mitigated. Organizational size, revenue, and state of incorporation are irrelevant to the assessment.