I85PREP
⌘ K
RHIA study materials
RHIA study resources

RHIA practice questions

One question at a time. Build your RHIA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Governance

What is the primary purpose of a data governance program in a healthcare organization?

  1. To set authority, policy, and accountability for enterprise data Correct answer.
  2. To replace the privacy officer during internal audits
  3. To increase the number of electronic documents scanned into the EHR
  4. To assign coding queries to clinical documentation specialists

Explanation

Data governance establishes decision rights, policies, standards, and accountability for managing data as an enterprise asset. It is not an operational task such as scanning, coding queries, or audit substitution.

Question 2Information Governance

Which data quality characteristic confirms that a patient's date of birth is entered in the same format across systems?

  1. Timeliness
  2. Relevance
  3. Consistency Correct answer.
  4. Granularity

Explanation

Consistency means the same data element is represented uniformly across systems and time. Format uniformity for date of birth is a classic example of consistency, not timeliness, relevance, or granularity.

Question 3Information Governance

Which document is generally considered part of the legal health record in an acute care hospital?

  1. The hospital's marketing brochure
  2. The billing office's internal pricing spreadsheet
  3. The EHR documentation created at the point of care Correct answer.
  4. The patient's signed authorization for release of information

Explanation

The legal health record includes records created and used to document patient care. Internal pricing spreadsheets, release authorizations, and marketing materials are not clinical documentation of care.

Question 4Information Governance

Retention schedules for health records are primarily driven by which combination?

  1. Staffing levels and storage capacity
  2. Patient preference and physician availability
  3. Insurance contract terms and vendor contract provisions
  4. Legal requirements, accreditation standards, and policy Correct answer.

Explanation

Retention periods must satisfy federal and state legal requirements, accreditation standards, and the organization's own record retention policy. Operational constraints such as staffing or storage capacity do not determine the legal retention period.

Question 5Information Governance

What is the primary function of the master patient index (MPI)?

  1. To track employee access to the EHR
  2. To calculate case-mix index for reimbursement
  3. To store scanned images of insurance cards
  4. To link patient records across systems Correct answer.

Explanation

The MPI is an enterprise index that identifies each patient and links that patient's records across systems. It is not a reimbursement calculator, access-log tool, or image repository.

Question 6Information Governance

The HIPAA Privacy Rule permits use or disclosure of protected health information without authorization for which purpose?

  1. Treatment, payment, and health care operations Correct answer.
  2. Selling patient data to a research firm
  3. Sharing with a patient's employer about job duties
  4. Marketing a new wellness product

Explanation

HIPAA permits covered entities to use and disclose PHI without authorization for treatment, payment, and health care operations. Marketing, sale of PHI, and most employer disclosures require authorization or another specific legal basis.

Question 7Information Governance

The principle of least privilege means that workforce members should receive:

  1. Minimum access needed to perform job duties Correct answer.
  2. Access to all EHR data to avoid delays
  3. Access based on their seniority in the organization
  4. Temporary access only during audits

Explanation

Least privilege limits access to the minimum necessary information and system permissions required for the job. Broad access, seniority-based access, or audit-only access does not reflect this principle.

Question 8Information Governance

Under HIPAA, de-identified health information must:

  1. Not identify an individual and leave no reasonable basis to re-identify Correct answer.
  2. Be approved by the patient in writing before any use or disclosure occurs
  3. Remove only the patient's name and address from the record before any use
  4. Be encrypted and stored only on paper

Explanation

HIPAA de-identification requires that the information not identify an individual and that there be no reasonable basis to believe it can be used to identify the individual. Removing only name and address is insufficient, and de-identification does not require patient approval.

Question 9Information Governance

A patient requests a copy of her discharge summary. The hospital uses an EHR. Under HIPAA, how must the hospital respond?

  1. Require the patient to pick up paper copies in person
  2. Provide it in the requested format if readily producible Correct answer.
  3. Charge a fee equal to the hospital's total cost of maintaining the EHR
  4. Deny the request because discharge summaries are outside the designated record set

Explanation

HIPAA gives patients a right to access their records in the form and format requested when readily producible, or in a readable alternative if not. Fees must be reasonable and cost-based, not the total cost of maintaining the EHR.

Question 10Information Governance

A patient asks for an accounting of disclosures. Which disclosure must be included?

  1. A public health disclosure required by law Correct answer.
  2. A disclosure to the patient's treating physician for care
  3. A disclosure to the patient's health plan for payment
  4. A disclosure authorized by the patient in writing

Explanation

The accounting of disclosures includes certain disclosures made without authorization, such as required public health disclosures. Disclosures for treatment, payment, and health care operations, and disclosures authorized by the patient, are generally excluded.

Question 11Information Governance

A coder needs to review records for billing. Which action best applies the minimum necessary standard?

  1. Reviewing all records in the department to identify patterns
  2. Accessing only the records and data elements needed for coding Correct answer.
  3. Sharing the full record with the billing vendor by unencrypted email
  4. Allowing the coder unrestricted EHR access for efficiency

Explanation

The minimum necessary standard requires limiting access to the least amount of PHI needed for the task. A coder should access only the records and data elements required for coding, rather than unrestricted or excessive access.

Question 12Information Governance

A laptop containing unencrypted PHI is stolen from an employee's car. The organization determines a low probability that PHI was compromised. What is the appropriate next step?

  1. Post a notice on the organization's website for 30 days
  2. Notify every patient in the organization immediately
  3. Do not document the incident because the risk is low
  4. Document the risk assessment and retain incident records Correct answer.

Explanation

A covered entity must perform a risk assessment to determine whether a breach occurred. If it demonstrates a low probability of compromise, individual notification is not required, but the incident and assessment must be documented.

Question 13Information Governance

A patient signs an authorization to release records to an attorney. Which element must the authorization contain to be valid under HIPAA?

  1. A description of the information disclosed Correct answer.
  2. The hospital's complete fee schedule
  3. The patient's employer identification number
  4. The attorney's billing rate

Explanation

A valid HIPAA authorization must describe the information to be used or disclosed, among other required elements. Employer identification numbers, attorney billing rates, and hospital fee schedules are not required authorization elements.

Question 14Information Governance

During a duplicate record review, two MPI entries are found for the same patient with different blood types. Which action should the HIM professional take first?

  1. Change the blood type to match the most recent laboratory result without review
  2. Merge the records and keep the first blood type entered
  3. Investigate the source documents and correct the erroneous data before merging Correct answer.
  4. Delete both records and ask the patient to re-register

Explanation

Data integrity requires resolving conflicting clinical information from source documents before merging duplicates. Merging or overwriting without investigation could propagate erroneous data and create safety risks.

Question 15Information Governance

Legal counsel notifies HIM that a lawsuit is pending involving a patient. What should happen to the patient's records?

  1. Destroy records according to the normal retention schedule
  2. Place the records on legal hold and suspend routine destruction Correct answer.
  3. Move the records to an offsite archive with no access controls
  4. Release the complete record to the opposing attorney without authorization

Explanation

A legal hold requires the organization to preserve potentially relevant records and suspend routine destruction. Releasing records to opposing counsel or moving them without access controls would not be appropriate without legal direction.

Question 16Information Governance

A patient believes her allergy list is incorrect and requests an amendment. The provider disagrees. What must the organization do?

  1. Send the patient a new authorization form to complete and return to the provider
  2. Remove the allergy from the record without review
  3. Deny the request verbally and take no further action
  4. Provide a written denial and explain the right to file a disagreement Correct answer.

Explanation

When an amendment is denied, the organization must provide a timely written denial and inform the patient of the right to submit a statement of disagreement. A verbal denial or silent removal does not satisfy HIPAA amendment requirements.

Question 17Information Governance

A clinician posts a photo of a patient's unusual rash on a personal social media account after removing the patient's name. What is the best analysis?

  1. The image may still identify the patient, so the post may be impermissible Correct answer.
  2. The post is permissible if the clinician deletes it within 24 hours of posting
  3. The post is permissible because the name was removed
  4. The post requires only the clinician's supervisor's verbal approval before posting

Explanation

Removing the name does not necessarily de-identify an image; the patient or others may still be identifiable from the photo or context. Disclosures on social media require authorization or another permitted basis, and deletion later does not cure an impermissible disclosure.

Question 18Information Governance

A hospital is closing a clinic and must decide what to do with the clinic's health records. Which factor is most important in determining retention and disposition?

  1. The number of pages in each record
  2. The storage cost of the records
  3. State retention requirements and organizational policy Correct answer.
  4. The personal preferences of the clinic's former manager

Explanation

Retention and disposition must comply with applicable state law and the organization's approved retention policy. Cost, manager preference, and record size may affect logistics but not the required retention period.

Question 19Information Governance

A new employee will access PHI. Before granting EHR access, what should the organization verify?

  1. Completed privacy training and signed a confidentiality agreement Correct answer.
  2. The employee has worked at another hospital
  3. The employee has a personal laptop with current antivirus software installed
  4. The employee has a social media account

Explanation

Workforce members who access PHI should receive privacy and security training and be bound by confidentiality requirements before access is granted. Personal devices, prior employment, and social media accounts are not prerequisites for legitimate access.

Question 20Information Governance

A transcription vendor will handle PHI for a covered entity. What document is required?

  1. A patient authorization for each transcript
  2. A business associate agreement Correct answer.
  3. A notice of privacy practices
  4. A certificate of need

Explanation

A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate and requires a business associate agreement. Individual patient authorizations, certificates of need, and notices of privacy practices do not replace that contract.

Question 21Information Governance

A hospital's EHR vendor delays a patient's electronic access to protect market share. Which statement best reflects the ONC information blocking rules?

  1. Charging a reasonable fee to cover the cost of copying records for a patient
  2. Following a patient's request to restrict disclosure to a health plan
  3. Denying access when the request is infeasible under the privacy exception
  4. Delaying a patient's electronic access to protect market share Correct answer.

Explanation

Information blocking includes practices that are likely to interfere with access, exchange, or use of electronic health information, unless an exception applies. Delaying patient access to protect market share is a clear interference, while reasonable cost-based fees, privacy-based denials, and patient-requested restrictions may fall within recognized exceptions or rights.

Question 22Information Governance

An organization has policies for data quality but no assigned data owners, and departments resolve data conflicts independently. Which data governance maturity stage does this best illustrate?

  1. Defined with standardized metrics across the enterprise
  2. Managed with enterprise-wide data stewardship
  3. Initial/ad hoc with limited governance structure Correct answer.
  4. Optimized with continuous improvement and predictive analytics

Explanation

The absence of data owners and reliance on departmental, independent conflict resolution reflects an initial or ad hoc governance state. Managed, defined, and optimized stages require formal stewardship, enterprise standards, and continuous improvement.

Question 23Information Governance

During litigation, opposing counsel requests all electronic communications about a patient's care. The organization has a litigation hold. Which action is most appropriate?

  1. Suspend routine destruction and preserve relevant ESI Correct answer.
  2. Provide the entire email system to opposing counsel without any review or filtering
  3. Ask clinicians to forward only favorable emails to legal counsel
  4. Delete emails older than 90 days per the normal retention policy

Explanation

A litigation hold requires suspension of routine destruction and preservation of relevant electronically stored information. Counsel should coordinate collection and review; deleting, cherry-picking, or producing the entire email system without review is inappropriate.

Question 24Information Governance

A researcher wants to use a limited data set. Which statement is accurate?

  1. A limited data set is the same as fully de-identified information and has no restrictions
  2. A limited data set may include direct identifiers whenever the researcher is an internal employee
  3. A limited data set may include dates and city but requires a data use agreement Correct answer.
  4. A limited data set may be used for marketing without patient authorization

Explanation

A limited data set excludes direct identifiers but may include dates, city, state, ZIP code, and certain other elements. Its use requires a data use agreement, and it is not the same as fully de-identified information.

Question 25Information Governance

An audit log shows a nurse accessed the records of a neighbor who was not under her care. What is the most appropriate initial response?

  1. Ignore the access because the nurse is a trusted employee with system credentials
  2. Delete the audit log entry to protect the nurse's privacy and avoid conflict
  3. Investigate through sanctioned channels and apply policy as warranted Correct answer.
  4. Post the nurse's name on a staff bulletin board so coworkers can monitor her

Explanation

Unauthorized access should be investigated through the organization's sanctioned compliance and privacy processes, with sanctions applied according to policy if warranted. Ignoring, publicizing, or deleting evidence would undermine accountability and violate audit integrity.

Question 26Information Governance

A hospital creates a governance structure in which a senior business leader is accountable for the quality and use of patient registration data across departments. Which role does this describe?

  1. Data user
  2. Data custodian
  3. Data steward
  4. Data owner Correct answer.

Explanation

A data owner is the senior accountable leader for a defined data domain and has authority over its standards, quality, and use. Data stewards and custodians carry out operational and technical responsibilities rather than owning the domain.

Question 27Information Governance

Which set of records is generally considered a hospital's legal health record?

  1. The organization's designated official record of care Correct answer.
  2. Only records the patient has authorized for release
  3. Only the paper records maintained in the HIM department
  4. Every record in the EHR, including shadow charts and administrative emails

Explanation

The legal health record is the record the organization designates as its official business record of care, as defined in policy. It may include paper and electronic components but does not automatically include every item stored in the EHR.

Question 28Information Governance

A data quality team measures the percentage of patient records that contain a value in the race field. Which data quality dimension is the team evaluating?

  1. Completeness Correct answer.
  2. Accuracy
  3. Consistency
  4. Timeliness

Explanation

Completeness measures whether required data elements are present. Accuracy concerns whether the recorded value is correct, timeliness concerns availability when needed, and consistency concerns agreement across sources.

Question 29Information Governance

A state requires adult hospital records to be kept for seven years after discharge and records of minors for seven years after the patient reaches the age of majority. A patient is discharged at age 10. Under this schedule, when may the record be destroyed at the earliest?

  1. When the patient reaches the age of majority, regardless of discharge date
  2. Twenty-five years after discharge
  3. Seven years after the patient turns 18 Correct answer.
  4. Seven years after discharge

Explanation

For a minor, the retention period typically begins when the patient reaches the age of majority, not at discharge. The patient reaches majority at 18, and the record must then be kept for seven more years.

Question 30Information Governance

Which method is most appropriate for destroying PHI on a decommissioned hospital server's hard drive before disposal?

  1. Deleting the files and emptying the recycle bin
  2. Overwriting only the patient folders
  3. Media sanitization by degaussing or physical destruction Correct answer.
  4. Reformatting the drive once

Explanation

PHI must be destroyed so that it cannot be reconstructed, and media sanitization or physical destruction is appropriate for storage devices. Deleting files, reformatting, or overwriting selected folders may leave recoverable data.

Question 31Information Governance

A hospital wants a single, consistent definition of "active patient" used by every EHR report. Where should the definition be documented?

  1. In the notice of privacy practices
  2. In the enterprise data dictionary Correct answer.
  3. In the EHR vendor's marketing brochure
  4. In each department's local procedure manual

Explanation

An enterprise data dictionary documents standard definitions, formats, and business rules for data elements so that reports use consistent meaning. Local manuals or vendor materials do not provide enterprise-wide control.

Question 32Information Governance

An organization's governance committee must resolve a conflict between the oncology service line and finance over the definition of "chemotherapy episode." Which action best reflects good data governance?

  1. Escalate to the governance council for an enterprise definition Correct answer.
  2. Let each department keep its own definition in its own reports
  3. Ask the EHR vendor to choose the definition for the organization
  4. Have HIM decide alone without clinical or finance input

Explanation

Data governance provides an accountable, cross-functional decision body for resolving enterprise data conflicts. The council should apply the organization's standards and document a single approved definition.

Question 33Information Governance

A hospital patient tells the admission clerk that she does not want her presence disclosed in the facility directory. What is the effect of that request?

  1. She may no longer receive visitors or telephone calls
  2. The hospital must obtain a signed authorization before providing treatment
  3. Her information is excluded from the directory and not disclosed to callers by name Correct answer.
  4. The hospital may still confirm her presence to anyone who asks by name

Explanation

When a patient objects to directory inclusion, the hospital may not include the patient's information in the directory or disclose it to callers or visitors who ask by name. The patient may still receive visitors she chooses to see.

Question 34Information Governance

Which statement about a covered entity's Notice of Privacy Practices is correct?

  1. It may omit state-law requirements if it includes federal requirements
  2. It must be signed by every patient before treatment can begin
  3. It describes patient rights and the entity's privacy duties Correct answer.
  4. It applies only to paper records

Explanation

The notice explains how the entity may use and disclose PHI and describes patient rights and the entity's legal duties. It is not a consent form that patients must sign before treatment.

Question 35Information Governance

A 16-year-old presents to the emergency department with her mother. State law allows the teen to consent to her own treatment for this condition. Who generally may exercise the patient's privacy rights for this visit?

  1. The patient, who consented to her own care under state law Correct answer.
  2. The mother, because the patient is a minor and lacks all privacy rights
  3. The patient's primary care physician
  4. The hospital administrator

Explanation

When a minor may lawfully consent to her own treatment, she generally may exercise privacy rights related to that care. A parent is not automatically the personal representative for that particular treatment.

Question 36Information Governance

A patient's record includes substance use disorder treatment information from a federally assisted program. The patient has signed a standard HIPAA authorization for release to an employer. What additional requirement generally applies?

  1. The employer must be a covered entity
  2. The consent must satisfy 42 CFR Part 2 requirements and redisclosure limits Correct answer.
  3. The information may be released only with a court order
  4. No additional requirement; the HIPAA authorization is sufficient

Explanation

Substance use disorder records from federally assisted programs are protected by 42 CFR Part 2, which imposes specific consent elements and redisclosure restrictions beyond a standard HIPAA authorization. A court order is not the only permissible route to disclosure.

Question 37Information Governance

A hospital receives a subpoena for a patient's records in a civil lawsuit. The subpoena is not accompanied by a court order or patient authorization. What should HIM do first?

  1. Ignore the subpoena because subpoenas never require disclosure
  2. Release the records immediately because a subpoena is a legal demand
  3. Check whether the subpoena includes satisfactory notice or a protective order Correct answer.
  4. Destroy the records to avoid litigation

Explanation

For judicial and administrative proceedings, HIPAA generally requires a court order or satisfactory assurance that the patient has been notified and can object, or a qualified protective order. A subpoena alone is not automatic authority to disclose.

Question 38Information Governance

A patient asks that appointment reminders be sent only to a mobile phone number, not to the home address. How should the organization respond?

  1. Accommodate the reasonable request without requiring an explanation Correct answer.
  2. Deny the request because patients cannot choose how PHI is used
  3. Require the patient to pay a fee before changing the contact method
  4. Report the request to law enforcement

Explanation

Patients may request confidential communications by alternative means or at an alternative location, and a covered entity must accommodate reasonable requests. The patient is not required to explain why the request is being made.

Question 39Information Governance

A hospital plans to decommission a legacy EHR. Which action best demonstrates defensible information governance for the legacy data?

  1. Delete all legacy data once the new EHR goes live
  2. Move all legacy data into the new EHR without mapping
  3. Retain per schedule, document the data map, and preserve required access Correct answer.
  4. Store the legacy data on unmanaged personal drives

Explanation

Legacy data must remain available for the required retention period and for legal, clinical, and audit needs. Good governance includes documenting the data map and planned access method before decommissioning.

Question 40Information Governance

A registration supervisor notices repeated duplicate entries from a new clerk. Which action is the best example of data stewardship?

  1. Ask the vendor to remove the duplicate-check feature
  2. Coach the clerk, provide targeted training, and monitor data quality Correct answer.
  3. Disable the clerk's EHR access permanently
  4. Ignore the duplicates until an analyst cleans them later

Explanation

Data stewardship involves actively improving the quality and responsible handling of data. Targeted coaching addresses the source of repeated entry errors, while monitoring checks whether the intervention improves record quality.

Question 41Compliance with Uses and Disclosures of PHI

A covered entity may use or disclose protected health information without the patient's written authorization for which purpose?

  1. Selling a patient list to an outside vendor
  2. Sharing psychotherapy notes with a researcher
  3. Treatment, payment, and health care operations Correct answer.
  4. Marketing a new service to current patients

Explanation

The Privacy Rule permits use and disclosure of PHI for treatment, payment, and health care operations without authorization. Marketing, sale of PHI, and most disclosures of psychotherapy notes fall outside those purposes and generally require authorization.

Question 42Compliance with Uses and Disclosures of PHI

A hospital submits a claim to a patient's health plan. What does the minimum necessary standard require for this disclosure?

  1. Limiting the PHI to the least amount reasonably needed for payment Correct answer.
  2. Giving the patient a copy of every claim submitted
  3. Sending the complete medical record so future requests are avoided
  4. Obtaining a new authorization before each claim is submitted

Explanation

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI to the least amount needed to accomplish the purpose. Payment to a health plan is subject to that standard.

Question 43Compliance with Uses and Disclosures of PHI

How must a covered health care provider make its Notice of Privacy Practices available to patients?

  1. Only when a records request is submitted
  2. At the first service delivery and upon request Correct answer.
  3. Only during an accreditation survey
  4. Only after a privacy complaint is filed

Explanation

Direct treatment providers must furnish the notice no later than the first service delivery and must provide a copy on request, and they must post it. They must also make a good faith effort to obtain the patient's written acknowledgment of receipt.

Question 44Compliance with Uses and Disclosures of PHI

Under the HIPAA Breach Notification Rule, how long does a covered entity have to notify affected individuals after discovering a breach of unsecured PHI?

  1. Within 24 hours
  2. Within 30 days
  3. Within 60 days Correct answer.
  4. Within 10 business days

Explanation

Individual notice must be provided without unreasonable delay and no later than 60 days after discovery of the breach. The 60-day clock begins when the breach is discovered, not when the investigation concludes.

Question 45Compliance with Uses and Disclosures of PHI

HIPAA protections for the protected health information of a deceased individual continue for how long after death?

  1. Indefinitely, with no time limit
  2. Until the estate is closed
  3. 7 years
  4. 50 years Correct answer.

Explanation

The Privacy Rule protects the PHI of a deceased individual for 50 years after the date of death. During that period, authorization from the personal representative or an exception to authorization is required.

Question 46Compliance with Uses and Disclosures of PHI

A state statute requires hospitals to report gunshot wounds to local police. The hospital may disclose the patient's PHI because:

  1. A state statute requires the disclosure Correct answer.
  2. Reporting is a health care operation
  3. Law enforcement is a covered entity
  4. The patient signed an authorization at registration

Explanation

The Privacy Rule permits disclosure when required by law, meaning a legal mandate that compels the covered entity to make the disclosure. A state reporting statute is a typical example of such a mandate.

Question 47Compliance with Uses and Disclosures of PHI

A hospital contacts former patients to solicit donations. What must each fundraising communication include?

  1. A signed authorization from every patient contacted
  2. Approval from an institutional review board
  3. A clear opportunity to opt out of future fundraising communications Correct answer.
  4. A statement that donor names will be published

Explanation

Fundraising communications may be made without authorization, but each communication must give the individual a clear and conspicuous opportunity to opt out, and the notice of privacy practices must describe the fundraising activity and the opt-out right.

Question 48Compliance with Uses and Disclosures of PHI

Under HIPAA, a covered entity must act on a patient's request for access to their PHI within how many days, assuming one permitted 30-day extension?

  1. 5 days
  2. 10 days
  3. 30 days Correct answer.
  4. 14 days

Explanation

A covered entity must provide access within 30 days of the request and may extend the deadline once by up to 30 additional days with written notice. The patient may also be given the records in the form and format requested if readily producible.

Question 49Compliance with Uses and Disclosures of PHI

Which element is required for a valid HIPAA authorization?

  1. The patient's insurance policy number
  2. A description of the information to be used or disclosed Correct answer.
  3. The name of the patient's attorney
  4. A witness signature from a family member

Explanation

A valid authorization must include core elements such as a description of the information, the names of the disclosing and receiving parties, the purpose, an expiration date or event, and the individual's signature. Required statements about the right to revoke and the potential for redisclosure must also appear.

Question 50Compliance with Uses and Disclosures of PHI

A patient who signed an authorization later decides to stop the disclosure. What is the patient's right?

  1. Wait until the authorization's expiration date passes
  2. Revoke it only at the next scheduled visit
  3. Obtain a court order canceling the authorization
  4. Revoke the authorization in writing unless action has already been taken Correct answer.

Explanation

An individual may revoke an authorization in writing at any time, except to the extent the covered entity has already relied on it. The authorization must tell the patient how to revoke and that revocation does not undo prior disclosures.