I85PREP
⌘ K
RHIT study materials
RHIT study resources

RHIT practice questions

One question at a time. Build your RHIT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data Content, Structure, and Information Governance

What is a primary purpose of an information governance program in a healthcare organization?

  1. To schedule clinical staff rotations each month
  2. To prepare and monitor the annual operating budget
  3. To assign accountability for information assets Correct answer.
  4. To install, configure, and maintain the network servers

Explanation

Information governance establishes decision rights and accountability for information assets so data are managed as an organizational resource. Server maintenance, budgeting, and staff scheduling are operational functions outside that governance scope.

Question 2Data Content, Structure, and Information Governance

A data dictionary primarily provides which of the following?

  1. Definitions and formats of data elements Correct answer.
  2. A catalog of hardware and software assets owned by IT
  3. A list of employees authorized to view patient records
  4. A schedule of planned record destruction dates by department

Explanation

A data dictionary documents each data element's name, definition, format, allowed values, and source so users interpret data consistently. Access lists, destruction schedules, and hardware inventories are separate governance artifacts.

Question 3Data Content, Structure, and Information Governance

The recorded weight is 170 lb, but the scale reading was 150 lb. Which data quality characteristic is deficient?

  1. Accuracy Correct answer.
  2. Timeliness
  3. Completeness
  4. Uniqueness

Explanation

Accuracy means the data reflect the true value. A recorded weight that differs from the measured weight is inaccurate even if the field is complete, timely, and unique.

Question 4Data Content, Structure, and Information Governance

What is the primary function of a master patient index (MPI)?

  1. To track employee training and certification records
  2. To store the complete full text of all clinical notes
  3. To identify each patient uniquely across systems Correct answer.
  4. To calculate reimbursement amounts for submitted claims

Explanation

The MPI maintains a unique identifier for each patient and links identifiers across systems to support correct record retrieval. It does not store full notes, calculate payment, or manage employee training.

Question 5Data Content, Structure, and Information Governance

Which is an example of a primary use of health information?

  1. Marketing analysis
  2. Public health surveillance
  3. Direct patient care Correct answer.
  4. Quality measure reporting

Explanation

Primary use is the original purpose for collecting data, which in healthcare is providing care to the patient. Public health surveillance, quality reporting, and marketing analysis reuse existing data for other purposes.

Question 6Data Content, Structure, and Information Governance

The Uniform Hospital Discharge Data Set (UHDDS) is best described as which of the following?

  1. A standard data set for inpatient discharges Correct answer.
  2. A federal regulation governing patient privacy
  3. A national registry for cancer case reporting
  4. A software platform used to schedule surgeries

Explanation

UHDDS is a standardized minimum data set for hospital inpatient discharges, supporting uniform collection and comparison. It is not a cancer registry, scheduling system, or privacy law.

Question 7Data Content, Structure, and Information Governance

Who typically performs day-to-day data quality monitoring and correction within a clinical department?

  1. Chief executive officer
  2. Patient
  3. Data steward Correct answer.
  4. External auditor

Explanation

Data stewards are designated staff who manage data quality and definitions in their area. The CEO, external auditors, and patients do not perform routine departmental data correction.

Question 8Data Content, Structure, and Information Governance

Which activity is a secondary use of health data?

  1. Reporting quality measures to a payer Correct answer.
  2. Administering a medication to a patient
  3. Documenting a progress note during a visit
  4. Ordering a laboratory test for a patient

Explanation

Secondary use applies existing health data for purposes other than direct care, such as quality reporting to a payer. Documenting, ordering, and administering medication are direct care activities.

Question 9Data Content, Structure, and Information Governance

How does a logical data model differ from a conceptual data model?

  1. It contains only narrative descriptions of business rules
  2. It specifies physical storage structures, file locations, and indexing methods
  3. It adds attributes, keys, and relationships without physical technology Correct answer.
  4. It is created only after the database is fully built and tested

Explanation

A conceptual model captures high-level entities and relationships, while a logical model adds attributes, keys, and relationships without specifying physical technology. Physical structures are defined later in the physical model.

Question 10Data Content, Structure, and Information Governance

A patient record has a missing discharge disposition field. Which data quality dimension is most directly affected?

  1. Consistency
  2. Timeliness
  3. Accuracy
  4. Completeness Correct answer.

Explanation

Completeness refers to whether required data elements are present. A missing discharge disposition is absent data, not necessarily inaccurate, late, or inconsistent.

Question 11Data Content, Structure, and Information Governance

What is the main purpose of data mapping?

  1. Mapping data elements between different systems Correct answer.
  2. Encrypting sensitive data during network transmission
  3. Deleting duplicate patient records from the database
  4. Compressing large data files to reduce storage costs

Explanation

Data mapping identifies how a data element in one system corresponds to an element in another, which is essential for exchange and integration. It does not encrypt, purge, or compress data.

Question 12Data Content, Structure, and Information Governance

The legal health record of a healthcare organization is best defined by which of the following?

  1. The complete contents of the EHR vendor database
  2. All email messages sent by clinicians to patients
  3. The patient's personal health record maintained at home
  4. Policy and law defining the business record Correct answer.

Explanation

The legal health record is defined by the organization's policies and applicable laws and includes the records that document care and business operations. It is not the entire vendor database, all clinician email, or the patient's personal record.

Question 13Data Content, Structure, and Information Governance

Which responsibility belongs to a data governance committee?

  1. Setting data access and quality policies Correct answer.
  2. Negotiating physician employment and compensation contracts
  3. Providing direct patient care in the outpatient clinic
  4. Repairing network hardware, servers, and workstations

Explanation

A data governance committee sets enterprise policies for data access, quality, definitions, and stewardship. Clinical care, hardware repair, and employment contracts fall outside its authority.

Question 14Data Content, Structure, and Information Governance

What is the primary purpose of a health information exchange (HIE)?

  1. To share health information among organizations Correct answer.
  2. To replace electronic health records with paper records
  3. To license physicians and other clinicians for practice
  4. To set national reimbursement rates for hospitals

Explanation

An HIE supports interoperable exchange of health information among providers and other organizations. It does not replace EHRs with paper, set payment rates, or license clinicians.

Question 15Data Content, Structure, and Information Governance

Which scenario best illustrates the timeliness dimension of data quality?

  1. The patient's address is recorded in a standard format
  2. A patient record contains no duplicate entries
  3. A lab result is available at the point of care Correct answer.
  4. A diagnosis code matches the physician documentation

Explanation

Timeliness means data are available when needed for decision-making. Availability of a lab result at the point of care demonstrates that dimension.

Question 16Data Content, Structure, and Information Governance

Metadata is best described as which of the following?

  1. Data that is encrypted and cannot be read without a key
  2. Data used exclusively for billing and claims purposes
  3. Data that has been permanently deleted from the system
  4. Data that describe other data Correct answer.

Explanation

Metadata are data about data, including definitions, formats, and provenance. They are not deleted, billing-only, or encrypted data.

Question 17Data Content, Structure, and Information Governance

Which factor is most important when establishing a record retention schedule?

  1. The number of employees in the HIM department
  2. The preference of the IT manager
  3. Legal, regulatory, and business requirements Correct answer.
  4. The storage capacity of the servers

Explanation

Retention schedules must satisfy legal, regulatory, and business needs, including statutes of limitation and payer requirements. Server capacity, staffing, and manager preference are not the governing basis.

Question 18Data Content, Structure, and Information Governance

What is the purpose of an audit trail in an EHR?

  1. To track record access and changes Correct answer.
  2. To improve the graphical user interface of the EHR
  3. To reduce the cost of long-term data storage
  4. To increase the speed of database queries and reports

Explanation

An audit trail records access and modifications with user identity and time stamps to support security and integrity. It does not exist to affect interface design, query speed, or storage cost.

Question 19Data Content, Structure, and Information Governance

Which is an example of unstructured health data?

  1. A laboratory result value
  2. A date of birth field
  3. A coded diagnosis field
  4. A free-text progress note Correct answer.

Explanation

Free-text progress notes are unstructured because they lack predefined fields. Coded diagnoses, numeric lab values, and dates are structured data elements.

Question 20Data Content, Structure, and Information Governance

How does data stewardship differ from data ownership?

  1. Stewardship grants legal title and ownership of the data
  2. Stewardship is limited to storage of paper records
  3. Stewardship is custody; ownership is accountability Correct answer.
  4. Ownership consists of performing routine data entry tasks

Explanation

Stewardship is the operational responsibility for data quality and custody, while ownership is accountability for the data asset. Stewardship does not confer legal title or apply only to paper.

Question 21Data Content, Structure, and Information Governance

Which information governance principle requires clearly defined roles and responsibilities for information across its lifecycle?

  1. Integrity
  2. Transparency
  3. Retention
  4. Accountability Correct answer.

Explanation

Accountability assigns clear roles and responsibilities for information throughout its lifecycle. Transparency concerns openness, integrity concerns accuracy and completeness, and retention concerns how long data are kept.

Question 22Data Content, Structure, and Information Governance

Which statement best distinguishes data validation from data verification?

  1. Validation checks defined rules; verification confirms accuracy against the source Correct answer.
  2. Validation confirms the data source, while verification checks the format
  3. Validation and verification are identical processes
  4. Validation is performed only on paper, while verification is performed only electronically

Explanation

Validation applies defined rules to data, such as range or format checks, while verification confirms that entered data match the source. They are complementary, not identical, processes.

Question 23Data Content, Structure, and Information Governance

A patient's date of birth is 05/10/1970 in the hospital EHR but 10/05/1970 in the clinic system. Which data quality issue does this illustrate?

  1. Consistency Correct answer.
  2. Completeness
  3. Timeliness
  4. Accessibility

Explanation

Consistency means the same data are represented the same way across systems. Conflicting dates of birth in two systems show an inconsistency, not missing, late, or inaccessible data.

Question 24Data Content, Structure, and Information Governance

Which component is part of data architecture?

  1. Annual marketing campaign plans and budgets
  2. Employee dress code and conduct policies
  3. Quarterly operating budgets and forecasts
  4. Data models and integration standards Correct answer.

Explanation

Data architecture comprises the models, standards, and structures that organize and integrate data across the enterprise. Marketing plans, dress codes, and budgets are not data architecture components.

Question 25Data Content, Structure, and Information Governance

In an enterprise master patient index (EMPI), what is the primary purpose of probabilistic matching?

  1. To encrypt patient identifiers during transmission
  2. To assign reimbursement codes to outpatient visits
  3. To delete all records that have missing data fields
  4. To link probable duplicate records for the same patient Correct answer.

Explanation

Probabilistic matching uses algorithms and weights to link records that likely refer to the same person when identifiers differ slightly. It does not delete records, encrypt identifiers, or assign reimbursement codes.

Question 26Data Content, Structure, and Information Governance

A data dictionary entry for the element "discharge disposition" would typically include which of the following?

  1. Names of the clinicians who documented the element
  2. Physical location of the server that stores the element
  3. Retention period required by the state licensing board
  4. Definition, data type, field length, and permitted values Correct answer.

Explanation

A data dictionary describes each data element in a database, including its definition, data type, field length, permitted or coded values, and the source of the data. It is a descriptive catalog of the data, not a log of who entered it or where the hardware sits. Retention rules and server details are governed by separate policies and technical documentation.

Question 27Data Content, Structure, and Information Governance

Which of the following is a primary data source for a hospital's clinical database?

  1. A state cancer registry report
  2. A claims file submitted to a payer
  3. The patient health record created during care Correct answer.
  4. A published clinical practice guideline

Explanation

Primary data sources are the original records generated at the point of care, such as the health record completed by providers during treatment. Claims files, registries, and published guidelines are secondary sources because they are derived from or compiled using data collected by someone else for another purpose.

Question 28Data Content, Structure, and Information Governance

Which document records a patient's preferences for future medical care in the event the patient loses decision-making capacity?

  1. The history and physical
  2. The operative report
  3. The discharge summary
  4. The advance directive Correct answer.

Explanation

An advance directive is completed by the patient to state preferences about future treatment, such as a living will or a durable power of attorney for health care. Operative reports, discharge summaries, and history and physical examinations are provider-generated documents describing care that has already occurred or is being planned.

Question 29Data Content, Structure, and Information Governance

Which terminology standard is designed to represent clinical findings and concepts in a computable form for use in the electronic health record?

  1. HCPCS Level II
  2. CPT
  3. SNOMED CT Correct answer.
  4. ICD-10-PCS

Explanation

SNOMED CT is a comprehensive clinical reference terminology built to encode findings, diagnoses, procedures, and other clinical concepts so systems can exchange and compute on them. ICD-10-PCS and CPT are procedure coding systems used mainly for billing, and HCPCS Level II covers supplies, drugs, and equipment.

Question 30Data Content, Structure, and Information Governance

A hospital is designing a relational patient table and needs a primary key. Which field is most appropriate?

  1. Patient insurance plan
  2. Patient date of birth
  3. Medical record number Correct answer.
  4. Patient home address

Explanation

A primary key must uniquely and consistently identify each row in a table, which the medical record number does for patients. Date of birth, address, and insurance plan can be shared by multiple patients or change over time, so they cannot guarantee uniqueness.

Question 31Data Content, Structure, and Information Governance

After the retention period expires, a hospital destroys a batch of paper records. Which documentation best demonstrates that the destruction was carried out appropriately?

  1. A certificate of destruction listing the records Correct answer.
  2. A copy of the retention schedule posted in the department
  3. A memo from the privacy officer to the staff
  4. A note in the department meeting minutes

Explanation

A certificate of destruction is the standard record that identifies what was destroyed, when, how, and by whom, providing evidence of compliant disposition. Meeting notes, posted schedules, and memos show that a policy exists but do not document that specific records were destroyed.

Question 32Data Content, Structure, and Information Governance

A hospital discharges 2,500 patients in a month. At the end of the month, 175 records remain incomplete more than 30 days after discharge. What is the record delinquency rate?

  1. 14 percent
  2. 7 percent Correct answer.
  3. 0.7 percent
  4. 5 percent

Explanation

The delinquency rate is the number of delinquent records divided by the number of discharges, then multiplied by 100: 175 divided by 2,500 equals 0.07, or 7 percent. This measure monitors how well the facility keeps documentation current within its completion policy.

Question 33Data Content, Structure, and Information Governance

A patient asks a hospital to amend an error in the health record. The hospital reviews the request and denies it. Under HIPAA, which action must the hospital take?

  1. File the request in the patient's billing record
  2. Delete the disputed entry from the record
  3. Accept a statement of disagreement into the record Correct answer.
  4. Refer the request to the state licensing board

Explanation

When an amendment is denied, HIPAA gives the patient the right to submit a written statement of disagreement, which the facility must retain and include with later disclosures of the disputed information. The original documentation is never removed, because the record must remain complete and accurate as a legal document.

Question 34Data Content, Structure, and Information Governance

An analyst finds an encounter record in the billing database with a patient identifier that does not exist in the patient table. Which database principle has been violated?

  1. Data granularity
  2. Field validation
  3. Referential integrity Correct answer.
  4. Record retention

Explanation

Referential integrity requires that a foreign key value in one table match an existing primary key value in the related table, so an encounter cannot point to a nonexistent patient. Granularity concerns the level of detail captured, field validation checks values at entry, and retention governs how long data are kept.

Question 35Access, Disclosure, Privacy, and Security

Under the HIPAA Privacy Rule, a covered entity may use or disclose protected health information without patient authorization for which purpose?

  1. Sale of the information to a marketing firm
  2. Research without any approval or waiver
  3. Treatment, payment, and operations Correct answer.
  4. Marketing a third-party product

Explanation

The Privacy Rule permits uses and disclosures for treatment, payment, and health care operations without authorization. Other purposes generally require a valid authorization, a waiver, or another specific permission.

Question 36Access, Disclosure, Privacy, and Security

Which element is required for a HIPAA-compliant authorization to disclose PHI?

  1. A description of the PHI to be disclosed Correct answer.
  2. An institutional review board approval number
  3. The patient's maiden name and place of birth
  4. A witness signature from a family member

Explanation

A valid authorization must include core elements such as a description of the information, the persons authorized to disclose and receive it, the purpose, an expiration date, and the patient's signature. It must also state the patient's right to revoke and other required notices.

Question 37Access, Disclosure, Privacy, and Security

The minimum necessary standard applies to most uses and disclosures, but it does not apply when PHI is disclosed:

  1. to a researcher under a data use agreement
  2. to a health plan for payment of a claim
  3. to the covered entity's attorney for a malpractice defense
  4. to a physician for treatment of the patient Correct answer.

Explanation

Minimum necessary does not apply to disclosures for treatment, disclosures to the individual, or disclosures made under a valid authorization. Payment, legal defense, and research disclosures are generally subject to the standard.

Question 38Access, Disclosure, Privacy, and Security

A patient submits a written request for access to her medical record. Under HIPAA, the covered entity must act on the request within how many days?

  1. 60
  2. 10
  3. 30 Correct answer.
  4. 15

Explanation

The covered entity must provide access within 30 days of the request. One 30-day extension is permitted if the entity notifies the patient in writing of the reasons and the expected date.

Question 39Access, Disclosure, Privacy, and Security

When a patient requests an accounting of disclosures, the covered entity generally must account for disclosures made during the prior:

  1. entire retention period
  2. six years Correct answer.
  3. three years
  4. ten years

Explanation

The accounting generally covers the six years before the request. Disclosures for treatment, payment, and operations are among those excluded from the accounting.

Question 40Access, Disclosure, Privacy, and Security

After discovering a breach of unsecured PHI, a covered entity must notify affected individuals without unreasonable delay and no later than how many days after discovery?

  1. 60 Correct answer.
  2. 90
  3. 120
  4. 30

Explanation

Individual notice must be provided no later than 60 days after discovery of the breach. Business associates must notify the covered entity within 60 days of discovering a breach at the associate.

Question 41Access, Disclosure, Privacy, and Security

A covered entity wants to rebut the presumption that an impermissible use of PHI is a breach. It may do so by demonstrating:

  1. a documented four-factor risk assessment shows low probability of compromise Correct answer.
  2. the patient has not complained about the incident
  3. every workforce member signed a confidentiality agreement
  4. the PHI was on a password-protected laptop whose password was on a note in the same bag

Explanation

The breach rule presumes an impermissible use or disclosure is a breach unless a documented risk assessment shows a low probability that the PHI was compromised. The assessment considers the nature and extent of the PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and the extent of mitigation.

Question 42Access, Disclosure, Privacy, and Security

Which is a required administrative safeguard under the HIPAA Security Rule?

  1. Encryption of all data at rest
  2. Mandatory biometric authentication
  3. A thorough security risk analysis Correct answer.
  4. Annual third-party penetration testing

Explanation

The Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to electronic PHI. Penetration testing, biometrics, and encryption are addressable or optional measures depending on the risk analysis.

Question 43Access, Disclosure, Privacy, and Security

A laptop containing PHI is stolen, but the PHI was encrypted according to NIST standards and the key was not stored with the laptop. What is the likely breach notification obligation?

  1. Notify all affected patients within 24 hours
  2. Notify only the Department of Health and Human Services
  3. No notification; the PHI is secured Correct answer.
  4. Notify the media immediately

Explanation

Encrypted PHI is not considered unsecured PHI when the encryption meets recognized standards and the key has not been compromised. The breach notification requirements therefore do not apply.

Question 44Access, Disclosure, Privacy, and Security

Which practice best implements role-based access control?

  1. Giving every employee administrator rights
  2. Limiting access to records needed for the job Correct answer.
  3. Sharing a single login credential among all front-desk staff members
  4. Using one generic account for the whole department

Explanation

Role-based access gives each user the minimum access needed for assigned duties. Shared or generic accounts undermine accountability and violate the minimum necessary principle.

Question 45Access, Disclosure, Privacy, and Security

An audit trail in an EHR should capture which set of data?

  1. A paper log kept at the nurses' station
  2. Only failed login attempts
  3. Only changes made by administrators
  4. User ID, date/time, record, and action Correct answer.

Explanation

Audit controls must record and examine activity in information systems containing electronic PHI. A useful audit trail identifies who accessed which record, when, and what action was taken.

Question 46Access, Disclosure, Privacy, and Security

A workforce member leaves a computer workstation unattended. The best security practice is to:

  1. share the password with a coworker
  2. leave the session open for the next user
  3. write the password on a sticky note
  4. log off or lock the workstation Correct answer.

Explanation

Workstations must be protected from unauthorized access, and locking or logging off prevents others from viewing or altering PHI. Sharing passwords or leaving sessions open defeats individual accountability.

Question 47Access, Disclosure, Privacy, and Security

Which method is acceptable for disposing of paper records containing PHI?

  1. Giving them to a new employee for scratch paper
  2. Putting them in a recycling bin without shredding
  3. Shredding or destroying the records Correct answer.
  4. Placing them intact in the regular trash

Explanation

PHI must be disposed of so that it cannot be reconstructed or read. Shredding, burning, or otherwise destroying paper records satisfies this requirement.

Question 48Access, Disclosure, Privacy, and Security

A covered entity contracts with a cloud vendor that stores EHR data on its behalf. What is required?

  1. A subpoena
  2. No agreement because the vendor is not a provider
  3. A written business associate agreement Correct answer.
  4. Only an oral promise of confidentiality

Explanation

A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate. A written business associate agreement must set out the permitted uses and required safeguards.

Question 49Access, Disclosure, Privacy, and Security

A hospital receives a subpoena for a patient's records in a civil lawsuit, with no court order and no patient authorization. The hospital should:

  1. Release only the billing record
  2. Release the full record immediately
  3. Ignore the subpoena
  4. Obtain satisfactory assurances or a protective order Correct answer.

Explanation

For a subpoena that is not accompanied by a court order, the covered entity must obtain satisfactory assurance that the patient has been notified or that a qualified protective order has been sought or issued. Without that assurance, disclosure is not permitted.

Question 50Access, Disclosure, Privacy, and Security

Who generally may exercise a patient's HIPAA rights on the patient's behalf?

  1. The patient's employer
  2. Only the patient's spouse
  3. A legally authorized personal representative Correct answer.
  4. Any coworker of the patient

Explanation

A personal representative, such as a parent of a minor, a guardian, a health care agent, or an executor, generally may exercise the patient's rights. Specific exceptions exist, including certain situations involving minors who consented to their own care.