Download RHIT DOMAIN 2 2026 EXAM and more Exams Management Information Systems in PDF only on Docsity!
RHIT DOMAIN 2 2026 EXAM BANK COMPLETE
(130) CURRENT TESTING QUESTIONS AND
DETAILED CORRECT ANSWERS|TOP-RATED
A+.
RHIT DOMAIN
Prepare for your RHIT Domain 2 Exam with this focused study guide. It covers health information management, data quality, coding, classification systems, and regulatory compliance. Emphasizes accurate recordkeeping, clinical documentation, and professional standards. Suitable for students and professionals preparing for the RHIT Domain 2 certification assessment. The process of releasing health record documentation originally created by a different provider is called: Privileged communication Subpoena Jurisdiction Redisclosure ✓ ✓ …… ANSWER …… d The process of releasing health record documentation originally created by a different provider is called redisclosure. Federal and state regulations provide specific redisclosure guidelines; however, when in doubt, follow the same principles as the release and disclosure guidelines for other types of health record information (Fahrenholz 2013a, 104).
When data has been lost in an EHR, which action is taken to remedy this problem? Build a firewall Data recovery Review the audit trail Develop data integrity plan ✓ ✓ …… ANSWER …… b Data recovery is the process of recouping lost data or reconciling conflicting data after the system fails. These data may be from events that occurred while the system was down or from backed-up data (Sayles and Trawick 2014, 213). Central City Clinic has requested that Ghent Hospital send its hospital records for Susan Hall's most recent admission to the clinic for her follow-up appointment. Which of the following statements is true? The Privacy Rule requires that Susan Hall complete a written authorization. The hospital may send only the discharge summary, history and physical, and operative report. The Privacy Rule's minimum necessary requirement does not apply. This "public interest and benefit" disclosure does not require the patient's authorization. ✓ ✓ …… ANSWER …… c
Cable locks Encryption ✓ ✓ …… ANSWER …… b In the HIPAA Security Rule, one of the technical safeguards standards is access control. This includes automatic log-off, which ensures processes that terminate an electronic session after a predetermined time of inactivity (Reynolds and Brodnik 2017, 277). Who owns the health record? Patient Provider who generated the information Insurance company who paid for the care recorded in the record No one ✓ ✓ …… ANSWER …… b Ownership of the health record has traditionally been granted to the provider who generates the record (Brodnik 2017a, 9). Which of the following is true regarding the development of health record destruction policies? All applicable laws must be considered The organization must find a way not to destroy any health records Health records involved in pending or ongoing litigation may be destroyed Only state laws must be considered ✓ ✓ …… ANSWER …… a
Not all information must be kept forever. Just as the HIM professional must consider multiple factors when determining retention, many factors must also be taken into consideration with regard to health record destruction. These include applicable federal and state statutes and regulations; accreditation standards; pending or ongoing litigation; storage capabilities; and cost (Rinehart-Thompson 2016a, 208). What is the biggest threat to the security of healthcare data? Natural disasters Fires Employees Equipment malfunctions ✓ ✓ …… ANSWER …… c Employees are the biggest threat to the security of healthcare data. Whether it is disgruntled employees destroying computer hardware, snooping employees accessing information without authorization to do so, or employees accessing information for fraudulent purposes, employees are a real threat to data security (Rinehart- Thompson 2016c, 256). Which of the following is not true about the Notice of Privacy Practices? It must include at least two examples of how information is used for both treatment and operations. It must include a description of the right to request restrictions on certain uses and disclosures. It must explain the patient's right to inspect and copy PHI. It must include a description of the patient's right to amend PHI. ✓ ✓ …… ANSWER …… a AHIMA outlines the requirements for the content of the
organization, what information physicians need as part of their treatment role (Thomason 2013, 5). Burning, shredding, pulping, and pulverizing are all acceptable methods in which process? Deidentification of electronic documents Destruction of paper-based health records Deidentification of records stored on microfilm Destruction of computer-based health records ✓ ✓ …… ANSWER …… b Because of cost and space limitations, permanently storing paper and microfilm-based health record documents is not an option for most hospitals. Acceptable destruction methods for paper documents include burning, shredding, pulping, and pulverizing (Fahrenholz 2013a, 111). Mary's PHI was breached by her physician office when it was disclosed in error to another patient. Which of the following breach notification statements is correct regarding the physician office's required action? It must report the breach to HHS within 60 days after the end of the calendar year in which the breach occurred It must report the breach to HHS within 60 days of the breach It must notify all local media outlets and HHS immediately It is not required to take any action since the breach affected only one person ✓ ✓ …… ANSWER …… a Since this breach applies to one patient, it must be reported to HHS within 60 days after the end of the calendar year (Rinehart-Thompson 2016b, 240). To ensure relevancy, an organization's security policies and procedures should be reviewed at least:
Once every six months Once a year Every two years Every five years ✓ ✓ …… ANSWER …… b All data security policies and procedures should be reviewed and evaluated annually to make sure they are up- to-date and still relevant to the organization (Rinehart- Thompson 2016c, 264). Which of the following laws created the HITECH act? Health Insurance Portability and Accountability Act American Recovery and Reinvestment Act Consolidated Omnibus Budget Reconciliation Act Healthcare Quality Improvement Act ✓ ✓ …… ANSWER …… b The American Recovery and Reinvestment Act of 2009 (ARRA) is considered one of the major health information technology laws that provided stimulus funds to the US economy
with acceptable business and legal rules (Johns 2015, 211). A secretary in the Nursing Office was recently hospitalized with ketoacidosis. She comes to the HIM department and requests to review her health record. Of the options here, what is the best course of action? Allow her to review her record after obtaining authorization from her. Refer the patient to her physician for the information. Tell her to go through her supervisor for the information. Tell her that hospital employees cannot access their own medical records. ✓ ✓ …… ANSWER …… a Review of records by the patient is permitted after the authorization for use and disclosure is verified. Usually hospital personnel should be present during on-site reviews to assist the requester with the paper record or working with the EHR if necessary. Assistance would not be needed if the people requesting on-site review work for the facility (Rinehart- Thompson 2016b, 225, 244). 130 Correct0 Wrong
Unanswered The HIPAA Privacy Rule: Protects only medical information that is not already specifically protected by state law Supersedes all state laws that conflict with it Is federal common law Sets a minimum (floor) of privacy requirements ✓ ✓ …… ANSWER …… d With the passage of the Privacy Rule, a minimum amount of protection (that is, a floor) was achieved uniformly across all the states through the establishment of a consistent set of standards that affected providers, healthcare clearinghouses, and health plans (Rinehart- Thompson 2017c, 210). The HIPAA Security Awareness and Training administrative safeguard requires all of the following addressable implementation programs for an entity's workforce except: Disaster recovery plan Log-in monitoring Password management Security reminders ✓ ✓ …… ANSWER …… a Another administrative safeguard specification requires that a covered entity implement a security awareness and training program for all members of its workforce. Special protections must be taken to ensure information is not inappropriately released or accessed. These protections include log-in monitoring, password management, and security reminders (Reynolds and Brodnik 2017, 274). A home health agency plans to implement a computer system whereby its nurses document home care services on
Identity management provides security functionality, including determining who (or what information system) is authorized to access information, authentication services, audit logging, encryption, and transmission controls (Amatayakul 2016, 307). Community Hospital is planning implementation of various elements of the EHR in the next six months. Physicians have requested the ability to access the EHR from their offices and from home. What advice should the HIM director provide? HIPAA regulations do not allow this type of access. This access would be covered under the release of PHI for treatment purposes and poses no security or confidentiality threats. Access can be permitted providing that appropriate safeguards are put in place to protect against threats to security. Access can be permitted because the physicians are on the medical staff of the hospital and are covered by HIPAA as employees. ✓ ✓ …… ANSWER …… c The HIPAA Privacy Rule permits healthcare providers to access protected health information for treatment purposes. However, there is also a requirement that the covered entity provide reasonable safeguards to protect the information. These requirements are not easy to meet when the access is from an unsecured location, although policies, medical staff bylaws, confidentiality or other agreements, and a careful use of new technology can mitigate some risks (Thomason 2013, 46). The director of health information services is allowed access
to the health record tracking system when providing the proper log-in and password. What is this access security mechanism called? Context based Role based Situation based User-based ✓ ✓ …… ANSWER …… d User-based access is a security mechanism that grants users of a system access based on their identity (Rinehart- Thompson 2016c, 262). Which of the following statements about the directory of patients maintained by a covered entity is true? Individuals must be given an opportunity to restrict or deny permission to place information about them in the directory. Individuals must provide a written authorization before information about them can be placed in the directory. The directory may contain only identifying information such as the patient's name and birth date. The directory may contain private information as long as it is kept confidential. ✓ ✓ …… ANSWER …… a
provided that he or she does so in writing. However, the revocation does not apply when the covered entity has already taken action on the authorization (Rinehart- Thompson 2017c, 223). The "custodian of health records" refers to the individual within an organization who is responsible for all except which of the following actions? Authorized to certify records Supervising inspection and copying of record Testifying to the authenticity of records Testifying regarding the care of the patient ✓ ✓ …… ANSWER …… d The custodian of health records is the individual who has been designated as having responsibility for the care, custody, control, and proper safekeeping and disclosure of health records for such persons or institutions that prepare and maintain records of healthcare. The custodian of the health record does not have the responsibility or expertise to testify regarding the care of the patient (Brodnik 2017a, 9). The legal health record (LHR) is a(n):
Defined subset of all patient-specific data created or accumulated by a healthcare provider that may be released to third parties in response to a legally permissible request for patient information Entire set of information created or accumulated by a healthcare provider that may be released to third parties in response to a legally permissible request for patient information Set of patient-specific data created or accumulated by a healthcare provider that is defined to be legal by the local, state, or federal authorities Set of patient-specific data that is defined to be legal by state or federal statute and that is legally permissible to provide in response to requests for patient information ✓ ✓ …… ANSWER …… a The legal health record is a defined subset of all patient- specific data. The legal health record is the record that will be disclosed upon request by third parties. It includes documentation about health services provided and stored on any media (Rinehart- Thompson 2016a, 206). The HIM supervisor suspects that a departmental employee is accessing the EHR for personal reasons, but has no specific data to support this suspicion. In this case, what should the supervisor do? Confront the employee. Send out a memorandum to all department employees reminding them of the hospital policy on Internet use. Ask the security officer for audit trail data to confirm or disprove the suspicion. Transfer the employee to another job that does not require computer usage. ✓ ✓ …… ANSWER …… c
A patient requests a copy of his health records. When the request is received, the HIM clerk finds that the records are stored off-site. Which is the longest timeframe the hospital can take to remain in compliance with HIPAA regulations? Provide copies of the records within 15 days Provide copies of the records within 30 days Provide copies of the records within 45 days Provide copies of the records within 60 days ✓ ✓ …… ANSWER …… d The HIPAA Privacy Rule requires that records be produced within 30 days to a patient or their personal representative, with a one-time extension of an additional 30 days if necessary. If such an additional 30 days is needed, the covered entity must notify the patient in writing of the need for additional time (Thomason 2013, 98). What is the legal term used to define the protection of health information in a patient-provider relationship? Access Confidentiality Privacy Security ✓ ✓ …… ANSWER …… b Confidentiality, as recognized by law and professional codes of ethics, stems from a relationship such as physician and patient, and pertains to the information resulting from that relationship. Privileged communication is a legal concept designed to protect the confidentiality between two parties (Brodnik 2017a, 7-8). Which of the following would be the best course of action to take to ensure continuous availability of electronic data?
Acquire storage management software. Send data to a remote site using the Internet. Store data on RAID. Use redundant servers. ✓ ✓ …… ANSWER …… d Data must be available continuously. When paper as a backup no longer exists in a paperless electronic health record (EHR) environment, users must be assured that the computer system is available to them at all times. To achieve such availability, an EHR should have server redundancy. This means that as data are entered and processed by one server, they are entered and processed simultaneously by a second server. Should the primary server crash, the system should be designed to "fail over" to the second server and can continue processing as if, at least from the user's point of view, nothing had happened (Rinehart-Thompson 2016a, 212-213). When an individual requests a copy of the PHI or agrees to accept summary or explanatory information, the covered entity may: Impose a reasonable cost-based fee Not charge the individual
