CMAA NHA Certified Medical Administrative Assistant - Set 3 - Part 2

Correct Answer: De-identified dataset

A de-identified dataset has had the eighteen HIPAA identifiers removed under the safe harbor method, with no actual knowledge of re-identification risk, and falls outside HIPAA's protections for many secondary uses. Option a is incorrect because a limited data set retains some indirect identifiers such as dates and limited geographic information and can be used with a Data Use Agreement for research and operations under HIPAA's framework. Option b is incorrect because the audit log file records access and modification events in the system rather than serving as a dataset stripped of identifiers, so it does not match the de-identification term being described. Option d is incorrect because the designated record set is the set of records subject to a patient's right of access under HIPAA, which is unrelated to the removal of identifiers for research or other uses outside care.

Correct Answer: All of the listed items count

Names, addresses smaller than a state, dates other than year, phone numbers, fax numbers, and email addresses all appear on the eighteen identifiers, alongside SSNs, MRNs, account numbers, biometrics, photos, and unique codes. Option a is incorrect because limiting PHI to the name leaves out addresses, dates, contact details, and many other identifiers that all appear on HIPAA's eighteen-identifier list and must be handled with the same protections. Option b is incorrect because limiting PHI to address and phone leaves out name, dates, email, and many other identifiers, which is far narrower than HIPAA's actual eighteen-identifier framework for protected information. Option c is incorrect because limiting PHI to email alone leaves out names, dates, addresses, phone numbers, and many other identifiers, which is far narrower than HIPAA's actual eighteen-identifier list for protected information.

Correct Answer: Forty-two CFR Part 2

Forty-two CFR Part 2 protects substance use disorder records more strictly than HIPAA, requiring specific consent for re-disclosure when programs receive federal funding for the relevant substance use treatment activities. Option a is incorrect because the Stark Law prohibits physician self-referral to entities with which the physician has a financial relationship, which has nothing to do with the heightened confidentiality of substance use disorder records. Option c is incorrect because the False Claims Act addresses billing fraud and whistleblower protections rather than the heightened confidentiality of substance use disorder records, which is governed by a different federal regulation entirely. Option d is incorrect because FDA MedWatch is the program for reporting adverse drug events and device problems to the FDA, which is unrelated to the substance use disorder confidentiality framework that applies in this scenario.

Correct Answer: Heightened protection for psychotherapy notes

Psychotherapy notes receive heightened protection under HIPAA and require a separate authorization for release, distinct from the general chart, except in narrow situations such as defending against legal action by the patient. Option b is incorrect because combining release of psychotherapy notes with the rest of the chart fails the separate-authorization requirement and risks an improper disclosure of information given heightened protection by the privacy rule. Option c is incorrect because no protection for patient notes is contrary to the heightened-protection rule for psychotherapy notes, which exists precisely because of the sensitivity of mental health treatment communications between provider and patient. Option d is incorrect because psychotherapy notes do not automatically travel with billing data; coding for billing relies on different documentation, while psychotherapy notes are kept separately and require their own authorization for release.

Correct Answer: Marketing photos require specific authorization

Marketing uses of identifiable patient photographs and names typically require specific written authorization, since names and full-face photographs are part of the eighteen identifiers and marketing falls outside routine treatment uses. Option a is incorrect because photos do not automatically carry implied consent for marketing, since the privacy rule treats marketing differently from clinical treatment and requires specific authorization in advance for these kinds of identifiable promotional uses. Option b is incorrect because an outcome story does not override the privacy rule, which requires specific authorization for marketing uses of protected information including identifiable photographs of the patient and their name in promotional content. Option d is incorrect because names and photos do count as protected health information when linked to care, since both appear on the eighteen-identifier list and require careful handling for any disclosure outside the clinical relationship

Correct Answer: Purpose; who; what; expiration; signature

A valid authorization specifies the purpose, who is releasing, who is receiving, what specific records are involved, expiration date, signature, and date, plus any required state-specific elements that further define the release. Option a is incorrect because color, font, and staple location are not required elements of a valid authorization, which is built around content describing purpose, parties, scope, expiration, and signature rather than purely cosmetic features. Option b is incorrect because patient hobbies and travel plans have nothing to do with the structure of a valid authorization, which is built around the elements describing the disclosure rather than personal lifestyle details. Option c is incorrect because provider birthdate, height, and weight are not required elements of a valid authorization for release of patient records, which focuses on the release scope rather than personal provider attributes.

Correct Answer: Disclosure to coroners or examiners

HIPAA permits disclosure to coroners, medical examiners, and funeral directors for purposes related to identifying a deceased person, determining cause of death, or other duties as authorized by law without specific authorization. Option b is incorrect because marketing always requires specific authorization, which is unrelated to the death-investigation request from a coroner that this scenario describes for the purposes of an official inquiry. Option c is incorrect because self-promotion is not a permitted disclosure category under HIPAA, since marketing requires specific authorization and does not fit a coroner's request for information related to a death investigation. Option d is incorrect because disclosure to friends is not a defined permitted category under HIPAA; family or friend disclosures are permitted with patient agreement or in best-interest situations, not as a stand-in for coroner authority.

Correct Answer: Disclose with patient agreement; limit to relevant

HIPAA permits disclosure to family or friends involved in care or payment with the patient's verbal agreement or opportunity to object, limited to information directly relevant to the person's role in the situation. Option a is incorrect because refusing and ending the conversation ignores the patient's clear permission and the framework that supports limited disclosure to people involved in care or payment with the patient's verbal agreement. Option b is incorrect because disclosing details unrelated to the partner exceeds the limit of relevance and conflicts with the minimum-necessary principle, which restricts disclosures to what relates to the partner's role in care or payment. Option d is incorrect because disclosing every chart entry without limits ignores the minimum-necessary principle and the relevance limit, which restricts shared information to what relates to the partner's role in care or payment.

Correct Answer: Treatment under TPO

Provider-to-provider communication for treatment falls under treatment within TPO, which generally does not require specific authorization, while curbside consults and care-team huddles also fit this routine treatment-related sharing. Option a is incorrect because marketing requires specific authorization, which is a different category than the routine treatment-related communication described in a referral between primary care and a cardiologist for ongoing care of the patient. Option c is incorrect because sale of records without consent is not a permitted disclosure category and is restricted under HIPAA, which is unrelated to the routine treatment-related referral described in this clinical scenario for cardiology. Option d is incorrect because public-health reporting is its own category and applies to specific reportable events to public health authorities, not to a routine cardiology referral between two clinicians treating the same patient.

Correct Answer: Notice to patient or qualified protective order

HIPAA permits release in response to a subpoena that is not a court order if the requestor provides notice to the patient or obtains a qualified protective order, with the practice also confirming compliance with state law. Option a is incorrect because immediate release without safeguards conflicts with HIPAA's specific conditions for non-court-order subpoenas, which require either notice to the patient or a qualified protective order to support a compliant release. Option b is incorrect because minor status does not by itself satisfy HIPAA's conditions, which apply to subpoenas regardless of patient age and require either notice or a qualified protective order before records are released. Option c is incorrect because the day of the week has no role in HIPAA's release conditions for non-court-order subpoenas, which focus on notice or qualified protective orders rather than scheduling by calendar day.

Correct Answer: State Child Protective Services

Suspected child abuse and neglect are reported to state Child Protective Services, with all health care personnel mandated as reporters and good-faith immunity from civil liability when reports are made in good faith. Option b is incorrect because FDA MedWatch receives reports of adverse drug events and device problems, which is unrelated to suspected child abuse and neglect that goes to state Child Protective Services under state mandatory reporting laws. Option c is incorrect because OSHA enforcement focuses on workplace safety standards rather than child welfare, which is the responsibility of state Child Protective Services under mandatory reporting laws across the various U.S. states. Option d is incorrect because the Federal Trade Commission addresses consumer protection and antitrust issues rather than child welfare, which is the responsibility of state Child Protective Services under mandatory reporting laws.

Correct Answer: Mandatory report to law enforcement

Most states require mandatory reporting of gunshot and stab wounds to law enforcement, regardless of patient consent, with good-faith immunity for reporters who follow the documented process for these notifications. Option a is incorrect because optional reporting with consent is not the typical structure for gunshot wounds in most states, which mandate reporting regardless of patient consent through the documented mandatory-reporting framework. Option b is incorrect because no report under any condition would conflict with state mandatory reporting laws for gunshot wounds, which require notification to law enforcement under most jurisdictions across the United States today. Option d is incorrect because a thirty-day delay would defeat the purpose of mandatory reporting for gunshot wounds, which focus on prompt notification to law enforcement rather than a long delay before any contact is made.

Correct Answer: Tarasoff doctrine

The Tarasoff doctrine, varying by state, may require warning identifiable victims and notifying law enforcement when a patient expresses an imminent threat to a specific person under listed clinical conditions. Option a is incorrect because res judicata is a procedural doctrine preventing relitigation of decided matters in court, which is unrelated to clinical duties to warn under threat-of-harm scenarios in patient-care settings. Option b is incorrect because the common rule for research consent governs federally funded human-subjects research, which has no role in the threat-of-harm warning framework that applies in clinical mental-health crises. Option c is incorrect because the locality rule for malpractice concerns standards of care and geographic comparison, which is unrelated to the warning-duty framework that applies when a patient expresses imminent intent to harm someone.

Correct Answer: State and local health departments

Tuberculosis is reported to state and local health departments as a notifiable condition, often with immediate notification, supporting contact tracing, treatment, and protection of the broader community from continued transmission. Option a is incorrect because the Federal Aviation Administration regulates aviation safety, which is unrelated to public-health reporting of communicable diseases such as tuberculosis under state and local notifiable conditions lists. Option c is incorrect because the Securities and Exchange Commission regulates financial markets, which has no role in public-health reporting of tuberculosis under state and local notifiable disease laws across U.S. jurisdictions. Option d is incorrect because the Federal Reserve Bank handles monetary policy and banking, which has no role in public-health reporting of tuberculosis under state and local notifiable disease laws across the country.

Correct Answer: Trigger; notify clinical lead; submit; document

Accepted steps include recognizing the trigger, notifying the clinical lead, locating the required form, submitting within the legal time frame, documenting in the chart, and maintaining confidentiality of the report itself. Option b is incorrect because ignoring, deferring, speculating, and spreading rumor would violate mandatory reporting law and the practice's policy and would also fail the patient who needs the report routed correctly. Option c is incorrect because billing, collecting, bonusing, and promoting are not reporting steps and have no role in the mandatory reporting workflow, which focuses on prompt and accurate notification to the right authority. Option d is incorrect because recording, printing, laminating, and displaying make no sense in the context of a confidential mandated report, which is documented carefully and routed rather than displayed publicly within the practice.

Correct Answer: Administrative; physical; technical

The HIPAA Security Rule organizes safeguards into administrative, physical, and technical categories, covering risk analysis and training, facility and workstation controls, and authentication and audit logs across the entity's information systems. Option a is incorrect because marketing, finance, and operations are organizational functions rather than the safeguard categories defined by the Security Rule, which are specifically administrative, physical, and technical for protected information systems. Option b is incorrect because cooking, cleaning, and ordering are not Security Rule categories at all and have no relationship to the structure of administrative, physical, and technical safeguards under federal regulation today. Option c is incorrect because inpatient, outpatient, and ambulatory are care settings rather than safeguard categories, so they do not match the HIPAA Security Rule's structure of administrative, physical, and technical safeguards.

Correct Answer: Recognize event; report; preserve evidence

The accepted initial steps include recognizing a possible breach, reporting immediately to the privacy or security officer, preserving evidence, cooperating with investigation, and avoiding discussion outside designated channels for the matter. Option a is incorrect because waiting one month delays both internal investigation and the federal breach notification timeline, which requires individual notice within sixty days of discovery and additional notifications based on the size of the breach. Option b is incorrect because reselling the laptop destroys the device and any evidence, complicates investigation, and would not satisfy any breach response requirement; it could also cause additional liability for the practice. Option d is incorrect because telling only the staff member's family does not meet any reporting requirement and risks delays in the formal process that protects affected patients and supports compliance with federal breach notification rules.

Correct Answer: Adults seven to ten; minors longer

Common retention guidance is seven to ten years for adults from the last encounter, longer for minors, often until age of majority plus the standard period, with state law and payer requirements modifying specifics in many jurisdictions. Option a is incorrect because a one-year retention period is far shorter than guidance for adult records, which commonly runs seven to ten years, and would put the practice in conflict with state law and payer requirements. Option c is incorrect because an unconditional decade retention does not capture longer minor retention periods and ignores variation in state law and payer requirements, so it does not fit the actual range of guidance. Option d is incorrect because burning records after each visit conflicts with retention requirements and the legal record obligations of the practice and is not a defensible retention strategy under any policy framework.

Correct Answer: Secure destruction with documentation

Secure destruction with documentation, including cross-cut shredding for paper and certified destruction for electronic media with a certificate, satisfies the principle of protecting information through every phase of its lifecycle. Option b is incorrect because open trash collection without records risks unauthorized access to identifiable information and fails to document the destruction event, contrary to the practice's records-management and HIPAA-related obligations. Option c is incorrect because backyard burning is not an authorized destruction method, lacks documentation, and may violate environmental rules, so it does not satisfy secure destruction requirements for protected information at the practice. Option d is incorrect because indefinite storage without limits conflicts with retention policies, increases storage costs, and creates additional risk for information that could otherwise have been destroyed under approved methods at the proper time.

Correct Answer: Physical workstation control

Physical workstation controls include placement away from public view and the use of screen visors, which protect identifiable information from incidental viewing by people in lobby and waiting areas around the desk. Option a is incorrect because administrative training is a different category that focuses on workforce education, sanctions, and risk analysis rather than the physical placement of a monitor at the registration desk in the lobby. Option b is incorrect because technical encryption protects data through cryptographic controls in the system rather than the physical positioning of a monitor, which is what the safeguard described in this scenario actually addresses. Option d is incorrect because marketing strategy concerns customer acquisition and brand messaging rather than safeguard categories, so it does not match the physical workstation control that the compliance officer is praising at the desk.