NHA CCMA Clinical Medical Assistant - Set 5 - Part 2

Correct Answer: Using unique user IDs and automatic logoff

The Security Rule's technical safeguards include access controls such as unique user identifiers, automatic logoff, audit controls, integrity controls, and transmission security, all of which protect electronic protected health information from access. Option a is incorrect because Locking a file cabinet is a physical safeguard that protects paper records, not a technical safeguard for ePHI, although both safeguards together are required under the HIPAA Security Rule for compliance today. Option b is incorrect because Posting a confidentiality reminder is part of administrative awareness rather than a technical control that protects electronic protected health information through encryption, audit, or access management features under the Security Rule. Option c is incorrect because Workforce training is an administrative safeguard under the Security Rule, focusing on policies and education, rather than a technical safeguard that uses technology to protect electronic protected heal

Correct Answer: Notify the privacy officer immediately

A misdirected fax containing PHI is a potential breach under the HIPAA Breach Notification Rule and must be reported to the privacy officer immediately so the practice can investigate and follow notification requirements. Option b is incorrect because Resending the fax to the correct number is an important step but is not the first action; the privacy officer must be notified to evaluate and document the potential reportable breach first today. Option c is incorrect because Apologizing to the wrong recipient does not address the regulatory requirement to investigate and document the potential breach through the privacy officer per the practice's HIPAA policies and procedures in place today. Option d is incorrect because Ignoring the misdirected fax leaves PHI exposed and bypasses the notification process required when unsecured PHI may have been improperly disclosed, exposing the practice to penalties under the rules in effect.

Correct Answer: Treatment, payment, or healthcare operations

HIPAA permits disclosures for treatment, payment, and healthcare operations without specific patient authorization, while marketing, sale of PHI, and most other non-routine disclosures require a written, signed authorization from the patient. Option a is incorrect because Marketing to the patient's employer requires written authorization under HIPAA because it falls outside treatment, payment, and operations and triggers the rule's specific authorization requirements for non-routine disclosures of PHI today. Option b is incorrect because Sale of records is a non-routine disclosure that requires specific written authorization from the patient under HIPAA and may also trigger additional requirements under HITECH and state law for valid consent today. Option d is incorrect because Sharing with a neighbor is not permitted without authorization unless the patient has specifically designated that person as an authorized recipient of certain information through a written release on

Correct Answer: Use the least PHI needed for purpose

The minimum-necessary standard requires workforce members to use, disclose, and request only the smallest amount of PHI needed to accomplish the intended purpose, with treatment activities being a notable exception to the rule. Option a is incorrect because Granting all staff full chart access conflicts directly with the minimum-necessary standard, which limits access based on role and the specific purpose of the access being requested under HIPAA at all times. Option c is incorrect because Patient approval for every disclosure is not required because HIPAA permits treatment, payment, and operations disclosures without authorization, while still requiring minimum necessary use except in treatment activities specifically and directly. Option d is incorrect because Annual record destruction is unrelated to the minimum-necessary standard and would violate retention requirements under state law, HIPAA, and CMS, which generally require records be retained for many years usually.

Correct Answer: 21st Century Cures Act of 2016

The 21st Century Cures Act of 2016 prohibits information blocking by providers, health IT developers, and exchanges, requiring electronic access to health information through APIs and patient portals with limited specific exceptions. Option a is incorrect because Stark Law addresses physician self-referral to entities with which the physician has a financial relationship and does not regulate information blocking or the electronic exchange of patient health information at all today. Option b is incorrect because The Controlled Substances Act regulates the manufacture, distribution, and prescription of controlled substances by schedule and does not address information blocking or interoperability of electronic health record systems used today. Option d is incorrect because The Anti-Kickback Statute prohibits remuneration in exchange for federal program referrals and does not regulate the sharing of electronic health information between providers, vendors, and patients in current profess

Correct Answer: Emergency Medical Treatment and Active Labor Act

The Emergency Medical Treatment and Active Labor Act requires hospitals with emergency departments to provide a medical screening exam and stabilize any patient who presents, regardless of insurance or ability to pay. Option b is incorrect because The Genetic Information Nondiscrimination Act prohibits discrimination based on genetic information in health insurance and employment but does not address emergency department screening or stabilization obligations of any kind in hospitals. Option c is incorrect because The Americans with Disabilities Act prohibits discrimination based on disability and requires reasonable accommodations, but does not specifically address emergency department screening or stabilization obligations of any hospital or facility. Option d is incorrect because The Patient Self-Determination Act addresses advance directive education for facilities receiving Medicare or Medicaid and does not address emergency department screening, stabilization, or the obligation t

Correct Answer: Prohibit genetic discrimination in insurance and employment

The Genetic Information Nondiscrimination Act prohibits discrimination based on genetic information in health insurance and employment, protecting patients who may otherwise hesitate to undergo genetic testing because of these specific employment concerns. Option a is incorrect because Regulating controlled substances is the role of the Controlled Substances Act, which establishes schedules and DEA registration requirements, not the Genetic Information Nondiscrimination Act used in clinical and employment settings today. Option c is incorrect because Advance directive education at facilities receiving Medicare or Medicaid is required by the Patient Self-Determination Act, not by the Genetic Information Nondiscrimination Act, which addresses genetic privacy rather than directives. Option d is incorrect because Accessibility for disabled patients is required by the Americans with Disabilities Act, which addresses reasonable accommodations and accessible facilities rather than genetic inf

Correct Answer: Implied consent through patient action

Implied consent is inferred from the patient's actions or circumstances, such as extending an arm for a routine blood draw after appropriate explanation, distinguishing it from written or verbal expressed consent for higher-risk procedures. Option b is incorrect because Written informed consent is required for higher-risk procedures such as surgery, blood transfusion, or sterilization, where the provider documents discussion of risks, benefits, alternatives, and the patient's voluntary decision to proceed. Option c is incorrect because Court-ordered consent applies in specific legal situations such as TB treatment or psychiatric holds and is not relevant to a routine venipuncture performed in an outpatient medical office setting today and tomorrow. Option d is incorrect because Surrogate consent is used when the patient lacks capacity and a designated agent or legal surrogate consents on the patient's behalf, which does not apply when an alert patient extends the arm fre

Correct Answer: Capacity is clinical and competency is legal

Capacity is a clinical judgment that the patient can understand and decide for a specific decision and may fluctuate, while competency is a legal determination made by a court with broader implications. Option a is incorrect because Capacity and competency are distinct concepts; capacity is a fluctuating clinical assessment for a specific decision, while competency is a legal designation from the court regarding overall decision-making authority of the patient today. Option c is incorrect because Capacity is the clinical concept and competency is the legal one, so reversing them inaccurately describes the difference and may lead to confusion about who determines decisional ability for a particular decision today. Option d is incorrect because Only competency is determined by a court, while capacity is assessed clinically by the provider for each specific decision and may change over time depending on the patient's condition and circumstances today.

Correct Answer: Durable power of attorney for health care

A durable power of attorney for health care, also called a healthcare proxy, designates an agent who is empowered to make medical decisions for the patient when the patient lacks decision-making capacity in clinical care. Option a is incorrect because A living will specifies the patient's own treatment preferences such as feeding tubes or ventilation if terminally ill or in a persistent vegetative state but does not designate a decision maker for the patient. Option b is incorrect because An insurance policy governs payment for care and does not designate a healthcare decision maker; it is a financial document rather than a legal advance directive used during incapacity for treatment decisions today. Option d is incorrect because A POLST or MOLST is a portable medical order set signed by the provider for life-sustaining treatment preferences, not a designation document appointing a person to make decisions on the patient's behalf today.

Correct Answer: Notify the provider about the conflict

When a family member disputes a valid advance directive, the medical assistant should notify the provider so the team, ethics committee, or legal counsel can address the conflict while the patient's documented wishes prevail. Option a is incorrect because Honoring the son's wishes when a valid POLST exists violates the patient's autonomy and the Patient Self-Determination Act, which requires that documented advance directives be followed by the healthcare team during care delivery. Option c is incorrect because Ignoring the POLST entirely contradicts the patient's documented wishes, violates the Patient Self-Determination Act, and exposes the practice to legal liability for failing to honor a valid advance directive on file. Option d is incorrect because Tearing up the POLST destroys a portable medical order and is itself an unauthorized destruction of medical record content, which may also constitute a tort and a breach of the patient's documented wishes.

Correct Answer: Court-appointed authority over an incapacitated person

Legal guardianship is established by court order after a hearing, granting authority to make decisions for someone deemed legally incapacitated, with categories including guardian of person, estate, plenary, or limited authority. Option a is incorrect because A patient-designated agent for finances only describes a financial power of attorney, which is created by the principal and not court-appointed, and does not necessarily extend to healthcare decisions for the patient today. Option b is incorrect because Permission to access medical records electronically is established through a release of information or proxy account in the portal, not through a court-ordered guardianship that determines overall decisional authority for the patient today. Option d is incorrect because A voluntary advance directive is completed by the patient while still possessing capacity and does not require a court hearing, which distinguishes it from legal guardianship granted through a judicial process and r

Correct Answer: Using a cross-cut shredder or shred bin

HIPAA requires reasonable safeguards during disposal of paper PHI, and the recommended method is cross-cut shredding or use of a contracted shred bin vendor with a business associate agreement and certificate of destruction. Option a is incorrect because Placing paper PHI in regular trash is a HIPAA violation that exposes records to unauthorized access and may trigger breach notification requirements when the records leave the practice's control without proper safeguards being in place. Option b is incorrect because Recycling with general office paper does not safeguard PHI from unauthorized viewing, may constitute a reportable breach, and is not an approved disposal method under HIPAA's reasonable safeguards or current professional standards today. Option c is incorrect because Storing PHI in an unlocked cabinet does not destroy the records and provides no physical safeguard against unauthorized access, which conflicts with HIPAA's physical safeguard requirements under

Correct Answer: Often seven to ten years after last visit

While retention varies by state and record type, adult medical records are commonly retained seven to ten years after the last visit, with longer requirements for minors, mental health, and certain occupational records. Option b is incorrect because Retaining adult records for only one year after the last visit conflicts with state laws and CMS expectations, which require multi-year retention to support continuity of care, audits, and statute of limitations protections today. Option c is incorrect because Retention until the next scheduled annual exam is unrelated to legal retention rules, which require records to be kept for years after the last visit to support continuity of care and litigation defense today. Option d is incorrect because Permanent retention is encouraged for some records such as immunizations, but is not generally required for all adult medical records under typical state and federal retention guidelines applicable in most clinics now.

Correct Answer: Notify the privacy officer or risk management

A subpoena alone may not satisfy HIPAA disclosure requirements, so the medical assistant should notify the privacy officer or risk management to verify whether a court order, authorization, or satisfactory assurances accompany the request. Option a is incorrect because Sending records the same day without verifying the form of legal process risks an improper disclosure under HIPAA, which requires either a court order, written authorization, or satisfactory assurances accompanying the subpoena currently received. Option b is incorrect because Refusing without contacting risk management may itself violate legal process if the request is valid; the appropriate first step is to involve the privacy officer or risk management who can review the request properly. Option d is incorrect because Calling the patient's attorney for guidance is not the first action, since the practice's privacy officer or risk management is responsible for evaluating subpoenas and ensuring HIPAA-compliant

Correct Answer: An expiration date or specific event listed

A valid HIPAA authorization must include the specific information disclosed, the recipient, the purpose, an expiration date or event, the patient's right to revoke, and the patient's signature with date. Option b is incorrect because An office manager signature is not a required element of a valid HIPAA authorization, which depends on the patient's signature and the specific elements outlined in the Privacy Rule for valid authorization documents today. Option c is incorrect because Insurance approval is not part of a HIPAA authorization, which is a patient-driven document rather than an insurer-driven document used to permit specific disclosures of protected health information by the practice today directly. Option d is incorrect because Filing with a state agency is not a HIPAA authorization requirement, which focuses on the patient's specific written permission rather than any external regulatory filing or approval before the records are released today.

Correct Answer: Stricter written authorization is generally required

Records protected by 42 CFR Part 2 covering federally assisted substance use disorder programs require stricter written authorization than HIPAA, and a subpoena alone is generally insufficient without additional court order requirements being met. Option a is incorrect because Court orders alone do not generally suffice for 42 CFR Part 2 records without specific provisions; the rule imposes additional requirements beyond HIPAA, distinguishing substance use disorder records from typical medical records under the Privacy Rule. Option b is incorrect because Releasing 42 CFR Part 2 records to family without specific written authorization violates the rule, which is stricter than HIPAA and limits disclosure to protect substance use disorder treatment information from unauthorized exposure today. Option c is incorrect because Subpoenas alone are insufficient for 42 CFR Part 2 records, which require written authorization or a qualifying court order following specific procedural protections to

Correct Answer: A legal demand for testimony or records

A subpoena is a legal demand for testimony or documents that requires HIPAA-compliant verification, while a court order is signed by a judge and provides a binding directive that allows disclosure under HIPAA today. Option a is incorrect because A judge's binding decision describes a court order, which is signed by a judicial officer and provides authority for disclosure under HIPAA, while a subpoena is a legal demand requiring further verification before any actual disclosure. Option c is incorrect because An insurer's request is not a subpoena and is generally handled through the routine payment-related disclosures permitted under HIPAA, with patient authorization or business associate arrangements in place where required by law today. Option d is incorrect because A patient-signed release is a HIPAA authorization, which is a voluntary document, while a subpoena is a legal demand initiated by a court or attorney that requires verification before any disclosure of protected

Correct Answer: Battery committed against the patient

Battery is the actual harmful or offensive contact with another person without consent, so administering an injection without proper consent fits the definition of battery as an intentional tort under civil law. Option b is incorrect because Assault is the threat or attempt to cause harmful contact that creates apprehension in the patient without actual touching, which differs from battery where physical contact actually occurs without the patient's consent today. Option c is incorrect because False imprisonment involves restraining a patient without legal cause and is unrelated to administering an injection, although it may apply if a patient is physically prevented from leaving the office or exam room today. Option d is incorrect because Defamation involves false statements that damage reputation through libel or slander and does not apply to physically administering an injection without first obtaining consent from the patient or an authorized surrogate today.

Correct Answer: Negligence by the medical assistant

Negligence is the failure to exercise the care a reasonably prudent person would in similar circumstances, and the four elements of duty, dereliction, damages, and direct causation apply directly to this scenario. Option a is incorrect because Battery is intentional offensive contact without consent, which differs from a negligent omission like leaving a tourniquet in place; the medical assistant did not intentionally cause harm in this clinical scenario today. Option b is incorrect because Assault is the threat or attempt to cause harmful contact creating apprehension and does not describe a negligent omission such as failing to release the tourniquet during the venipuncture procedure being performed in office. Option c is incorrect because Defamation involves false statements that damage reputation and is unrelated to the physical harm caused by failing to release the tourniquet, which falls under unintentional torts such as negligence in this scenario.