Medical law and ethics is 7 of the 150 scored items on the NHA CCMA. Answer 10 exam style questions on HIPAA, privacy and healthcare laws and see exactly which concepts would cost you points on test day.
Start the 10 questions →Under HIPAA, disclosure of PHI without the patient's authorization is generally permitted for which purposes?
These questions cover privacy, minimum necessary, patient rights, security and breaches. Each one shows the correct answer and why every other option is wrong, so a miss tells you exactly what to review before the CCMA.
Prefer to read first? Every question from the practice set above, with the correct answer and why each wrong option is wrong.
Answer: A. HIPAA permits use and disclosure for treatment, payment, and health care operations (TPO) without a separate authorization. Marketing, most employer disclosures, and public posting require the patient's written authorization.
Why not B: Employers are not entitled to PHI without authorization.
Why not C: Public posting of PHI requires authorization.
Why not D: Marketing generally requires written authorization.
Exam tactic: TPO without authorization. Almost everything else needs it.
Answer: D. The minimum necessary standard limits uses and disclosures of PHI to the least amount needed for the purpose. It does not apply to disclosures for treatment between providers.
Why not A: The whole record exceeds what is needed for billing.
Why not B: Requests must still be limited to what is necessary.
Why not C: Billing is a permitted use under payment.
Exam tactic: Share only what the task needs.
Answer: A. Patients have the right to inspect and obtain copies of their records (with limited exceptions), to request amendments, to receive an accounting of certain disclosures, and to request restrictions and confidential communications.
Why not B: Patients may request an amendment, but providers do not delete records on request.
Why not C: Patients cannot access other patients' information.
Why not D: Patients can request records directly.
Exam tactic: Access yes, amend by request, delete no.
Answer: D. The Security Rule requires administrative, physical, and technical safeguards. Examples include unique user IDs, access controls, audit controls, and workforce training, plus addressable measures such as automatic logoff and encryption.
Why not A: Shared logins prevent accountability and audit tracking.
Why not B: Posted passwords defeat access controls.
Why not C: Displaying schedules publicly exposes PHI.
Exam tactic: Your login, your screen, locked when you leave.
Answer: B. Any suspected impermissible disclosure is reported promptly to the privacy officer, who assesses it under the HIPAA Breach Notification Rule and handles required notifications to the patient and, when applicable, to HHS.
Why not A: Waiting can violate notification timelines.
Why not C: The privacy officer, not staff, determines whether notification is required.
Why not D: Concealing a breach violates policy and the law.
Exam tactic: Mistake with PHI? Tell the privacy officer now.
Answer: B. Unless the patient has agreed otherwise, voicemails contain minimal information: who is calling, that the patient should call back, and the number. Detailed health information could be heard by others.
Why not A: Sensitive results are never left on voicemail by default.
Why not C: Diagnoses should not be left on voicemail without permission.
Why not D: Medication details are PHI that others could overhear.
Exam tactic: Voicemail: who, call back, number. Nothing more.
Answer: A. A subpoena duces tecum orders the production of records or documents. It is routed to the designated person (such as the privacy officer or practice manager), who verifies its validity and releases only what is legally required.
Why not B: Records are released only after proper review.
Why not C: Valid legal orders cannot be ignored.
Why not D: A subpoena duces tecum is about documents, not substitute testimony.
Exam tactic: Duces tecum = bring the documents. Route to the designated person.
Answer: B. The medical record is the legal record of care and is used in court. Timely, accurate, objective documentation protects the patient and the practice.
Why not A: Late entries reduce accuracy and credibility.
Why not C: Clinicians, insurers, and courts all rely on documentation.
Why not D: Memory is not a legal record.
Exam tactic: Not documented = not done.
Answer: B. OSHA enforces workplace safety standards, including the Bloodborne Pathogens Standard and the Hazard Communication Standard.
Why not A: CLIA regulates laboratory testing quality.
Why not C: CMS administers Medicare and Medicaid.
Why not D: The FDA regulates drugs, devices, and food.
Exam tactic: Worker safety = OSHA.
Answer: B. The ADA requires reasonable accommodations and equal access, such as accessible entrances, exam rooms and equipment, and effective communication aids like interpreters, unless an undue burden applies.
Why not A: Segregating patients is not required and may be discriminatory.
Why not C: Communication must be effective for each patient's needs.
Why not D: The ADA does not require free care.
Exam tactic: ADA = equal access + reasonable accommodation.
The free 20 question diagnostic covers all 12 areas of the CCMA outline and shows the 3 fixes worth the most points.
Take the free diagnosticSee all 43 CCMA practice topics →