A hospital's HIM director is asked how the new information governance (IG) program differs from the department's traditional records management function. Which statement BEST describes the difference?

IG is an enterprise-wide framework for all information across its lifecycle, while records management focuses mainly on storing and retaining documents

IG replaces the need for retention schedules, while records management depends on them

IG is an IT function that manages servers and networks, while records management is an HIM function

IG applies only to electronic information, while records management applies only to paper records

A researcher receives a data set containing admission and discharge dates, five-digit ZIP codes, and patient ages. Names, street addresses, and medical record numbers have been removed. Which statement is correct?

The data set is a limited data set and may be used for research under a data use agreement

The data set is fully identifiable PHI and requires authorization from every patient

The data set may be used only after an expert determination

The data set is de-identified under Safe Harbor and may be used without restriction

An audit log review shows that an employee accessed her former husband's record 14 times with no work assignment related to his care. What should the privacy officer do FIRST?

Investigate under the privacy policy to confirm the access lacked a business need, then apply sanctions and complete a breach risk assessment

Remove the audit log entries to protect the employee's privacy

Take no action, because the employee's role gave her system access

A Medicare Part A claim is denied, and the hospital wants to appeal. What is the first level of the Medicare appeals process?

Redetermination by the Medicare Administrative Contractor

An Administrative Law Judge hearing

Reconsideration by a Qualified Independent Contractor

Review by the Medicare Appeals Council

A research data set contains each patient's year of birth and age (all patients are under 90), diagnosis codes, and state of residence. All other identifiers have been removed, and the hospital has no knowledge that the remaining data could identify anyone. Under the Safe Harbor method, is the data set de-identified?

Yes, because Safe Harbor permits the year and ages under 90, and the other identifiers were removed

No, because year of birth is an identifier

Yes, but only if an expert also signs off

Police investigating a stolen server tell the hospital, in writing, that breach notification now would impede their investigation, and they specify a delay period. What should the hospital do?

Delay notification for the period specified by law enforcement, and document the request

Notify immediately anyway, because the 60-day deadline cannot change

A control chart of weekly coding turnaround time shows one point above the upper control limit. What does this indicate?

Possible special-cause variation that should be investigated

Improved performance that should be standardized

An error in the chart that should be deleted

A Medicare Advantage plan's payment for each member is adjusted based on the chronic conditions documented and coded for that member during the year. Which methodology is being used?

Hierarchical condition category (HCC) risk adjustment

The Resource-Based Relative Value Scale

Ambulatory payment classifications

RHIA

Free RHIA Practice Questions

10 sample questions for the RHIA, with the correct answer and an explanation for each. No account needed. Try each one before you open the answer.

Sections covered on the exam: Information Governance, Introductiontoinformationgovernance, Compliance with Uses and Disclosures of PHI, Riskmanagementininformationgovernance, Standards, Compliance With Uses And Disclosures Of, Management and Leadership, Hipaaandotherregulatoryrequirements, Phidisclosureprotocols, Patientaccess,Retention,Anddestruction, Data Analytics And Informatics, Data Analytics and Informatics, Utilizinganalyticsfordecision-Making, Healthcarestatistics, Masterpatientindexanddatabasemanagement, Revenue Management, Medicalcodingandbilling, Reimbursementmodels, Revenueoptimizationstrategies, Value-Basedprogramsandfraudprevention, Management And Leadership, Teambuildingandemployeeengagement, Operationalmanagementinhealthcare, Strategicplanningandexecution, Humanresources,Budgets,Contracts,And.

Question 1 · Information Governance
A hospital's HIM director is asked how the new information governance (IG) program differs from the department's traditional records management function. Which statement BEST describes the difference?
- A.IG replaces the need for retention schedules, while records management depends on them
- B.IG is an enterprise-wide framework for all information across its lifecycle, while records management focuses mainly on storing and retaining documents
- C.IG is an IT function that manages servers and networks, while records management is an HIM function
- D.IG applies only to electronic information, while records management applies only to paper records
Show answer and explanation
Answer: B. IG is an enterprise-wide framework for all information across its lifecycle, while records management focuses mainly on storing and retaining documents
AHIMA defines IG as an organization-wide framework for managing information throughout its lifecycle to support strategy, operations, and compliance; records management is narrower. IG is not an IT function, it covers information in every format, and retention remains one of its core principles.
Question 2 · Compliance with Uses and Disclosures of PHI
A researcher receives a data set containing admission and discharge dates, five-digit ZIP codes, and patient ages. Names, street addresses, and medical record numbers have been removed. Which statement is correct?
- A.The data set is fully identifiable PHI and requires authorization from every patient
- B.The data set is a limited data set and may be used for research under a data use agreement
- C.The data set may be used only after an expert determination
- D.The data set is de-identified under Safe Harbor and may be used without restriction
Show answer and explanation
Answer: B. The data set is a limited data set and may be used for research under a data use agreement
A limited data set excludes direct identifiers but may keep dates, city, state, ZIP code, and ages, and may be used for research, public health, or operations under a data use agreement. It is not de-identified under Safe Harbor, because full dates and five-digit ZIP codes are identifiers.
Question 3 · Compliance with Uses and Disclosures of PHI
An audit log review shows that an employee accessed her former husband's record 14 times with no work assignment related to his care. What should the privacy officer do FIRST?
- A.Remove the audit log entries to protect the employee's privacy
- B.Notify the local media
- C.Investigate under the privacy policy to confirm the access lacked a business need, then apply sanctions and complete a breach risk assessment
- D.Take no action, because the employee's role gave her system access
Show answer and explanation
Answer: C. Investigate under the privacy policy to confirm the access lacked a business need, then apply sanctions and complete a breach risk assessment
Having system access does not permit viewing records without a work-related need. The privacy officer investigates, applies sanctions consistently, and evaluates the event under the breach notification rule. Audit logs must never be altered.
Question 4 · Utilizinganalyticsfordecision-Making
A coder coded 84 charts in 35 productive hours. The department's standard is 3.0 charts per hour. What percentage of the productivity standard did the coder achieve?
- A.2.4%
- B.80%
- C.120%
- D.125%
Show answer and explanation
Answer: B. 80%
Actual rate = 84 ÷ 35 = 2.4 charts per hour. Percentage of standard = 2.4 ÷ 3.0 × 100 = 80%. The 125% option inverts the ratio (3.0 ÷ 2.4).
Question 5 · Revenue Management
A Medicare Part A claim is denied, and the hospital wants to appeal. What is the first level of the Medicare appeals process?
- A.An Administrative Law Judge hearing
- B.Reconsideration by a Qualified Independent Contractor
- C.Redetermination by the Medicare Administrative Contractor
- D.Review by the Medicare Appeals Council
Show answer and explanation
Answer: C. Redetermination by the Medicare Administrative Contractor
The five levels are redetermination by the MAC, reconsideration by a Qualified Independent Contractor, an Administrative Law Judge hearing, Medicare Appeals Council review, and judicial review in federal district court.
Question 6 · Information Governance
A hospital is launching an information governance program. Which document formally states the program's scope, guiding principles, roles, and objectives?
- A.Privacy impact assessment
- B.Data backup schedule
- C.Information governance charter
- D.Service level agreement
Show answer and explanation
Answer: C. Information governance charter
An IG charter establishes the program's authority, scope, principles, roles, and objectives. A service level agreement sets vendor performance terms, a privacy impact assessment evaluates a specific project's privacy risks, and a backup schedule is an operational control.
Question 7 · Compliance With Uses And Disclosures Of
A research data set contains each patient's year of birth and age (all patients are under 90), diagnosis codes, and state of residence. All other identifiers have been removed, and the hospital has no knowledge that the remaining data could identify anyone. Under the Safe Harbor method, is the data set de-identified?
- A.No, because age is always PHI
- B.Yes, because Safe Harbor permits the year and ages under 90, and the other identifiers were removed
- C.No, because year of birth is an identifier
- D.Yes, but only if an expert also signs off
Show answer and explanation
Answer: B. Yes, because Safe Harbor permits the year and ages under 90, and the other identifiers were removed
Safe Harbor requires removal of all elements of dates except the year, allows ages under 90, and permits state-level geography. With the other identifiers removed and no actual knowledge of identifiability, the data set is de-identified. Expert determination is a separate, alternative method.
Question 8 · Compliance with Uses and Disclosures of PHI
Police investigating a stolen server tell the hospital, in writing, that breach notification now would impede their investigation, and they specify a delay period. What should the hospital do?
- A.Notify immediately anyway, because the 60-day deadline cannot change
- B.Delay notification for the period specified by law enforcement, and document the request
- C.Notify only the media
- D.Cancel notification entirely
Show answer and explanation
Answer: B. Delay notification for the period specified by law enforcement, and document the request
The Breach Notification Rule allows a delay when a law enforcement official states that notice would impede a criminal investigation or damage national security. A written statement supports a delay for the specified period; an oral statement supports up to 30 days unless followed in writing.
Question 9 · Utilizinganalyticsfordecision-Making
A control chart of weekly coding turnaround time shows one point above the upper control limit. What does this indicate?
- A.Normal common-cause variation
- B.Possible special-cause variation that should be investigated
- C.Improved performance that should be standardized
- D.An error in the chart that should be deleted
Show answer and explanation
Answer: B. Possible special-cause variation that should be investigated
A point outside the control limits signals special-cause (assignable) variation, such as a staffing gap or system outage, which should be investigated. Points scattered randomly within the limits reflect common-cause variation.
Question 10 · Reimbursementmodels
A Medicare Advantage plan's payment for each member is adjusted based on the chronic conditions documented and coded for that member during the year. Which methodology is being used?
- A.The Resource-Based Relative Value Scale
- B.Ambulatory payment classifications
- C.Hierarchical condition category (HCC) risk adjustment
- D.The chargemaster
Show answer and explanation
Answer: C. Hierarchical condition category (HCC) risk adjustment
CMS-HCC risk adjustment uses coded diagnoses to predict expected cost and adjust capitated payments, so complete, supported documentation of chronic conditions each year matters. RBRVS sets physician fees, and APCs are outpatient hospital groupings.

Keep practicing for the RHIA

TTP Prep has 200 RHIA practice questions with explanations, timed and mock-exam modes, 68 flashcards, interactive lessons, a printable cheat sheet and a readiness score. Start free, no card needed.

Take a free Quick 10 See everything in the RHIA prep