CCMA - Medical Law and Ethics (5% of the exam) - Section 7.4

Identify mandatory reporting obligations and apply correct medical record retention and storage requirements.

Identify mandatory reporting obligations - child abuse, elder abuse, communicable diseases, and gunshot wounds - and describe the process for fulfilling each. Apply medical record retention schedules and storage requirements to ensure compliance with applicable state and federal regulations.

Mandatory reportingMedical record retentionReporting lawsCompliance

Practice question for this objective

Free sampleMedical Law and Ethicsmedium

Which statement most accurately describes the category of conditions that a medical assistant should expect to be subject to mandatory reporting laws in the United States?

AOnly sexually transmitted infections diagnosed in patients aged 18 years or older are reportable by the practice to public health authorities.
BSuspected abuse of a child or vulnerable adult, certain communicable diseases, and specific injuries such as gunshot wounds are reportable as defined by state and federal law. Correct
CAny patient complaint about a clinician must be reported to the state medical board within 24 hours of the visit by the medical assistant.
DReportable events are limited to in-hospital deaths and surgical never-events, and outpatient practices have no mandatory reporting duties.

Recognise that mandatory reporting covers suspected abuse, notifiable communicable diseases, and specific injuries under state and federal law. Mandatory reporting laws exist to protect public health and vulnerable people. They create a non-discretionary duty for healthcare workers to notify the appropriate agency when suspicion meets the statutory threshold, covering suspected abuse or neglect of children and vulnerable adults, designated notifiable diseases tracked by public health, and certain injuries such as gunshot or stab wounds. The triggering categories are set by state statute working alongside federal frameworks rather than by the practice's internal policy.

Why A is wrong: Reportable communicable disease lists are not restricted to STIs in adults; they include a broad set of infections such as tuberculosis, measles and pertussis, and they apply across age groups.

Why B is correct: Mandatory reporting categories combine suspected abuse or neglect of protected groups, designated notifiable diseases, and certain violent injuries; the exact list is fixed by state statute alongside federal requirements.

Why C is wrong: Routine patient complaints are handled through internal practice procedures and are not statutory mandatory reports; only specific licensure or safety triggers go to the board, usually filed by the practice or licensee.

Why D is wrong: Outpatient settings have clear duties for abuse suspicion, notifiable diseases and certain injuries; restricting reporting to inpatient deaths and never-events ignores public health and protective statutes that bind ambulatory staff.

See more CCMA practice questions, answers explained.

Exam traps in Medical Law and Ethics

Answers that look right on this material and are not. Each one is a distractor from a different question in the CCMA bank for this domain.

Shred the entire chart now using a cross-cut shredder because the HIPAA six year retention period from the last effective date has already passed for the authorisation forms.
Why it is wrong: This option is tempting because the HIPAA six year clock has indeed expired for the authorisation forms, but the state medical record retention rule of 10 years is longer and governs the chart as a whole, so destruction now would breach state law.
Photograph the bruises on a personal phone for evidence and store the images locally until the provider returns to the examination room to assess the patient further.
Why it is wrong: This is tempting because preserving evidence feels protective, but personal devices breach HIPAA safeguards on PHI, and clinical photography requires a documented order and a secured device, so this action is wrong.
HIPAA requires covered entities to retain required documentation for two years from the date of creation, after which the material may be securely destroyed.
Why it is wrong: Two years is shorter than the federal floor. Candidates sometimes confuse HIPAA documentation retention with shorter operational record schedules, but the Privacy Rule explicitly requires six years.

Examworthy is not affiliated with or endorsed by National Healthcareer Association. Original, blueprint-aligned practice material only.