Free CCMA practice questions

Which statement best distinguishes a subcutaneous injection from an intramuscular injection in terms of needle angle and target tissue?

• ASubcutaneous injections enter adipose tissue at 45 or 90 degrees depending on body build, while intramuscular injections enter muscle at 90 degrees.check_circle Correct
• BSubcutaneous injections enter muscle at 45 degrees, while intramuscular injections enter the dermis at 90 degrees.
• CSubcutaneous injections enter the dermis at 5 to 15 degrees, while intramuscular injections enter adipose tissue at 45 degrees.
• DSubcutaneous injections enter muscle at 90 degrees, while intramuscular injections enter adipose tissue at 45 degrees.

Why A is correct: Correct. Subcutaneous medication is deposited into the adipose layer beneath the dermis, where slower absorption is desired, and the angle is adjusted to body habitus. Intramuscular medication is deposited into well-vascularised muscle, which requires a perpendicular 90 degree approach to traverse skin and subcutaneous tissue and reach the muscle belly.

Why B is wrong: Tempting because both terms are listed and 45 and 90 degrees are correct injection angles in other contexts, but the target tissues are reversed. Subcutaneous targets fat under the dermis, not muscle, and intramuscular targets muscle, not the dermis.

Why C is wrong: This conflates subcutaneous with intradermal technique. 5 to 15 degrees and a dermal target describe intradermal injections used for tuberculin and allergy testing, not subcutaneous, and IM injections do not stop in adipose tissue.

Why D is wrong: This swaps the two routes entirely. The deeper target (muscle) requires the steeper perpendicular angle, and the shallower target (subcutaneous fat) uses the lesser angle, so the assignments here are inverted.

Which option correctly defines the intradermal route by needle angle, depth, and a typical clinical use?

• A90 degree insertion into muscle, used for routine adult vaccines.
• B5 to 15 degree insertion into the dermis, used for tuberculin skin testing.check_circle Correct
• C45 degree insertion into subcutaneous fat, used for routine insulin doses.
• D5 to 15 degree insertion into the dermis, used for large-volume antibiotic doses.

Why A is wrong: This describes intramuscular technique, not intradermal. IM is used for many adult vaccines, but the intradermal route is defined by a very shallow angle into the dermis, not a perpendicular angle into muscle.

Why B is correct: Correct. Intradermal injections use a near-flat 5 to 15 degree angle with the bevel up so the needle sits just within the dermis, producing the characteristic wheal. This is the route for tuberculin (Mantoux) skin testing and allergy testing, where local immune response in the dermis is needed.

Why C is wrong: This describes the subcutaneous route, which targets adipose tissue and is appropriate for insulin. The intradermal route is shallower and targets the dermis, not subcutaneous fat.

Why D is wrong: The angle and depth are right, but the use case is wrong. Intradermal sites hold only about 0.1 mL because the dermis cannot accommodate larger volumes, so it is not used for large-volume antibiotic delivery.

Within the rights of medication administration, which statement best describes the principle of right documentation?

• ADocumenting the medication and dose at the start of the shift so the record is ready when the dose is due.
• BDocumenting only the medication name and time, since dose and route are already in the provider order.
• CDocumenting the medication, dose, route, site, time, and the administering clinician immediately after the dose is given, not before.check_circle Correct
• DDocumenting the patient's verbal consent and identity check, while dose details are kept in a separate pharmacy log.

Why A is wrong: Pre-charting is plausible to a candidate focused on efficiency, but it is explicitly wrong: it creates a record of a dose that has not yet been administered, which is a falsification risk if the dose is later held, refused, or omitted.

Why B is wrong: The order shows what was intended, but the medication administration record must independently show what was actually given, including dose, route, and site, so that the two can be cross-checked. A minimal entry is insufficient for medico-legal review.

Why C is correct: Correct. Right documentation requires recording exactly what was given, how, where, when, and by whom, and the entry is made after administration so the record reflects what actually happened. Pre-charting risks recording a dose that was never delivered if the patient refuses or an error is caught at the last moment.

Why D is wrong: Identity verification is part of administration, but it does not replace the requirement to document the drug, dose, route, site, and time on the patient's record. Splitting dose details into a separate log obscures the clinical chart.

A medical assistant reviews a prescription that reads metoprolol 25 mg PO BID AC. The patient asks when to take the second dose of the day. What is the BEST instruction the medical assistant can reinforce, consistent with the order as written?

• ATake one tablet by mouth twice a day, with both doses taken shortly after the morning and evening meals.
• BTake one tablet by mouth twice a day, with each dose taken about thirty minutes before a meal as written.check_circle Correct
• CTake one tablet by mouth three times a day, spacing each dose evenly across waking hours.
• DTake one tablet by mouth at bedtime each night for two consecutive nights and then stop.

Why A is wrong: This describes PC (post cibum, after meals) rather than AC, so it is tempting only if the abbreviations are confused but it contradicts the written order.

Why B is correct: BID means twice daily and AC (ante cibum) means before meals, so the dose is taken by mouth before two meals each day, which matches the written order exactly.

Why C is wrong: Three times daily corresponds to TID, not BID, so this misreads the frequency abbreviation and would result in an extra daily dose.

Why D is wrong: Bedtime dosing corresponds to HS (hora somni), and the order has no stop date, so this confuses BID with HS and misrepresents the duration of therapy.

An adult patient in the clinic develops sudden chest tightness, and the prescriber orders nitroglycerin 0.4 mg sublingual now. After confirming the order and the patient's identity, what is the BEST technique for the medical assistant to reinforce with the patient before the dose is taken?

• AChew the tablet thoroughly and then swallow it with a small sip of water to speed absorption from the stomach.
• BApply the tablet to the skin over the chest and cover the area with a clean dry gauze pad for absorption.
• CPlace the tablet under the tongue and allow it to dissolve without chewing or swallowing while remaining seated.check_circle Correct
• DHold the tablet between the cheek and gum on the affected side and avoid swallowing for fifteen minutes.

Why A is wrong: Chewing and swallowing converts the route to oral and exposes the drug to first-pass metabolism, which delays effect and contradicts the sublingual route specified in the order.

Why B is wrong: Skin application describes the topical or transdermal route, not sublingual, and a tablet formulation is not designed for cutaneous absorption, so this misuses the dosage form.

Why C is correct: Sublingual administration places the tablet under the tongue so the drug is absorbed across the oral mucosa directly into the systemic circulation, bypassing first-pass metabolism and producing a rapid effect appropriate for acute symptoms.

Why D is wrong: Placement between cheek and gum describes the buccal route rather than sublingual; the absorption sites differ and the tablet is formulated for under-the-tongue placement.

During medication reconciliation a patient lists ibuprofen taken several times a week for chronic knee pain and lisinopril prescribed for hypertension. The patient also mentions occasional black stools. What is the BEST action for the medical assistant to take after documenting these findings?

• AReassure the patient that combining an NSAID with an ACE inhibitor is routine and requires no further reporting.
• BTell the patient to stop the lisinopril immediately and continue the ibuprofen at the same daily dose.
• CInstruct the patient to double the ibuprofen dose so that the knee pain is controlled and the visit can proceed.
• DPromptly report the NSAID use, the ACE inhibitor regimen, and the black stools to the prescriber before the visit continues.check_circle Correct

Why A is wrong: NSAIDs can reduce the antihypertensive effect of ACE inhibitors and increase the risk of gastrointestinal bleeding, so dismissing the combination understates a clinically important interaction.

Why B is wrong: A medical assistant cannot independently alter a prescribed medication, and stopping an antihypertensive without prescriber input is outside scope of practice.

Why C is wrong: Increasing an NSAID dose is a prescribing decision outside the medical assistant's scope and would raise the bleeding risk that the patient's symptoms already suggest.

Why D is correct: Black stools may indicate upper gastrointestinal bleeding, an NSAID adverse effect that is amplified by chronic use, while NSAIDs also blunt ACE inhibitor effect, so the prescriber must be informed within the medical assistant's documenting and reporting role.

A medical assistant is preparing a referral for a 58 year old patient with a six month history of worsening exertional dyspnoea whom the family physician has just referred to cardiology for an outpatient stress echocardiogram in four weeks. The patient has commercial insurance that requires pre-authorisation for advanced cardiac imaging. What is the BEST next action before the patient leaves the clinic?

• ASubmit the pre-authorisation request to the insurer with the diagnosis code, requested CPT code, and supporting clinical notes, then schedule the cardiology appointment once approval is received.check_circle Correct
• BHand the patient the cardiology contact details and tell them to ring the insurer themselves to obtain the pre-authorisation before the appointment.
• CSchedule the stress echocardiogram immediately and submit the pre-authorisation request to the insurer on the morning of the procedure to avoid delay.
• DSend the cardiology office a one line note stating the patient needs a stress echocardiogram and let the specialist handle authorisation and records.

Why A is correct: Commercial payers require pre-authorisation to be obtained before a non-urgent specialty imaging study is performed; submitting the request with diagnosis, procedure code, and clinical justification, then booking on approval, protects the patient from a denied claim and ensures continuity of care.

Why B is wrong: It is tempting because the patient is ultimately the policy holder, but offloading the pre-authorisation to the patient is outside accepted referral workflow and routinely leads to denied claims and missed appointments; the referring practice initiates the authorisation.

Why C is wrong: This sounds efficient because it locks in a slot quickly, but submitting authorisation on the day of a non-urgent study risks the insurer denying the claim, leaving the patient or practice liable for the cost.

Why D is wrong: It feels reasonable because the specialist performs the study, yet a complete referral must include reason, urgency, relevant history, and attached records; a bare request leaves the receiving office without the information needed to triage or to support authorisation.

A medical assistant is handing off a 72 year old patient to the ambulance crew who will transport her to the emergency department for suspected stroke after a sudden onset of right sided weakness in the clinic ten minutes ago. The provider has asked the assistant to give the crew a structured handoff. Using the SBAR framework, which sequence is the BEST way to deliver this handoff?

• AState the patient's name and age, then list every medication on her chart, her allergies, and her past surgical history before describing the current event.
• BSituation, then background, then assessment, then recommendation, including symptom onset time, relevant history, current vital signs and neurological findings, and the requested level of care.check_circle Correct
• CRecommendation first so the crew knows what to do, then assessment, then background, then situation so the story can be reconstructed in transit.
• DGive the crew the patient's full chart and her insurance card and let them read the history during transport while you note the symptom onset time in the record.

Why A is wrong: It looks thorough because it covers history first, but leading with a full medication and surgical recap buries the time critical situation; SBAR begins with the situation so the receiving team can act on stroke timing immediately.

Why B is correct: This is the SBAR structure used for clinical handoffs: situation gives the presenting problem and onset time, background gives relevant history, assessment gives current vitals and findings, and recommendation states the requested action, which is exactly what a stroke handoff requires.

Why C is wrong: Front-loading the recommendation is tempting under time pressure, but SBAR is deliberately ordered so the receiver understands the situation before the request; reversing the sequence makes the recommendation hard to evaluate and is not the recognised framework.

Why D is wrong: Handing over the chart feels like full disclosure, but a verbal structured handoff is a patient safety requirement, especially for time sensitive conditions; a chart dump without a spoken summary fails the handoff and risks losing the onset time.

A medical assistant is completing a paper referral form for a 45 year old patient being sent from primary care to gastroenterology for evaluation of three months of intermittent epigastric pain not relieved by a proton pump inhibitor. The provider has noted that the referral is routine, not urgent. Which combination of elements MUST appear on the referral so the receiving practice can triage and see the patient appropriately?

• APatient's preferred appointment time, the names of family members listed on the chart, and the practice's billing terms for outstanding balances.
• BPatient's marketing communication preferences, the referring provider's social media handle, and a generic note that the patient has stomach pain.
• CReason for referral, urgency, relevant history, and attached pertinent records such as recent labs and the medication trial.check_circle Correct
• DReason for referral only, with no urgency, no history, and no records, on the basis that the specialist will reorder any investigations they need.

Why A is wrong: These details may sit on a registration form, but a referral exists to communicate clinical information; appointment preferences and billing terms do not let the specialist triage the case.

Why B is wrong: It sounds like reasonable demographic data, but marketing preferences and a vague symptom note are not part of a clinical referral; without urgency or attached records the receiving practice cannot triage.

Why C is correct: A complete referral identifies why the patient is being sent, how urgent the visit is, the relevant clinical history, and supporting records so the specialist can triage, plan the visit, and avoid duplicate investigations.

Why D is wrong: This feels efficient because it shortens the assistant's task, but stripping a referral to the reason alone forces the specialist to repeat work and delays continuity of care; urgency, history, and pertinent records are core elements.

A medical assistant is filing paper progress notes for the day and notices that a note from Mr Andrew Smith-Brown has been inserted into the chart of Mr Andrew Smith. What is the BEST first action to take?

• ACross out the misfiled note with a single line, write the correct patient name beside it, and leave it in the current chart.
• BShred the misfiled note because it has been touched by the wrong chart and re-print a fresh copy from the electronic system tomorrow.
• CLeave the note where it is and add a sticky note flag for the provider to review at the next appointment in two weeks.
• DRemove the misfiled note from the wrong chart and refile it into the correct patient record, then document the correction in both charts.check_circle Correct

Why A is wrong: Crossing out and rewriting the patient name on a clinical note alters another patient's record, breaks chart integrity rules, and leaves the document in the wrong file where it can still be relied on for care decisions.

Why B is wrong: Destroying an original signed clinical note breaches medical record retention rules; the document is still valid evidence of care for the correct patient and must be preserved, not shredded and reprinted.

Why C is wrong: A sticky note is not part of the legal record and can fall off, and leaving a misfiled document in the wrong chart risks another clinician treating the wrong patient based on it before the next visit.

Why D is correct: The misfiled note must be moved to the correct record so that clinical decisions are based on the right patient's history, and noting the correction in both charts preserves an auditable trail of who moved the document and when.

While entering vital signs into the electronic health record, a medical assistant notices they typed the blood pressure as 1280 over 80 mmHg instead of 128 over 80 mmHg and has already saved the note. What is the BEST action to correct the entry?

• AUse the EHR amendment or addendum function to enter the correct value, with a note that the prior entry was a typing error, while the original entry remains visible.check_circle Correct
• BDelete the saved entry from the chart entirely and re-enter the correct blood pressure with the original time stamp so the record looks clean.
• CLeave the incorrect entry in place and verbally tell the provider during the visit so the doctor remembers the right value when reviewing the chart.
• DAsk the IT department to overwrite the field in the database so the patient's chart shows only the correct blood pressure going forward.

Why A is correct: The EHR amendment function preserves the original entry, adds the corrected value, and stamps the change with the user and time, which is the documentation method required for electronic records and meets the legal standard for an auditable correction.

Why B is wrong: Deleting the saved entry hides that an error occurred and rewriting the original time stamp falsifies the audit trail; electronic records must retain the original entry and show every change with its own time stamp.

Why C is wrong: Verbal handoff does not correct the written record, and a future clinician opening the chart will still see 1280 over 80 mmHg, which is clinically impossible and could trigger a wrong treatment decision.

Why D is wrong: Database overwrites bypass the audit trail and are treated as record tampering; corrections must be made through the EHR's user-facing amendment workflow, not by editing stored data directly.

A patient asks the medical assistant to release a copy of their entire chart to a new specialist before their appointment next week. The patient has not yet signed any release paperwork. What is the BEST first action?

• AEmail a PDF of the chart from the medical assistant's work account to the specialist's office to save time before the appointment.
• BProvide the patient with a release of information form to complete and sign, then process the request once the signed authorisation is in the chart.check_circle Correct
• CPrint the chart and hand it to the patient in the waiting room so they can deliver it to the specialist themselves before next week.
• DCall the specialist's office and read the relevant history over the phone since clinicians may share information for treatment purposes.

Why A is wrong: Sending PHI by email without an authorisation on file and without secure transmission breaches the HIPAA Privacy Rule, and unencrypted email is not a permitted channel for releasing a full chart to an outside provider.

Why B is correct: A signed, dated authorisation that identifies what is released, to whom, and for what purpose is required before sharing a full chart with a third party, and processing the request only after that form is on file satisfies the HIPAA Privacy Rule.

Why C is wrong: Even though the patient has a right to their own records, a full chart release is still tracked through the release-of-information process; printing a full chart on demand without authorisation skips identity verification and the required disclosure log.

Why D is wrong: Although treatment disclosures are permitted without separate authorisation, reading an entire chart by phone fails the minimum-necessary standard, gives no auditable record of what was shared, and is not the workflow for a full chart transfer to a new specialist.

A medical assistant needs to hand off a patient who has just had a vasovagal episode after a venipuncture to the registered nurse for continued monitoring. The patient is now alert with a pulse of 58 bpm and a blood pressure of 102/64 mmHg. Which approach to the handoff is BEST?

• AUse an SBAR handoff, stating the situation, background, current assessment with vital signs, and a recommendation that the nurse reassess before discharge.check_circle Correct
• BTell the nurse that the patient fainted during a blood draw and ask her to take a look when she has a moment.
• CDocument the episode fully in the chart first and let the nurse read the note when she gets to the patient room.
• DPage the supervising physician immediately and wait for orders before saying anything to the nurse at the bedside.

Why A is correct: SBAR (situation, background, assessment, recommendation) is the standard structured handoff for clinical events, packaging the syncope episode, baseline context, current vitals, and a clear ask in a sequence the receiver expects.

Why B is wrong: This sounds collegial but it buries the urgency, omits vital signs, and skips background and assessment, so the nurse has to chase information that should have been delivered up front.

Why C is wrong: Documentation matters, but relying on the nurse to find and read the note delays direct clinical communication after an adverse event and is not a substitute for a verbal handoff.

Why D is wrong: Escalation to the physician may follow, but bypassing the nurse who is taking over monitoring leaves the bedside without a briefed clinician and is not the first communication step for a stable, recovering patient.

A medical assistant notices that a colleague repeatedly leaves the workstation logged in to the electronic health record when stepping away, which the team has discussed in a recent huddle. The medical assistant decides to raise it directly with the colleague in private. Which opening uses an effective peer-feedback technique?

• AYou never lock your computer and you are going to get all of us written up for a HIPAA breach if you keep doing it.
• BI noticed the workstation in room three was left logged in twice this morning, and I felt worried because an unlocked session is on me too if PHI is exposed; can we agree on a quick lock habit when one of us steps away?check_circle Correct
• CEveryone has been saying that you leave your computer unlocked and the manager is about to notice, so you should fix it before it becomes a problem.
• DI think you might possibly want to consider being a bit more careful with the computer at some point if that works for you.

Why A is wrong: This is a you-statement loaded with an absolute (never) and a threat, which puts the colleague on the defensive and makes a constructive response unlikely even though the underlying concern is valid.

Why B is correct: This is an I-statement that pairs a specific observation with the speaker's own feeling and a concrete request, which is the recognised structure for non-defensive peer feedback on a clear behaviour.

Why C is wrong: Citing unnamed others and an impending consequence is hearsay-based and coercive rather than direct peer feedback, and it does not own the speaker's own observation or concern.

Why D is wrong: Excessive hedging hides the actual concern and leaves the colleague unsure what behaviour is being raised or why it matters, so no change is likely to follow.

During a debrief after a difficult morning, the lead medical assistant wants to give a junior colleague feedback about an interaction in which the colleague spoke sharply to a patient who was asking repeated questions about a co-payment. Which feedback follows the situation-behaviour-impact model most closely?

• AYou came across as rude at the front desk this morning and patients have been complaining about your attitude in general.
• BI have been told you have an attitude problem with patients who ask a lot of questions; we need to talk about how you treat people from now on.
• CAt the front desk just before ten, when Mrs Patel asked for the third time about her co-pay you raised your voice and cut her off; she looked upset and stepped back from the counter, and I was concerned it could damage our patient relationship.check_circle Correct
• DYou should remember that the customer is always right and try harder to be patient with everyone who comes to the desk today.

Why A is wrong: This labels the person rather than the behaviour, generalises with unsourced complaints, and gives the colleague nothing specific to change, which is the failure mode SBI is designed to avoid.

Why B is wrong: Relying on second-hand reports without a specific situation and characterising the person rather than the behaviour is the opposite of SBI and is likely to provoke defensiveness rather than change.

Why C is correct: This names the situation (front desk, time, specific patient), the behaviour (raised voice and interruption), and the impact (the patient's visible reaction and the risk to the relationship), which is the SBI structure for actionable feedback.

Why D is wrong: This is generic advice with an absolute slogan rather than feedback tied to an observed event and its impact, so the colleague has no way to know what specifically to do differently.

A medical assistant is taking vital signs on an adult patient who reports light-headedness on standing. The patient's resting pulse is 58 bpm, respirations 16 per minute, blood pressure 102/64 mmHg, and SpO2 98 percent on room air. The patient also mentions taking a beta-blocker for hypertension. Considering the role of the cardiovascular and autonomic nervous systems, what is the BEST next action for the medical assistant?

• ADocument the findings as within normal limits, since the pulse, respirations, and SpO2 all fall in the adult reference ranges for a resting patient.
• BRecord the vital signs, flag the symptomatic bradycardia and the beta-blocker therapy in the chart, and notify the provider before the patient leaves the room.check_circle Correct
• CIndependently advise the patient to skip the next beta-blocker dose at home and recheck the pulse before bed to confirm whether the medication is the cause.
• DReposition the patient supine, administer 2 litres per minute of oxygen by nasal cannula, and recheck the blood pressure in five minutes to address the symptoms.

Why A is wrong: Tempting because 58 bpm sits just under 60 bpm and the other vitals are normal, but the patient is symptomatic with light-headedness and on a rate-controlling drug, so the finding cannot be dismissed as routine; the medical assistant should escalate, not merely document.

Why B is correct: A pulse of 58 bpm is below the adult reference range of 60 to 100 bpm and the patient is symptomatic, so the medical assistant accurately documents the cardiovascular findings, links them to the rate-slowing medication, and escalates to the provider while remaining within scope of practice.

Why C is wrong: Tempting because the beta-blocker is the obvious mechanistic suspect for the slow pulse, but adjusting or withholding a prescribed medication is outside the medical assistant's scope and could destabilise the patient's blood pressure control.

Why D is wrong: Tempting because positional change can help orthostatic symptoms, but starting oxygen therapy is a treatment that requires a provider order, and the SpO2 of 98 percent shows no hypoxaemia, so this exceeds scope and is clinically unjustified.

A medical assistant is rooming an adult patient with a history of asthma who presents with cough and shortness of breath. The patient is speaking in short phrases, the respiratory rate is 26 per minute, SpO2 is 91 percent on room air, and accessory muscles in the neck are visibly contracting. Drawing on respiratory system physiology, what is the BEST FIRST action?

• AFinish collecting the full medication reconciliation and allergy history before notifying the provider, so the clinician has a complete picture on arrival.
• BAdminister two puffs from the patient's rescue inhaler kept in the room cabinet and recheck the SpO2 after five minutes before involving the provider.
• CPlace the patient in an upright seated position, alert the provider immediately to the abnormal respiratory rate and SpO2, and stay with the patient.check_circle Correct
• DHave the patient lie supine to rest, loosen any tight clothing around the chest, and recheck the SpO2 in ten minutes before deciding whether to escalate.

Why A is wrong: Tempting because thorough intake supports the visit, but completing routine paperwork while the patient shows hypoxaemia and accessory muscle use prioritises documentation over a deteriorating airway and delays escalation.

Why B is wrong: Tempting because a short-acting bronchodilator is the standard relief for asthma, but a medical assistant cannot administer medication without a current order from the provider for this encounter, and delaying escalation while self-treating is outside scope.

Why C is correct: An adult respiratory rate above 20 per minute and SpO2 below 95 percent indicate inadequate ventilation and oxygenation; sitting upright improves diaphragmatic excursion and lung expansion, and immediate provider notification is mandatory because bronchodilator or oxygen orders are clinical decisions outside the medical assistant's scope.

Why D is wrong: Tempting because rest seems supportive, but a supine position compresses the diaphragm against the abdominal contents and worsens the work of breathing in a hypoxaemic asthma patient, and a ten minute delay is unsafe given the current SpO2.

An adult patient at a follow-up visit reports right-sided facial droop that started one hour ago, slurred speech, and weakness of the right arm. The medical assistant is in the room first and takes vital signs: blood pressure 178/96 mmHg, pulse 88 bpm, respirations 18 per minute, SpO2 97 percent. Considering nervous system physiology and time-critical perfusion, what is the BEST action for the medical assistant?

• AReassure the patient that the symptoms are likely from a pinched cervical nerve, document the vital signs, and add the complaint to the visit note for the provider to review at the end of the visit.
• BDocument the symptoms in the chart, schedule a same-week imaging appointment, and instruct the patient to go to the emergency department if the symptoms get worse over the next day.
• CHave the patient practise smiling and lifting both arms, then document the results in the chart and continue with the planned vital signs and intake before alerting the provider.
• DNote the time of symptom onset, keep the patient seated and safe, and alert the provider immediately that the patient has acute focal neurological symptoms and an elevated blood pressure.check_circle Correct

Why A is wrong: Tempting because cervical nerve impingement can cause arm weakness, but interpreting neurological symptoms is diagnostic reasoning outside the medical assistant's scope, and delaying notification of a possible acute stroke wastes time-dependent salvageable brain tissue.

Why B is wrong: Tempting because the medical assistant is arranging follow-up care, but stroke is a time-critical perfusion emergency where minutes determine outcome, so deferring evaluation to a future appointment fails the patient and is inappropriate.

Why C is wrong: Tempting because facial and arm assessment mirrors common stroke screening steps, but performing and interpreting a neurological exam is outside scope and any delay completing intake before notifying the provider erodes the narrow treatment window.

Why D is correct: Acute unilateral facial droop, slurred speech, and arm weakness suggest cerebral hypoperfusion from a possible stroke, where treatment depends on time from onset, so the medical assistant documents the onset time, keeps the patient safe from a fall, and immediately escalates to the provider for assessment and emergency activation, staying within scope.

A medical assistant at a family practice receives a phone call from a community pharmacy requesting the dosing history of a patient's antihypertensive medication so the pharmacist can verify a refill. The caller identifies the pharmacy and the patient by name and date of birth, and the patient is an established patient of the practice. What is the BEST action under the HIPAA Privacy Rule?

• ARefuse to release any information because the patient has not signed a specific written authorisation for this disclosure to the pharmacy.
• BVerify the pharmacy's identity and the patient context, then share only the dosing information needed for the refill verification.check_circle Correct
• CFax the patient's full medication list and recent progress notes to the pharmacy so the pharmacist has complete clinical context for the refill.
• DTell the pharmacist to have the patient call the practice directly because clinical staff cannot release any medication information to a pharmacy by telephone.

Why A is wrong: Tempting because authorisation feels safest, but the Privacy Rule allows disclosure for treatment without a separate written authorisation. Refusing here delays legitimate patient care and misapplies the authorisation requirement, which is reserved for uses outside treatment, payment, or healthcare operations.

Why B is correct: Pharmacy refill verification is a treatment activity between healthcare providers, permitted under the Privacy Rule's treatment, payment, and healthcare operations provisions without separate authorisation, while the minimum-necessary standard still limits the disclosure to the dosing data the pharmacist actually needs.

Why C is wrong: Sending the full chart feels thorough and provider-friendly, but the Privacy Rule's minimum-necessary standard limits disclosures to the information reasonably needed for the purpose. Sharing progress notes and the entire medication list exceeds what refill verification requires.

Why D is wrong: Routing the patient back into the call seems privacy-protective, but the Privacy Rule does not bar telephone disclosures to another treating provider after reasonable identity verification. Refusing creates an unnecessary barrier to care and misreads the rule as more restrictive than it is.

While reviewing an unencrypted backup log, the IT lead at a small clinic discovers that an external billing vendor's lost laptop contained an unencrypted spreadsheet with the names, dates of birth, addresses, and account balances of 820 patients of the clinic. The clinic has a signed business-associate agreement with the vendor. What is the BEST FIRST action for the medical assistant supporting the privacy officer?

• AWait until the vendor completes its internal forensic review before documenting anything, because the breach belongs to the business associate and not to the clinic as the covered entity.
• BSend a notification email only to the 820 affected patients and consider the matter closed once the vendor confirms that the laptop has been remotely wiped and a new encryption policy is in place.
• CBegin documenting the incident timeline and the data elements involved, and prepare individual notifications plus notice to HHS and prominent media because more than 500 individuals in the state were affected.check_circle Correct
• DReport the incident to HHS only if the vendor's forensic team concludes that account balances and addresses meet the definition of protected health information under the Security Rule.

Why A is wrong: Deferring to the vendor feels reasonable because it is their device, but under the Breach Notification Rule the covered entity remains responsible for notifying affected individuals and HHS. Waiting silently risks missing the deadline and breaches of the business-associate agreement's reporting clauses.

Why B is wrong: Notifying patients is necessary but not sufficient. Because the breach affects more than 500 individuals, the Breach Notification Rule also requires concurrent notice to HHS and to prominent media. Treating the laptop wipe as closure ignores reporting obligations that sit with the covered entity.

Why C is correct: The Breach Notification Rule requires individual notice without unreasonable delay and within 60 days, and when a breach affects 500 or more individuals in a state the covered entity must also notify HHS contemporaneously and provide notice to prominent media outlets serving the area. Early, accurate documentation supports those required notifications.

Why D is wrong: It is tempting to gate reporting on a PHI determination, but names, dates of birth, and addresses tied to a healthcare account are clearly PHI under the Privacy Rule's identifiers. Waiting for a vendor determination on a question already answered by the rule delays mandatory notifications.

Which statement best describes the scope of protected health information under the HIPAA Privacy Rule?

• AOnly electronic medical record entries created by a covered entity after the compliance date of the Privacy Rule.
• BAny health-related information about a patient, even after it has been fully de-identified using the safe harbour method.
• CBilling and insurance records held by a covered entity, excluding clinical notes and diagnostic test results.
• DIndividually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.check_circle Correct

Why A is wrong: Tempting because the Security Rule focuses on electronic PHI, but the Privacy Rule itself covers PHI in any form, including paper records, oral communications, and electronic data, so limiting scope to electronic records is incorrect.

Why B is wrong: Tempting because de-identified data still describes health, but once identifiers are removed under the safe harbour method, the information is no longer PHI and the Privacy Rule no longer restricts its use or disclosure.

Why C is wrong: Tempting because billing data clearly carries identifiers, but PHI covers clinical notes, test results, and treatment records as well as payment data, so excluding clinical content understates the rule's scope.

Why D is correct: The Privacy Rule defines PHI as individually identifiable health information that relates to past, present, or future care, payment, or condition, held or transmitted by a covered entity or business associate, in any form, whether electronic, paper, or oral.