Medical Law, Ethics & HIPAA: NHA CCMA Practice Questions

The assistant is risking a charge for the civil tort of battery. Even though the assistant had good intentions to prevent infection, continuing to physically touch the patient and remove sutures after consent is explicitly withdrawn constitutes unauthorized touching. This is not assault because the issue is the actual physical contact, not just a threat that caused fear. It is not criminal healthcare billing fraud because there is no financial deception or intentional misrepresentation of services for money. It is not a criminal act of abuse because the action was meant to be therapeutic rather than maliciously harmful, though it remains a civil violation. Patients have the right to halt procedures at any time.

The 21st Century CURES Act strongly emphasizes interoperability and patient access to electronic health information. Implementing a new smartphone application interface to let patients download their health data directly complies with this mandate by preventing information blocking. The Affordable Care Act (Option B) and essential health benefits (Option D) relate to insurance coverage and preventive care, not software interfaces. The HITECH Act (Option C) focuses on initial EHR adoption and breach notifications, whereas the CURES Act specifically drives modern app-based data sharing and seamless interoperability.

The legal doctrine of respondeat superior translates to "let the master answer." This principle means that an employer or supervising physician is legally responsible for the actions of their employees when those actions occur within the scope of their employment. Option B is correct because the physician is held liable for the assistant's dosing error. Option A is incorrect because res ipsa loquitur means "the thing speaks for itself" and applies to obvious negligence like retained surgical instruments, not vicarious liability. Option C is incorrect because contributory negligence refers to the patient's own actions contributing to their injury, which did not happen here. Option D is incorrect because comparative negligence involves weighing the shared fault between the plaintiff and defendant, rather than an employer's vicarious liability for staff.

The DEA strictly regulates the disposal of controlled substances to prevent diversion. Expired Schedule II medications must be destroyed beyond reclamation, requiring two authorized witnesses and the completion of DEA Form 41. Option D correctly identifies this legal protocol. Option A is incorrect because flushing medications violates environmental guidelines and DEA rules. Option B is incorrect because sharps containers are for needles, and placing intact patches there risks diversion. Option C is incorrect because clinics cannot arbitrarily transfer controlled substances without proper reverse distributor documentation.

The correct action is to refuse the request because audit trails automatically log every user who opens a chart. Accessing a record without a direct clinical or administrative need is a HIPAA violation. Option A is incorrect because briefly viewing the chart still generates an audit log and breaches confidentiality. Option C is incorrect because asking the provider to commit the breach does not resolve the ethical and legal issue. Option D is incorrect because printing demographic information is still an unauthorized disclosure of electronic protected health information. Medical assistants must always protect patient privacy and rely on established security protocols rather than fulfilling informal requests.

When parents share joint legal custody, both have an equal right to make medical decisions for their child. If they explicitly disagree, the medical assistant must notify the provider to halt non-emergent treatment until the parents reach an agreement or obtain a court directive. Option A is incorrect because one parent's consent does not override the other's explicit refusal when legal custody is shared. Option B is wrong because routine consent usually requires only one signature; requiring both is not standard practice unless a dispute is already known. Option C is incorrect because legal custody, not primary physical caregiver status, dictates medical decision-making authority.

When a caregiver claims legal authority over an adult with a severe intellectual disability, the medical assistant must obtain the official court appointed guardianship order to verify this status before proceeding with care. Option C is correct because this legal document must be scanned into the patient's medical record to prove the caregiver has the right to consent to the routine vaccination. Option A is incorrect because verbal claims are legally insufficient for establishing guardianship or obtaining informed consent. Option B is incorrect as primary care providers do not have the legal jurisdiction to grant guardianship; only a judge can do so. Option D is incorrect because a patient with severe cognitive impairment lacks the legal capacity to understand and sign an informed consent form, even with witnesses present.

For informed consent to be legally valid, the patient must be competent and of sound mind at the time of signing. Because the patient was just given a medication that alters mental status, they are temporarily legally incompetent to provide valid consent. Option D is correct because the assistant must halt the process and alert the provider. Option A and Option C are incorrect because any signature obtained under the influence of narcotics is invalid and considered coercive. Option B is incorrect because a family member cannot simply witness a compromised patient's signature; they would need to be a designated legal proxy signing on the patient's behalf.

The assistant committed battery because they intentionally touched the patient without permission. Even though the blood draw was ordered by a provider, the patient explicitly withdrew consent by pulling away and refusing. Proceeding with the physical puncture is an unauthorized touching. This is not assault because assault involves creating the fear of harm rather than the actual physical contact itself. It is not negligence or malpractice because those involve a failure to meet the standard of care that results in accidental injury, whereas this was an intentional tort. Medical assistants must always respect a patient's right to refuse treatment at any time to avoid civil liabilities.

Altering diagnosis codes to justify unnecessary procedures is a criminal act of fraud. Fraud involves intentional deception for financial gain, which violates federal laws like the False Claims Act and can result in severe criminal penalties including prison time. This is not a civil tort of negligence or malpractice, because those involve unintentional errors or a failure to meet the standard of care that results in patient injury, rather than deliberate financial deception. It is not a criminal act of battery because there is no unauthorized physical contact mentioned in the scenario. Medical assistants who notice intentional upcoding or false billing must recognize it as criminal behavior and report it through the proper compliance channels.

In tort law, negligence can be categorized by the type of action or inaction. Nonfeasance is the failure to perform an act that should have been performed, such as ignoring a safety hazard like a spill. Option A is correct because the assistant failed to act when duty required it. Option B is incorrect because malfeasance refers to performing an act that is wholly illegal or wrongful, which does not fit a simple failure to clean a floor. Option C is incorrect because misfeasance involves performing a lawful act improperly, whereas this scenario describes a complete omission of action. Option D is incorrect because defamation involves damaging a person's reputation through false statements, which is entirely unrelated to a physical injury caused by a slip and fall.

The Patient's Bill of Rights guarantees financial transparency, meaning patients are entitled to know the expected costs of care before agreeing to it. Option B correctly supports the patient's right to make an informed financial decision. Option A dismisses the patient's immediate request and violates their right to prior disclosure. Option C improperly shifts the entire burden to the patient when the clinic should provide the procedural cost estimate. Option D is incorrect because patients can still choose to decline medically necessary care based on cost considerations.

Minors who are legally married are considered emancipated and have the legal right to consent to their own medical care, just like an adult. The medical assistant should allow her to sign her own consent form. Option B is incorrect because a spouse does not need to sign a consent form for a competent adult or an emancipated minor. Option C is wrong because marriage legally severs the requirement for parental medical consent. Option D is incorrect because a valid marriage certificate is sufficient proof of emancipation in this context; a separate court order from a judge is not required for married minors to receive medical care.

When managing records for minors, you must hold onto them until the patient reaches the age of majority plus the state's statute of limitations. Option B is correct because a 16-year-old has not yet reached adulthood, meaning the retention clock extends further than it would for an adult. Options A and D are incorrect because destroying the file prematurely violates medical records law and leaves the clinic legally vulnerable. Option C is incorrect because standard recycling does not protect patient privacy and is never an acceptable disposal method for health information.

Patients have the right to refuse treatment at any time. When the assistant performed the venipuncture after the patient explicitly refused, they committed battery, which is the intentional, unconsented physical contact with another person. Therefore, Option C is correct. Option A is incorrect because negligence involves an unintentional breach of the standard of care, whereas this was a deliberate action. Option B is incorrect because assault refers to the threat or perceived threat of bodily harm, not the actual physical contact itself. Option D is incorrect because patient abandonment involves a provider terminating care without proper notice or a suitable replacement, which does not apply to forcing a procedure on a patient who is currently in the clinic.

During an internal audit, finding unsigned laboratory results requires routing them to the provider. Only the provider can legally sign off on diagnostic reports to confirm they reviewed the data, even if results are normal and patients were notified. Option B is incorrect because closing the encounter without a provider signature violates compliance standards. Option C is inappropriate as deleting medical records is illegal and destroys clinical history. Option D is incorrect because medical assistants cannot sign diagnostic reports on behalf of a provider, which falls outside their scope of practice.

When a patient transitions to a new facility, providing an updated medication list and a discharge summary is crucial to prevent adverse events and ensure seamless care. Option B is correct because it directly supports clinical continuity. Option A is incorrect as demographic forms alone do not provide necessary clinical context. Option C is unsafe because relying on a patient to verbally report complex medication changes risks dangerous errors. Option D is incorrect because while advance directives are important, blank forms do not communicate the patient's current medical status.

A complete laboratory requisition must include the ordering provider's information to be valid. Option C is correct because the medical assistant must verify the order with the provider's office before proceeding, even for stat tests. Option A is incorrect; performing the draw without a valid, signed order is outside the scope of practice and risks unauthorized testing. Option B is incorrect because the patient's verbal claim does not substitute for a provider signature or official authorization. Option D is incorrect; a medical assistant cannot legally sign a requisition on behalf of a provider.

Under HIPAA regulations, being the spouse of a patient does not automatically grant someone access to protected health information like recent biopsy results. Option B is correct because the medical assistant must verify that a valid, signed release of information is on file specifically authorizing the spouse to receive medical updates. Option A is incorrect because verifying the spouse's identity is irrelevant if they are not legally authorized to receive the information. Option C is incorrect because obtaining the patient's social security number from the caller does not substitute for documented consent. Option D is incorrect because results can often be shared over the phone, provided the proper authorization and identity verification protocols are strictly followed.

For a routine gastroenterology referral evaluating chronic abdominal pain, sending relevant clinic notes and recent labs ensures the specialist has the necessary clinical context to evaluate the patient effectively. Option A is correct because it adheres to the minimum necessary standard for continuity of care. Option B is incorrect because sending the entire chart violates privacy guidelines and overwhelms the consulting provider with irrelevant data. Option C is incorrect because relying on the patient's memory is clinically unreliable and does not constitute professional care coordination. Option D is incorrect because the specialist needs existing baseline data to avoid duplicating expensive and invasive diagnostic tests.

Medical assistants play a vital role in managing quality measure alerts by preparing necessary interventions for the provider. When an EHR alert indicates a missing preventive service like a pneumococcal vaccine for a 65-year-old patient, the most appropriate action is to pend the order. This allows the provider to review the patient's history, confirm the clinical appropriateness, and authorize the administration. Option A is incorrect because administering a vaccine requires a provider's order first, making it outside the assistant's scope of practice to proceed independently. Option C is incorrect because overriding the alert ignores a critical preventive care standard and negatively impacts clinic quality metrics. Option D is incorrect because while a pharmacy is an option, the clinic should attempt to fulfill the preventive care measure during the current visit to ensure compliance.

Every patient has the right to refuse any medication or treatment, regardless of the reason. When a patient declines a medication, the medical assistant must respect their decision, document the refusal accurately in the medical record, and notify the provider immediately so they can address the patient's concerns or adjust the treatment plan. Option B is incorrect because forcing compliance or arguing with the patient violates their autonomy and informed consent rights. Option C is incorrect because a medical assistant cannot independently alter a medication dose without a new order from the provider. Option D is incorrect because rescheduling the dose does not address the patient's immediate refusal or the adverse side effect they are experiencing. The provider needs to evaluate the reported dizziness before any further action is taken.

A potassium level of 6.8 mEq/L is a critical, life-threatening value that can cause fatal cardiac arrhythmias. When ancillary lab services report a critical value, the medical assistant must immediately notify the provider, making option C the correct choice. The provider will then determine the appropriate emergency intervention. Option A is incorrect because simply documenting the result delays urgent medical care. Option B is outside the medical assistant's scope of practice, as only a provider can direct a patient to the emergency room for a critical laboratory value. Option D is incorrect because repeating the venipuncture wastes valuable time when the patient requires immediate medical evaluation and intervention by the supervising physician.

The immediate priority for chemical burns to the eye is to perform continuous irrigation with saline or water to flush out the chemical and minimize permanent corneal damage. Covering the eye with sterile gauze pads traps the chemical against the eye, worsening the burn. Administering topical analgesic drops is outside the medical assistant's scope of practice without an immediate provider order, and it delays the critical step of flushing. Performing a visual acuity test is an important assessment tool later, but it should never delay immediate irrigation in a chemical exposure emergency.

A valid ABN must include a good-faith estimated cost for the non-covered service. Because the field was left blank, the form is invalid, meaning the clinic cannot legally bill the patient and must absorb the cost (Option D). Option A is incorrect because a patient signature does not validate an incomplete form. Option B is incorrect because Medicare will still deny the non-covered service regardless of the signature. Option C is incorrect because the invalid ABN protects the patient from unexpected financial liability.

Option A is correct because connecting the patient to a food pantry directly addresses the food insecurity that is preventing them from managing their new diagnosis. Option B is incorrect because a standard diet plan is useless if the patient cannot afford the recommended foods, thereby ignoring the underlying social determinants of health. Option C is incorrect because suggesting bulk organic purchases is financially out of touch with the patient's stated inability to afford basic fresh produce. Option D is incorrect because advising a diabetic patient to skip meals is dangerous medical advice and outside the medical assistant's scope of practice.

Facilitating effective communication is a cornerstone of clinic teamwork and patient safety. For a complex procedure like a diabetic wound dressing change, accurate patient education and consent are mandatory. Coordinating a certified medical interpreter (Option D) ensures that medical terminology is translated accurately and objectively. Option A violates best practices and potentially HIPAA, as family members may lack medical vocabulary or filter information. Option B is unsafe because receptionists and basic software are not qualified to translate complex medical instructions. Option C ignores the patient's right to understand their care and participate in the procedure, which is especially dangerous for diabetic wound management where at-home care instructions are vital for healing.

When leaving a message on a shared family voicemail, the medical assistant must adhere to the minimum necessary rule to prevent unauthorized disclosure of protected health information. Option A is correct because stating only your name and requesting a callback protects the patient's privacy regarding the positive STI result. Option B is incorrect because leaving the clinic name can inadvertently reveal the nature of the call, especially if the clinic specializes in infectious diseases. Options C and D are incorrect because stating the test results or diagnosis on a voicemail directly violates HIPAA guidelines by exposing sensitive medical information to anyone who might listen to the recording. Always prioritize patient confidentiality by limiting the details provided in any automated or shared message system.

In an Accountable Care Organization, addressing frequent emergency visits requires comprehensive support. Referring the patient to a care navigator helps identify social determinants of health and barriers to medication adherence. Option A is incorrect because prescribing medications is outside the medical assistant's scope of practice. Option B might be helpful eventually, but a care navigator provides the broader, immediate coordination needed for complex compliance issues. Option D is clinically incorrect, as controlled asthma should not preclude a patient from exercising.

While parents generally have access to a minor's medical records, exceptions exist for sensitive services such as reproductive health, where a sixteen-year-old daughter can consent to treatment and request confidentiality. Option D is correct because the medical assistant must respect the minor's right to privacy regarding her pregnancy test results and require explicit consent before disclosing them. Option A is incorrect because the legal status of a minor does not automatically override state and federal privacy protections for specific confidential services. Option B is incorrect because being the financial guarantor does not grant access to protected health information without authorization. Option C is incorrect because the medical assistant should be trained to handle routine privacy boundaries without immediately escalating to management.