Preparing for the RHIA (Registered Health Information Administrator) exam? Legal is one of the areas our deck drills hardest: 150 of its 1000 flashcards focus on legal, covering topics like NPP, Privacy Rule, Privacy Practices, Security Rule. Try the sample questions below — every card is a real question-and-answer pair from the full deck.
150
Cards on this topic
1000
Total RHIA cards
$7
Full access
Under the HIPAA Privacy Rule, when must a healthcare provider with a direct treatment relationship first provide the Notice of Privacy Practices (NPP) to a patient?
Show answer →Providers must provide the NPP no later than the date of the first service delivery. For electronic service delivery, it must be provided as soon as practicable. A provider must also make a good faith effort to obtain a written acknowledgment of receipt. Strategy Tip: AHIMA often tests the timing (first service) and the good faith effort requirement. Note: Failure to obtain acknowledgment does not prevent treatment, but the effort must be documented.
A facility conducts a systematic process to identify potential vulnerabilities and threats to the confidentiality, integrity, and availability of ePHI. According to the HIPAA Security Rule, which specific Administrative Safeguard standard does this fulfill?
Show answer →This fulfills the **Risk Analysis** implementation specification under the **Security Management Process** standard. **Key Exam Point:** Risk Analysis is a **REQUIRED** (not addressable) specification. It is the foundational step that informs the Risk Management plan. **Distinction:** Risk Analysis is the *identification* of risks; Risk Management is the *implementation* of measures to reduce those identified risks to a reasonable and appropriate level. AHIMA often tests the distinction between these two components of the Security Management Process.
A HIM Director is told the facility completed a Gap Analysis against the HIPAA Security Rule. Does this satisfy the §164.308(a)(1)(ii)(A) requirement for a Risk Analysis?
Show answer →No. A Gap Analysis identifies which controls are missing (the what), whereas a Risk Analysis identifies specific vulnerabilities and threats (the why/how) to determine the likelihood and impact of potential risks to ePHI. AHIMA emphasizes that a Gap Analysis is a partial tool but does not constitute a full SRA. Exam Tip: Look for distractors that equate compliance checklists with formal risk assessment; OCR frequently cites failure to perform a comprehensive enterprise-wide risk analysis as a top violation.
A HIM Director reviews an ROI request. To be HIPAA-compliant, which core elements must be present for the authorization to be considered valid?
Show answer →Per HIPAA Privacy Rule, a valid authorization must include: 1) Specific description of PHI; 2) Name of person/entity authorized to make the disclosure; 3) Name of recipient; 4) Purpose of disclosure; 5) Expiration date or event; 6) Signature of individual and date. It must also contain required statements regarding the right to revoke, the potential for redisclosure, and whether treatment is conditioned on signing. Exam Tip: AHIMA often tests for the Purpose element; if the patient initiates the request, the statement at the request of the individual is legally sufficient to satisfy this requirement.
An HIM department receives a subpoena duces tecum for a patient's records signed by the plaintiff's attorney. No patient authorization is attached. What is the HIM Director's first action under HIPAA?
Show answer →Under HIPAA, a subpoena signed by an attorney is NOT a court order. The HIM Director must ensure the patient has been notified or that a qualified protective order has been sought. The first action is to check for a valid authorization. If missing, the facility must receive satisfactory assurance (proof of notification or a protective order) before releasing records. AHIMA tip: Distinguish between judicial (court-signed) and administrative/attorney subpoenas.
Keep going
You just saw a few. The full deck covers every RHIA topic.
One-time payment · less than 1¢ per card · 30-day money-back guarantee
Try 30 free RHIA cards firstThe full RHIA deck contains 1000 flashcards, and 150 of them focus on legal. This page shows 5 free samples.
Our RHIA deck dedicates 150 of 1000 cards (15%) to legal — always cross-check the official AHIMA exam outline for the current blueprint weighting.
Yes — the samples on this page are free, and the RHIA preview page has 30 more free cards. Full access to all 1000 cards is a one-time $7.
RHIA practice test
20 mixed questions across every topic, with answers — see where you stand →
RHIA study guide
Topic weights, difficulty breakdown and a 5-step study plan →
Eligibility rules, fees, question counts and passing standards are set by the certifying body and change over time. Always confirm them at the source before you apply or schedule your exam — our flashcards are practice material, not the official handbook.