Free RHIA Practice Test
This free RHIA practice test contains 50 original questions across all five exam domains, with answers and explanations. This is an unofficial practice sample, not a full-length AHIMA exam.
The 50 practice questions
Question 1
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-01
A patient submits a written request for a copy of her records. The records are in off-site storage and the release-of-information team cannot fulfill the request within the first 30 days. Under the HIPAA Privacy Rule, what is the longest total time the hospital may take, assuming it handles the delay correctly?
Show answer and explanation
Answer: C. 60 days, if it gives the patient a written reason for the delay and a completion date within the first 30 days
45 CFR 164.524(b)(2) requires action within 30 days of receipt, with one extension of no more than 30 days if the entity, within the first 30 days, gives the individual a written statement of the reasons and the date it will act. State law may be stricter, and a stricter state deadline still applies.
Why the others are wrong
- A: One extension is allowed.
- B: No 45-day rule exists in 164.524.
- D: Off-site storage does not create a longer HIPAA deadline; only one 30-day extension is allowed.
Outline task: D2 Task 3: Process health information requests according to legal and regulatory standards
Source: 45 CFR 164.524, Access of individuals to protected health information (eCFR), (a)(1)-(a)(3); (b)(2); (c)(2)-(c)(4); (d)(1)
Question 2
D3 Data Analytics and Informatics · RHIA-D3-01
A hospital recorded 9,180 inpatient service days during a 30-day month. What was the average daily census for the month?
Show answer and explanation
Answer: B. 306
Average daily census = total inpatient service days in the period / number of days in the period. 9,180 / 30 = 306.
Why the others are wrong
- A: Divides by 31 days instead of the 30 days in the period (9,180 / 31 is approximately 296).
- C: Divides by 28 days, the wrong length for this period (9,180 / 28 is approximately 328).
- D: That is the total inpatient service days for the month, not the daily average.
Outline task: D3 Task 9: Validate healthcare statistics for organizational stakeholders
Source: Hawaii SHPDA, Bed Utilization Formulas (2023 Health Care Utilization Report, Table 30), ADC and occupancy rate formulas with worked example, p. 110; Calculation from the figures given in the question
Question 3
D4 Revenue Cycle Management · RHIA-D4-01
A patient is admitted as an acute care inpatient with shortness of breath. After study, the attending physician documents that the shortness of breath was due to acute on chronic systolic heart failure, which was treated with IV diuretics. What is the principal diagnosis?
Show answer and explanation
Answer: D. Acute on chronic systolic heart failure
The principal diagnosis is the condition established after study to be chiefly responsible for the admission. Symptom codes are not used as principal diagnosis when a related definitive diagnosis has been established (ICD-10-CM Official Guidelines, Sections I.B.4 and II.A).
Why the others are wrong
- A: Shortness of breath is not the principal diagnosis here because a related definitive diagnosis has been established.
- B: The guidelines do not leave this to coder discretion.
- C: Drops the acute component the physician documented. Code to the highest specificity documented, here acute on chronic.
Outline task: D4 Task 6: Assign diagnoses and procedure codes and groupings according to official guidelines
Source: CMS/
Question 4
D5 Management and Leadership · RHIA-D5-01
An HIM department needs 16,640 productive coding hours next year. One FTE is paid for 2,080 hours per year, and the department's productive-time standard is 85% of paid hours. How many coding FTEs are needed? Express the calculated requirement to one decimal place.
Show answer and explanation
Answer: C. 9.4
Productive hours per FTE = 2,080 x 0.85 = 1,768. FTEs needed = 16,640 / 1,768 = 9.41, or about 9.4 FTEs.
Why the others are wrong
- A: Multiplies 8.0 by 0.85 instead of dividing, which shrinks the requirement.
- B: Divides by paid hours (16,640 / 2,080) and ignores non-productive time.
- D: Rounds up to a whole number without basing it on the calculation; staffing plans can round, but the computed requirement is 9.4.
Outline task: D5 Task 4: Perform and oversee work design and process improvement activities
Source: Calculation from the figures given in the question
Question 5
D1 Data and Information Governance · RHIA-D1-01
A returning patient tells registration she has changed her last name since her last visit. The clerk does not find her under the new name and creates a new medical record number. She now has two medical record numbers at the same hospital. Which MPI error has occurred?
Show answer and explanation
Answer: B. Duplicate
A duplicate is one patient assigned a second, new medical record number within the same system. That is exactly what happened here: one person, two MRNs at one hospital.
Why the others are wrong
- A: An overlay is the reverse problem: a patient is assigned another patient's number, so two people end up in one record.
- C: An overlap is one patient holding different record numbers at different facilities in an enterprise. This stayed within one hospital.
- D: A merge is the correction step that combines duplicate records. It is the fix, not the error.
Outline task: D1 Task 8: Manage the integrity of the master patient index (MPI)
Source: ONC, SAFER Patient Identification guide, Recommended Practice 3.2, printed p. 23: duplicate, overlay and overlap definitions; immediate remediation; AHIMA, RHIA Exam Content Outline (Effective Date: 10/01/2023), pp. 1-2, Domains 1-5 and task statements
Question 6
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-02
A patient requests a copy of 'everything' from his outpatient behavioral health care. The record includes progress notes, medication management notes, and his therapist's separately kept notes analyzing the contents of their counseling sessions. Under HIPAA's right-of-access rule, how should the release-of-information specialist respond?
Show answer and explanation
Answer: B. Provide the rest of the requested record; the separately kept psychotherapy notes may be withheld, and that denial is not subject to review
Psychotherapy notes, as defined in 45 CFR 164.501, are excluded from the right of access, and denial on that ground is an unreviewable denial under 164.524(a)(2)(i). The entity must still give access to the other requested PHI (164.524(d)(1)). Medication management and treatment summaries are not psychotherapy notes by definition.
Why the others are wrong
- A: Psychotherapy notes are a specific exception to the right of access.
- C: Mental health information in general is not excluded; only psychotherapy notes as defined are.
- D: Review by a licensed professional applies to reviewable denials, such as risk of harm. This exclusion is unreviewable.
Outline task: D2 Task 1: Manage patient access to their health information, including use of patient portals
Source: 45 CFR 164.524, Access of individuals to protected health information (eCFR), (a)(1)-(a)(3); (b)(2); (c)(2)-(c)(4); (d)(1); 45 CFR 164.501, Definitions (eCFR), Designated record set; Psychotherapy notes
Question 7
D3 Data Analytics and Informatics · RHIA-D3-02
A 250-bed hospital recorded 6,600 inpatient service days in April (30 days). The bed count did not change. What was the inpatient bed occupancy rate?
Show answer and explanation
Answer: C. 88.0%
Occupancy = inpatient service days / (beds x days in the period) x 100. Bed days available = 250 x 30 = 7,500. 6,600 / 7,500 = 0.88, or 88.0%. This matches the government formula ADC / beds x 100: ADC = 6,600 / 30 = 220; 220 / 250 = 88.0%.
Why the others are wrong
- A: Divides inpatient service days by beds only (6,600 / 250), forgetting the number of days.
- B: Uses 31 days instead of 30 (6,600 / 7,750).
- D: Inverts the formula (7,500 / 6,600).
Outline task: D3 Task 9: Validate healthcare statistics for organizational stakeholders
Source: Hawaii SHPDA, Bed Utilization Formulas (2023 Health Care Utilization Report, Table 30), ADC and occupancy rate formulas with worked example, p. 110; Calculation from the figures given in the question
Question 8
D4 Revenue Cycle Management · RHIA-D4-02
An acute care inpatient's discharge summary states 'probable bacterial pneumonia,' and the record shows the workup and IV antibiotic treatment directed at pneumonia. How should the coder report the pneumonia?
Show answer and explanation
Answer: A. Code it as if it existed or was established
For inpatient admissions to short-term acute, long-term care, and psychiatric hospitals, Section II.H of the ICD-10-CM guidelines says a diagnosis documented at discharge as 'probable,' 'suspected,' 'likely,' and similar terms is coded as if it existed. The outpatient rule (Section IV.H) is the opposite.
Why the others are wrong
- B: This is the outpatient rule in Section IV.H, not the inpatient rule.
- C: Code assignment is based on the provider's diagnostic statement, not on a specific lab result (Section I.A.19).
- D: Category Z03 applies when a suspected condition is ruled out, not when a diagnosis is documented as probable at discharge.
Outline task: D4 Task 6: Assign diagnoses and procedure codes and groupings according to official guidelines
Source: CMS/
Question 9
D5 Management and Leadership · RHIA-D5-02
The HIM department budgeted $18,000 for overtime this quarter and spent $22,500. How should the variance be described? Express the percentage as a share of the budget.
Show answer and explanation
Answer: D. $4,500 unfavorable (25%)
Spending more than budgeted on an expense line is an unfavorable variance. $22,500 - $18,000 = $4,500. As a percentage of budget: $4,500 / $18,000 = 25%.
Why the others are wrong
- A: Overspending an expense budget is not favorable, and 20% uses actual spending as the base.
- B: Correct direction, but 20% divides by actual spending ($4,500 / $22,500) instead of budget.
- C: Wrong direction and favorable is incorrect for an expense overrun.
Outline task: D5 Task 6: Prepare and implement budgets
Source: Calculation from the figures given in the question
Question 10
D1 Data and Information Governance · RHIA-D1-02
In the emergency department, a clerk selects an existing record for 'James R. Ortiz, DOB 03/14/1961' when registering a different patient, 'James T. Ortiz, DOB 07/02/1958.' The second patient's triage notes, orders, and lab results are filed to the first patient's medical record number. Why does this error require urgent correction?
Show answer and explanation
Answer: D. Two different people's clinical information now sits in one record, so clinicians may act on the wrong patient's data
This is an overlay: one patient was assigned another patient's medical record number. Overlays blend two people's histories, allergies, and results into one chart, which is a direct patient-safety risk, not just a data-cleanup task.
Why the others are wrong
- A: That describes a duplicate (one person, two numbers). Here, two people share one number.
- B: That describes an overlap across facilities, which is not what the scenario shows.
- C: Billing delay may follow, but it is not the main risk in this scenario.
Outline task: D1 Task 8: Manage the integrity of the master patient index (MPI)
Source: ONC, SAFER Patient Identification guide, Recommended Practice 3.2, printed p. 23: duplicate, overlay and overlap definitions; immediate remediation; AHIMA, RHIA Exam Content Outline (Effective Date: 10/01/2023), pp. 1-2, Domains 1-5 and task statements
Question 11
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-03
A patient asks for an electronic copy of her records under her HIPAA right of access. Which cost may the hospital include in a reasonable, cost-based fee?
Show answer and explanation
Answer: D. Labor for copying the requested information
45 CFR 164.524(c)(4) limits the fee to labor for copying, supplies for creating the copy or portable media, postage if mailed, and preparing an agreed-upon summary or explanation. Nothing else may be included.
Why the others are wrong
- A: Search and retrieval are not among the permitted cost elements.
- B: System maintenance is not a permitted cost element.
- C: The fee must be cost-based and limited to the listed elements, not tied to what third parties pay.
Outline task: D2 Task 3: Process health information requests according to legal and regulatory standards
Source: 45 CFR 164.524, Access of individuals to protected health information (eCFR), (a)(1)-(a)(3); (b)(2); (c)(2)-(c)(4); (d)(1)
Question 12
D3 Data Analytics and Informatics · RHIA-D3-03
A unit had 200 beds from January 1-15 and 240 beds from January 16-31 after an expansion opened. It recorded 6,000 inpatient service days in January. What was the January occupancy rate?
Show answer and explanation
Answer: B. 87.7%
When the bed count changes, bed days available must be summed for each period: (200 x 15) + (240 x 16) = 3,000 + 3,840 = 6,840 bed days. 6,000 / 6,840 = 0.877, or 87.7%. Using a single bed count for the whole month misstates capacity.
Why the others are wrong
- A: Uses 240 beds for all 31 days (6,000 / 7,440), overstating capacity.
- C: Uses an averaged 220 beds x 31 days (6,000 / 6,820). The days at each bed count are not equal (15 vs 16), so a simple average is slightly off.
- D: Uses 200 beds for all 31 days (6,000 / 6,200), understating capacity.
Outline task: D3 Task 9: Validate healthcare statistics for organizational stakeholders
Source: Hawaii SHPDA, Bed Utilization Formulas (2023 Health Care Utilization Report, Table 30), ADC and occupancy rate formulas with worked example, p. 110; Calculation from the figures given in the question
Question 13
D4 Revenue Cycle Management · RHIA-D4-03
A CDI specialist sees that a post-operative patient's hemoglobin fell from 12.1 g/
Show answer and explanation
Answer: C. An open-ended query that cites the hemoglobin values and the transfusion with their record locations and asks the provider to clarify the clinical significance of these findings, if any
The AHIMA/
Why the others are wrong
- A: Leading and references reimbursement impact, which the brief prohibits.
- B: Yes/
no queries may not be used to obtain a new diagnosis that has not been documented. - D: Bolding or highlighting an option directs the provider to a response and is considered leading.
Outline task: D4 Task 4: Conduct clinical documentation integrity (CDI) activities
Source: ACDIS/
Question 14
D5 Management and Leadership · RHIA-D5-03
A hospital's finance policy says items costing more than $5,000 with a useful life of more than one year go in the capital budget; everything else is an operating expense. The HIM director plans to buy a $48,000 high-speed scanner expected to last 6 years and $3,000 of scanner paper and toner. How should these be budgeted?
Show answer and explanation
Answer: A. Scanner in the capital budget; paper and toner in the operating budget
Apply the stated policy: the scanner exceeds $5,000 and lasts more than a year, so it is capital. The supplies fall below the threshold and are consumed, so they are operating expenses.
Why the others are wrong
- B: The scanner meets both capital criteria.
- C: The supplies fall below the $5,000 threshold.
- D: Reverses the policy.
Outline task: D5 Task 6: Prepare and implement budgets
Source: Calculation from the figures given in the question
Question 15
D1 Data and Information Governance · RHIA-D1-03
Under the Medicare Conditions of Participation for hospitals, what is the minimum period that medical records must be retained in their original or legally reproduced form?
Show answer and explanation
Answer: B. 5 years
42 CFR 482.24(b)(1) requires hospital medical records to be kept in original or legally reproduced form for at least 5 years. State law or other rules can require longer.
Why the others are wrong
- A: Three years is not the CoP floor for hospital records.
- C: Six years is the look-back period for a HIPAA accounting of disclosures (45 CFR 164.528), not a hospital record-retention rule. Mixing the two is a common trap.
- D: Ten years is not the federal CoP minimum.
Outline task: D1 Task 7: Comply with retention and destruction policies for health information
Source: 42 CFR 482.24, Condition of participation: Medical record services (eCFR), 482.24(b)(1); (c)(1)-(2); (c)(4)(i)(A)-(C); (c)(4)(viii); 45 CFR 164.528, Accounting of disclosures (eCFR), (a)(1)(i)-(ix); (c)(1)-(c)(2)
Question 16
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-04
A patient exercising her right of access asks the hospital to send an electronic copy of her EHR records directly to her attorney. What must her request include for the hospital to send the copy to the attorney under the right-of-access rule?
Show answer and explanation
Answer: A. A written, signed request that clearly identifies the attorney and where to send the copy
Under 45 CFR 164.524(c)(3)(ii), when an individual directs the covered entity to send the copy to another person, the request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy. After the Ciox Health v. Azar ruling, HHS limits this third-party directive to electronic copies of records in an EHR. Building that check into the ROI workflow is the task here.
Why the others are wrong
- B: Authorization elements apply to disclosures under 164.508. For an electronic copy of EHR records that the patient directs to a third party, the signed written access directive is enough.
- C: No subpoena is needed when the patient directs her own copy.
- D: The directive must be written and signed.
Outline task: D2 Task 5: Develop health information request workflows to comply with legal and regulatory standards
Source: 45 CFR 164.524, Access of individuals to protected health information (eCFR), (a)(1)-(a)(3); (b)(2); (c)(2)-(c)(4); (d)(1); HHS, Court Order Regarding the HIPAA Right of Access (Ciox Health v. Azar), Third-party directive limited to electronic copies of EHR; fee limits apply only to an individual's own access
Question 17
D3 Data Analytics and Informatics · RHIA-D3-04
The quality committee wants to see how the hospital's 30-day readmission rate has changed each month over the past 24 months. Which display is the best choice?
Show answer and explanation
Answer: A. Arithmetic-scale line graph
CDC's guide to selecting graphs recommends an arithmetic-scale line graph to show trends in numbers or rates over time. Monthly rates across 24 months is a classic trend display.
Why the others are wrong
- B: Pie charts show components of a whole at one point in time.
- C: Spot maps show where cases occur, not change over time.
- D: A histogram of ages shows a frequency distribution, not the rate trend the committee asked about.
Outline task: D3 Task 2: Create reports and visual representations of data
Source: CDC, Principles of Epidemiology in Public Health Practice, Lesson 4 Summary, Guide to Selecting a Graph or Chart to Illustrate Epidemiologic Data
Question 18
D4 Revenue Cycle Management · RHIA-D4-04
In which situation is a yes/
Show answer and explanation
Answer: B. Determining whether a documented pressure injury was present on admission
The brief allows yes/
Why the others are wrong
- A: Sepsis is not documented, so a yes/
no query would introduce a new diagnosis. - C: Malnutrition is not documented by the provider, so a yes/
no query is not permitted for it. - D: Queries must never reference DRGs or reimbursement.
Outline task: D4 Task 4: Conduct clinical documentation integrity (CDI) activities
Source: ACDIS/
Question 19
D5 Management and Leadership · RHIA-D5-04
An EHR conversion project has these tasks: A (requirements, 3 weeks) must finish before B (interface build, 4 weeks) and C (data migration, 6 weeks). D (go-live readiness testing, 2 weeks) can start only after both B and C finish. What is the minimum project duration?
Show answer and explanation
Answer: B. 11 weeks
Paths: A-B-D = 3 + 4 + 2 = 9 weeks; A-C-D = 3 + 6 + 2 = 11 weeks. The longest path (the critical path) sets the minimum duration: 11 weeks. Task B has 2 weeks of slack.
Why the others are wrong
- A: Uses the shorter path, which would leave data migration unfinished.
- C: Adds B and C in sequence plus A (3 + 4 + 6), ignoring that B and C run in parallel, and drops D.
- D: Adds every task in sequence (3 + 4 + 6 + 2), ignoring parallel work.
Outline task: D5 Task 9: Demonstrate knowledge to lead or facilitate project management
Source: Calculation from the figures given in the question
Question 20
D1 Data and Information Governance · RHIA-D1-04
A new compliance analyst drafts this sentence for the retention policy: 'HIPAA requires us to keep every patient's medical record for 50 years after death.' What should the HIM director tell her?
Show answer and explanation
Answer: A. The HIPAA Privacy Rule does not set medical-record retention periods; state and other applicable law generally do
HHS states that the Privacy Rule has no medical-record retention requirement; state laws generally govern how long records are kept. The 50-year figure is how long HIPAA protects a decedent's information, and HHS confirms a covered entity may destroy the record when state or other law permits.
Why the others are wrong
- B: This confuses the 50-year protection period for decedents with a retention requirement. HHS answers this exact question directly.
- C: There is no HIPAA 6-year medical-record retention rule. Six years appears in the accounting-of-disclosures look-back.
- D: No HIPAA provision requires permanent retention.
Outline task: D1 Task 7: Comply with retention and destruction policies for health information
Source: HHS FAQ 580: Does the HIPAA Privacy Rule require covered entities to keep patients' medical records for any period of time?, Full answer; HHS FAQ 1501: Am I required to keep the decedent's information for 50 years?, Full answer
Question 21
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-05
The privacy officer is training staff on the HIPAA minimum necessary standard. Which use or disclosure is NOT subject to the minimum necessary requirement?
Show answer and explanation
Answer: C. Sending records to a specialist who will treat the patient next week
45 CFR 164.502(b)(2) lists exceptions to minimum necessary, beginning with disclosures to or requests by a health care provider for treatment. The other options are payment or operations activities, where minimum necessary applies.
Why the others are wrong
- A: Disclosures for payment are subject to minimum necessary.
- B: Auditing for compliance is a health care operations activity, which is subject to minimum necessary.
- D: Internal uses for payment are subject to minimum necessary.
Outline task: D2 Task 7: Ensure compliance with privacy and security initiatives
Source: 45 CFR 164.502, Uses and disclosures: general rules (eCFR), 164.502(b)(2)(i), (e)(1)-(2), and (f)
Question 22
D3 Data Analytics and Informatics · RHIA-D3-05
An analyst needs to show the distribution of length of stay (measured in days, including fractions of a day) for 1,400 heart failure discharges. Which display fits best?
Show answer and explanation
Answer: C. Histogram
CDC recommends a histogram (or frequency polygon) to show the frequency distribution of a continuous variable. Here, length of stay is measured on a continuous scale.
Why the others are wrong
- A: Simple bar charts compare discrete categories of a single variable, such as payer type.
- B: Pie charts show components of a whole.
- D: Area maps display data geographically.
Outline task: D3 Task 2: Create reports and visual representations of data
Source: CDC, Principles of Epidemiology in Public Health Practice, Lesson 4 Summary, Guide to Selecting a Graph or Chart to Illustrate Epidemiologic Data
Question 23
D4 Revenue Cycle Management · RHIA-D4-05
A Medicare inpatient develops a condition on CMS's hospital-acquired conditions (HAC) list during the stay. It is coded as a secondary diagnosis with a POA indicator of 'N.' What is the payment effect under the IPPS HAC provision?
Show answer and explanation
Answer: D. The case is paid as though that secondary diagnosis were not present
CMS states that for selected HACs not present on admission, hospitals do not receive additional payment; the case is paid as though the secondary diagnosis were not present. Accurate POA assignment directly affects payment.
Why the others are wrong
- A: The provision removes the HAC's effect on the MS-DRG; it does not deny the whole claim.
- B: This is exactly the higher payment the provision prevents.
- C: POA status does not change principal diagnosis selection rules.
Outline task: D4 Task 7: Conduct revenue integrity activities
Source: CMS, Hospital-Acquired Conditions (HAC) / Present on Admission Indicator, HAC Payment Provision
Question 24
D5 Management and Leadership · RHIA-D5-05
The release-of-information team pilots a new request-intake checklist with two staff members for one week. At the end of the week, the supervisor compares the error rate against the goal set before the test. Which PDSA step is the supervisor performing?
Show answer and explanation
Answer: D. Study
In AHRQ's PDSA directions, Study is where you review the results and ask whether you met your measurement goal. The small, short test with two staff members is also consistent with PDSA's small-sample, short-duration design.
Why the others are wrong
- A: Plan is when the test and its hoped-for result are defined, before the pilot.
- B: Do is carrying out the test and recording observations during it.
- C: Act is deciding what to do next: adopt, adjust, or try a different change.
Outline task: D5 Task 4: Perform and oversee work design and process improvement activities
Source: AHRQ, Plan-Do-Study-Act Worksheet, Directions, and Examples (Health Literacy Universal Precautions Toolkit, 3rd ed.), Directions: Plan, Do, Study, Act; Small Sample Size
Question 25
D1 Data and Information Governance · RHIA-D1-05
Paper records have passed their retention period. The hospital plans to hire a shredding company to pick up locked bins weekly and destroy the records. What must be in place before the vendor handles the records?
Show answer and explanation
Answer: C. A written business associate agreement with the shredding company
A vendor that handles PHI on the hospital's behalf is a business associate. Under 45 CFR 164.502(e), the hospital must obtain satisfactory assurances, documented in a written contract or agreement, before disclosing PHI to it. HHS specifically describes using a disposal vendor as a business associate to pick up and shred PHI.
Why the others are wrong
- A: Patient authorizations are not required for the covered entity's own disposal activities.
- B: HIPAA has no advance-notice requirement to HHS for record destruction.
- D: The vendor still handles readable PHI before shredding, so no exemption applies.
Outline task: D1 Task 7: Comply with retention and destruction policies for health information
Source: 45 CFR 164.502, Uses and disclosures: general rules (eCFR), 164.502(b)(2)(i), (e)(1)-(2), and (f); HHS FAQ 576: May a covered entity dispose of PHI in dumpsters accessible by the public?, Full answer (disposal vendor as business associate)
Question 26
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-06
On April 2, a nurse (not the person responsible) notices that a coworker emailed an unencrypted spreadsheet of patient names and diagnoses to an outside personal address. The nurse does not report it until April 20, when the privacy officer learns of it. The hospital's risk assessment concludes it is a breach of unsecured PHI. Assume the breach could not reasonably have been discovered before April 2 and no law-enforcement delay applies. What is the latest date individuals may be notified?
Show answer and explanation
Answer: B. June 1
Under 45 CFR 164.404(a)(2), discovery occurs when a breach is known, or would have been known through reasonable diligence, to the covered entity, including a workforce member or agent other than the person who committed it. Discovery is April 2, not April 20. Notice is due without unreasonable delay and no later than 60 calendar days after discovery: April 2 + 60 days = June 1. June 1 is the outer limit, not the target.
Why the others are wrong
- A: Thirty days is not the breach notification limit.
- C: June 19 counts from April 20, when the privacy officer learned of it. The clock starts on April 2 in this scenario.
- D: The rule sets both a standard (without unreasonable delay) and an outer limit (60 calendar days).
Outline task: D2 Task 6: Follow breach of information protocols
Source: 45 CFR Part 164 Subpart D, Breach notification (eCFR), 164.402; 164.404(a)(2) and (b); 164.412
Question 27
D3 Data Analytics and Informatics · RHIA-D3-06
A table named deficiency has 5 rows. The completion_date column holds a date in 3 rows and is NULL in 2 rows. What do SELECT COUNT(*) FROM deficiency and SELECT COUNT(
Show answer and explanation
Answer: B. 5 and 3
COUNT(*) counts every row, so it returns 5. COUNT(
Why the others are wrong
- A: COUNT(
completion_date) skips the 2 NULL rows. - C: COUNT(*) counts rows, including rows with NULLs.
- D: The counts are reversed.
Outline task: D3 Task 3: Use database management software and techniques (e.g., data mining)
Source: PostgreSQL 18 Documentation, Aggregate Functions, Section 9.21, Table 9.62: count(*) and count(any)
Question 28
D4 Revenue Cycle Management · RHIA-D4-06
A small hospital unit had five discharges with these MS-DRG relative weights: 0.8, 1.1, 1.6, 2.5, and 1.0. What is the case mix index?
Show answer and explanation
Answer: B. 1.40
Case mix index = sum of MS-DRG relative weights / number of discharges. 0.8 + 1.1 + 1.6 + 2.5 + 1.0 = 7.0. 7.0 / 5 = 1.40.
Why the others are wrong
- A: That is the median weight, not the mean.
- C: Divides by 4 instead of 5 discharges.
- D: The sum of the weights, not the average.
Outline task: D4 Task 1: Educate providers on various reimbursement models
Source: California HCAI, Case Mix Index dataset definition (data.gov), Dataset description; Calculation from the figures given in the question
Question 29
D5 Management and Leadership · RHIA-D5-06
An HIM manager is preparing questions for interviews for a release-of-information supervisor position. Which question should be removed?
Show answer and explanation
Answer: A. Do you have children, or plan to?
The EEOC identifies questions about the number and ages of children or future child-bearing plans as pre-employment inquiries that may be regarded as evidence of intent to discriminate. The other questions are job-related.
Why the others are wrong
- B: Credentials are a legitimate job qualification.
- C: A behavioral question about job-related experience is appropriate.
- D: A job-knowledge scenario question is appropriate.
Outline task: D5 Task 3: Perform human resource management activities
Source: EEOC, Pre-Employment Inquiries and Marital Status or Number of Children, Full page
Question 30
D1 Data and Information Governance · RHIA-D1-06
A documentation audit at a Medicare-participating hospital finds that several progress notes show a date and an electronic signature but no time of entry. Which Condition of Participation requirement do these entries fail?
Show answer and explanation
Answer: B. Entries must be legible, complete, dated, timed, and authenticated by the person responsible for the service
42 CFR 482.24(c)(1) requires all medical record entries to be legible, complete, dated, timed, and authenticated in written or electronic form. A missing time fails the 'timed' element even when the entry is signed and dated.
Why the others are wrong
- A: Real requirement, but it addresses record completion after discharge, not how each entry is documented.
- C: Real requirement, but it is specific to the H&P, not to all progress notes.
- D: Retention is unrelated to how an entry is documented.
Outline task: D1 Task 1: Evaluate the integrity of the health record documentation
Source: 42 CFR 482.24, Condition of participation: Medical record services (eCFR), 482.24(b)(1); (c)(1)-(2); (c)(4)(i)(A)-(C); (c)(4)(viii)
Question 31
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-07
During a HIPAA Security Rule review, the IT manager says encryption of stored electronic protected health information (ePHI) is an "addressable" implementation specification, so the clinic can skip it. Which response is correct?
Show answer and explanation
Answer: B. No. The clinic must assess whether it is reasonable and appropriate; if it is, implement it, and if not, document why and adopt an equivalent alternative when that is reasonable and appropriate.
HHS's Security Rule summary says the addressable designation does not mean a specification is optional. The entity assesses whether it is reasonable and appropriate, adopts it if so, and otherwise documents why not and adopts an alternative measure that achieves the standard's purpose if that alternative is reasonable and appropriate.
Why the others are wrong
- A: HHS states plainly that addressable does not mean optional.
- C: That describes a required specification. Addressable ones allow a documented, reasonable alternative.
- D: A proposed rule is not in effect, and today's rule already requires the assessment.
Outline task: D2 Task 7: Ensure compliance with privacy and security initiatives
Source: HHS, The Security Rule (summary of the rule in effect), Required and addressable implementation specifications; 45 CFR 164.306, Security standards: General rules (eCFR), (d)(3), Addressable implementation specifications; 45 CFR 164.312, Technical safeguards (eCFR), (a)(2)(iv), Encryption and decryption (Addressable)
Question 32
D3 Data Analytics and Informatics · RHIA-D3-07
A table named DISCHARGES contains six rows: (MRN 1001, LOS 3, Medicare), (1002, 7, Medicare), (1003, 9, Medicaid), (1004, 6, Medicare), (1005, 5, Medicare), (1006, 12, Commercial). An analyst runs: SELECT mrn FROM discharges WHERE los > 5 AND payer = 'Medicare'; How many rows are returned?
Show answer and explanation
Answer: A. 2
AND requires both conditions. Rows with LOS greater than 5 are 1002, 1003, 1004, and 1006. Of those, only 1002 and 1004 are Medicare. Two rows are returned. MRN 1005 is Medicare but its LOS of 5 is not greater than 5.
Why the others are wrong
- B: Treats > as >= and wrongly includes 1005.
- C: Applies only the LOS condition and ignores payer.
- D: Treats AND as OR, which returns every row that meets either condition (here, all six).
Outline task: D3 Task 3: Use database management software and techniques (e.g., data mining)
Source: PostgreSQL 18 Documentation, Table Expressions, Section 7.2.2, WHERE clause and Boolean selection; Calculation from the figures given in the question
Question 33
D4 Revenue Cycle Management · RHIA-D4-07
A hospital outpatient department expects Original Medicare to deny a scheduled screening test because the beneficiary is having it more often than Medicare covers. What should happen to shift potential financial liability to the beneficiary?
Show answer and explanation
Answer: A. Issue an Advance Beneficiary Notice of Noncoverage (ABN) to the beneficiary before the test is performed
CMS describes the ABN as a notice issued to Original Medicare (fee-for-service) beneficiaries when Medicare payment is expected to be denied, in order to transfer potential financial liability. It must be delivered before the service. Effective delivery includes a properly completed notice and enough time for the beneficiary to understand the options before the service.
Why the others are wrong
- B: Notice after the fact does not give the beneficiary a choice and does not transfer liability.
- C: Without a required ABN, the provider generally cannot shift liability for an expected denial of a normally covered service.
- D: The ABN is for Original Medicare beneficiaries, not Medicare Advantage enrollees.
Outline task: D4 Task 5: Support the claims management process
Source: CMS, FFS Advance Beneficiary Notice of Noncoverage (ABN), FFS ABN description; ABN Form Instructions; CMS, Medicare Claims Processing Manual, Chapter 30: Financial Liability Protections, Sections 50.1-50.2, 50.8 and 50.9; emergency context in 40.3-40.4
Question 34
D5 Management and Leadership · RHIA-D5-07
A hospital is accredited through a CMS-approved accrediting organization's hospital program and has deemed status. What does deemed status mean?
Show answer and explanation
Answer: D. CMS considers the hospital to meet Medicare requirements through the accreditor's program instead of routine State Survey Agency certification surveys
CMS explains that facilities may demonstrate compliance through accreditation by a CMS-approved accrediting organization instead of being surveyed by State Survey Agencies, which is deemed status. CMS still notes that a complaint may be filed with the State Survey Agency even when a facility has deemed status.
Why the others are wrong
- A: Deemed status is not an exemption from oversight.
- B: The accreditor's standards must meet or exceed Medicare's; the CoPs still apply.
- C: CMS states complaints may also go to the State Survey Agency.
Outline task: D5 Task 7: Assist with accreditation, licensing, or certification processes
Source: CMS, Accrediting Organizations (AOs), Medicare Participation Requirements (deemed status); How to File a Complaint with an AO
Question 35
D1 Data and Information Governance · RHIA-D1-07
A patient's surgeon completed a history and physical in her office 20 days before the patient is admitted as an inpatient for elective surgery at a Medicare-participating hospital. What documentation does the hospital need regarding the H&P?
Show answer and explanation
Answer: D. An updated examination noting any changes in the patient's condition, placed in the record within 24 hours after admission and before surgery
Under 42 CFR 482.24(c)(4)(i), an H&P may be completed up to 30 days before admission, but then an updated examination documenting any changes must be placed in the record within 24 hours after admission or registration and before surgery or a procedure requiring anesthesia.
Why the others are wrong
- A: A pre-admission H&P within 30 days is acceptable only with the required update.
- B: The rule expressly allows an H&P completed up to 30 days before admission.
- C: The update must come before surgery, not after.
Outline task: D1 Task 4: Manage documentation and data standards based on organizational policy
Source: 42 CFR 482.24, Condition of participation: Medical record services (eCFR), 482.24(b)(1); (c)(1)-(2); (c)(4)(i)(A)-(C); (c)(4)(viii)
Question 36
D2 Compliance with Access, Use, and Disclosure of Health Information · RHIA-D2-08
A patient requests an accounting of disclosures for the past six years. Which disclosure must appear in the accounting?
Show answer and explanation
Answer: D. A report of the patient's reportable communicable disease to the state health department as required by law
45 CFR 164.528(a)(1) excludes disclosures for treatment, payment, and health care operations, disclosures to the individual, disclosures under an authorization, and several others. A public health report under 164.512 is not on the exclusion list, so it must be accounted for.
Why the others are wrong
- A: Treatment disclosures are excluded from the accounting.
- B: Disclosures made under a valid authorization are excluded.
- C: Payment disclosures are excluded.
Outline task: D2 Task 4: Monitor access to protected health information (PHI) internal and external to the organization
Source: 45 CFR 164.528, Accounting of disclosures (eCFR), (a)(1)(i)-(ix); (c)(1)-(c)(2)
Question 37
D3 Data Analytics and Informatics · RHIA-D3-08
Six months after a new release-of-information system went live, the HIM director compares turnaround times, error rates, and user satisfaction against the objectives written in the original project charter. Which phase of the systems development life cycle is this?
Show answer and explanation
Answer: D. Evaluation
The RHIA outline names five SDLC phases: analysis, design/
Why the others are wrong
- A: Analysis happens before selection or build: documenting current workflow and requirements.
- B: Design/
development builds or configures the system. - C: Implementation is go-live: installation, testing, training, and conversion.
Outline task: D3 Task 8: Understand the information systems development life cycle
Source: AHIMA, RHIA Exam Content Outline (Effective Date: 10/01/2023), pp. 1-2, Domains 1-5 and task statements; ONC, Defining Goals and Objectives for EHR Implementation, p. 2 instructions; Section 5, Measuring Success, p. 5; postimplementation benchmark template, p. 11
Question 38
D4 Revenue Cycle Management · RHIA-D4-08
Which situation best fits CMS's definition of Medicare fraud rather than abuse?
Show answer and explanation
Answer: D. A practice knowingly bills Medicare for therapy sessions it never provided
CMS defines fraud as knowingly submitting, or causing to be submitted, false claims or misrepresentations of fact to obtain federal health care payment when no entitlement would otherwise exist. Billing for services never provided, done knowingly, is the textbook example.
Why the others are wrong
- A: Unspecified codes are sometimes appropriate and are not knowingly false claims.
- B: Price differences alone are not false claims.
- C: An unintentional error is not knowing misrepresentation.
Outline task: D4 Task 7: Conduct revenue integrity activities (e.g., coding audits, denials management, and fraud prevention)
Source: CMS, Medicare Fraud & Abuse: Prevent, Detect, Report (MLN4649244), pp. 5-6: fraud definition, billing for services not provided, fraud/
Question 39
D5 Management and Leadership · RHIA-D5-08
The HIM director compares two options for 9,600 outpatient charts per year. In-house: two coders at a fully loaded cost of $78,000 each. Vendor: $14.50 per chart plus a $12,000 annual interface fee. Based on cost alone, which statement is correct?
Show answer and explanation
Answer: A. The vendor costs $15.75 per chart, $0.50 less than in-house at $16.25
In-house: $156,000 / 9,600 = $16.25 per chart. Vendor: (9,600 x $14.50) + $12,000 = $139,200 + $12,000 = $151,200; $151,200 / 9,600 = $15.75 per chart. The vendor saves $0.50 per chart ($4,800 per year). Cost is only one factor; quality, turnaround, and a business associate agreement also belong in the decision.
Why the others are wrong
- B: Swaps the two results.
- C: Ignores the $12,000 interface fee.
- D: The calculations differ by $0.50 per chart.
Outline task: D5 Task 2: Demonstrate knowledge of contracting/
Source: Calculation from the figures given in the question; 45 CFR 164.502, Uses and disclosures: general rules (eCFR), 164.502(b)(2)(i), (e)(1)-(2), and (f)
Question 40
D1 Data and Information Governance · RHIA-D1-08
An HIM director is writing a policy that lists which hospital records are part of the designated record set (DRS) for HIPAA purposes. Which item belongs in the hospital's DRS?
Show answer and explanation
Answer: A. The billing records about individual patients
45 CFR 164.501 defines a provider's designated record set to include the medical records and billing records about individuals maintained by or for the provider, plus other records used to make decisions about individuals. Billing records are named explicitly.
Why the others are wrong
- B: De-identified data is not protected health information, so it is not a 'record' for DRS purposes.
- C: Workforce employment records are not records about patients.
- D: A policy manual contains no PHI about individuals.
Outline task: D1 Task 6: Develop policies and procedures for health record data, documentation management, and information governance
Source: 45 CFR 164.501, Definitions (eCFR), Designated record set; Psychotherapy notes
Question 41
D3 Data Analytics and Informatics · RHIA-D3-09
Which federal standard is a standardized set of health data classes and constituent data elements for nationwide, interoperable health information exchange?
Show answer and explanation
Answer: A. United States Core Data for Interoperability (USCDI)
ASTP/
Why the others are wrong
- B: ICD-10-PCS is an inpatient procedure classification, not an exchange data set.
- C: The Security Rule sets safeguards for electronic PHI, not a data set for exchange.
- D: The UHDDS principal diagnosis definition guides inpatient diagnosis selection.
Outline task: D3 Task 6: Support health information exchange solutions
Source: ONC, Standards Bulletin 2026-1: Background on USCDI, Background: United States Core Data for Interoperability; definition of data classes and elements
Question 42
D4 Revenue Cycle Management · RHIA-D4-09
The revenue integrity team defines the initial denial rate as claims initially denied divided by claims submitted. In March, 1,600 claims were submitted and 112 were initially denied, 40 of which were later overturned on appeal. What was March's initial denial rate?
Show answer and explanation
Answer: C. 7.0%
Use the stated definition: 112 / 1,600 = 0.07, or 7.0%. Overturned appeals do not change an initial denial rate; they would matter for a final or net denial rate.
Why the others are wrong
- A: Uses only the overturned denials (40 / 1,600).
- B: Subtracts overturned denials ((112 - 40) / 1,600), which is a different measure from the one defined.
- D: Adds the overturned denials ((112 + 40) / 1,600).
Outline task: D4 Task 7: Conduct revenue integrity activities (denials management)
Source: Calculation from the figures given in the question
Question 43
D5 Management and Leadership · RHIA-D5-09
A coding backlog stands at 330 inpatient charts. Three coders each code 22 charts per workday, and 50 new charts arrive each workday. If nothing else changes, how many workdays will it take to clear the backlog?
Show answer and explanation
Answer: D. 21 workdays
Daily output = 3 x 22 = 66 charts. Net backlog reduction = 66 - 50 = 16 charts per day. 330 / 16 = 20.6, so 21 workdays.
Why the others are wrong
- A: Divides 330 by 66 and ignores new incoming charts.
- B: Divides 330 by 50, which confuses incoming volume with net reduction.
- C: Divides 330 by 22, as if only one coder's output mattered and no new charts arrived.
Outline task: D5 Task 4: Perform and oversee work design and process improvement activities
Source: Calculation from the figures given in the question
Question 44
D1 Data and Information Governance · RHIA-D1-09
A Medicare-participating hospital is setting its record-completion deadline in the medical staff rules. Under the hospital Conditions of Participation, final diagnosis and completion of the medical record must occur within how many days after discharge?
Show answer and explanation
Answer: B. 30 days
42 CFR 482.24(c)(4)(viii) requires the final diagnosis with completion of medical records within 30 days following discharge. Hospitals may set a shorter internal deadline but not a longer one.
Why the others are wrong
- A: A hospital may choose 14 days internally, but that is not the CoP limit.
- C: Exceeds the CoP limit.
- D: Sixty days appears elsewhere in HIPAA (breach notice, accounting of disclosures), not in record completion.
Outline task: D1 Task 6: Develop policies and procedures for health record data, documentation management, and information governance
Source: 42 CFR 482.24, Condition of participation: Medical record services (eCFR), 482.24(b)(1); (c)(1)-(2); (c)(4)(i)(A)-(C); (c)(4)(viii)
Question 45
D3 Data Analytics and Informatics · RHIA-D3-10
The enterprise MPI uses statistical analysis across patient identifiers to calculate a match likelihood. It flags 'Katherine Lopez, DOB 05/09/1980' and 'Catherine Lopez, DOB 05/09/1980' as a possible match even though the first names are not spelled the same. Which matching approach produced this flag?
Show answer and explanation
Answer: C. Probabilistic matching
Probabilistic matching uses statistical analysis to estimate whether two records refer to the same person. The statistical likelihood calculation, not the spelling difference alone, identifies the method here.
Why the others are wrong
- A: The stem describes a statistical likelihood calculation, not an exact match on a specified set of identifiers.
- B: Abstraction is a coding/
data-collection task, not an MPI matching algorithm. - D: Exact-match hashing does not produce the statistical likelihood calculation described here.
Outline task: D3 Task 3: Use database management software and techniques (e.g., data mining)
Source: ONC, Patient Identification and Matching Final Report, Matching Methods and Algorithms, pp. 26-27; glossary, probabilistic matching, p. 85
Question 46
D4 Revenue Cycle Management · RHIA-D4-10
During an inpatient coding validation review, which documented condition meets the criteria to be reported as an additional (secondary) diagnosis?
Show answer and explanation
Answer: A. Provider-documented hypokalemia treated with IV potassium replacement
Section III of the ICD-10-CM guidelines reports other diagnoses that affect patient care by requiring clinical evaluation, therapeutic treatment, diagnostic procedures, extended length of stay, or increased nursing care and/
Why the others are wrong
- B: Conditions from an earlier episode with no bearing on the current stay are excluded.
- C: Abnormal findings are not coded unless the provider indicates their clinical significance.
- D: A resolved past condition with no current effect does not meet the criteria.
Outline task: D4 Task 2: Validate coding accuracy
Source: CMS/
Question 47
D5 Management and Leadership · RHIA-D5-10
During a record review at a Medicare-participating hospital, the HIM director finds verbal orders that were dated and timed when taken but never authenticated. Under the hospital Conditions of Participation, who may authenticate a verbal order?
Show answer and explanation
Answer: A. The ordering practitioner, or another practitioner responsible for the patient's care acting in accordance with state law, hospital policies, and medical staff bylaws
42 CFR 482.24(c)(2) requires all orders, including verbal orders, to be dated, timed, and authenticated promptly by the ordering practitioner or by another practitioner responsible for the patient's care, only if acting in accordance with state law, hospital policies, and medical staff bylaws, rules, and regulations.
Why the others are wrong
- B: Taking the order does not make the nurse the authenticating practitioner.
- C: HIM access permissions alone do not authorize authentication of clinical orders.
- D: Dispensing the medication is not authenticating the order.
Outline task: D5 Task 8: Monitor organizational compliance with health laws, regulations, or standards
Source: 42 CFR 482.24, Condition of participation: Medical record services (eCFR), 482.24(b)(1); (c)(1)-(2); (c)(4)(i)(A)-(C); (c)(4)(viii)
Question 48
D3 Data Analytics and Informatics · RHIA-D3-11
Of 2,000 discharge abstracts, 60 are missing a discharge disposition. An analyst's report states the missing rate is 3.1%, calculated as 60 / 1,940. What should the HIM director do?
Show answer and explanation
Answer: B. Correct it to 3.0%, because the denominator should be all 2,000 abstracts reviewed
A missing-data rate divides the number missing by the total population reviewed. 60 / 2,000 = 3.0%. Dividing by only the complete abstracts (1,940) removes the missing ones from the denominator and overstates the rate.
Why the others are wrong
- A: The denominator wrongly excludes the 60 incomplete abstracts.
- C: 97.0% is the completeness rate, a different measure from the one reported.
- D: Expressed per 1,000 it would be 30 per 1,000, not 30.0%.
Outline task: D3 Task 9: Validate healthcare statistics for organizational stakeholders
Source: Calculation from the figures given in the question
Question 49
D5 Management and Leadership · RHIA-D5-11
A proposed automated release-of-information platform costs $60,000 up front and is projected to save a net $1,500 per month in labor and postage after ongoing costs. What is the simple payback period?
Show answer and explanation
Answer: C. 40 months
Simple payback = initial investment / periodic savings. $60,000 / $1,500 per month = 40 months. Simple payback ignores the time value of money and savings after the payback point.
Why the others are wrong
- A: Would require savings of $5,000 per month.
- B: Would require savings of $2,500 per month.
- D: Would require savings of about $667 per month.
Outline task: D5 Task 6: Prepare and implement budgets
Source: Calculation from the figures given in the question; U.S. Department of Energy, Financing Energy Upgrades for K-12 School Districts, Appendix A, Metric 1: Simple Payback (PDF p. 26)
Question 50
D3 Data Analytics and Informatics · RHIA-D3-12
A hospital's readmission measure is defined as unplanned readmissions within 30 days divided by index discharges. Last quarter there were 1,250 index discharges and 172 readmissions within 30 days, 22 of which were planned (scheduled chemotherapy admissions). What is the readmission rate under this definition?
Show answer and explanation
Answer: C. 12.0%
Apply the definition exactly: unplanned readmissions = 172 - 22 = 150. 150 / 1,250 = 0.12, or 12.0%.
Why the others are wrong
- A: Uses only the planned readmissions (22 / 1,250).
- B: Adds the planned readmissions to the denominator (150 / 1,272).
- D: Includes planned readmissions in the numerator (172 / 1,250), contradicting the stated definition.
Outline task: D3 Task 9: Validate healthcare statistics for organizational stakeholders
Source: Calculation from the figures given in the question
Score yourself by domain
How to use it: Answer each question, then open the explanation. Track misses by domain with the score table below. Prefer exam conditions? The real exam gives you 3 hours 25 minutes for instructions and 150 questions, about 1.4 minutes each, so allow about 68 minutes for these 50.
Count your correct answers in each domain, and count any question you skipped as a miss. The answer key below lists every question's domain.
| Domain | Questions in this set | Your correct | Share of scored items on the real exam |
|---|---|---|---|
| D1 Data and Information Governance | 9 | ___ / 9 | 17-20% |
| D2 Compliance with Access, Use, and Disclosure of Health Information | 8 | ___ / 8 | 15-18% |
| D3 Data Analytics and Informatics | 12 | ___ / 12 | 23-26% |
| D4 Revenue Cycle Management | 10 | ___ / 10 | 20-23% |
| D5 Management and Leadership | 11 | ___ / 11 | 23-26% |
| Total | 50 | ___ / 50 |
The domain counts are an editorial sampling choice, not an exact replica of exam weighting.
What your score means, and what it doesn't. Your percentage here is feedback on these 50 questions. It is not an AHIMA scaled score and doesn't predict a pass. AHIMA reports scores on a 100-400 scale with 300 to pass, and the number of correct answers needed depends on the difficulty of the exam form you receive. With only 8 to 12 questions per domain, one or two misses swing a domain's percentage a lot, so use it to choose what to review next, not to judge readiness.
Where to put your next hour. Look at Domains 3 and 5 first if you missed several there. They have the largest published ranges: 30-34 scored items each. Then reread the explanations for every question you got right by guessing.
Answer key
| # | Answer | Domain | Question ID |
|---|---|---|---|
| 1 | C | D2 | RHIA-D2-01 |
| 2 | B | D3 | RHIA-D3-01 |
| 3 | D | D4 | RHIA-D4-01 |
| 4 | C | D5 | RHIA-D5-01 |
| 5 | B | D1 | RHIA-D1-01 |
| 6 | B | D2 | RHIA-D2-02 |
| 7 | C | D3 | RHIA-D3-02 |
| 8 | A | D4 | RHIA-D4-02 |
| 9 | D | D5 | RHIA-D5-02 |
| 10 | D | D1 | RHIA-D1-02 |
| 11 | D | D2 | RHIA-D2-03 |
| 12 | B | D3 | RHIA-D3-03 |
| 13 | C | D4 | RHIA-D4-03 |
| 14 | A | D5 | RHIA-D5-03 |
| 15 | B | D1 | RHIA-D1-03 |
| 16 | A | D2 | RHIA-D2-04 |
| 17 | A | D3 | RHIA-D3-04 |
| 18 | B | D4 | RHIA-D4-04 |
| 19 | B | D5 | RHIA-D5-04 |
| 20 | A | D1 | RHIA-D1-04 |
| 21 | C | D2 | RHIA-D2-05 |
| 22 | C | D3 | RHIA-D3-05 |
| 23 | D | D4 | RHIA-D4-05 |
| 24 | D | D5 | RHIA-D5-05 |
| 25 | C | D1 | RHIA-D1-05 |
| 26 | B | D2 | RHIA-D2-06 |
| 27 | B | D3 | RHIA-D3-06 |
| 28 | B | D4 | RHIA-D4-06 |
| 29 | A | D5 | RHIA-D5-06 |
| 30 | B | D1 | RHIA-D1-06 |
| 31 | B | D2 | RHIA-D2-07 |
| 32 | A | D3 | RHIA-D3-07 |
| 33 | A | D4 | RHIA-D4-07 |
| 34 | D | D5 | RHIA-D5-07 |
| 35 | D | D1 | RHIA-D1-07 |
| 36 | D | D2 | RHIA-D2-08 |
| 37 | D | D3 | RHIA-D3-08 |
| 38 | D | D4 | RHIA-D4-08 |
| 39 | A | D5 | RHIA-D5-08 |
| 40 | A | D1 | RHIA-D1-08 |
| 41 | A | D3 | RHIA-D3-09 |
| 42 | C | D4 | RHIA-D4-09 |
| 43 | D | D5 | RHIA-D5-09 |
| 44 | B | D1 | RHIA-D1-09 |
| 45 | C | D3 | RHIA-D3-10 |
| 46 | A | D4 | RHIA-D4-10 |
| 47 | A | D5 | RHIA-D5-10 |
| 48 | B | D3 | RHIA-D3-11 |
| 49 | C | D5 | RHIA-D5-11 |
| 50 | C | D3 | RHIA-D3-12 |
What the real RHIA exam looks like
Verified against AHIMA's RHIA page, content outline, certification FAQ, and exam scoring explanation on October 23, 2026.
| Current rule | |
|---|---|
| Questions | 150 total: 130 scored and 20 unscored pretest items, mixed in so you can't tell them apart |
| Time | 3 hours 30 minutes in total: 5 minutes to read the testing agreement, then 3 hours 25 minutes for instructions and questions. The clock doesn't stop for breaks. |
| Question types | Multiple choice with four options and one correct answer |
| Passing score | 300 on a scale of 100 to 400 |
| Guessing | No penalty; a wrong answer simply earns no points |
| Where | Computer-based, at a Pearson VUE testing center |
| Navigation | You can move back and forth after selecting an answer, flag items, and review before submitting as time allows |
| Fee | $229 for AHIMA members, $299 for non-members; retakes cost the same |
| Retake | New application and fee; at least 30 days before approval, then a new Authorization to Test before scheduling |
| Books or references | None required on exam day |
| 2025 first-time pass rate | 67% of 860 first-time testers (71% in 2024, 64% in 2023) |
The five domains
| Domain | Share of exam | Scored items |
|---|---|---|
| 1. Data and Information Governance | 17-20% | 22-26 |
| 2. Compliance with Access, Use, and Disclosure of Health Information | 15-18% | 20-23 |
| 3. Data Analytics and Informatics | 23-26% | 30-34 |
| 4. Revenue Cycle Management | 20-23% | 26-30 |
| 5. Management and Leadership | 23-26% | 30-34 |
Each domain's task list is in AHIMA's RHIA Exam Content Outline. Every question on this page is tagged to one of those tasks.
Watch for outdated RHIA information
The RHIA exam changed on October 1, 2023, and plenty of study material hasn't caught up. Check any practice resource for these older details:
- "180 questions" or "4 hours." Before October 1, 2023, candidates had 4 hours for 170 to 200 items. Today it's 150 items in 3.5 hours.
- The old domain names. "Information Governance," "Compliance with Uses and Disclosures of PHI," and "Revenue Management" are 2018 names. The 2023 outline also moved tasks: retention and destruction and the master patient index now sit in Domain 1, organizational compliance monitoring moved to Domain 5, and the systems development life cycle and project management were added. Check how any prep resource maps to the current outline.
- An older content outline. AHIMA's pre-2023 RHIA outline PDF, with domain shares of 19, 26, 24, 16, and 15 percent, still turns up in search. The current outline took effect October 1, 2023.
- Proposed HIPAA Security Rule changes treated as law. HHS published proposed changes in January 2025, but they are not final. Questions should test the rule in effect today.
- Remote testing. AHIMA's RHIA page says the exam must be scheduled at a Pearson VUE testing center.
- A retake wait other than 30 days. AHIMA's RHIA page says 30 days.
Turn your misses into a plan
- List each miss by its task, not just its domain. "D2 Task 6: breach protocols" tells you far more than "D2."
- Go to the primary source cited in the explanation. RHIA questions on HIPAA, CoPs, and coding guidelines reward knowing the actual rule, including its exceptions and deadlines.
- Redo the calculation items from scratch a day later. Census, occupancy, case mix, FTE, variance, and critical-path questions are quick points once the setup is automatic.
- Retake the full set in about a week, under time, and compare domain counts.
Common questions
Is this an official AHIMA practice test?
No. These are original questions written by Castleport Test Prep to match the topics in AHIMA's current content outline. AHIMA's certification commission (CCHIIM) says it doesn't contribute to, review, endorse, or require any review books, study guides, or prep activities.
How many questions do you need to get right to pass the RHIA?
There's no fixed number. AHIMA sets the passing standard through a panel process, then converts it to a scaled score of 300. The raw number needed depends on the difficulty of the questions on your form, and the 20 pretest items don't count.
Is there a penalty for guessing on the RHIA?
No. AHIMA says a wrong answer earns no points and nothing is deducted, so answer every question.
Can I take the RHIA exam online?
Not according to AHIMA's RHIA page, which says the exam is computer-based and must be scheduled at a Pearson VUE testing center.
Who is eligible to take the RHIA?
AHIMA requires completion of a CAHIIM-accredited baccalaureate or master's HIM program, a CAHIIM-approved post-baccalaureate HIM certificate, or graduation from an HIM program approved by a foreign association with which AHIMA has a reciprocity agreement. AHIMA notes it currently accepts only HIM degree programs, not health informatics. Eligible final-term students can apply to test early with AHIMA's signed early-testing form; see the RHIA page for the current form and instructions.
What is the RHIA pass rate?
AHIMA reports a 67% pass rate for 860 first-time testers in 2025, 71% in 2024, and 64% in 2023.
What happens if I fail?
You submit a new application with the full exam fee and must wait at least 30 days before it can be approved. You need a new Authorization to Test before scheduling the retake. Your score report breaks down your performance by content outline domain, which is the best place to aim your next round of study (AHIMA certification FAQ).
Related free guides
- Health information certification guides
- How to register for an AHIMA exam
- How to read your AHIMA exam results
- AHIMA exam retake policy
Sources
Exam facts last verified October 23, 2026. Each question's explanation cites the rule or reference it relies on. How we write and check practice questions.
- AHIMA, Registered Health Information Administrator (RHIA) credential page (Eligibility; Exam Specifications; Exam Functionality; Testing Location; Pricing; Retake Policy; Certified Professionals and Pass Rates)
- AHIMA, RHIA Exam Content Outline (Effective Date: 10/01/2023) (pp. 1-2, Domains 1-5 and task statements)
- AHIMA, RHIA Content Outline Crosswalk 2018-2023 (Executive summary p. 1; Table 1 p. 2; task crosswalk pp. 3-7)
- AHIMA, About Certification Exams (Exam Questions; Exam Scores; Exam Scoring)
- 45 CFR 164.524, Access of individuals to protected health information (eCFR) ((a)(1)-(a)(3); (b)(2); (c)(2)-(c)(4); (d)(1))
- 45 CFR Part 164 Subpart D, Breach notification (eCFR) (164.402; 164.404(a)(2) and (b); 164.412)
- 45 CFR 164.528, Accounting of disclosures (eCFR) ((a)(1)(i)-(ix); (c)(1)-(c)(2))
- 45 CFR 164.502, Uses and disclosures: general rules (eCFR) (164.502(b)(2)(i), (e)(1)-(2), and (f))
- 45 CFR 164.501, Definitions (eCFR) (Designated record set; Psychotherapy notes)
- 42 CFR 482.24, Condition of participation: Medical record services (eCFR) (482.24(b)(1); (c)(1)-(2); (c)(4)(i)(A)-(C); (c)(4)(viii))
- HHS FAQ 580: Does the HIPAA Privacy Rule require covered entities to keep patients' medical records for any period of time? (Full answer)
- HHS FAQ 1501: Am I required to keep the decedent's information for 50 years? (Full answer)
- HHS FAQ 576: May a covered entity dispose of PHI in dumpsters accessible by the public? (Full answer (disposal vendor as business associate))
- ONC, SAFER Patient Identification guide (Recommended Practice 3.2, printed p. 23: duplicate, overlay and overlap definitions; immediate remediation)
- Hawaii SHPDA, Bed Utilization Formulas (2023 Health Care Utilization Report, Table 30) (ADC and occupancy rate formulas with worked example, p. 110)
- CDC, Principles of Epidemiology in Public Health Practice, Lesson 4 Summary (Guide to Selecting a Graph or Chart to Illustrate Epidemiologic Data)
- ONC, Standards Bulletin 2026-1: Background on USCDI (Background: United States Core Data for Interoperability; definition of data classes and elements)
- CMS/
NCHS, ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (effective Oct 1, 2026) (I.A.19 p. 12; I.B.4-6 p. 13; I.C.21.c.6 pp. 98-99; II/II.A p. 108; II.H p. 109; III/ III.A-B pp. 110-111; IV.H p. 114) - ACDIS/
AHIMA, Guidelines for Achieving a Compliant Query Practice (2026 Update) (V.I.B-C pp. 7-8; V.II.A pp. 10-11; V.II.B pp. 12-13; V.II.C p. 14) - CMS, Hospital-Acquired Conditions (HAC) / Present on Admission Indicator (HAC Payment Provision)
- California HCAI, Case Mix Index dataset definition (data.gov) (Dataset description)
- CMS, FFS Advance Beneficiary Notice of Noncoverage (ABN) (FFS ABN description; ABN Form Instructions)
- CMS, Medicare Fraud & Abuse: Prevent, Detect, Report (MLN4649244) (pp. 5-6: fraud definition, billing for services not provided, fraud/
abuse distinction) - EEOC, Pre-Employment Inquiries and Marital Status or Number of Children (Full page)
- CMS, Accrediting Organizations (AOs) (Medicare Participation Requirements (deemed status); How to File a Complaint with an AO)
- AHRQ, Plan-Do-Study-Act Worksheet, Directions, and Examples (Health Literacy Universal Precautions Toolkit, 3rd ed.) (Directions: Plan, Do, Study, Act; Small Sample Size)
- AHIMA, Certification FAQ (Exam format and time table; retesting waiting period; exam results)
- HHS, Court Order Regarding the HIPAA Right of Access (Ciox Health v. Azar) (Third-party directive limited to electronic copies of EHR; fee limits apply only to an individual's own access)
- HHS, The Security Rule (summary of the rule in effect) (Required and addressable implementation specifications)
- PostgreSQL 18 Documentation, Aggregate Functions (Section 9.21, Table 9.62: count(*) and count(any))
- AHIMA, Early Tester Form (p. 1, Parts 1-2: candidate requirements and program-director verification of final-term eligibility)
- ONC, Patient Identification and Matching Final Report (Matching Methods and Algorithms, pp. 26-27; glossary, probabilistic matching, p. 85)
- PostgreSQL 18 Documentation, Table Expressions (Section 7.2.2, WHERE clause and Boolean selection)
- ONC, Defining Goals and Objectives for EHR Implementation (p. 2 instructions; Section 5, Measuring Success, p. 5; postimplementation benchmark template, p. 11)
- CMS, Medicare Claims Processing Manual, Chapter 30: Financial Liability Protections (Sections 50.1-50.2, 50.8 and 50.9; emergency context in 40.3-40.4)
- U.S. Department of Energy, Financing Energy Upgrades for K-12 School Districts (Appendix A, Metric 1: Simple Payback (PDF p. 26))
- 45 CFR 164.306, Security standards: General rules (eCFR) ((d)(3), Addressable implementation specifications)
- 45 CFR 164.312, Technical safeguards (eCFR) ((a)(2)(iv), Encryption and decryption (Addressable))
By Castleport Test Prep Editorial Team. Castleport Test Prep is an independent exam prep publisher. We are not affiliated with, endorsed by, or approved by the American Health Information Management Association (AHIMA) or its Commission on Certification for Health Informatics and Information Management (CCHIIM). Exam and credential names identify the subjects of this page; trademarks belong to their respective owners. All practice questions are original and are not official exam questions. Practice results do not predict an exam score or guarantee a passing result.