Free RHIT Practice Test: 60 Questions With Answers
This free RHIT practice test has 60 original, unofficial questions covering all six domains of AHIMA's current RHIT content outline: four choices, one correct answer. Pick your answer before you open the explanation; each one shows why it's right, why every other choice misses, and the source behind the rule.
RHIT practice questions
Question 1 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-05
Registration creates medical record number 448120 for Ana Ruiz. She already has MRN 301557 at the same hospital with the same name, date of birth, address, and phone number. What MPI error is this?
Show answer and explanation
Answer: C. Duplicate
A duplicate exists when two or more medical record numbers are created for the same person. The fix is a reviewed merge so the clinical history lives under one identifier.
Why the others miss:
- A. An overlay puts one patient's information on another patient's record.
- B. An overlap is more than one identifier for the same person across facilities in an enterprise.
- D. Not a standard MPI error category.
Source: AHIMA white paper, A Realistic Approach to Achieving a 1% Duplicate Record Error Rate (p 6: duplicate/
Question 2 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-01
A short-term acute care hospital inpatient's discharge summary states "probable aspiration pneumonia," and the patient was treated for it. Under the ICD-10-CM Official Guidelines for inpatient reporting, how is the condition coded?
Show answer and explanation
Answer: A. As if it existed or was established
For inpatient admissions to short-term acute care, long-term care, and psychiatric hospitals, an uncertain diagnosis documented at the time of discharge with terms such as probable, suspected, or likely is coded as if it existed. The guidelines carve out exceptions to this inpatient rule for certain conditions, such as HIV and COVID-19, which are coded only when confirmed.
Why the others miss:
- B. That is the outpatient rule.
- C. The inpatient guideline does not require culture confirmation for this condition.
- D. The condition was current and treated.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 3 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-01
The hospital receives a patient's written request for a copy of her records on March 3. Part of the record is in off-site storage. Under HIPAA's access rule, what is the longest the hospital may take to act if it cannot act within 30 days, and what must it do to use extra time?
Show answer and explanation
Answer: C. Up to 60 days total, using one 30-day extension with a written notice of the reason and expected date sent within the first 30 days
A covered entity must act within 30 calendar days of receiving the request. If it cannot act within that period, it may take one extension of no more than 30 calendar days if, within the first 30 days, it gives the individual a written statement of the reasons for the delay and the date it will complete action.
Why the others miss:
- A. One extension is permitted.
- B. The maximum is one 30-day extension, and notice must come within the original 30 days.
- D. There is no business-day rule or off-site exemption.
Source: 45 CFR 164.524, Access of individuals to PHI ((b)(2)(i)-(ii): timely action and one conditional extension); HHS, How timely must a covered entity be in responding to individuals' requests for access to their PHI? (Answer:30 calendar days; one 30 calendar-day extension)
Question 4 of 60
Domain 3: Data Analytics and Use · RHIT-D3-01
Five Medicare discharges have these practice MS-DRG relative weights: 1.0124, 0.8436, 2.5310, 1.2290, and 0.9840. What is the case mix index for this group?
Show answer and explanation
Answer: B. 1.3200
CMI is the average relative weight of the discharges: sum the weights (6.6000) and divide by the number of discharges (5). 6.6000 / 5 = 1.3200. These weights are made up for practice; real weights come from CMS's MS-DRG tables for the fiscal year.
Work: 1.0124 + 0.8436 + 2.5310 + 1.2290 + 0.9840 = 6.6000; 6.6000 / 5 = 1.3200
Why the others miss:
- A. 1.0124 is the median weight, not the average.
- C. 6.6000 is the sum before dividing by discharges.
- D. 1.2290 is one discharge's weight.
Source: California HCAI Case Mix Index dataset (data.gov) (Dataset description: average MS-DRG relative weight and CMS-provided weights.)
Question 5 of 60
Domain 5: Compliance · RHIT-D5-01
An internal audit finds a pattern of unsupported secondary diagnoses on one MS-DRG. Under OIG's seven fundamental elements of a compliance program, which element covers what happens next?
Show answer and explanation
Answer: A. Respond to detected offenses and develop corrective action initiatives
The audit itself is "audit and monitor." Once a problem is detected, the element in play is responding to detected offenses and developing corrective action, such as correcting claims, retraining, and reauditing.
Why the others miss:
- B. Program structure, not the response to a finding.
- C. Hotlines and reporting channels.
- D. Policies may be revised as part of corrective action, but the element here is the response.
Source: HHS-OIG, The 7 Fundamental Elements of a Compliance Program (Fundamental 6, PDF p. 8; Fundamental 7, PDF p. 9; voluntary status on PDF p. 1)
Question 6 of 60
Domain 6: Leadership · RHIT-D6-01
A hospital HIM manager is planning HIPAA Privacy Rule training. Which schedule meets the rule's training requirement?
Show answer and explanation
Answer: C. Train each new workforce member within a reasonable period after joining, and retrain affected workforce members within a reasonable period after a material policy change takes effect
Covered entities must train all workforce members on privacy policies and procedures as necessary and appropriate for their functions, train new members within a reasonable period after they join, and train those affected by a material change within a reasonable period after it takes effect.
Why the others miss:
- A. The requirement covers all workforce members.
- B. The rule ties training to onboarding and material changes, not a fixed five-year cycle.
- D. Training is required regardless of breaches.
Source: 45 CFR 164.530, Administrative requirements ((b)(1), (b)(2)(i)(B)-(C): appropriate workforce training; new members and material changes.)
Question 7 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-01
A patient asks the HIM department for "everything you used to make decisions about my care and to bill me." Under HIPAA, which of these is part of the hospital's designated record set for that patient?
Show answer and explanation
Answer: B. The patient's medical record and billing records
HIPAA defines a provider's designated record set to include the medical records and billing records about individuals, plus any other records used to make decisions about individuals.
Why the others miss:
- A. Aggregate unit data is not a record about this individual.
- C. A credentialing file is about the physician, not about decisions regarding this patient.
- D. De-identified data is no longer individually identifiable health information.
Source: 45 CFR 164.501, Definitions (designated record set, psychotherapy notes, health care operations, payment) (Designated record set definition, (1)(i), (1)(iii), and (2)); 45 CFR 164.514, De-identification and limited data sets ((a)-(b): de-identification)
Question 8 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-02
An emergency department patient with right flank pain is discharged home. The physician writes "possible kidney stone, follow up with urology." Under the outpatient guidelines, what is coded?
Show answer and explanation
Answer: B. The flank pain, coded to the highest degree of certainty for the visit
In outpatient settings, diagnoses documented as possible, probable, suspected, or rule out are not coded. Code the condition to the highest degree of certainty for the encounter, such as the symptom.
Why the others miss:
- A. Coding this uncertain diagnosis as established is the hospital inpatient rule, not the outpatient rule.
- C. The uncertain diagnosis is not reported in the outpatient setting.
- D. Nothing indicates an observation encounter.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 9 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-02
A patient requests her complete behavioral health record. Which item can the hospital withhold as psychotherapy notes under HIPAA?
Show answer and explanation
Answer: D. The therapist's notes analyzing the conversation in a private session, kept separate from the rest of the record
Psychotherapy notes are a mental health professional's notes documenting or analyzing session conversation that are separated from the rest of the record. They are excluded from the right of access. The definition expressly excludes medication monitoring, session times, test results, and summaries of diagnosis, plan, symptoms, prognosis, and progress.
Why the others miss:
- A. Expressly excluded from the psychotherapy-notes definition.
- B. Expressly excluded from the psychotherapy-notes definition.
- C. Expressly excluded from the psychotherapy-notes definition.
Source: 45 CFR 164.501, Definitions (designated record set, psychotherapy notes, health care operations, payment) (Psychotherapy notes definition and exclusions); 45 CFR 164.524, Access of individuals to PHI ((a)(1)(i): psychotherapy-notes access exception)
Question 10 of 60
Domain 3: Data Analytics and Use · RHIT-D3-02
In April (30 days), a hospital recorded 5,580 inpatient service days. What was the average daily inpatient census?
Show answer and explanation
Answer: C. 186.0
Average daily census = inpatient service days for the period / number of days in the period. 5,580 / 30 = 186.0.
Work: 5580 / 30 = 186.0
Why the others miss:
- A. Divides by 31; April has 30 days.
- B. Divides by 365, an annual denominator.
- D. Divides by 10, which is not a period length.
Source: Hawaii SHPDA, Bed Utilization Formulas (2023 Utilization Report, Table 30) (p. 110 (PDF p. 1), formula 2: Average Daily Census.)
Question 11 of 60
Domain 5: Compliance · RHIT-D5-02
A hospital sets up an anonymous hotline so staff can report suspected billing problems without fear of retaliation. Which OIG compliance element does this support most directly?
Show answer and explanation
Answer: C. Develop effective lines of communication
Reporting channels such as hotlines are the core of developing effective lines of communication.
Why the others miss:
- A. Auditing tests claims and processes.
- B. Training teaches the rules.
- D. Discipline enforces the rules.
Source: HHS-OIG, The 7 Fundamental Elements of a Compliance Program (Fundamental 4, PDF p. 6: anonymous reporting hotline and nonretaliation)
Question 12 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-02
A surgeon's office faxes a history and physical (H&P) for a patient scheduled for an elective inpatient admission with surgery under general anesthesia. Under the Medicare hospital Conditions of Participation, which H&P timing is acceptable without anything further?
Show answer and explanation
Answer: D. Completed 20 days before admission, with a documented update examination placed in the record within 24 hours after admission and before surgery
The H&P must be completed no more than 30 days before or 24 hours after admission, and before surgery or a procedure requiring anesthesia. When it was done within the 30 days before admission, an updated examination must also be documented within 24 hours after admission and before the procedure.
Why the others miss:
- A. 35 days is outside the 30-day window.
- B. An update note cannot rescue an H&P older than 30 days.
- C. It must be done before surgery and no later than 24 hours after admission.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((c)(4)(i)(A)-(B): inpatient H&P and update timing)
Question 13 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-03
A patient is admitted with sepsis due to pneumonia. Both were present on admission and the sepsis meets the definition of principal diagnosis. How are the codes sequenced?
Show answer and explanation
Answer: C. The underlying systemic infection (sepsis) first, with pneumonia as a secondary diagnosis
When the reason for admission is sepsis and a localized infection such as pneumonia, the code for the underlying systemic infection is sequenced first and the localized infection is secondary. If the patient is admitted for pneumonia and sepsis develops after admission, the pneumonia goes first.
Why the others miss:
- A. That order can apply when the patient is admitted for pneumonia and sepsis develops after admission.
- B. R65.2 codes can never be principal, and nothing documents severe sepsis.
- D. The guideline directs the sequence.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 14 of 60
Domain 6: Leadership · RHIT-D6-02
HIM is retiring an outdated release-of-information policy. Under the HIPAA Privacy Rule, how long must the retired policy be kept?
Show answer and explanation
Answer: C. 6 years from the date of creation or the date it was last in effect, whichever is later
Required documentation, including policies and procedures, must be retained for six years from the date of its creation or the date when it was last in effect, whichever is later.
Why the others miss:
- A. Too short.
- B. The clock runs from when it was last in effect.
- D. Not the HIPAA standard.
Source: 45 CFR 164.530, Administrative requirements ((j)(1)-(2): required documentation and six-year retention; (i): policies and procedures.)
Question 15 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-03
An emergency physician at another hospital calls for a patient's recent cardiac workup to treat him right now. How does the HIPAA minimum necessary standard apply to this disclosure?
Show answer and explanation
Answer: C. It does not apply, because the disclosure is to a health care provider for treatment
The minimum necessary requirement does not apply to disclosures to, or requests by, a health care provider for treatment. Other exceptions include disclosures to the individual and disclosures under a valid authorization.
Why the others miss:
- A. Under HIPAA, this treatment disclosure does not require the patient's authorization.
- B. The treatment exception removes the minimum necessary limit.
- D. The standard is not limited by format.
Source: 45 CFR 164.502(b), Minimum necessary ((b)(2)(i)-(iii): minimum-necessary exceptions)
Question 16 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-03
The HIM director is updating the medical staff rules on record completion. What is the federal outer limit for completing an inpatient record with the final diagnosis under the hospital Conditions of Participation?
Show answer and explanation
Answer: D. Within 30 days following discharge
The CoP requires the final diagnosis with completion of medical records within 30 days following discharge. A hospital's own bylaws can set a shorter deadline, but not a longer one.
Why the others miss:
- A. The CoP does not require completion at the moment of discharge.
- B. 14 days may be a local policy, but it is not the federal limit.
- C. 60 days exceeds the federal limit.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((c)(4)(viii): final diagnosis and completion within 30 days after discharge)
Question 17 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-04
The physician's only diagnostic statement about an infection is "urosepsis." What should the coder do?
Show answer and explanation
Answer: A. Query the provider for clarification
Urosepsis is a nonspecific term with no default code and is not synonymous with sepsis. The guidelines require a query when a provider uses it.
Why the others miss:
- B. The guideline says it is not synonymous with sepsis.
- C. Urosepsis has no default code.
- D. Neither condition is established by the documentation.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 18 of 60
Domain 3: Data Analytics and Use · RHIT-D3-03
A 200-bed hospital had 5,100 inpatient service days in June (30 days). The bed count did not change. What was the inpatient bed occupancy rate?
Show answer and explanation
Answer: D. 85.0%
Occupancy = inpatient service days / (bed count x days in period) x 100. 5,100 / (200 x 30 = 6,000) = 85.0%. You get the same result from average daily census: 5,100 / 30 = 170, and 170 / 200 = 85.0%.
Work: 5100 / (200 * 30) * 100 = 85.0
Why the others miss:
- A. Inverts the fraction (6,000 / 5,100).
- B. Uses 31 days for June.
- C. Divides service days by beds only, ignores the days in the month, and mislabels 25.5 service days per bed as a percentage.
Source: Hawaii SHPDA, Bed Utilization Formulas (2023 Utilization Report, Table 30) (p. 110 (PDF p. 1), formulas 2 and 3: Average Daily Census and Occupancy Rate.)
Question 19 of 60
Domain 5: Compliance · RHIT-D5-03
A coding accuracy audit reviewed two coders. Coder 1: 10 of 10 records correct. Coder 2: 80 of 100 records correct. What is the department's record-level accuracy rate for the audit, to one decimal place?
Show answer and explanation
Answer: C. 81.8%
Pool the counts, not the percentages: (10 + 80) correct / (10 + 100) audited = 90 / 110 = 81.8%. Averaging 100% and 80% gives each coder equal weight even though Coder 2's sample is ten times larger.
Work: (10 + 80) / (10 + 100) * 100 = 81.8
Why the others miss:
- A. Averages the two percentages and ignores the different sample sizes.
- B. Uses only Coder 2's rate.
- D. Uses only Coder 1's rate.
Source: calculation from the numbers and definition given in the question.
Question 20 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-04
A patient requests an accounting under HIPAA of disclosures made during the past year. Which disclosure must appear on it?
Show answer and explanation
Answer: D. An identifiable report of her diagnosis to the state health department required under a public health law
The accounting covers disclosures made in the six years before the request, or a shorter period the individual requests, except categories the rule exempts, including treatment, payment, and health care operations, disclosures to the individual, and disclosures made under an authorization. A required public health report is not in an exempt category.
Why the others miss:
- A. Payment disclosures are exempt.
- B. Treatment disclosures are exempt.
- C. Authorized disclosures are exempt.
Source: 45 CFR 164.528, Accounting of disclosures ((a)(1)(i)-(iv), (a)(1)(viii), and (a)(3): six-year window, exemptions, and shorter requested periods)
Question 21 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-04
A weekly EHR report shows 212 progress notes and nursing entries that were saved but never authenticated. Which Condition of Participation requirement do these entries currently fail?
Show answer and explanation
Answer: A. Entries must be legible, complete, dated, timed, and authenticated by the person responsible
Every medical record entry must be dated, timed, and authenticated, in written or electronic form, by the person responsible for providing or evaluating the service. Unauthenticated entries fail the authentication requirement, which is exactly what this report is built to catch.
Why the others miss:
- B. Retention is about how long records are kept, not signatures.
- C. Coding and indexing is about retrieval by diagnosis and procedure.
- D. The discharge summary is a separate content requirement.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((c)(1): authentication; (b)(1)-(2): retention and coding/
Question 22 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-05
A CDI specialist drafts a multiple-choice query about the type of anemia, listing the relevant lab values and the treatment given. Which feature would make the query noncompliant?
Show answer and explanation
Answer: C. Noting that a more specific anemia type would raise the DRG payment
Compliant query guidance says never to include impact on reimbursement, quality measures, or other reportable data, and a query should not lead the provider toward a specific response. Multiple-choice queries should offer clinically reasonable options plus "other" or similar.
Why the others miss:
- A. That is the recommended multiple-choice format.
- B. Clinical indicators from the record support a compliant query.
- D. Asking for documentation in the record is expected.
Source: ACDIS/
Question 23 of 60
Domain 3: Data Analytics and Use · RHIT-D3-04
For the month: 398 admissions, 412 discharges (including deaths), 1,903 inpatient service days, and 1,854 discharge days (total length of stay of discharged patients). Using average length of stay = discharge days / discharges, what is the ALOS?
Show answer and explanation
Answer: A. 4.5 days
1,854 discharge days / 412 discharges = 4.5 days. The trap is mixing data streams: this question's discharge-based ALOS uses the stays of patients who were discharged.
Work: 1854 / 412 = 4.5
Why the others miss:
- B. 1,903 / 398 uses inpatient service days and admissions instead of the discharge-based definition specified in the question.
- C. 1,903 / 412 uses service days instead of discharge days.
- D. 1,854 / 398 uses admissions instead of discharges.
Source: Pennsylvania Department of Health, Tools of the Trade: Average Length of Stay in Hospitals (p. 1, Method 1 and total discharge days/
Question 24 of 60
Domain 5: Compliance · RHIT-D5-04
The FY 2027 ICD-10-CM Official Guidelines for Coding and Reporting cover which period?
Show answer and explanation
Answer: B. October 1, 2026 to September 30, 2027
The FY 2027 guidelines are dated October 1, 2026 through September 30, 2027, following the federal fiscal year. Coding staff, encoder updates, and education have to be ready before October 1.
Why the others miss:
- A. Calendar year is not the ICD-10-CM update cycle.
- C. April updates can occur, but the fiscal-year edition runs October to September.
- D. Not the federal fiscal year.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 25 of 60
Domain 6: Leadership · RHIT-D6-03
An EHR scanning project has four tasks. A (3 weeks) starts first. B (5 weeks) and C (4 weeks) both start after A. D (2 weeks) starts after both B and C finish. What is the critical path and the minimum project length?
Show answer and explanation
Answer: B. A-B-D, 10 weeks
The critical path is generally the longest path through the project and determines its duration. A-B-D = 3 + 5 + 2 = 10 weeks, longer than A-C-D at 9 weeks, so any delay to A, B, or D delays the project.
Work: A-B-D = 3+5+2 = 10; A-C-D = 3+4+2 = 9
Why the others miss:
- A. A-C-D is shorter and has a week of slack.
- C. B and C run in parallel, not in sequence.
- D. Ignores task A, which must finish first.
Source: Virginia IT Agency, COV IT Glossary: Critical Path and Critical Path Method (citing PMBOK) (Critical Path and Critical Path Method (CPM) definitions.)
Question 26 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-06
A nurse scans the wrong wristband and documents a medication administration for Patient X in Patient Y's record. Which identity problem has occurred?
Show answer and explanation
Answer: B. Overlay
An overlay occurs when the wrong patient is registered, admitted, or documented on another patient's record. It is a dangerous identity error because a clinician may act on someone else's information.
Why the others miss:
- A. A duplicate is two record numbers for one person.
- C. An overlap involves identifiers across facilities in an enterprise.
- D. An amendment is a patient-requested change under HIPAA, not an identity error.
Source: AHIMA white paper, A Realistic Approach to Achieving a 1% Duplicate Record Error Rate (p 6: overlay definition and patient-safety consequences); 45 CFR 164.526, Amendment of PHI ((a)(1): individual right to request amendment)
Question 27 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-06
In which situation is a yes/
Show answer and explanation
Answer: B. Asking whether a provider-documented pressure ulcer was present on inpatient admission
Yes/
Why the others miss:
- A. Only clinical indicators are present, so a yes/
no format would introduce a new diagnosis. - C. Queries may never reference reimbursement.
- D. Steering toward a preferred answer is leading.
Source: ACDIS/
Question 28 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-05
On April 1 a hospital discovers that an unencrypted laptop holding PHI for 1,240 patients was stolen. 700 of those patients live in State X. The hospital determines this is a reportable breach of unsecured PHI, and no law-enforcement delay applies. Which response meets the HIPAA Breach Notification Rule?
Show answer and explanation
Answer: B. Notify affected individuals and HHS at the same time, without unreasonable delay and no later than 60 days after discovery, and notify prominent media outlets serving State X on that timeline
Individual notice is due without unreasonable delay and no later than 60 days after discovery. A breach affecting 500 or more individuals also requires notice to the HHS Secretary at the same time as the individual notice, and a breach affecting more than 500 residents of a state or jurisdiction requires notice to prominent media serving it without unreasonable delay and no later than 60 days after discovery.
Why the others miss:
- A. Annual reporting to HHS is available for breaches affecting fewer than 500 individuals, with reports due within 60 days after the end of the year of discovery; individual notice is still due without unreasonable delay and within 60 days after discovery.
- C. The statewide media notice required here adds to individual notice; it does not replace it.
- D. The outer limit is 60 days, and media notice is required here.
Source: HHS, Breach Notification Rule (Definition of Breach; Individual Notice; Media Notice; Notice to the Secretary); 45 CFR 164.404, Notification to individuals ((a)-(b): discovery and individual-notice deadline); 45 CFR 164.406, Notification to the media ((a)-(b): more-than 500-resident media threshold and deadline); 45 CFR 164.408, Notification to the Secretary ((b)-(c): contemporaneous HHS notice at 500 or more; annual reports below 500); 45 CFR 164.412, Law enforcement delay (Law-enforcement delay exception)
Question 29 of 60
Domain 3: Data Analytics and Use · RHIT-D3-05
For the quarter: 300 discharges (including deaths) and 12 inpatient deaths, 7 of which occurred less than 48 hours after admission. Using net death rate = (deaths - deaths under 48 hours) / (discharges - deaths under 48 hours) x 100, what is the net death rate?
Show answer and explanation
Answer: C. 1.71%
Remove the 7 early deaths from both the numerator and the denominator: (12 - 7) / (300 - 7) = 5 / 293 = 1.71%.
Work: (12 - 7) / (300 - 7) * 100 = 1.706 -> 1.71
Why the others miss:
- A. 12 / 300 is the gross death rate.
- B. 5 / 300 forgets to adjust the denominator.
- D. 12 / 293 adjusts only the denominator.
Source: calculation from the numbers and definition given in the question.
Question 30 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-07
A health system with three hospitals uses an enterprise MPI. The same patient has one enterprise identifier at Hospital A and a different enterprise identifier at Hospital B. What is this called?
Show answer and explanation
Answer: D. Overlap
An overlap is more than one enterprise identifier for the same person across two or more facilities in the enterprise.
Why the others miss:
- A. The error spans facilities, so it is not a single-facility duplicate.
- B. No one else's data is in the record, so it is not an overlay.
- C. Downtime documentation is a business-continuity issue, not an identifier error.
Source: AHIMA white paper, A Realistic Approach to Achieving a 1% Duplicate Record Error Rate (p 6: overlap definition and enterprise example)
Question 31 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-07
Under Medicare's two-midnight benchmark, when is an inpatient admission generally appropriate for Part A payment?
Show answer and explanation
Answer: B. When the admitting physician expects the patient to require hospital care that crosses two midnights, based on documented complex medical factors
The benchmark turns on the admitting physician's expectation that the patient will need hospital care crossing two midnights, supported by complex medical factors documented in the record.
Why the others miss:
- A. The benchmark is two midnights, not 24 hours.
- C. Bed placement alone does not establish the benchmark.
- D. Prior observation time is not a prerequisite.
Source: 42 CFR 412.3(d)(1), Two-midnight benchmark (§ 412.3(d)(1), including (i)–(ii))
Question 32 of 60
Domain 5: Compliance · RHIT-D5-05
For this exercise, delinquent record rate = records past the completion deadline at month end / that month's discharges × 100. The hospital had 1,200 discharges in May. At the end of the month, 84 records were incomplete beyond the medical staff's completion deadline. What is the delinquent record rate for the month?
Show answer and explanation
Answer: A. 7.0%
84 / 1,200 = 7.0%. Use the denominator defined by your policy and keep it consistent month to month.
Work: 84 / 1200 * 100 = 7.0
Why the others miss:
- B. Uses 1,200 / 84 ≈ 14.3 rather than 84 / 1,200 × 100.
- C. Subtracts 7.0% from 100%; that is not the defined delinquent record rate.
- D. Decimal place error.
Source: calculation from the numbers and definition given in the question.
Question 33 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-06
HIM is preparing a dataset under HIPAA's safe harbor de-identification method. Which data element may stay in the file?
Show answer and explanation
Answer: A. Year of discharge
Safe harbor removes all elements of dates directly related to an individual except the year, so the discharge year may remain. Dates, including years, that indicate an age over 89 must also be removed or aggregated into the 90-or-older category. The entity must have no actual knowledge that the remaining information could identify an individual.
Why the others miss:
- B. Month and day are date elements that must be removed.
- C. Ages over 89 must be removed or grouped into a single category of 90 or older.
- D. Only the first three ZIP digits may remain, and only where that area has more than 20,000 people.
Source: 45 CFR 164.514, De-identification and limited data sets ((b)(2)(i)(B)-(C) and (b)(2)(ii): ZIP/
Question 34 of 60
Domain 6: Leadership · RHIT-D6-04
HIM and IT are validating the hospital's electronic patient event notifications under the CoP. Which event must trigger a notification, when the hospital's system is conformant with the required content exchange standard?
Show answer and explanation
Answer: D. The patient's admission to inpatient services
The CoP requires notifications at emergency department registration and inpatient admission, and immediately before or at discharge or transfer, to the extent permitted by law and the patient's expressed privacy preferences. The hospital must make a reasonable effort to send them to applicable post-acute providers and suppliers and the patient's established primary care practitioner, practice group, or other patient-identified practitioner or entity primarily responsible for care when they need the notification for treatment, care coordination, or quality improvement.
Why the others miss:
- A. Not a listed trigger.
- B. Not a listed trigger.
- C. Not a listed trigger.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((d)(3)(ii), (d)(4), (d)(5): admission event, discharge/
Question 35 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-08
The attending physician documents "acute kidney injury" throughout the stay and in the discharge summary. Nothing in the record conflicts with that diagnosis. A coder thinks the creatinine values look borderline. Under Section I.A.19 of the ICD-10-CM Official Guidelines, which code-assignment principle applies?
Show answer and explanation
Answer: A. Assign the code for acute kidney injury based on the provider's diagnostic statement
Code assignment is based on the provider's diagnostic statement that the condition exists; it is not based on the clinical criteria the provider used. The guideline directs a query when the record contains conflicting documentation, which this case does not. This code-assignment rule does not prevent a nonleading clinical-validation query when a documented diagnosis appears to lack clinical support.
Why the others miss:
- B. Coders do not overrule a documented diagnosis with their own clinical criteria.
- C. The provider established a diagnosis, so a finding code is not appropriate.
- D. A query must not direct the provider to remove a diagnosis. A nonleading clinical-validation query can seek clarification when clinical support is in question.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 36 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-08
A test is denied as not medically necessary under a local coverage determination (LCD). Which statement about LCDs is accurate?
Show answer and explanation
Answer: C. They are issued by Medicare Administrative Contractors and apply within that contractor's jurisdiction
MACs issue LCDs, which apply only in their jurisdictions, so coverage can vary by region. National coverage determinations are CMS national policies binding on all MACs.
Why the others miss:
- A. That describes an NCD.
- B. LCDs are Medicare contractor policies.
- D. LCDs limit coverage within the jurisdiction and drive medical-necessity denials.
Source: CMS, Medicare Coverage of Items and Services (Overview of Medicare Coverage Pathways: National Coverage Determinations (NCDs); Local Coverage Determinations (LCDs))
Question 37 of 60
Domain 3: Data Analytics and Use · RHIT-D3-06
This month the CDI team reviewed 640 inpatient records and issued at least one query on 96 of them. What is the query rate per reviewed record?
Show answer and explanation
Answer: B. 15.0%
Query rate = records with a query / records reviewed x 100. 96 / 640 = 15.0%. Always confirm the definition your organization uses, because some count total queries rather than queried records.
Work: 96 / 640 * 100 = 15.0
Why the others miss:
- A. Inverts the fraction (640 / 96 = 6.7), then mislabels that quotient as a percentage.
- C. The share of records without a query.
- D. Divides by records without a query (544) instead of all records reviewed.
Source: AHIMA, Clinical Documentation Integrity Key Performance Indicators Practice Brief (August 29, 2022) (Query Rate: definition, best-practice first bullet and equation (queried health records / reviewed records).)
Question 38 of 60
Domain 5: Compliance · RHIT-D5-06
An access audit shows that a registration clerk opened a celebrity patient's chart with no work-related reason. Under the HIPAA Privacy Rule's administrative requirements, what must the covered entity have and do?
Show answer and explanation
Answer: B. Have and apply appropriate sanctions against workforce members who fail to comply, and document the sanctions applied
Covered entities must have and apply appropriate sanctions against workforce members who violate privacy policies or the rule, and must document the sanctions applied. Whether a breach notice is also required is a separate analysis under the Breach Notification Rule.
Why the others miss:
- A. Media notice depends on breach size; there is no 24-hour rule.
- C. The rule requires appropriate sanctions, not a specific penalty.
- D. Enforcement does not depend on a complaint.
Source: 45 CFR 164.530, Administrative requirements (§ 164.530(e)(1)–(2): sanctions and documentation); HHS, Breach Notification Rule (Breach Notification Requirements; Media Notice)
Question 39 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-07
An attorney presents a patient-signed authorization that describes the information, names the recipient and purpose, includes the required statements, and is signed and dated. It has no expiration date or expiration event. What should the release-of-information specialist conclude?
Show answer and explanation
Answer: C. It is defective, because an expiration date or event is a required core element
A valid authorization must contain an expiration date or an expiration event. An authorization that has not been filled out completely with respect to a core element is defective.
Why the others miss:
- A. A signature does not cure a missing core element.
- B. HIPAA sets no default expiration period.
- D. A treatment purpose does not cure a missing core element in this authorization.
Source: 45 CFR 164.508, Authorizations ((b)(2)(ii) and (c)(1)(v): incomplete authorizations and required expiration date/
Question 40 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-09
A dietitian documents a BMI of 41.2 for a nonpregnant adult. The attending physician documents "morbid obesity," which meets the encounter's criteria for a reportable diagnosis. Which approach follows the ICD-10-CM Official Guidelines?
Show answer and explanation
Answer: C. Code morbid obesity from the attending's documentation and the BMI from the dietitian's, reporting the BMI as a secondary diagnosis
BMI is one of the listed exceptions that may be coded from documentation by clinicians other than the patient's provider, but the associated reportable diagnosis (such as obesity) must be documented by the provider. BMI codes are reported only as secondary diagnoses.
Why the others miss:
- A. The BMI alone is incomplete when the provider has documented the associated diagnosis.
- B. The provider does not need to restate the BMI value.
- D. BMI codes are secondary-only.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 41 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-09
The provider documents pneumonia due to methicillin-resistant Staphylococcus aureus (MRSA). Which coding approach follows the guidelines?
Show answer and explanation
Answer: C. Assign the combination code for MRSA pneumonia only, without B95.62 and without a Z16.11- resistance code
When an MRSA infection has a combination code that includes the organism, such as J15.212, assign that code alone. Do not add B95.62 or a code from Z16.11-, because the combination code already captures both.
Why the others miss:
- A. Z16.11- is not added to MRSA combination codes.
- B. B95.62 is for MRSA infections that lack a combination code.
- D. Carrier status describes colonization, not an active infection.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 42 of 60
Domain 3: Data Analytics and Use · RHIT-D3-07
Release-of-information turnaround times for seven requests were 2, 9, 4, 30, 5, 3, and 6 days. One request waited on a court order. Which figure best represents typical turnaround for a leadership report?
Show answer and explanation
Answer: A. Median of 5 days
Sorted, the times are 2, 3, 4, 5, 6, 9, 30, so the median is 5 days. The single 30-day outlier pulls the mean up to 8.4 days. The median is less sensitive to extreme values and better represents the typical turnaround in this skewed set.
Work: sorted: 2,3,4,5,6,9,30 -> median 5; mean 59/7 = 8.43
Why the others miss:
- B. The mean is pulled toward the outlier.
- C. Range describes spread, not a typical value.
- D. No value repeats, so there is no mode; 30 is the outlier.
Source: CDC, Principles of Epidemiology, Lesson 2, Section 6: Measures of Central Location (archived) (Mode (no repeated values); Median: definition and Properties and uses; Arithmetic mean: sensitivity to extreme values.)
Question 43 of 60
Domain 5: Compliance · RHIT-D5-07
The HIM department uses identifiable records to measure whether discharge summaries meet internal quality criteria. Under HIPAA, this internal use is classified as:
Show answer and explanation
Answer: B. Health care operations
Health care operations include conducting quality assessment and improvement activities, provided that obtaining generalizable knowledge is not the primary purpose.
Why the others miss:
- A. The audit does not provide care to the patient.
- C. Research aims at generalizable knowledge; this is internal QI.
- D. No product or service is being promoted.
Source: 45 CFR 164.501, Definitions (designated record set, psychotherapy notes, health care operations, payment) (Health care operations definition, paragraph (1); compare Research, Treatment, Marketing definitions)
Question 44 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-10
At discharge, the provider documents a "borderline" condition. The ICD-10-CM Alphabetic Index has no specific "borderline" entry for that condition. How is it coded?
Show answer and explanation
Answer: A. As confirmed, in both inpatient and outpatient settings
A borderline diagnosis documented at discharge is coded as confirmed unless the classification has a specific borderline entry. Borderline conditions are not uncertain diagnoses, so the guideline makes no inpatient/
Why the others miss:
- B. That split applies to uncertain diagnoses, not borderline ones.
- C. The guideline says to code borderline conditions as confirmed.
- D. Borderline and uncertain are treated differently.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 45 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-10
At month end, gross unbilled A/
Show answer and explanation
Answer: D. 12.0 days
DNFB days = gross unbilled A/
Work: 4200000 / 350000 = 12.0
Why the others miss:
- A. Inverts the ratio and scales it.
- B. Off by a factor of 10.
- C. Off by a factor of 10.
Source: HFMA, MAP Keys: PB-1 DNFB and AR-5 Remittance Denial Rate (PB-1, Days in Total Discharged Not Final Billed: equation and definitions; 2023 PDF p. 11)
Question 46 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-08
On January 10 a patient asks the hospital to amend a progress note. The author reviews it and finds the note accurate and complete. Which response complies with HIPAA?
Show answer and explanation
Answer: D. Send a written denial within 60 days, with one possible 30-day extension, explaining the basis and the patient's right to file a statement of disagreement
A covered entity may deny amendment when the information is accurate and complete. It must act within 60 days; one extension of up to 30 days is allowed if a written reason and completion date are provided within the original 60 days. The plain-language written denial must state the basis, explain how to submit a statement of disagreement, and explain how to complain. It must also explain that, without submitting a disagreement, the patient may request that the amendment request and denial accompany future disclosures of the information.
Why the others miss:
- A. Accurate entries are not deleted; accepted amendments are appended or linked.
- B. The entity must act on every request.
- C. Denials must be written.
Source: 45 CFR 164.526, Amendment of PHI ((a)(2)(iv), (b)(2), (c)(1), and (d)(1): accurate records, timing, appended amendments, and denial rights)
Question 47 of 60
Domain 6: Leadership · RHIT-D6-05
A new HIPAA-covered ambulatory surgery center asks the HIM consultant what personnel designations the HIPAA Privacy Rule requires. What is the correct answer?
Show answer and explanation
Answer: A. A privacy official, plus a contact person or office responsible for receiving complaints, with both designations documented
A covered entity must designate a privacy official responsible for its privacy policies and procedures, and a contact person or office responsible for receiving complaints, and must document those designations.
Why the others miss:
- B. The Privacy Rule requires a privacy official and a complaint contact; a security-only designation does not satisfy it.
- C. Committees are an OIG compliance-program element, not this Privacy Rule requirement.
- D. There is no small-entity exemption from these designations.
Source: 45 CFR 164.530, Administrative requirements ((a)(1)-(2): privacy official, complaints contact, documented designations.); HHS-OIG, The 7 Fundamental Elements of a Compliance Program (Fundamental 2, PDF p. 3: compliance officer and compliance committee; introduction p. 1: voluntary guidance.)
Question 48 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-11
The attending documents "pressure ulcer of heel" without stating the side. The wound care nurse documents "left heel" throughout the stay, and nothing in the record conflicts. What should the coder do about laterality?
Show answer and explanation
Answer: B. Assign the left-side code based on the nurse's documentation
Laterality is one of the listed exceptions where code assignment may be based on documentation by clinicians other than the patient's provider. Query when the documentation about the side conflicts.
Why the others miss:
- A. Unspecified-side codes should rarely be used when the side is documented.
- C. The guideline permits using the nurse's documentation for laterality.
- D. Nothing documents both sides.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 49 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-11
Last quarter 8,500 claims were remitted and 340 of those claims had actionable denials, counted at the claim level. Using HFMA's remittance denial rate (claims denied / claims remitted), what is the denial rate?
Show answer and explanation
Answer: A. 4.0%
340 / 8,500 = 0.04, or 4.0%. HFMA's MAP Key counts actionable denials and excludes items such as patient-responsibility denials and duplicate-claim denials.
Work: 340 / 8500 * 100 = 4.0
Why the others miss:
- B. Inverts the ratio (8,500 / 340 = 25) and labels the quotient as a percentage; it is not the denial rate.
- C. Decimal place error.
- D. Divides by remitted plus denied claims, which is not the defined denominator.
Source: HFMA, MAP Keys: PB-1 DNFB and AR-5 Remittance Denial Rate (AR-5, Remittance Denial Rate: equation, claim-level unit, inclusions/
Question 50 of 60
Domain 3: Data Analytics and Use · RHIT-D3-08
Quality wants every inpatient treated for a specific diagnosis who also had a specific procedure last year. Which internal data source is designed for this kind of retrieval?
Show answer and explanation
Answer: D. The coded diagnosis and procedure index
Hospitals must maintain a system of coding and indexing medical records that allows timely retrieval by diagnosis and procedure to support medical care evaluation studies.
Why the others miss:
- A. The MPI identifies patients and encounters, not clinical content.
- B. That log tracks certain disclosures.
- C. The CDM lists chargeable items and their charges.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((b)(2): coding/
Question 51 of 60
Domain 5: Compliance · RHIT-D5-08
A release-of-information vendor working as the hospital's business associate discovers that mailing records to the wrong requester resulted in a breach of unsecured protected health information. No permitted law-enforcement delay applies. Under the Breach Notification Rule, what is the vendor's obligation?
Show answer and explanation
Answer: D. Notify the covered entity without unreasonable delay and no later than 60 calendar days from discovery
A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days from discovery of a breach. The covered entity is responsible for the required notifications.
Why the others miss:
- A. The BA's duty runs to the covered entity.
- B. Media notice is the covered entity's duty and only above the size threshold.
- C. There is no waiting for an audit.
Source: 45 CFR 164.410, Notification by a business associate (§ 164.410(a)(1)–(2), (b) and (c): breach of unsecured PHI, discovery, timing and notice content); HHS, Breach Notification Rule (Definition of Breach; Individual Notice; Notification by a Business Associate)
Question 52 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-09
A hospital is writing its retention schedule. What is the minimum retention period the Medicare hospital Conditions of Participation set for medical records?
Show answer and explanation
Answer: A. At least 5 years, in original or legally reproduced form
The CoP requires medical records to be retained in their original or legally reproduced form for at least 5 years. State law or other rules can require longer, so a retention schedule follows whichever requirement is longest.
Why the others miss:
- B. Shorter than the federal minimum.
- C. Not the CoP standard.
- D. Not required by the CoP.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((b)(1): at least 5 years in original or legally reproduced form)
Question 53 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-12
A hospitalist gives a verbal order for a medication change during a rapid response. Under the hospital Conditions of Participation, what must happen to that order?
Show answer and explanation
Answer: B. It must be dated, timed, and authenticated promptly by the ordering practitioner or another responsible practitioner acting within State law and hospital policy
All orders, including verbal orders, must be dated, timed, and authenticated promptly by the ordering practitioner, or by another practitioner responsible for the patient's care when permitted by State law, hospital policy, and medical staff bylaws.
Why the others miss:
- A. Receiving and recording a verbal order does not replace the required practitioner authentication.
- C. The 30-day timeframe is for record completion, not order authentication.
- D. Standing orders are a separate pathway with their own requirements.
Source: 42 CFR 482.24, Hospital Condition of Participation: Medical record services ((c)(2): authentication of all orders; (c)(3): standing orders; (c)(4)(viii): record-completion deadline)
Question 54 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-12
Under federal hospital price transparency rules, what does the charge description master (chargemaster) contain?
Show answer and explanation
Answer: B. The list of all individual items and services for which the hospital has established a charge
The rule defines the chargemaster as the list of all individual items and services for which the hospital has established a charge. The gross charge is the charge on the chargemaster, absent any discounts.
Why the others miss:
- A. Negotiated rates are payer-specific standard charges, not the chargemaster itself.
- C. DRG weights come from CMS.
- D. Account balances live in patient accounting.
Source: 45 CFR 180.20, Hospital price transparency definitions (Definitions: Chargemaster; Gross charge; Payer-specific negotiated charge)
Question 55 of 60
Domain 6: Leadership · RHIT-D6-06
The inpatient coding team receives 432 discharges per week. The productivity standard is 3 inpatient records per hour, and each full-time coder has 36 productive coding hours per week. How many coding FTEs are needed to stay current?
Show answer and explanation
Answer: A. 4.0 FTE
Hours needed = 432 / 3 = 144 hours per week. FTEs = 144 / 36 = 4.0. Adjust for real-world factors such as education time or backlog only after the base calculation.
Work: 432 / 3 = 144 hours; 144 / 36 = 4.0
Why the others miss:
- B. Uses 40 paid hours instead of 36 productive hours.
- C. 432 / 36 ignores the productivity standard.
- D. Uses 30 productive hours instead of 36.
Source: calculation from the numbers and definition given in the question.
Question 56 of 60
Domain 3: Data Analytics and Use · RHIT-D3-09
The hospital's CMI rose from 1.25 last quarter to 1.40 this quarter. What is the percent change?
Show answer and explanation
Answer: D. 12.0%
Percent change = (new - old) / old x 100 = (1.40 - 1.25) / 1.25 x 100 = 12.0%. Before calling it a documentation win, check whether the patient mix or service lines also changed.
Work: (1.40 - 1.25) / 1.25 * 100 = 12.0
Why the others miss:
- A. Divides by the new value instead of the old value.
- B. Treats the raw difference of 0.15 as 15 percent.
- C. Reports the raw difference as a percentage.
Source: AHIMA, Clinical Documentation Integrity Key Performance Indicators Practice Brief (August 29, 2022) (Case Mix Index: Best Practice and Benchmarking (service mix and other variables affect CMI).)
Question 57 of 60
Domain 5: Compliance · RHIT-D5-09
During a coding compliance review, which documentation pattern most clearly needs a provider query rather than coder-assigned codes?
Show answer and explanation
Answer: D. Two providers document conflicting diagnoses for the same condition
The guidelines direct a query when the record contains conflicting documentation. The other patterns are handled directly by specific guidelines.
Why the others miss:
- A. Consistent laterality from another clinician may be used.
- B. BMI may be coded from the dietitian when the provider documents the associated diagnosis.
- C. Borderline diabetes has a specific index entry and is coded as the classification directs.
Source: ICD-10-CM Official Guidelines for Coding and Reporting FY 2027 (CMS and CDC/
Question 58 of 60
Domain 2: Access, Disclosure, Privacy, and Security · RHIT-D2-10
A clinic is starting its HIPAA Security Rule compliance program. According to HHS, which activity is the first step?
Show answer and explanation
Answer: B. Conducting an accurate and thorough risk analysis of risks and vulnerabilities to ePHI
HHS describes risk analysis as the first step in Security Rule compliance. The required implementation specification is an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
Why the others miss:
- A. Safeguards are chosen based on the risk analysis.
- C. Writing a notification template does not identify risks and vulnerabilities to ePHI.
- D. A vendor change does not replace the covered entity's own risk analysis.
Source: HHS, Guidance on Risk Analysis (HIPAA Security Rule) (Introduction; Risk Analysis Requirements under the Security Rule; In Summary)
Question 59 of 60
Domain 1: Data Content, Structure, and Information Governance · RHIT-D1-13
A patient asks through the portal for a PDF copy of her lab results and visit notes, which the hospital maintains electronically and can readily export as a PDF. What must the hospital do?
Show answer and explanation
Answer: D. Provide the electronic copy in the form and format she requested, because it is readily producible
When PHI is maintained electronically and the individual requests an electronic copy, the covered entity must provide it in the electronic form and format requested if readily producible, or otherwise in a readable electronic form and format both agree to.
Why the others miss:
- A. Paper does not satisfy a request for an electronic copy of electronically maintained PHI that can be produced.
- B. Inspection is one option, but she asked for a copy.
- C. A summary requires the individual's advance agreement.
Source: 45 CFR 164.524, Access of individuals to PHI ((c)(2)(ii)-(iii): requested electronic format and advance agreement to a summary)
Question 60 of 60
Domain 4: Revenue Cycle Management · RHIT-D4-13
A utilization review nurse sends clinical information to a health plan for concurrent review of a patient's continued stay. Under HIPAA, this disclosure falls under which category?
Show answer and explanation
Answer: D. Payment
HIPAA's definition of payment includes utilization review activities, including precertification and preauthorization of services and concurrent and retrospective review of services.
Why the others miss:
- A. UR is not a systematic investigation for generalizable knowledge.
- B. UR is not a communication encouraging purchase of a product.
- C. UR is not a disclosure to a public health authority.
Source: 45 CFR 164.501, Definitions (designated record set, psychotherapy notes, health care operations, payment) (Payment definition, paragraph (2)(v); compare Research, Marketing, and Public health authority definitions)
Score yourself by domain
Count your first-try correct answers in each domain. Your result here is feedback on these 60 questions, not a scaled score. The share of questions in each domain falls within AHIMA's published weight range; this short set does not cover every task.
| Domain | Official weight | Questions here | Your first-try correct |
|---|---|---|---|
| 1. Data Content, Structure, and Information Governance | 19–25% | 13 | ___ / 13 |
| 2. Access, Disclosure, Privacy, and Security | 14–18% | 10 | ___ / 10 |
| 3. Data Analytics and Use | 12–18% | 9 | ___ / 9 |
| 4. Revenue Cycle Management | 19–25% | 13 | ___ / 13 |
| 5. Compliance | 13–17% | 9 | ___ / 9 |
| 6. Leadership | 9–12% | 6 | ___ / 6 |
| Total | 60 | ___ / 60 |
What your result means. AHIMA reports every exam on a scaled score from 100 to 400, and 300 passes. Its candidate guide is blunt that a scaled score is not a percent or number correct. So no percentage on a practice set converts to a 300, and six to thirteen questions per domain is too few to measure a domain precisely. Use the missed questions to choose topics to review, not to predict a result. A second pass can reflect memory of these items as well as learning, so count only your first try.
Your review sheet
Copy this table and fill one row for every question you missed or guessed. The first row is a worked example.
| Question | My first choice | Rule I missed | The rule in my own words | Next review step |
|---|---|---|---|---|
| Q1 (RHIT-D1-05) | A. Overlay | Duplicate vs overlay vs overlap | Two record numbers for one person is a duplicate; someone else's data in a chart is an overlay; extra IDs across facilities is an overlap. | Reread the three definitions, then answer Question 26 and Question 30 again without looking. |
Then do three things:
- Open the source linked under each missed question and read the rule itself, not just our summary of it.
- Redo every missed calculation on paper, saying out loud what the numerator counts and what the denominator counts. AHIMA's candidate guide lists calculators among the items you can't bring into the testing room.
- Find the task behind each miss in the official RHIT content outline. Study the task, not the question wording.
How this practice test compares with the real RHIT exam
Checked against AHIMA's RHIT certification page, its exam and scoring page, and its certification FAQ on October 23, 2026.
| This practice test | The RHIT exam | |
|---|---|---|
| Questions | 60, all counted | 150: 130 scored and 20 unscored pretest items, mixed in at random. You can't tell which are pretest. |
| Format | Four choices, one correct answer | Four choices, one correct answer. (AHIMA's multiple-response items apply only to the CCS and CCS-P.) |
| Question levels | Mostly scenario questions | Recall, application, and analysis questions |
| Time | Untimed, or about 82 minutes for approximate exam pacing | 3 hours 30 minutes total: 5 minutes for the confidentiality agreement, then 3 hours 25 minutes of exam time that includes reading the instructions. No scheduled breaks, and the clock keeps running if you step out. |
| Navigation | Any order | You can move back and forth once an answer is selected, flag questions, and review before submitting, as time allows. |
| Scoring | Your count of correct answers | Scaled score from 100 to 400; 300 passes |
| Results | Self-mark by domain using the table above | Normally immediately after the exam, with a percent-correct breakdown by content outline domain that excludes pretest items. In a beta period before the passing mark is set, you receive a completion notice and results follow later. |
| Where | Here | Pearson VUE test center, computer-based. No books or resources are required on exam day. |
The pacing reference is 205 minutes ÷ 150 questions × 60 questions = 82 minutes; the official 205-minute interval also includes instructions.
One more number worth knowing: AHIMA reports a first-time pass rate of 74% for 2025 (1,630 first-time testers), down from 78% in 2024 (1,541 first-time testers) and 84% in 2023 (1,577 first-time testers). These are separate annual cohorts, not a prediction of your result. Use these questions to find what to review. (AHIMA's published pass rates)
Ready for the logistics? Our guides cover AHIMA exam registration and scheduling, reading your AHIMA score report, and AHIMA retake rules, including RHIT's 30-day wait.
Formulas used on this page
These are the definitions the calculation questions use. Statistics texts sometimes word them a little differently, so learn what each one counts.
| Measure | Formula |
|---|---|
| Average daily inpatient census | Inpatient service days for the period ÷ days in the period |
| Inpatient bed occupancy rate (constant bed count) | Inpatient service days ÷ (bed count × days in the period) × 100 |
| Average length of stay (discharge-based) | Discharge days (total length of stay of discharged patients) ÷ discharges, including deaths |
| Net death rate (definition used in Question 29) | (Inpatient deaths − deaths under 48 hours) ÷ (total discharges including deaths − deaths under 48 hours) × 100 |
| Case mix index | Sum of MS-DRG relative weights ÷ number of discharges |
| Combined rate across groups | Total successes ÷ total cases × 100 (pool the counts; don't average the percentages) |
| Percent change | (New − old) ÷ old × 100; requires a nonzero old value |
| DNFB days (HFMA) | Gross unbilled A/ |
| Remittance denial rate (HFMA) | Actionable denied claims ÷ claims remitted × 100 (claim-level counts) |
Common questions
Are these real RHIT exam questions? No. We wrote every question for this page from the public content outline and the regulations and guidelines cited under each answer. AHIMA does not disclose exam questions, and its testing rules prohibit sharing or helping reconstruct them.
Which coding guidelines do the coding questions follow? The FY 2027 ICD-10-CM Official Guidelines for Coding and Reporting, which cover October 1, 2026 through September 30, 2027. That identifies the teaching edition used here; it does not establish which edition AHIMA uses on a particular test form.
Sources
Official exam facts:
- AHIMA: Registered Health Information Technician (RHIT) — exam specifications, navigation, retake rules, pass rates
- AHIMA: About the Certification Exams — question format, cognitive levels, score scale
- AHIMA: RHIT Content Outline (effective 10/01/2022) — domains, weights, tasks
- AHIMA: Certification FAQs — timing, results
- AHIMA/
CCHIIM Candidate Guide — test center restrictions, score report notes
Sources behind the answers:
-
HIPAA Privacy Rule: 45 CFR 164.501, 164.502, 164.508, 164.514, 164.524, 164.526, 164.528, 164.530
-
HHS: Breach Notification Rule and HHS: Guidance on Risk Analysis
-
Medicare and federal rules: 42 CFR 482.24 (medical record services), 42 CFR 412.3 (two-midnight benchmark), 45 CFR 180.20 (chargemaster definitions)
-
ICD-10-CM Official Guidelines for Coding and Reporting, FY 2027
-
ACDIS/
AHIMA: Guidelines for Achieving a Compliant Query Practice (2026 Update) -
AHIMA: A Realistic Approach to Achieving a 1% Duplicate Record Error Rate
-
HHS-OIG: The 7 Fundamental Elements of a Compliance Program, CMS: Medicare Coverage of Items and Services
-
HFMA MAP Keys, California HCAI: Case Mix Index, Hawaii SHPDA: Bed Utilization Formulas, CDC: Principles of Epidemiology, Lesson 2, Section 6, Virginia IT Agency glossary: critical path
-
Additional answer sources: HHS: Access-request timing; Pennsylvania Department of Health: Average Length of Stay in Hospitals; AHIMA: Clinical Documentation Integrity Key Performance Indicators
-
HIPAA breach rules: 45 CFR 164.404, 45 CFR 164.406, 45 CFR 164.408, 45 CFR 164.410, 45 CFR 164.412
Last verified: October 23, 2026, for the exam format, timing, scoring, pass rates, content outline, and every source linked under the answers.
Developed with AI assistance and checked against the cited sources. Source checking is not a credentialed professional review. How Castleport develops and checks study material.
By the Castleport Test Prep Editorial Team. Castleport Test Prep is an independent exam prep publisher. It is not affiliated with, endorsed by, or approved by the American Health Information Management Association (AHIMA) or its Commission on Certification for Health Informatics and Information Management (CCHIIM). RHIT and other exam and credential names identify their subjects; trademarks belong to their respective owners. These are original, unofficial practice questions, not official or recalled exam content, and no result here guarantees an exam result, certification, or employment.