CCMA Medical Law and Ethics Practice Test

25 practice questions

Choose an answer, then check it under Show answer.

1. Question 1 of 25Medium

   While off duty at a park, a medical assistant performs CPR on a man who collapsed, within the limits of her training and without expecting payment. Which law generally protects her from liability?

   1. AA. HIPAA
   2. BB. Patient Self-Determination Act
   3. CC. CLIA
   4. DD. Good Samaritan law
   Show answer to question 1

   Answer: D. Good Samaritan law

   Good Samaritan laws protect people who give emergency care in good faith, without expecting payment and within their training, from liability for ordinary negligence. Details vary by state.

   Why the other options are wrong

   • AHIPAA protects the privacy and security of health information.
   • BThe Patient Self-Determination Act concerns informing patients about advance directives.
   • CCLIA regulates the quality of laboratory testing.

2. Question 2 of 25Easy

   To prove negligence in a malpractice case, which four elements must generally be shown?

   1. AA. Diagnosis, delay, documentation and damages
   2. BB. Duty, delegation, discharge and disability
   3. CC. Duty, dereliction, direct cause, damages
   4. DD. Delay, denial, dereliction and disclosure
   Show answer to question 2

   Answer: C. Duty, dereliction, direct cause, damages

   The four Ds of negligence are duty (a relationship that created a duty of care), dereliction (a breach of the standard of care), direct cause (the breach caused the harm) and damages (actual injury or loss).

   Why the other options are wrong

   • ADiagnosis and documentation are not elements of negligence.
   • BDelegation, discharge and disability are not the four required elements.
   • DDelay, denial and disclosure are not recognized elements of negligence.

3. Question 3 of 25Medium

   A patient calls and asks the medical assistant whether he should take a double dose of his blood pressure medicine because he missed yesterday's dose. What should the medical assistant do?

   1. AA. Tell him to take a double dose to catch up
   2. BB. Tell him to skip the medicine for the rest of the week
   3. CC. Look up the medicine online and give him dosing advice
   4. DD. Take a message and route the question to the provider
   Show answer to question 3

   Answer: D. Take a message and route the question to the provider

   Advising patients about medication changes requires clinical judgment and is outside the medical assistant's scope. The medical assistant documents the question and routes it to the provider, or follows an approved protocol, so the patient gets a timely answer.

   Why the other options are wrong

   • ADoubling a dose could be dangerous and is medical advice.
   • BTelling the patient to stop his medicine is medical advice and could be harmful.
   • CGiving dosing advice from an online source is outside the medical assistant's scope.

4. Question 4 of 25Medium

   A patient's employer calls the office asking for details about the patient's diagnosis from last week's visit. What should the medical assistant do?

   1. AA. Decline unless the patient has signed an authorization
   2. BB. Share the diagnosis, since the employer pays for the plan
   3. CC. Confirm only the diagnosis but not the treatment
   4. DD. Share the information if the caller sounds trustworthy
   Show answer to question 4

   Answer: A. Decline unless the patient has signed an authorization

   Employers are not entitled to a patient's PHI without the patient's written authorization, except in limited situations such as certain workers' compensation claims. The medical assistant politely declines to share any information.

   Why the other options are wrong

   • BPaying for insurance does not give an employer access to an employee's health information.
   • CEven confirming a diagnosis is a disclosure of PHI.
   • DA caller's manner does not authorize disclosure of PHI.

5. Question 5 of 25Medium

   A medical assistant needs a patient to call the office about test results and reaches the patient's voicemail. What should the message include?

   1. AA. The test name, the result and the provider's comments
   2. BB. The diagnosis, so the patient can prepare for the call
   3. CC. No message at all, since voicemail is never allowed
   4. DD. Name, office callback number and a request to call
   Show answer to question 5

   Answer: D. Name, office callback number and a request to call

   Unless the patient has agreed to more detailed messages, voicemails include only the minimum: the caller's name, the office name and number, and a request to call back. Test details and diagnoses are not left on voicemail.

   Why the other options are wrong

   • ALeaving results on voicemail could disclose PHI to others who hear the message.
   • BDiagnoses should not be left on voicemail.
   • CHIPAA allows limited voicemail messages, so a brief message is acceptable.

6. Question 6 of 25Medium

   Under the HIPAA Security Rule, which is an example of a technical safeguard?

   1. AA. Locking the file room door at night
   2. BB. Training staff on privacy policies each year
   3. CC. Automatic logoff of idle workstations
   4. DD. Shredding paper records before disposal
   Show answer to question 6

   Answer: C. Automatic logoff of idle workstations

   Technical safeguards are technology-based protections for electronic PHI, such as unique user logins, automatic logoff, encryption and audit controls.

   Why the other options are wrong

   • ALocking doors is a physical safeguard.
   • BStaff training is an administrative safeguard.
   • DShredding protects paper records and is not a technology-based safeguard for electronic PHI.

7. Question 7 of 25Medium

   A patient wants to name her daughter to make medical decisions for her if she becomes unable to make them herself. Which document accomplishes this?

   1. AA. A health care power of attorney
   2. BB. A living will listing treatment wishes
   3. CC. A Notice of Privacy Practices form
   4. DD. An assignment of benefits form
   Show answer to question 7

   Answer: A. A health care power of attorney

   A durable power of attorney for health care, also called a health care proxy, names an agent to make medical decisions when the patient cannot. A living will states treatment wishes but does not appoint a decision maker.

   Why the other options are wrong

   • BA living will records treatment preferences but does not name someone to decide for the patient.
   • CThe Notice of Privacy Practices explains how health information is used and protected.
   • DAn assignment of benefits directs insurance payments to the provider.

8. Question 8 of 25Easy

   Which document explains how a medical practice may use and disclose a patient's health information and describes the patient's privacy rights?

   1. AA. Notice of Privacy Practices
   2. BB. Advance directive
   3. CC. Assignment of benefits
   4. DD. Informed consent form
   Show answer to question 8

   Answer: A. Notice of Privacy Practices

   The Notice of Privacy Practices describes how the practice may use and disclose PHI and explains patients' rights. It is provided at the first visit, and the practice makes a good faith effort to obtain written acknowledgment of receipt.

   Why the other options are wrong

   • BAn advance directive states a patient's wishes for future medical care.
   • CAn assignment of benefits authorizes the insurer to pay the provider directly.
   • DAn informed consent form documents agreement to a specific treatment or procedure.

9. Question 9 of 25Medium

   After a hectic shift, a medical assistant wants to post online about an unusual patient case, leaving out the patient's name. Which statement is accurate?

   1. AA. It is acceptable, since the name is left out
   2. BB. It is acceptable if the post is set to friends only
   3. CC. It may still identify the patient and violate privacy
   4. DD. It is acceptable if the patient is no longer seen there
   Show answer to question 9

   Answer: C. It may still identify the patient and violate privacy

   Details such as the date, location, condition or unusual circumstances can identify a patient even without a name. Posting about patients on social media can violate HIPAA and employer policy and damage trust.

   Why the other options are wrong

   • ALeaving out the name does not prevent identification through other details.
   • BPrivacy settings do not prevent sharing and do not make the disclosure acceptable.
   • DPrivacy protections continue after a patient leaves the practice.

10. Question 10 of 25Easy

    Under HIPAA, which item is an example of protected health information (PHI)?

    1. AA. A clinic's published list of office hours
    2. BB. A lab result linked to a patient's name
    3. CC. A news article about flu season in general
    4. DD. Average wait times reported for the clinic
    Show answer to question 10

    Answer: B. A lab result linked to a patient's name

    Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate. A lab result tied to a patient's name identifies the person and relates to his or her health.

    Why the other options are wrong

    • AOffice hours are general business information and do not identify a patient.
    • CGeneral public health news does not identify any individual patient.
    • DCombined wait-time data does not identify individual patients.

11. Question 11 of 25Easy

    Under the HIPAA Breach Notification Rule, what is the maximum amount of time a covered entity has to notify affected individuals following the discovery of a breach of unsecured protected health information?

    1. AA. 60 calendar days
    2. BB. 120 calendar days
    3. CC. 30 calendar days
    4. DD. 90 calendar days
    Show answer to question 11

    Answer: A. 60 calendar days

    Federal regulations require covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach. While organizations are encouraged to notify individuals as quickly as possible, 30 calendar days is not the statutory deadline under federal law.

12. Question 12 of 25Medium

    A 17-year-old who lives independently comes in for treatment and has documentation that she is legally emancipated. Who can consent to her care?

    1. AA. Only her parents
    2. BB. The patient herself
    3. CC. Only a court-appointed guardian
    4. DD. The provider alone
    Show answer to question 12

    Answer: B. The patient herself

    Emancipated minors are legally treated as adults for most purposes, including consenting to their own medical care. The office keeps a copy of the documentation according to policy.

    Why the other options are wrong

    • AParental consent is not required for a legally emancipated minor.
    • CAn emancipated minor does not need a guardian to consent to her own care.
    • DProviders cannot consent on a patient's behalf except in limited emergencies.

13. Question 13 of 25Medium

    A competent patient decides not to have a recommended screening test after the provider explains the risks and benefits. Respecting this decision reflects which ethical principle?

    1. AA. Beneficence
    2. BB. Justice
    3. CC. Nonmaleficence
    4. DD. Autonomy
    Show answer to question 13

    Answer: D. Autonomy

    Autonomy is the right of competent patients to make informed decisions about their own care, including refusing recommended tests or treatments.

    Why the other options are wrong

    • ABeneficence is the duty to act in the patient's best interest.
    • BJustice refers to fairness in the distribution of care and resources.
    • CNonmaleficence is the duty to avoid causing harm.

14. Question 14 of 25Medium

    Prior to administering an intramuscular injection, a medical assistant performs the three standard medication checks to ensure the medication and dosage are correct. This safety habit primarily upholds which ethical principle?

    1. AA. Autonomy
    2. BB. Nonmaleficence
    3. CC. Justice
    4. DD. Fidelity
    Show answer to question 14

    Answer: B. Nonmaleficence

    Nonmaleficence is the fundamental obligation to do no harm, which encompasses following strict medication verification protocols to avoid preventable injury. Fidelity refers to remaining loyal and keeping promises, which is not the primary ethical driver for medication safety checks.

15. Question 15 of 25Easy

    A physician decides to discontinue the patient-physician relationship due to a patient's repeated noncompliance. To protect the patient's right to continuity of care and avoid accusations of abandonment, what must the practice provide to the patient?

    1. AA. A verbal notification given by the medical assistant during the patient's next appointment
    2. BB. A formal written notice sent by certified mail providing reasonable time to find a new provider
    3. CC. A court-ordered injunction authorizing the closure of the patient's electronic medical chart
    4. DD. An immediate cessation of all clinical services alongside a copy of the unpaid ledger
    Show answer to question 15

    Answer: B. A formal written notice sent by certified mail providing reasonable time to find a new provider

    To prevent claims of medical abandonment and ensure continuity of care, a provider terminating a relationship must issue a written notice, typically sent by certified mail with return receipt requested. This notice must offer emergency coverage and give the patient adequate time (typically 30 days) to locate a new provider. Immediate cessation of care without notice or relying solely on verbal communication leaves the practice vulnerable to legal liability.

16. Question 16 of 25Hard

    A medical assistant notices that a coworker documented vital signs for a patient even though the coworker never took them. What should the medical assistant do?

    1. AA. Say nothing, since it is not her own patient
    2. BB. Report it to the supervisor per policy
    3. CC. Change the coworker's entry herself to fix it
    4. DD. Confront the coworker in front of the patient
    Show answer to question 16

    Answer: B. Report it to the supervisor per policy

    Documenting care that was not performed is falsification of the medical record and can harm patients. Staff have an ethical duty to report it through the proper channel, usually the supervisor, according to policy.

    Why the other options are wrong

    • AStaying silent allows false information to remain in the record and puts patients at risk.
    • CAltering another person's entry is improper and creates further record problems.
    • DA public confrontation is unprofessional and does not correct the record.

17. Question 17 of 25Hard

    A patient's adult sister is in the exam room when the medical assistant needs to ask about the patient's medications and symptoms. What should the medical assistant do?

    1. AA. Ask the sister to leave without asking the patient
    2. BB. Proceed, since family members may always hear PHI
    3. CC. Ask the patient privately if the sister may stay
    4. DD. Ask the sister to answer the questions for the patient
    Show answer to question 17

    Answer: C. Ask the patient privately if the sister may stay

    Under HIPAA, PHI may be discussed in front of a family member if the patient agrees or does not object when given the chance. Asking the patient, ideally privately, respects her wishes.

    Why the other options are wrong

    • AThe patient may want her sister present, and the decision is hers.
    • BFamily members do not automatically have the right to hear PHI.
    • DA competent adult should answer for herself unless she asks for help.

18. Question 18 of 25Easy

    How does professional certification, such as the CCMA credential, differ from licensure?

    1. AA. A credentialing body certifies; a state licenses
    2. BB. Certification is required by federal law; licensure is optional
    3. CC. They are two names for the same credential
    4. DD. A state certifies; a credentialing body licenses
    Show answer to question 18

    Answer: A. A credentialing body certifies; a state licenses

    Certification is awarded by a nongovernmental credentialing organization, such as the NHA for the CCMA, to show that a person met set standards. Licensure is granted by a state government and is legally required for certain professions.

    Why the other options are wrong

    • BNo federal law requires medical assistant certification, and licensure, where required, is not optional.
    • CCertification and licensure are different credentials issued by different bodies.
    • DThis reverses the roles of states and credentialing organizations.

19. Question 19 of 25Easy

    What is a subpoena duces tecum?

    1. AA. A patient's request to amend a record
    2. BB. An order to appear in court as a witness only
    3. CC. An order to produce records or documents
    4. DD. A form that releases a provider from liability
    Show answer to question 19

    Answer: C. An order to produce records or documents

    A subpoena duces tecum is a legal order requiring a person to bring or produce documents, such as medical records, for a legal proceeding. Offices follow their policy and often involve the privacy officer or legal counsel when responding.

    Why the other options are wrong

    • AA request to amend a record is a patient right under HIPAA, not a subpoena.
    • BAn order only to appear and testify is a different type of subpoena.
    • DA liability release is a contract matter, not a subpoena.

20. Question 20 of 25Hard

    A patient is scheduled for an in-office procedure. The provider asks the medical assistant to have the patient sign the consent form, but the patient says, 'Nobody has explained the risks to me.' What should the medical assistant do?

    1. AA. Explain the risks herself so the form can be signed
    2. BB. Have the patient sign, since the procedure is minor
    3. CC. Tell the patient the risks are listed on the form
    4. DD. Hold the form and notify the provider
    Show answer to question 20

    Answer: D. Hold the form and notify the provider

    Informed consent requires the provider to explain the procedure, its risks, benefits and alternatives and to answer questions. The medical assistant may witness a signature but should not obtain it from a patient who has not been informed, so she notifies the provider.

    Why the other options are wrong

    • AExplaining risks and obtaining informed consent is the provider's responsibility.
    • BConsent is not valid if the patient has not received the needed information.
    • CReading a form does not replace the provider's explanation and the chance to ask questions.

21. Question 21 of 25Hard

    While a medical assistant is swabbing the antecubital fossa for a routine blood draw, the patient pulls their arm back and says, 'I cannot do this today; please stop.' How should the medical assistant handle this situation?

    1. AA. Discharge the patient from the clinic without entering notes into the medical record
    2. BB. Complete the blood draw quickly because the patient previously implied consent
    3. CC. Ask a coworker to hold the patient's arm still while drawing the sample
    4. DD. Halt the procedure immediately, document the refusal, and notify the provider
    Show answer to question 21

    Answer: D. Halt the procedure immediately, document the refusal, and notify the provider

    Competent patients retain the legal right to revoke consent at any point during a procedure, even if they initially provided implied consent. Continuing to perform the procedure against the patient's wishes constitutes civil battery, so the assistant must stop, document the refusal, and inform the provider.

22. Question 22 of 25Hard

    While rooming a 4-year-old, a medical assistant notices several bruises in different stages of healing on the child's back, and the parent's explanation does not fit the injuries. What should the medical assistant do?

    1. AA. Confront the parent and demand an explanation
    2. BB. Report the concern per policy and state law
    3. CC. Ignore it unless the child says that someone hurt him
    4. DD. Wait to see if new bruises appear at the next visit
    Show answer to question 22

    Answer: B. Report the concern per policy and state law

    Health care workers are mandated reporters of suspected child abuse. Reasonable suspicion, not proof, is enough, and reports made in good faith are legally protected; the medical assistant follows the office's reporting procedure and state law.

    Why the other options are wrong

    • AConfronting the parent can put the child at greater risk and is not the reporting process.
    • CSuspicion is enough to report; a child's disclosure is not required.
    • DWaiting leaves the child at risk; reasonable suspicion now is enough to report.

23. Question 23 of 25Hard

    A competent adult patient refuses a tetanus vaccine that the provider recommended after a minor cut. What should the medical assistant do?

    1. AA. Give the vaccine anyway, since it is in the patient's best interest
    2. BB. Tell the patient the office will not treat her unless she agrees
    3. CC. Notify the provider and document the refusal in the record
    4. DD. Ask a family member to persuade the patient later in private
    Show answer to question 23

    Answer: C. Notify the provider and document the refusal in the record

    Competent adults have the right to refuse treatment. The medical assistant informs the provider, who can discuss the risks, and the refusal is documented, often with a signed refusal form per policy.

    Why the other options are wrong

    • AGiving a vaccine against a patient's refusal could be considered battery.
    • BThreatening to end care is coercive and inappropriate.
    • DInvolving family to pressure the patient disregards her decision and may breach privacy.

24. Question 24 of 25Hard

    A medical assistant's work laptop, which contains unencrypted patient information, is stolen from her car. What should she do first?

    1. AA. Report it to the privacy officer immediately
    2. BB. Wait a few days to see whether the laptop is returned
    3. CC. Contact each patient herself to explain what happened
    4. DD. Say nothing, since she did not cause the theft
    Show answer to question 24

    Answer: A. Report it to the privacy officer immediately

    Possible breaches of PHI must be reported promptly to the privacy or security officer according to policy. The organization then investigates and handles any required notifications to patients and authorities.

    Why the other options are wrong

    • BDelaying the report can worsen harm and violates breach procedures.
    • CNotifications are handled by the organization in a coordinated way, not by individual staff.
    • DStaff must report possible breaches regardless of who caused them.

25. Question 25 of 25Medium

    Which of the following is classified as an administrative safeguard under the HIPAA Security Rule?

    1. AA. Encrypting electronic protected health information stored on hard drives
    2. BB. Conducting mandatory annual privacy and security awareness training
    3. CC. Setting automatic logoff timers on clinical computer terminals
    4. DD. Installing badge-reader locks on doors leading to server rooms
    Show answer to question 25

    Answer: B. Conducting mandatory annual privacy and security awareness training

    Conducting workforce security training is an administrative safeguard, which involves managerial policies, operational processes, and training to protect health information. Data encryption and automatic logoff timers are technical safeguards, whereas badge-access doors represent physical safeguards.

Email me my score report

The full CCMA bank has 191 Medical Law and Ethics questions. See plans