CET NHA Certified EKG Technician - Set 1 - Part 1

Correct Answer: The HIPAA Privacy Rule

The Privacy Rule grants patients the right to receive a Notice of Privacy Practices, which describes how a covered entity may use and disclose their information. Posting this notice satisfies that legal requirement directly. Option b is incorrect because the OSHA Bloodborne Pathogens Standard regulates worker safety around blood exposure, not patient information sharing. A waiting room notice about privacy would have no role under a standard focused on needles and PPE. Option c is incorrect because the HITECH Act funded incentives to push providers toward electronic record adoption, with privacy strengthening as one part. A notice about general privacy use, however, is required by the original Privacy Rule, not the HITECH program. Option d is incorrect because the Security Rule applies to electronic protected health information and demands safeguards like access controls and encryption. A printed lobby notice that describes how data may be shared falls outside that technical and electr

Correct Answer: Patient email address

Email addresses appear on the HIPAA list of eighteen identifiers because they link directly to one person. Recognizing this identifier helps a technician avoid casually leaving emails on shared screens or in unprotected messages. Option a is incorrect because eye color is a physical descriptor used on ID cards but does not appear on the regulatory list of eighteen identifiers. Treating it as protected information would misapply the rule and confuse what truly needs safeguarding. Option b is incorrect because height records a clinical measurement that, by itself, cannot single out a person. The HIPAA identifier list focuses on data that links records to one individual, and a height value does not do that alone. Option d is incorrect because blood type is a clinical lab result shared among millions of people and lacks the uniqueness HIPAA's identifier list requires. Lab values gain protection through the chart they sit in, not as identifiers themselves.

Correct Answer: The minimum necessary standard

The minimum necessary standard requires covered entities to share only the smallest amount of protected information needed to accomplish a task such as a billing request. Insurers receive what billing needs, not the entire chart. Option a is incorrect because the Breach Notification Rule activates only after unsecured information has been compromised. It does not shape how much information is shared in a normal billing transmission that never went wrong in the first place. Option b is incorrect because the right to amend lets patients correct mistakes in their own record, which is a power they exercise after reviewing it. That power neither restricts nor expands what an insurer receives during routine billing. Option c is incorrect because the Enforcement Rule sets the penalty tiers that the Office for Civil Rights uses after a violation is found. Penalty schedules describe consequences and do not directly cap the volume of information shared during normal operations.

Correct Answer: Physical safeguard breach

Physical safeguards include controls over workstations, devices, media, and printouts, all of which protect tangible patient information from unauthorized eyes. An EKG tracing left in a hallway represents a direct failure of these physical safeguards. Option a is incorrect because administrative safeguards describe written policies, training, security officer roles, and similar planning activities. A physical printout left unattended is a hands-on failure that no written policy alone can directly cause. Option c is incorrect because privacy authorization refers to a patient's written permission for specific uses of their information. The exposed tracing was never about whether the patient signed a form, only about who could see what was printed. Option d is incorrect because the Breach Notification Rule sets reporting duties triggered after a breach exposes unsecured information. The technician's discovery may eventually require notification, but it does not name which catego

Correct Answer: The Omnibus Final Rule

The Omnibus Final Rule extended HIPAA obligations to business associates by making them directly liable for breaches and impermissible uses. Vendors like billing companies and transcription services fall under this expanded reach. Option b is incorrect because the Privacy Rule established the original baseline for how covered entities use and disclose information. While powerful, it did not impose direct liability on outside vendors until a later amendment broadened that scope. Option c is incorrect because the Enforcement Rule defines investigation procedures and penalty tiers that the Office for Civil Rights applies. Procedures for handling violations are not the same as adding a brand new class of regulated parties. Option d is incorrect because the Security Rule focuses on technical safeguards for electronic protected health information, such as encryption and access controls. Technical safeguards for data do not address who is regulated, only how the data must be protected.

Correct Answer: Direct her to the ordering physician

An EKG technician does not interpret results or share them with family members, even with good intentions. Sending the daughter to the ordering physician keeps the disclosure with the licensed clinician who is authorized to discuss findings. Option a is incorrect because handing a printed tracing to a family member transfers a piece of the medical record without authorization. The technician has no order, no consent on file, and no role to make that disclosure decision. Option b is incorrect because summarizing visible findings crosses into interpretation, which sits outside the technician's scope. Even a brief verbal description shapes the daughter's understanding in a way only a licensed clinician should be doing. Option d is incorrect because photographing tracings on a personal device captures protected information onto unsecured technology. Sending such a photo by text adds an unencrypted transmission to the violation, layering one breach on top of another.

Correct Answer: Lock the screen and notify the coworker

Locking the unattended screen stops anyone walking by from viewing patient records and prompts the coworker to take responsibility for her own session. A quick, polite notification reinforces good practice without escalating the issue unnecessarily. Option a is incorrect because charting under another technician's login attaches every entry to the wrong user in the audit trail. Audit trails are how facilities trace accountability, and crossing them turns one moment of convenience into a documentation problem. Option b is incorrect because printing a chart that the coworker had open creates more paper protected information to manage and does nothing to secure the screen still showing names. The exposure problem grows rather than shrinks with this choice. Option c is incorrect because reading another patient's chart without a treating role is unauthorized access, even when phrased as helpful. Curiosity is a banned reason to open a record, no matter how good the intent feels in

Correct Answer: Report the disclosure to a supervisor

Reporting the disclosure to a supervisor places the incident with the person who can investigate, document, and escalate the issue through the privacy officer. Quiet, proper escalation is the appropriate response to a witnessed HIPAA violation. Option b is incorrect because joining the conversation adds another voice to a disclosure that should never have happened, and a clarification still references the patient by name. Two voices sharing information do not make the disclosure any less wrong. Option c is incorrect because the personal nature of a break does not erase the work nature of the information. Patient names and diagnoses keep their protection no matter where the speaker happens to be sitting at the time. Option d is incorrect because a loud confrontation in a public space draws more attention to the patient's information and may expose it to bystanders. Public correction creates a second disclosure on top of the first one.

Correct Answer: The minimum necessary access rule

Looking up a chart without a treating relationship breaks the minimum necessary access rule because the technicians had no legitimate purpose that required them to view that information. Curiosity is never a permitted reason to open a record. Option a is incorrect because the Breach Notification Rule kicks in after an unauthorized access has been discovered and a breach confirmed. It defines reporting timelines rather than the original boundary the technicians crossed when they opened the file. Option b is incorrect because penalty caps describe the maximum fine amounts the Office for Civil Rights can assess for repeated violations of the same type. Caps describe consequences after the fact and do not define what the technicians did wrong. Option d is incorrect because the Notice of Privacy Practices is a document handed to patients explaining how a facility uses their information. This patient-facing document cannot be the rule that staff members violated by opening someone's cha

Correct Answer: Close the curtain, speak low, minimize traffic

Reasonable safeguards in a setting where some incidental sound is unavoidable include closing the curtain fully, keeping the voice low, and limiting people moving through. Incidental disclosures that occur despite reasonable safeguards are permitted under the Privacy Rule. Option a is incorrect because refusing care over an imperfect physical layout delays a diagnostic test the ordering clinician judged necessary. The HIPAA rule never demands silence or a sealed room, only that reasonable steps to reduce exposure be taken. Option c is incorrect because postponing the test for a private room may worsen care when the indication is urgent and the curtain provides acceptable privacy. The standard asks for reasonable safeguards, not for perfect rooms to be available. Option d is incorrect because loud discussion of results spreads information beyond the care team and turns a manageable layout into an actual breach. Loud results-sharing takes a permitted setting and creates an avoidable disc

Correct Answer: The right to access her own records

Patients have the right to access their own protected health information and receive copies in the form they request when readily producible. This right lets the patient take her cardiac record to her new cardiologist directly. Option a is incorrect because confidential communication addresses how a facility contacts a patient, such as choosing a cell over a home line. This right does not describe how the patient obtains a stored copy of her own record. Option b is incorrect because the right to request restrictions lets a patient ask the facility to limit certain disclosures, which it may but is usually not required to honor. Limiting disclosures is a different question from receiving a personal copy. Option c is incorrect because filing a privacy complaint is a remedy pursued after a patient believes a violation has occurred. A complaint mechanism is not the path used by a patient simply asking for her own record to take elsewhere.

Correct Answer: Implied consent through cooperation

A noninvasive routine EKG generally does not require a separate written form, and the patient's voluntary cooperation in lying down and exposing the chest counts as implied consent. The cooperation itself signals agreement to a low-risk procedure. Option b is incorrect because express written consent is reserved for higher-risk procedures with significant complications, such as surgery or invasive cardiac catheterization. A standard surface tracing does not meet the risk threshold that triggers a formal signed document. Option c is incorrect because emergency consent is invoked when a patient cannot communicate and immediate intervention is needed to prevent harm. A routine EKG with a conversational patient lying calmly on the table has neither of those conditions present. Option d is incorrect because informed consent for surgery is a formal process where a surgeon explains risks, benefits, alternatives, and refusal rights before a major operation. None of that applies to a brief

Correct Answer: Acknowledge, notify the physician, document

Patients have the right to refuse any procedure, even after consenting earlier in the encounter. The technician should respectfully acknowledge the refusal, notify the ordering physician so care can be re-planned, and document the refusal in the medical record. Option a is incorrect because insisting on a procedure after a competent patient has refused crosses into coercion, which violates autonomy. Pressure tactics can result in serious disciplinary and legal consequences for the technician involved. Option b is incorrect because applying electrodes despite a clear refusal is treatment without consent, which is legally classified as battery. Going ahead with a procedure the patient declined produces real liability regardless of how routine the test seems. Option d is incorrect because the technician has no authority to discharge a patient or promise that the encounter will leave no documentation. Care decisions and discharge orders belong to the ordering clinician, not to the technici

Correct Answer: Leave the object in place and proceed

Respecting cultural and religious practices is part of patient-centered care, and the object does not interfere with any electrode placement. Leaving it where it is allows the test to proceed with full respect for the patient's preferences and beliefs. Option a is incorrect because firmly removing a religious item without asking dismisses the patient's beliefs and may cause distress during what should be a calm test. Respect for religion and dignity is built into the basic ethical standards. Option c is incorrect because canceling a clinically indicated test over a small object that interferes with nothing wastes time and may delay care. There is no clinical justification to involve family for a routine recording the patient consents to. Option d is incorrect because placing electrodes on top of any object disrupts the gel-to-skin contact and produces artifact in those leads. The signal becomes unreliable, so the workaround would hurt the diagnostic value of the recording.

Correct Answer: Request a qualified medical interpreter

Qualified medical interpreters reduce errors, protect family dynamics, and meet the legal duty to communicate clearly with patients of limited English proficiency. A family member, especially a child, is generally avoided when accuracy and impartiality matter. Option a is incorrect because using a teenager to translate places a child in the middle of a parent's medical decision and risks softened or filtered language about clinical risks. Family translators also have no training in medical terminology or boundaries. Option b is incorrect because skipping consent paperwork removes the legal documentation that the procedure was authorized. The communication barrier must be solved, not avoided, since the parent still has the right to understand what the test involves. Option c is incorrect because an untrained coworker who happens to speak the language has no certification in medical interpretation and may mistranslate technical terms. Convenient bilingual staff cannot stand in for a

Correct Answer: The chain of infection

The chain of infection names six links, including agent, reservoir, portal of exit, transmission, portal of entry, and susceptible host, that all must connect for spread to occur. Breaking any link prevents transmission and guides infection control choices. Option b is incorrect because the Bloodborne Pathogens Standard is the OSHA regulation requiring employer programs for blood exposure protection. The standard sets workplace duties rather than describing how infections move through the six environmental steps in question. Option c is incorrect because standard precautions are the practical actions taken at every patient encounter, like hand hygiene and PPE use. The action list is built on the chain of infection but is not the sequence itself. Option d is incorrect because the Spaulding classification ranks equipment as critical, semi-critical, or non-critical based on where the equipment contacts the body. Spaulding guides cleaning intensity for items rather than describing how orga

Correct Answer: The Bloodborne Pathogens Standard

The Bloodborne Pathogens Standard requires a written exposure control plan, universal precautions, engineering controls, work practice controls, free hepatitis B vaccination for at-risk staff, and post-exposure follow-up. These provisions speak directly to blood exposure risks. Option a is incorrect because the Hazard Communication Standard governs how chemicals in the workplace are labeled and documented with safety data sheets. Labeling rules for chemicals do not address blood exposures, vaccination offers, or exposure control plans. Option b is incorrect because the General PPE Standard sets baseline rules about selecting and providing protective equipment for many hazards. General PPE rules do not include the specific exposure control plan or hepatitis B vaccination program tied to blood-borne risks. Option d is incorrect because the Respiratory Protection Standard governs respirator fit testing and use, including N-95s for airborne hazards. Respirator rules cover inhalation risks,

Correct Answer: All body fluids except sweat

Standard precautions treat blood, all body fluids and secretions except sweat, non-intact skin, and mucous membranes as potentially infectious. Sweat is the only excretion left off the list, which the technician should remember at every encounter. Option a is incorrect because older universal precautions focused on blood and a narrow set of fluids, but standard precautions expanded that scope substantially. Limiting protection to blood alone would leave gaps the modern framework deliberately closes. Option b is incorrect because saliva is included on the list while sweat is excluded, so pairing them does not reflect the rule. The framework draws a clear line that puts saliva with the protected fluids and leaves sweat outside. Option c is incorrect because sweat is the only commonly named fluid that escapes the standard precautions list. Choosing sweat as the included substance reverses the actual rule and would mislead staff about which fluids warrant precautions.

Correct Answer: Surgical mask within close range

Droplet precautions call for a surgical mask within six feet of the patient or upon room entry because large respiratory droplets travel short distances. A surgical mask blocks those droplets without requiring the higher protection a fit-tested respirator provides. Option a is incorrect because an N-95 respirator with annual fit testing is reserved for airborne precautions with small particle nuclei. Influenza droplets are larger and fall to the ground quickly, making a surgical mask the matched choice. Option c is incorrect because gowning alone does nothing to block droplets that land on the technician's mouth, nose, or eyes during patient care. A gown without a mask leaves the very pathway that droplets use to spread between people. Option d is incorrect because a powered air purifying respirator is reserved for high-risk procedures or when respirator fit fails. Pulling the highest level of protection for routine droplet care wastes resources and adds bulk to the visit.

Correct Answer: Negative pressure room and fitted N-95

Tuberculosis spreads on small particle nuclei that stay suspended in air, so airborne precautions require a negative pressure airborne infection isolation room and a fit-tested N-95 respirator for every person who enters. Both conditions together protect against inhalation. Option b is incorrect because positive pressure rooms push air outward and are used for the reverse purpose of protecting an immunocompromised patient from the environment. Using positive pressure for tuberculosis would push infectious air toward the hallway and worsen exposure. Option c is incorrect because a standard room without negative pressure allows airborne particles to escape into corridors and other patient areas. A contact gown also addresses physical surface transmission, not the inhalation pathway tuberculosis uses to spread between people. Option d is incorrect because cohort rooms group similar contact-precaution patients, while gloves alone protect only against surface transfer. Neither feature addre