HIPAA Compliance Checklist — CCMA Study Guide

Daily Tasks

[ ] Verify the screen-saver lock activates within 60 seconds on every workstation.
[ ] Confirm the printer tray contains only the charts for patients currently being seen.
[ ] Empty the fax machine of any documents waiting longer than one hour.
[ ] Sign out of every EHR session before stepping away, even for a moment.
[ ] Verify the patient identifier on every lab label before sending the specimen out.
[ ] Confirm no charts or printed schedules are visible from the patient waiting area.
[ ] Close open browser tabs that display PHI before opening a new tab in public view.
[ ] Lock the records room door at the end of the day and verify the audit log.

Weekly Tasks

[ ] Review the EHR access log for any user records pulled without a scheduled encounter.
[ ] Confirm the shred bins in every work area are emptied according to the contract.
[ ] Walk the office to look for posted schedules, sticky notes, or printouts containing PHI.
[ ] Run the HIPAA workforce training reminder for any staff member overdue on the annual module.
[ ] Verify the breach-notification contact list is current and that each contact has been tested within the year.
[ ] Audit the printer and copier hard drives for any cached documents that should be purged.
[ ] Confirm the patient portal messages have been answered within the practice's standard window.

Monthly Tasks

[ ] Run the full risk analysis required by the Security Rule and document the result.
[ ] Review every Business Associate Agreement that is up for renewal in the next 90 days.
[ ] Conduct a tabletop breach drill with the privacy officer and document the response time.
[ ] Verify the encryption status of every laptop, tablet, and removable drive in the office.
[ ] Re-train any staff member who failed the previous month's phishing simulation.
[ ] Update the workforce training log and send reminders to anyone approaching the 12-month deadline.
[ ] Confirm the policy and procedure manual reflects the current state of the office and the law.

Additional Practice Questions and Scenarios

When you encounter practice questions on this topic, apply the following framework:

1. Identify the question type — recall, application, or analysis

2. Locate the relevant rule in your notes or in the CNA blueprint

3. Eliminate obviously wrong answers — look for absolute terms (always, never), distractors with mismatched units, or procedures that violate safety

4. Select the most specific correct answer — not the most general one

5. Check your reasoning — does the answer match what you'd actually do in a real-world scenario?

Common Mistakes to Avoid

Picking the most general correct answer instead of the most specific one
Skipping the calculation or assumption verification step
Forgetting to apply safety rules (PPE, hand hygiene, isolation)
Confusing similar-sounding terms (e.g., "disinfection" vs "sterilization")
Misreading the question stem — especially negation ("EXCEPT" or "NOT")

Time Management

Plan 30-45 seconds per multiple-choice question. If you're stuck, flag for review and move on. Return to flagged questions only after answering the easier ones. Do not spend more than 90 seconds on a single question — even the most challenging exam questions should not require more than 90 seconds.

Frequently Asked Questions

Q: How do I apply this content on exam day?

A: Read the question stem carefully, identify the *most specific* correct answer, and use the rule of elimination to remove obviously wrong choices. On exam day, time management matters more than depth of knowledge — aim for 30-45 seconds per question.

Q: What if two answers both seem correct?

A: Pick the one that matches the *more specific* rule. NHA, EPA, ASCP, and NRA exam writers reward policy-precision: a more general statement might be technically true but a more specific statement is what the exam is testing.

Q: How does this topic connect to other domains on the exam?

A: Every content domain on the certification exam connects to several others. Patient care questions assume anatomy knowledge; phlebotomy questions assume infection control; HVAC questions assume refrigerant-cycle knowledge. Build cross-domain mental models as you study.

Q: How long should I spend on this subsection during my study plan?

A: Plan 60-90 minutes per subsection for first-pass reading and note-taking. Spend another 30-60 minutes on practice questions drawn from this subsection. Plan a 15-minute review pass in the week before your exam.

Q: What's the most common mistake candidates make on this topic?

A: Memorizing without understanding. The exam tests recognition of scenarios and application of rules, not word-for-word recall. Focus on understanding the *why* behind each rule and you'll be able to apply it to unfamiliar scenarios on exam day.

Q: Where can I find authoritative sources for this content?

A: The candidate handbook published by your certifying body (NHA, ASCP, NRA, EPA) is the primary reference. Secondary references include the CDC Infection Control guidelines, CLSI GP41, FDA Food Code, ASHRAE standards, and ACCA manuals.

Cross-References to Other Subsections

This topic connects to several other subsections on the certification exam. Build mental bridges between these domains as you study:

Patient-care topics connect to anatomy and physiology
Infection control connects to phlebotomy, EKG, and pharmacology
Pharmacology connects to medical terminology and law/ethics
Specimen handling connects to safety, infection control, and patient identification
Refrigerant management connects to safety, leak detection, and equipment service

How to Study This Subsection in 30 Minutes

1. Read the section once at normal pace (8-10 minutes)

2. Highlight the rules and definitions that are explicitly numbered or bolded (3-5 minutes)

3. Memorize 3-5 key facts (5-7 minutes)

4. Take 10 practice questions on this subsection, focusing on application scenarios (10-12 minutes)

5. Review the explanations on every practice question, even the ones you got right (3-5 minutes)

Common Exam Pitfalls

| Pitfall | How to avoid |

|---------|--------------|

| Reading the question stem too quickly | Slow down on the first read; identify the key verb (most appropriate, first, best) |

| Picking the most general answer | Look for the answer with the most specific qualifiers |

| Skipping the calculation step | Always verify math on dosage, conversion, or lab-value questions |

| Confusing similar terms | Build a glossary of similar-sounding terms (disinfect vs sterilize, etc.) |

| Time pressure | Practice timed exams to build exam-day pacing |

| Misreading answer choices | Read every choice before selecting; cross off the wrong ones first |

Self-Check: Do You Know These?

The three primary rules or definitions from this subsection (write them from memory)
The 3-5 most common scenarios where this knowledge is applied
The most common errors candidates make on this topic
The connections between this topic and other exam domains

If you can't answer any of these from memory, schedule another review pass on this subsection.

Practice Strategy

The most effective practice strategy for this topic is spaced repetition combined with scenario-based questions. Build a flashcard deck of the rules, then take a 10-question practice quiz every 2-3 days. Each time you get a question wrong, write down the rule you missed and review it the next day.

Practice questions should mimic the exam format: scenario stems, four answer choices, and one clearly correct answer. Avoid questions that ask for trivial recall (e.g., "What year was the Clean Air Act passed?") — the exam focuses on application and analysis.

Exam-Day Performance Tips

On exam day, your performance on this topic depends on three things:

1. Recognizing the scenario — quickly identifying that a question is testing this topic

2. Recalling the rule — pulling the right rule from memory under time pressure

3. Applying the rule — selecting the answer that matches the rule, not the most general statement

Practice each of these in your study plan. Use timed practice exams to build exam-day pacing. Use spaced repetition to improve recall. Use scenario-based questions to improve application.

Retention Strategies

Most candidates retain exam content for 2-4 weeks after initial study. To retain this content longer, use these strategies:

Spaced repetition: Review flashcards 1 day, 3 days, 7 days, 14 days, and 30 days after first encounter
Teaching: Explain the topic to a friend, study group, or even a rubber duck. If you can teach it, you know it.
Application: Connect the content to real-world scenarios (work, clinical, or personal)
Cross-referencing: Link this topic to other exam domains in your notes
Active recall: Quiz yourself without looking at the notes

The exam rewards retention over short-term memorization. Plan your study calendar to include multiple review passes on each subsection.