Documentation: Legal, Privacy, and Data Practice Questions

35 multiple-choice questions on Legal, privacy, and data for paramedic and EMT students, from Chapter 6 (Documentation). Read each question, pick your answer, then tap Show answer to check it and read the explanation.

35 practice questions

1. The patient care report is considered:

   1. A. A billing form used mainly for insurance claims
   2. B. A public record available to any requester
   3. C. An internal agency document owned by the crew
   4. D. A confidential medical record under HIPAA
   Show answer

   Answer: D. A confidential medical record under HIPAA

   It is a confidential medical record protected by HIPAA and state law. Release follows the agency's records process.

2. Requests for a copy of a patient care report from an attorney should be:

   1. A. Denied automatically to protect the agency
   2. B. Filled directly by the crew who wrote the report
   3. C. Answered verbally by the crew's supervisor
   4. D. Routed to the records custodian and counsel
   Show answer

   Answer: D. Routed to the records custodian and counsel

   Route it through the agency's records custodian and legal counsel. Never alter a record after a request arrives.

3. Retention requirements for patient care reports are set by:

   1. A. Agency preference, usually one year after the call
   2. B. Federal law, uniformly seven years nationwide
   3. C. The receiving hospital's records department
   4. D. State law and agency policy, often for years
   Show answer

   Answer: D. State law and agency policy, often for years

   Retention is often many years, and longer for minors. Destroying records early creates legal exposure.

4. Sharing a patient care report with the receiving hospital is:

   1. A. Permitted as part of treatment
   2. B. Allowed only with written authorization
   3. C. A HIPAA violation without consent
   4. D. Prohibited when sent electronically
   Show answer

   Answer: A. Permitted as part of treatment

   Treatment, payment, and operations are permitted uses.

5. Using a de-identified call for agency training is:

   1. A. A privacy violation even with names removed
   2. B. Acceptable once identifiers are removed
   3. C. Allowed only with the patient's written consent
   4. D. Prohibited for any internal training purpose
   Show answer

   Answer: B. Acceptable once identifiers are removed

   Be careful: unusual circumstances can identify a patient even without a name.

6. Documenting a higher level of service than was provided in order to increase reimbursement is:

   1. A. Health care billing fraud
   2. B. Permitted for very sick patients
   3. C. A billing department decision
   4. D. Accepted industry practice
   Show answer

   Answer: A. Health care billing fraud

   It is fraud. Bill what you documented, and document what you did.

7. Leaving a paper report or tablet unattended at the hospital is:

   1. A. Only a concern with paper charts, not tablets
   2. B. Acceptable for a few minutes during hand-off
   3. C. A risk of exposing protected information
   4. D. Standard practice in most emergency departments
   Show answer

   Answer: C. A risk of exposing protected information

   It can expose protected health information. Secure devices and lock screens.

8. The national EMS data set that agencies submit records to is:

   1. A. NFPA
   2. B. NREMT
   3. C. NEMSIS
   4. D. CAAHEP
   Show answer

   Answer: C. NEMSIS

   Consistent documentation is what makes that data usable for research.

9. Electronic patient care reporting improves data quality mainly by:

   1. A. Standardized fields and required entries
   2. B. Reducing how much training providers need
   3. C. Eliminating documentation errors entirely
   4. D. Making the narrative section unnecessary
   Show answer

   Answer: A. Standardized fields and required entries

   Standardized fields, required key entries, and legible, shareable records improve quality. The narrative still carries the story.

10. A weakness of drop-down and check box documentation is that it:

    1. A. Is too slow to complete during busy shifts
    2. B. Can look complete but show no reasoning
    3. C. Prevents corrections once it is entered
    4. D. Cannot be audited once it is submitted
    Show answer

    Answer: B. Can look complete but show no reasoning

    That is why the narrative remains essential.

11. The patient care report is a legal document because it:

    1. A. It carries the provider's signature
    2. B. It is evidence of what occurred
    3. C. It is kept confidential under HIPAA
    4. D. It is stored in an electronic system
    Show answer

    Answer: B. It is evidence of what occurred

    It serves as evidence of what occurred and may be used in court. Treat every report that way.

12. The report may be subpoenaed in:

    1. A. Only civil cases, never criminal prosecutions
    2. B. Malpractice, criminal, and many other cases
    3. C. Only criminal cases involving the patient
    4. D. Only malpractice cases against the crew members
    Show answer

    Answer: B. Malpractice, criminal, and many other cases

    It may be subpoenaed in malpractice, criminal, insurance, workers' compensation, and other proceedings. Many parties may need it.

13. Providing a copy of the report to the patient requires:

    1. A. A proper request through the agency process
    2. B. A court order, since the record is protected
    3. C. Approval from the patient's own physician
    4. D. Nothing; the crew can simply hand a copy over
    Show answer

    Answer: A. A proper request through the agency process

    The patient is entitled to it; HIPAA grants access rights.

14. Providing a copy to a family member requires:

    1. A. Patient authorization or legal authority
    2. B. A court order in every single circumstance
    3. C. A phone call confirming the relationship
    4. D. Nothing, as long as they are next of kin
    Show answer

    Answer: A. Patient authorization or legal authority

    Legal authority includes a health care proxy. Family does not automatically have access.

15. Providing a copy to law enforcement:

    1. A. Is always permitted for an active investigation
    2. B. Always requires the patient's written consent
    3. C. Depends on state law, request type, and policy
    4. D. Is never permitted without a signed court order
    Show answer

    Answer: C. Depends on state law, request type, and policy

    Route the request through the records custodian.

16. Reports should be stored:

    1. A. In any cabinet at the station for convenience
    2. B. In the ambulance for quick crew reference
    3. C. At home if the provider finishes them there
    4. D. Securely, with access limited by role
    Show answer

    Answer: D. Securely, with access limited by role

    Access should be limited to authorized personnel, with physical and electronic security.

17. Paper reports left in a vehicle overnight:

    1. A. Are secure because the vehicle is locked
    2. B. Are standard practice between back-to-back shifts
    3. C. Are fine as long as the station bay is closed
    4. D. Risk unauthorized access and must be secured
    Show answer

    Answer: D. Risk unauthorized access and must be secured

    Secure them per policy. Vehicles are broken into.

18. Electronic devices used for documentation should be:

    1. A. Available for personal tasks between calls
    2. B. Locked when taken outside the ambulance
    3. C. Encrypted, with one login shared by the crew
    4. D. Password protected, encrypted, and attended
    Show answer

    Answer: D. Password protected, encrypted, and attended

    They should never be left unattended. Lost devices are breaches. A device left unlocked inside the ambulance is still exposed, and a shared login defeats the audit trail that shows who viewed or changed a record.

19. Taking a photo of a report with a personal phone:

    1. A. Is convenient and allowed for your records
    2. B. Creates an unsecured copy of patient data
    3. C. Is permitted if the photo is deleted later
    4. D. Is allowed if the phone is passcode locked
    Show answer

    Answer: B. Creates an unsecured copy of patient data

    It creates an unsecured copy of protected information. Personal devices are a leading breach source. A passcode does not make a personal phone an approved, secured system for patient data.

20. Data submitted to NEMSIS is:

    1. A. Optional for EMS agencies in most states
    2. B. Fully identifiable for patient follow-up
    3. C. De-identified for national aggregation
    4. D. Public, with names available on request
    Show answer

    Answer: C. De-identified for national aggregation

    Identifiers are removed.

21. NEMSIS compliance affects:

    1. A. Data quality, state reporting, and funding
    2. B. Nothing beyond the software vendor's contract
    3. C. Only billing and Medicare reimbursement rates
    4. D. Only national research projects using the data
    Show answer

    Answer: A. Data quality, state reporting, and funding

    It affects data quality, state reporting, and eligibility for some funding. Software must meet the standard.

22. State EMS data systems use patient care reports to:

    1. A. Bill insurers for state-funded transports
    2. B. Build continuing education schedules for agencies
    3. C. Discipline individual providers for poor charting
    4. D. Monitor performance and public health trends
    Show answer

    Answer: D. Monitor performance and public health trends

    They monitor system performance and public health trends. Data submission is often required.

23. Data validation rules in electronic systems:

    1. A. Catch missing or impossible values
    2. B. Are optional settings most agencies disable
    3. C. Replace the need for any human review
    4. D. Slow documentation without adding value
    Show answer

    Answer: A. Catch missing or impossible values

    They catch errors before submission; a heart rate of 500 is flagged.

24. Linking EMS records to hospital outcomes:

    1. A. Violates HIPAA even with data agreements
    2. B. Is impossible under current privacy law
    3. C. Allows evaluation of prehospital care
    4. D. Is done only to reconcile billing claims
    Show answer

    Answer: C. Allows evaluation of prehospital care

    It allows evaluation of prehospital care effectiveness. Data agreements enable it.

25. Your agency's general retention period for PCRs is 7 years. A report for a 4-year-old patient reaches that age. What should you consider before destroying it?

    1. A. It can be destroyed, since the general period has passed
    2. B. Pediatric records may be destroyed earlier than adult records
    3. C. Many states require keeping minors' records until a set age past majority
    4. D. Retention rules apply only to paper, not electronic, reports
    Show answer

    Answer: C. Many states require keeping minors' records until a set age past majority

    Retention is set by state law and agency policy. Many states keep minors' records longer, often until a set number of years after the patient turns 18, because a minor's time to file a claim usually doesn't start until majority. Destroying a record early can break the law and count as destroying evidence. Retention rules apply to electronic records too.

26. Destroying reports before the retention period ends:

    1. A. Saves space and is routine housekeeping
    2. B. Is routine once a patient is discharged
    3. C. Violates law and destroys evidence
    4. D. Is permitted once records are digitized
    Show answer

    Answer: C. Violates law and destroys evidence

    This is spoliation.

27. You want to present an interesting STEMI call at a regional conference. Which version is appropriate?

    1. A. The full PCR, since the audience is all health care workers
    2. B. The PCR with only the patient's name blacked out
    3. C. Scene photos, since they show no medical information
    4. D. A case with name, dates, address, and unique details removed
    Show answer

    Answer: D. A case with name, dates, address, and unique details removed

    Educational use outside treatment requires de-identification: names, dates, locations, and any detail that could identify the patient must be removed, unless the patient authorizes the use. A health care audience doesn't make disclosure permissible. Removing the name alone leaves other identifiers. Scene photos can identify people and places.

28. A report requested for a quality review by the medical director:

    1. A. Is permitted under health care operations
    2. B. Requires a court order or subpoena
    3. C. Is prohibited without a privacy waiver
    4. D. Requires the patient's written consent
    Show answer

    Answer: A. Is permitted under health care operations

    Oversight is a permitted use.

29. A supervisor suggests adding "possible cardiac" to BLS transports so they bill at the ALS level. What is the most appropriate response?

    1. A. Add it only when the patient is older and has heart history
    2. B. Add it, since the supervisor takes responsibility for it
    3. C. Decline and report it through compliance as billing fraud
    4. D. Add it, since it is only a field impression, not a diagnosis
    Show answer

    Answer: C. Decline and report it through compliance as billing fraud

    Documenting a condition or level of service that didn't exist in order to raise reimbursement is upcoding. It is health care fraud, and federal programs can prosecute it under the False Claims Act. Each provider who signs a report is accountable for it, whatever a supervisor says. Compliance programs and whistleblower protections exist for exactly this situation.

30. Upcoding refers to:

    1. A. Correcting a coding error after submission
    2. B. Coding a call correctly after an audit
    3. C. Lowering the billed level to avoid denials
    4. D. Billing a higher level than was provided
    Show answer

    Answer: D. Billing a higher level than was provided

    Documenting or billing a higher level of service than provided is fraud.

31. Documenting medical necessity for transport means:

    1. A. Why an ambulance rather than another means
    2. B. Stating that a transport took place and when
    3. C. Listing the hospital the patient asked to go to
    4. D. Noting that the patient requested an ambulance
    Show answer

    Answer: A. Why an ambulance rather than another means

    Describe why ambulance transport was required rather than another means. Payers require it.

32. The False Claims Act allows:

    1. A. Only the government to sue, never individuals
    2. B. Agencies to sue insurers for unpaid claims
    3. C. Whistleblowers to sue and share in recovery
    4. D. Only patients to sue agencies for overbilling
    Show answer

    Answer: C. Whistleblowers to sue and share in recovery

    Whistleblowers can report fraud and share in the recovery. Employees have reported EMS fraud.

33. Signing a report you did not write:

    1. A. Is required for the attending paramedic
    2. B. Is standard when the crew agrees on care
    3. C. Is efficient when your partner is busy
    4. D. Certifies content you cannot vouch for
    Show answer

    Answer: D. Certifies content you cannot vouch for

    It certifies content you may not know is accurate and should be avoided. Each provider documents their own care.

34. The most important data quality factor is:

    1. A. Annual documentation training for all staff
    2. B. Validation rules that block incorrect entries
    3. C. Software with the newest validation features
    4. D. Accurate, complete entry by the provider
    Show answer

    Answer: D. Accurate, complete entry by the provider

    Accurate, complete entry at the point of care matters most. Garbage in, garbage out.

35. Which best describes the paramedic's relationship to EMS data?

    1. A. Every report is a data point shaping decisions
    2. B. Data matters only for billing and revenue
    3. C. Data is the job of the quality department
    4. D. Only supervisors use the data collected
    Show answer

    Answer: A. Every report is a data point shaping decisions

    Every report shapes system decisions and research. You are the data source.