NP Technology & Digital Applications 4 — Questions and Answers
Question 1: A large healthcare system experiences a ransomware attack that encrypts EHR data. According to HIPAA Breach Notification Rule, when must affected patients be notified?
- Within 24 hours of discovery
- Within 60 calendar days of discovering the breach (Correct answer)
- Only if the breach is reported in local news
- Notification is optional if data is recovered within 30 days
Correct answer: Within 60 calendar days of discovering the breach
HIPAA requires covered entities to notify affected individuals within 60 calendar days of discovering a breach of unsecured PHI, regardless of whether data is recovered.
Question 2: Which of the following BEST describes the purpose of a Continuity of Care Document (CCD) in health information exchange?
- A document used to process insurance claims
- A standardized summary of a patient's key health information used to facilitate care transitions between providers (Correct answer)
- A legal consent form for sharing medical records
- A template for writing referral letters
Correct answer: A standardized summary of a patient's key health information used to facilitate care transitions between providers
A CCD is a standardized, structured document (based on HL7 CDA) that summarizes a patient's health history to support safe and informed care transitions.
Question 3: A nurse practitioner is implementing population health management using EHR data. Which feature would MOST effectively identify patients overdue for colorectal cancer screening?
- Free-text search of all progress notes
- A registry-based report querying structured data fields for age, diagnosis codes, and last colonoscopy date (Correct answer)
- Manual chart review by the front desk team
- Reviewing only patients with upcoming appointments
Correct answer: A registry-based report querying structured data fields for age, diagnosis codes, and last colonoscopy date
Registry-based reports leverage structured EHR data to systematically identify care gaps across entire patient panels, enabling proactive outreach.
Question 4: An NP prescribes a controlled substance using an Electronic Prescribing for Controlled Substances (EPCS) system. Which security feature is specifically REQUIRED by DEA regulations for EPCS?
- A single-factor username/password login
- Two-factor authentication using at least two of: something you know, something you have, or something you are (Correct answer)
- Biometric login only
- A paper backup copy of each EPCS prescription
Correct answer: Two-factor authentication using at least two of: something you know, something you have, or something you are
DEA EPCS regulations mandate two-factor authentication combining at least two identity factors to prevent unauthorized prescribing of controlled substances.
Question 5: A patient uses a diabetes management app that integrates with the EHR via FHIR APIs. The patient withdraws consent for data sharing. What is the MOST appropriate response?
- Continue receiving data since it has clinical value
- Revoke API access permissions and document the patient's withdrawal of consent in the EHR (Correct answer)
- Archive the data but continue passive monitoring
- Refer the patient to a specialist who uses the same app
Correct answer: Revoke API access permissions and document the patient's withdrawal of consent in the EHR
Patient autonomy requires honoring withdrawal of consent; the provider must revoke access, stop data flow, and document the decision as part of the patient record.
Question 6: Which of the following BEST demonstrates meaningful use of a clinical decision support tool in NP practice?
- Installing the tool and ignoring its recommendations
- Consistently reviewing relevant alerts, applying evidence-based guidance, documenting clinical reasoning, and auditing alert override rates (Correct answer)
- Customizing the tool to suppress all low-priority alerts immediately
- Using the tool only for billing code suggestions
Correct answer: Consistently reviewing relevant alerts, applying evidence-based guidance, documenting clinical reasoning, and auditing alert override rates
Meaningful use of CDSS involves active engagement with alerts, evidence-based decision-making, documentation, and quality improvement through override rate monitoring.
Question 7: A chronic pain patient reports using a pain-tracking app that logs 10 data points daily. When the patient shares 6 months of data before an appointment, what is the MOST effective way for the NP to use this information?
- Print all raw data and file it in the chart without review
- Review trend summaries and patterns collaboratively with the patient to inform treatment adjustments and goal-setting (Correct answer)
- Discard the data to avoid information overload
- Use it exclusively to justify or deny opioid prescriptions
Correct answer: Review trend summaries and patterns collaboratively with the patient to inform treatment adjustments and goal-setting
Digital patient-generated health data is most valuable when reviewed as trends, integrated into shared decision-making, and used to personalize treatment plans.
NP Technology & Digital Applications 4
A large healthcare system experiences a ransomware attack that encrypts EHR data.
According to HIPAA Breach Notification Rule, when must affected patients be notified?