Which disclosure of PHI is permitted without the patient's written authorization?

Reporting a measles case to the health department

Sending psychotherapy notes to the patient's insurer

Giving a drug company a list of patients for marketing

Releasing test results to the patient's employer

An MA finds an error in a paper chart entry she made yesterday. How should she correct it?

Draw one line, write "error," initial and date

Black out the entry fully and rewrite it

Cover it with correction fluid and then rewrite it

Remove the page and rewrite the whole note

A patient asks the office to call her only on her cell phone and never on her home line. Under HIPAA, which patient right is she using?

Restriction of certain disclosures

Which action would be a breach of patient confidentiality?

Discussing a patient with a coworker not on their care

Giving records to an insurer with valid authorization

Sharing results with a specialist on the care team

Discussing care options with the provider in a private room

Study guide · category 12 of 12

Medical law and ethics for the CCMA exam

Scope, consent, HIPAA, malpractice, mandatory reporting and charting: six topics carry the whole medical law and ethics domain of the CCMA, and scope comes first. Start with the can/can't map below.

scored items: 7
of the test plan: 4.7%
of malpractice: 4 Ds

Practice free here Get the CCMA app

§01

What an MA can and cannot do

Supervision covers delegated tasks. It never turns them into licensed acts.

Delegated tasks still depend on state law and employer policy
Task	Medical assistant (delegated, supervised)	Licensed provider
Take vitals and a history	Yes	Yes
Give an injection or immunization per order	Yes	Yes
Draw blood, run an EKG	Yes	Yes
Reinforce education the provider gave	Yes	Yes
Witness a consent signature	Yes	Yes
Obtain informed consent	No	Yes
Diagnose	No	Yes
Prescribe or renew a prescription	No	Yes
Interpret test results for the patient	No	Yes
Advise a caller on medications independently	No	Yes

Highlighted rows are where the two differ.

Medical Law and Ethics is Domain 7 of the 2022 test plan: 7 of the 150 scored items, the smallest of the seven domains. It reaches further than its weight, because scope decides the key in many care-coordination and communication scenarios too. An MA is unlicensed and works under a provider's delegation; the full line is drawn on MA scope of practice, and whether the credential is a license at all is answered on is CCMA a license.

§02

Consent and advance directives

Who obtains it and how it was given are separate questions.

Informed consent: The provider explains the diagnosis, the treatment, its risks and benefits, and the alternatives. The MA may witness the signature but doesn't obtain it.
Implied consent: Shown by conduct, such as rolling up a sleeve for a blood pressure, or presumed in an emergency.
Expressed consent: Given out loud or in writing.
Minors: A parent or guardian consents, except for emancipated or mature minors and certain services set by state law.
Refusal: A competent adult may refuse. Don't proceed; document the refusal and tell the provider.
Living will: States which treatments the patient wants or refuses if they can't decide.
Healthcare proxy: Also called durable power of attorney for healthcare: names the person who decides for the patient.
DNR and POLST: Orders about resuscitation and life-sustaining treatment.

§03

Malpractice needs all four Ds

Remove any one D and there is no malpractice case.

Duty
A provider–patient relationship existed.
Dereliction
The standard of care was breached: something was done, or left undone, that a reasonable professional would not have.
Direct cause
That breach caused the harm.
Damages
The patient suffered actual harm or loss.

Negligence is a failure of reasonable care; malpractice is negligence by a professional. Under respondeat superior the employer answers for an employee's acts within the job. Assault is a threat of unwanted touching and battery is the touching itself. Libel is written defamation; slander is spoken.

§04

HIPAA, piece by piece

Privacy covers all PHI. Security covers only the electronic kind.

Piece	What it means for the exam
Covered entities	Health plans, clearinghouses and providers who transmit health information electronically
Business associates	Outside companies handling PHI for a covered entity, bound by a business associate agreement
PHI	Individually identifiable health information (18 identifiers), in any form
Privacy Rule	Protects PHI on paper, spoken aloud and in electronic form
Security Rule	Administrative, physical and technical safeguards for ePHI only
Minimum necessary	Share only what the purpose needs. Doesn't apply to treatment disclosures, disclosures to the patient, authorized ones or those required by law
TPO	Treatment, payment and operations disclosures need no authorization
Authorization needed	Marketing, sale of PHI, psychotherapy notes
Patient rights	Access and copies, amendment, an accounting of disclosures, restrictions, confidential communications, the notice of privacy practices, a complaint to OCR
Breach	Affected patients are notified within 60 days. HHS is told about every breach: within 60 days when 500 or more people are affected, otherwise in a yearly report. Local media too when more than 500 residents of one state are affected
Enforcement	HHS Office for Civil Rights. HITECH (2009) strengthened HIPAA and pushed EHR adoption

HIPAA dates from 1996.

§05

Ethics principles with a one-line test

Name the principle by the question it answers.

Principle	Ask yourself
Autonomy	Is the patient's own choice being respected?
Beneficence	Does this do the patient good?
Nonmaleficence	Could this harm the patient?
Justice	Is care fair and equal, whatever the patient's means?
Fidelity and veracity	Am I keeping promises and telling the truth?
Confidentiality	Is the information going only where it should?

§06

Charting, the legal record

Not documented means not done.

The chart is a legal document: record what you did, saw and were told, with date and time.
To fix an error, draw one line through it, write error, then initial and date it. The original stays readable.
Never erase, use correction fluid or write over an entry.
An incident report is a risk-management document. File it separately; the chart doesn't mention it.
A patient's refusal is charted, along with the fact that the provider was told.

§07

Reading a law-and-ethics stem

Find the legal question hiding inside the office story.

Most items here are short office stories with a legal question inside: someone wants information, someone refuses, someone made a mistake, someone was hurt. Name the category first (scope, consent, privacy, tort, reporting or charting) and the options shrink to one or two. The distractors are often real laws or real principles that govern something else, such as a federal law that sounds close but covers employment or genetics, so the right name matters more than a vague sense of what is fair.

Your score report gives each domain a band of Above, Near or Below the passing standard, and shows N/A only for a content area with five questions or fewer. With 7 scored items, law and ethics gets a band, so a weak result here is visible and worth fixing before a retake. How scoring works is on the CCMA passing score page.

§08

Law and ethics drill

Scope, consent, HIPAA, torts, reporting, ethics and charting.

Two questions sort most of these: is this inside MA scope, and does this disclosure need the patient's authorization?

0 of 15 answered · 0 right

Question 1
A patient clearly refuses an ordered injection, but the MA gives it anyway. Which legal wrong has occurred?
Answer & explanation
Answer: D. Battery
Battery is touching a person without consent, and giving an injection after a clear refusal is exactly that. Assault is the threat or fear of harmful contact, the common mix-up because the terms are paired. Negligence is failure to use reasonable care, not intentional unconsented touching, and slander is spoken defamation.
- Assault is the threat or fear of harmful contact; here the contact actually happened.
- Negligence is careless failure of reasonable care, not deliberately touching someone who refused.
- Slander is spoken defamation that harms reputation and has nothing to do with an injection.
- Correct: an injection after a clear refusal is touching without consent — battery.
Question 2
Which disclosure of PHI is permitted without the patient's written authorization?
Answer & explanation
Answer: D. Reporting a measles case to the health department
Reporting a notifiable disease such as measles is a public-health disclosure required by law, so no authorization is needed. Marketing uses and psychotherapy notes are the classic cases that always require written authorization, even though marketing may seem like routine business. Employers have no right to PHI without the patient's authorization.
- Psychotherapy notes need specific written authorization, even when the request comes from an insurer.
- Marketing uses always require written authorization; selling patient lists is never routine business.
- Employers have no right to PHI without the patient's signed authorization.
- Correct: reporting a notifiable disease is a public-health disclosure required by law, so no authorization is needed.
Question 3
Under HIPAA, which safeguard category covers electronic protected health information (ePHI)?
Answer & explanation
Answer: D. The Security Rule
The HIPAA Security Rule sets the administrative, physical, and technical safeguards specifically for ePHI. The Privacy Rule covers all PHI in any form, minimum necessary limits how much is used, and breach notification governs reporting after a breach.
- The Breach Notification Rule governs reporting after a breach, not ongoing safeguards.
- Minimum necessary limits how much PHI is used or shared; it is not a safeguards rule.
- The tempting choice: the Privacy Rule covers PHI in every form, not ePHI safeguards specifically.
- Correct: the Security Rule sets administrative, physical and technical safeguards for ePHI only.
Question 4
Which legal document names another person to make medical decisions for a patient who can no longer make them?
Answer & explanation
Answer: B. Healthcare proxy
A healthcare proxy (durable power of attorney for health care) appoints a person to decide for the patient if the patient becomes incapacitated. A living will states the patient's own treatment wishes but does not name a decision-maker, which is why it is the common confusion. A DNR order is a provider's order about CPR only, and an informed consent form covers one specific procedure.
- A DNR is a provider's order about withholding CPR; it does not name a decision-maker.
- Correct: a healthcare proxy (durable power of attorney for health care) names who decides when the patient cannot.
- Informed consent covers one specific procedure and names no decision-maker.
- A living will records the patient's own wishes but appoints no one — the common confusion.
Question 5
An MA finds an error in a paper chart entry she made yesterday. How should she correct it?
Answer & explanation
Answer: C. Draw one line, write "error," initial and date
A charting error is corrected with a single line through the entry so it stays readable, the word "error," and the writer's initials and date, followed by the correct information. Blacking out the entry hides the original, which looks like tampering even though it seems thorough. Correction fluid and removing pages also destroy the legal record.
- Blacking out hides the original entry, which looks like tampering with a legal record.
- Correction fluid destroys the original and is never acceptable in a medical record.
- Correct: one line keeps the original readable; add 'error', initials and date, then the correction.
- Removing a page destroys part of the legal record and looks like a cover-up.
Question 6
A patient asks the office to call her only on her cell phone and never on her home line. Under HIPAA, which patient right is she using?
Answer & explanation
Answer: D. Confidential communications
Patients may ask to receive communications by an alternative means or at an alternative location, and the office must accommodate reasonable requests. A restriction request limits who receives PHI or how it is used, which sounds similar but is not about the contact method. Amendment corrects errors in the record, and an accounting lists certain disclosures that were made.
- A restriction limits who receives PHI or how it is used, not how she is contacted.
- Amendment is the right to correct inaccurate information in the record.
- An accounting of disclosures lists certain past disclosures of her PHI.
- Correct: asking to be contacted only by cell phone is a confidential communications request.
Question 7
While rooming a patient, the MA notices a fresh stab wound that the patient says came from an assault. Most states require this injury to be reported to whom?
Answer & explanation
Answer: B. Local law enforcement
Most states require providers to report gunshot and stab wounds from violence to law enforcement, and this legal duty overrides confidentiality. The health department receives reports of communicable diseases, which is the usual mix-up with mandatory reporting. CPS handles suspected child abuse, and the medical board licenses and disciplines physicians.
- The health department receives communicable-disease reports — the usual mix-up with injury reporting.
- Correct: most states require stab and gunshot wounds from violence to be reported to law enforcement.
- CPS handles suspected child abuse, and nothing here involves a child.
- The medical board licenses and disciplines physicians; it does not receive injury reports.
Question 8
Which ethical principle is involved when a healthcare provider ensures that all patients, regardless of socioeconomic status, have equal access to quality treatments and care?
Answer & explanation
Answer: A. Justice
Justice refers to the ethical principle of ensuring that all patients have fair and equal access to healthcare resources, regardless of their socioeconomic status. Beneficence refers to actions that promote the well-being of others. Nonmaleficence means avoiding the causation of harm. Autonomy is the respect for patients' rights to make their own decisions.
- Correct: justice means fair, equal access to care regardless of income or status.
- Nonmaleficence means avoiding harm, not fair distribution of resources.
- Autonomy is the patient's right to make their own decisions.
- Beneficence is acting for the patient's good, not ensuring equal access across patients.
Question 9
Which action would be a breach of patient confidentiality?
Answer & explanation
Answer: A. Discussing a patient with a coworker not on their care
Talking about a patient with a coworker who has no role in their care violates the minimum-necessary standard and confidentiality. The other options are legitimate, authorized disclosures for care or payment.
- Correct: a coworker with no role in the patient's care has no need to know, so this is a breach.
- Disclosure with valid authorization is permitted, as is disclosure for payment.
- Sharing results with a specialist on the care team is a permitted treatment disclosure.
- A private discussion with the treating provider is a normal part of care.
Question 10
An MA declines to give an injection she has not been trained to give, because doing it wrong could hurt the patient. Which ethical principle is she following?
Answer & explanation
Answer: A. Nonmaleficence
Nonmaleficence means "do no harm," which is exactly avoiding a task that could injure the patient. Beneficence, acting for the patient's good, is the near-miss because both aim at the patient's welfare, but beneficence is about doing good rather than avoiding harm. Autonomy is the patient's right to decide, and justice is fair distribution of care.
- Correct: nonmaleficence is 'do no harm' — declining a task you could do wrongly avoids injuring the patient.
- Beneficence means actively doing good; the near-miss, since here the focus is avoiding harm.
- Distributive justice concerns fair allocation of care across patients, not one MA's competence.
- Autonomy belongs to the patient's right to decide, not to an MA's choice about a task.
Question 11
After the provider explains the risks, a competent adult patient refuses an ordered tetanus booster. What should the MA do?
Answer & explanation
Answer: A. Document the refusal; tell the provider
A competent adult has the right to refuse treatment, so the MA respects the decision, documents the refusal and informs the provider. Giving the booster because it was ordered is battery once consent is refused. A family member cannot override a competent adult, and repeated pressure is coercion rather than education.
- Correct: a competent adult may refuse; document the refusal and inform the provider.
- Repeated pressure after an informed refusal is coercion, not education.
- A family member cannot override a competent adult's own decision.
- Giving the booster after a refusal is battery, even though the provider ordered it.
Question 12
You see a medical assistant take medication from the supply cabinet without authorization. What should you do?
Answer & explanation
Answer: C. Report it to your supervisor through proper channels
Reporting to a supervisor lets the possible diversion be investigated properly and protects patients. Confronting the person can escalate the situation, ignoring it enables misconduct, and posting evidence online is itself an ethical and legal breach.
- Posting a video online is itself a privacy and ethics breach and bypasses proper channels.
- A direct confrontation can escalate the situation and compromise a proper investigation.
- Correct: report it to your supervisor so possible drug diversion is investigated properly.
- Staying silent enables possible diversion and puts patients at risk.
Question 13
What is the purpose of the HITECH Act regarding electronic health records?
Answer & explanation
Answer: C. To promote EHR adoption and strengthen HIPAA protections
HITECH encouraged EHR adoption and reinforced HIPAA's privacy and security rules with tougher penalties. It did not outlaw paper records, weaken privacy, or hand exclusive control to states.
- HITECH is a federal law; it did not hand health data control to the states.
- HITECH did the opposite, strengthening privacy rules and raising penalties.
- Correct: HITECH (2009) funded EHR adoption and tightened HIPAA privacy and breach rules.
- Paper records remain legal; HITECH encouraged EHRs but banned nothing.
Question 14
The office receives a court order signed by a judge requesting a patient's records from a specific visit. What should the MA do?
Answer & explanation
Answer: C. Release only the records the order specifies
A court order is a disclosure required by law, so no patient authorization is needed, but only the information the order expressly covers may be released. Requiring the patient's authorization is the common over-cautious error. Sending the entire record exceeds the order, and the office does not need to notify the patient in person before complying.
- A court order is a disclosure required by law, so patient authorization is not needed.
- Releasing the entire record exceeds the order and over-discloses PHI.
- Correct: comply with the order, releasing only the records it specifically names.
- No in-person notification is required before complying with a valid court order.
Question 15
Which regulation most directly requires the confidential handling of patient health information?
Answer & explanation
Answer: B. HIPAA
HIPAA is the federal law that specifically mandates protecting the privacy and security of patient health information. The Hippocratic Oath is an ethical tradition, the PSDA addresses treatment decisions, and the ADA addresses disability discrimination.
- The Hippocratic Oath is an ethical tradition, not an enforceable law.
- Correct: HIPAA is the federal law that directly requires protecting patient health information.
- The ADA prohibits disability discrimination; it does not govern health record privacy.
- The Patient Self-Determination Act concerns advance directives and treatment decisions.

§09

Two law-and-ethics concepts

Consent types and MA scope each get a full page.

§10

Law and ethics questions

Phone advice, torts, the PSDA and incident reports.

Can a medical assistant give medical advice over the phone?

Not independently. An MA can relay the provider's instructions and take a message; advising a caller on medications or symptoms on their own is outside scope.

Is assault the same as battery?

No. Assault is the threat or fear of unwanted touching; battery is the touching itself. Giving an injection a competent patient has refused is battery, even if it was ordered.

What is the Patient Self-Determination Act?

A 1990 federal law on advance directives. It's the reason patients are asked whether they have a living will or a healthcare proxy.

Is an incident report part of the medical record?

No. It's filed separately for risk management, and the chart entry describes what happened to the patient without referring to the report.