CPHIMS Practice Questions (2026) — Free Sample Questions with Answers

Answer: A

LOINC for the test; SNOMED CT for the organism: Correct. LOINC identifies the observation (what was tested), and SNOMED CT provides coded result values such as organisms.

SNOMED CT for both the test and the organism: SNOMED CT is the right choice for the organism value, but lab test identifiers in exchange use LOINC.

LOINC for the test; ICD-10-CM for the organism: ICD-10-CM classifies diagnoses for billing and statistics, not organisms as result values.

CPT for the test; SNOMED CT for the organism: CPT codes bill the procedure; it does not identify the observation in a result message.

LOINC names the question (the test or observation); SNOMED CT often supplies the coded answer (organism, finding).

Answer: C

Foundational: Foundational interoperability (secure transport between systems) is working; the messages arrive.

Structural: Structural interoperability (format and syntax) is working; every value lands in the correct field.

Semantic: Correct. Semantic interoperability requires shared meaning, such as standard codes (for example, LOINC); local codes break it even when structure is correct.

Organizational: Organizational interoperability covers governance, policy, consent and trust between organizations; the problem here is code meaning.

HIMSS levels: foundational (connectivity), structural (format), semantic (shared meaning/codes), organizational (governance, policy, trust).

Answer: C

Individuals, media in both states, and HHS within 60 days of discovery: The media threshold is counted per state or jurisdiction; neither state has more than 500 residents affected.

Individuals within 60 days; HHS in the annual log after year-end: The annual log is for breaches of fewer than 500 individuals; this breach affects 700 in total.

Individuals and HHS within 60 days of discovery; no media notice: Correct. Breaches of 500 or more individuals must be reported to HHS at the same time as individual notice (within 60 days of discovery). Media notice applies only when more than 500 residents of one state or jurisdiction are affected, and neither state reaches that.

Individuals only, because each state count is below the 500 threshold: The HHS threshold is the total number of individuals, not the per-state count.

Count the total for the HHS rule (500 or more = report contemporaneously) and the per-state count for the media rule (more than 500 residents of a state).

Answer: C

The delay is allowed because HIPAA gives up to 30 days to answer access requests: The HIPAA access timeline is a separate rule; meeting it does not excuse interference under the Cures Act information blocking regulations.

The delay is allowed because lab results are outside the definition of EHI: Lab results in the designated record set are electronic health information.

The blanket delay likely interferes with access unless a specific exception applies: Correct. Delaying patients' electronic access to EHI is a practice likely to interfere with access, which is the core of information blocking. A hold applied to every result, rather than a decision about a specific patient, is unlikely to be excused by an exception.

The delay is a concern only for the EHR developer, not for the hospital: Health care providers are actors and can commit information blocking themselves.

Under 45 CFR Part 171, a provider practice that delays patients' electronic access to EHI is likely interference unless an exception applies; blanket holds rarely qualify.

Answer: B

Random variation, since no point fell outside control limits: Run charts have no control limits; that test belongs to control charts.

A shift, signaling non-random change consistent with improvement: Correct. A run of consecutive points on one side of the median beyond the rule length (commonly 6 or more) is a shift, a non-random signal; nine points below the median after the change suggests improvement.

A trend, since all the points lie on the same side of the median: A trend means consecutive points steadily rising or falling; points on one side of the median are a shift.

No conclusion, since run charts cannot show change after an intervention: Run charts are designed to show change over time around an intervention.

Run chart rules: a shift is a run of points on one side of the median; a trend is a run of consecutive increases or decreases.

Answer: A

Observe nurses to learn why bedside scanning fails: Correct. Workarounds signal a process or technology problem (failing scanners, poor wristband print, out-of-reach devices). Understanding the cause first lets the fix remove the reason for the workaround.

Remove the copies and re-educate the unit on bedside scanning: Removing the copies is needed, but without fixing the cause the workaround tends to return.

Make wristband scanning a hard stop for all doses: Scanning is already required; a stricter stop does not fix why bedside scanning fails.

Report scan compliance by nurse to the unit manager weekly: Scan compliance looks normal, since the copies are being scanned.

Treat workarounds as data: find the root cause (equipment, wristbands, workflow) before re-education or enforcement.

Answer: B

1. 1. CPOE orders = orders entered directly by the prescriber = 18,000 orders.
2. 2. Denominator = all medication orders = 18,000 + 4,800 + 1,200 = 24,000 orders.
3. 3. CPOE rate = 18,000 ÷ 24,000 = 0.75 = 75%.

25%: This is the share of orders NOT entered by prescribers: (4,800 + 1,200) ÷ 24,000.

75%: Correct. Only orders entered directly by the prescriber count as CPOE: 18,000 ÷ 24,000 = 0.75 = 75%.

78.9%: This drops the 1,200 transcribed written orders from the denominator: 18,000 ÷ 22,800.

95%: This counts nurse-entered verbal orders as CPOE: 22,800 ÷ 24,000. Under the stated definition, orders entered by someone else on the prescriber's behalf do not count.

CPOE adoption counts only orders the licensed prescriber enters directly, divided by all orders of that type.

Answer: A

Notify the 320 individuals; report to HHS after year-end: Correct — individuals must be notified without unreasonable delay and no later than 60 days after discovery. With fewer than 500 affected, the breach is reported to HHS within 60 days after the end of the calendar year.

Notify the individuals, HHS and prominent media within 60 days: Media notice and a report to HHS at the same time as individual notice apply only when 500 or more residents of a state or jurisdiction are affected.

Report to HHS in the annual log; individual notice is optional: Individual notice is required for every breach of unsecured PHI, whatever its size.

Notify individuals only after forensics confirms data misuse: The rule presumes a breach unless a low probability of compromise is shown. It does not wait for proof of misuse.

Breach of unsecured PHI: notify individuals within 60 days of discovery; at 500 or more in a state, also the media and HHS at the same time; under 500, HHS within 60 days after year-end.

Answer: B

1. Last verified good copy = 09:00 log backup
2. Failure (system stops processing) = 11:30
3. Data lost = 11:30 − 09:00 = 2.5 hours
4. The 4-hour backup interval is the worst-case RPO design; this event lost less than that

1.5 hours: Measures from the failure to the next scheduled backup at 13:00, which is not data loss.

2.5 hours: Correct — everything recorded between the last good copy (09:00) and the failure (11:30) is lost: 2.5 hours. That is the actual loss to compare with the RPO.

4.0 hours: That is the backup interval (the worst-case design RPO), not the actual loss in this event.

10.5 hours: Measures from the 01:00 full backup, but the 09:00 log backup restores everything up to 09:00.

Data loss = time from the last good recovery point to the failure; RPO is the maximum loss the business will tolerate, RTO the time to restore.

Answer: D

The quality of cardiology care declined after go-live: A real decline in care would raise the number of readmissions, and that count did not change.

The new feed counts some readmissions twice: Double counting would raise the readmission count, which is unchanged.

The feed now adds observation stays to the numerator: Adding stays to the numerator would also raise the readmission count.

The feed is dropping index discharges from the denominator: Correct — with a fixed numerator, a higher rate means a smaller denominator. A feed that loses index discharges (for example, through an unmapped discharge disposition) fits the data. Check denominator counts against the source system.

When a rate moves but its numerator doesn't, investigate the denominator — feed and mapping changes often drop records silently.

Answer: B

1. Total cost = $300,000 + $250,000 + $250,000 = $800,000
2. Total benefit = $700,000 + $500,000 = $1,200,000
3. Net benefit = $1,200,000 − $800,000 = $400,000
4. ROI = $400,000 ÷ $800,000 = 0.50 = 50%

33%: Divides the $400,000 net benefit by total benefits ($1,200,000). That is a percentage of the wrong base: ROI divides by cost.

50%: Correct — total cost is $800,000 and total benefit is $1,200,000. ROI = (benefit − cost) ÷ cost = $400,000 ÷ $800,000 = 50%.

118%: Leaves out the five years of support costs: ($1,200,000 − $550,000) ÷ $550,000. Ongoing support is part of the full cost.

150%: Benefit ÷ cost = 1.5 is the benefit-cost ratio, not ROI. The cost was never subtracted from the benefit.

ROI = (benefit − cost) ÷ cost, with every cost line (including multi-year support) in the denominator.

Answer: D

Delay go-live until every surgeon agrees to use it: Unanimity is unrealistic and delays the benefits for everyone. Resistance should be addressed, not waited out.

Schedule extra classroom training sessions for these surgeons: Training addresses knowledge gaps, but these surgeons are objecting to workflow burden.

Exempt the surgeons for six months after go-live: Exemptions create two workflows and documentation gaps, and adoption is delayed rather than achieved.

Pair them with a surgeon champion to fix workflow issues: Correct — a respected peer champion works through their specific concerns (for example, preference lists and templates that cut clicks) and arranges personal at-the-elbow support, which targets the real cause of resistance.

Address physician resistance at its cause, through peer champions and workflow fixes, rather than with delay, exemptions or generic training.

Answer: B

1. Path A–B–E = 4 + 6 + 2 = 12 weeks
2. Path A–C–D–E = 4 + 3 + 5 + 2 = 14 weeks (critical path)
3. Float of B = 14 − 12 = 2 weeks
4. After the slip, A–B–E = 4 + 9 + 2 = 15 weeks > 14, so the new duration is 15 weeks

14 weeks: Assumes the slip has no effect because B is not on the critical path, but B has only 2 weeks of float.

15 weeks: Correct — the original critical path is A–C–D–E = 14 weeks and A–B–E = 12 weeks, so B has 2 weeks of float. A 3-week slip makes A–B–E = 15 weeks, the new critical path.

17 weeks: Adds the full 3-week slip to the original 14 weeks. Only the slip beyond B's 2 weeks of float delays the project.

23 weeks: Sums every activity plus the slip (20 + 3), ignoring that B runs in parallel with C and D.

The critical path is the longest path; a delay in a non-critical activity moves the end date only by the amount that exceeds its float.

Answer: C

Desire: The nurses say they want the change to succeed, so desire is present.

Knowledge: They all pass the quiz on the steps, so they know how the workflow should go.

Ability: Correct — ability is turning knowledge into actual performance. Coached practice, at-the-elbow support and fixes to workflow or equipment address it.

Reinforcement: Reinforcement sustains a change once it is achieved. These nurses have not yet achieved it.

ADKAR = Awareness, Desire, Knowledge, Ability, Reinforcement; find the first element that is missing and work there.

Answer: A

1. CPI = EV ÷ AC = $180,000 ÷ $225,000 = 0.80
2. SPI = EV ÷ PV = $180,000 ÷ $200,000 = 0.90
3. CPI < 1 → over budget (earning $0.80 of value per $1 spent)
4. SPI < 1 → behind schedule (90% of planned work done)

CPI 0.80, SPI 0.90: over budget and behind schedule: Correct — CPI = EV ÷ AC = $180,000 ÷ $225,000 = 0.80, and SPI = EV ÷ PV = $180,000 ÷ $200,000 = 0.90. Both are below 1, so the project is over budget and behind schedule.

CPI 0.80, SPI 1.13: over budget but ahead of schedule: SPI was computed as AC ÷ PV, using actual cost in place of earned value.

CPI 0.90, SPI 0.80: over budget and behind schedule: CPI and SPI are swapped (EV ÷ PV reported as CPI, EV ÷ AC as SPI).

CPI 1.25, SPI 1.11: under budget and ahead of schedule: The ratios are inverted (AC ÷ EV and PV ÷ EV), which flips the interpretation.

CPI = EV/AC and SPI = EV/PV; values below 1 mean over budget and behind schedule.