Medical Assistant Certification (CMA / RMA) Medical Law, Ethics, and Compliance Syllabus

What is a 'covered entity' under HIPAA?

Health care providers who transmit health information electronically, health plans, and health care clearinghouses.

What is a Business Associate under HIPAA?

A person or entity that performs functions or services for a covered entity involving the use or disclosure of PHI (e.g., billing companies, IT vendors), bound by a Business Associate Agreement.

What does the HIPAA Security Rule specifically protect?

Electronic protected health information (ePHI) — it sets standards for the confidentiality, integrity, and availability of ePHI.

What are the three categories of safeguards required by the HIPAA Security Rule?

Administrative safeguards, physical safeguards, and technical safeguards.

Give an example of a technical safeguard under the HIPAA Security Rule.

Access controls (unique user IDs/passwords), data encryption, automatic logoff, and audit controls/logs.

What is the Patients' Bill of Rights designed to ensure?

That patients receive respectful care and have rights such as informed consent, confidentiality, access to their records, the right to refuse treatment, and the right to know provider identities and costs.

Name three basic rights guaranteed to patients under a Patients' Bill of Rights.

The right to considerate/respectful care, the right to information about diagnosis and treatment, and the right to confidentiality of records. (Also: right to refuse treatment and to participate in care decisions.)

What is mandatory reporting in health care?

The legal requirement that health professionals report certain events or conditions to authorities, even when this overrides patient confidentiality.

Give four examples of conditions or events that require mandatory reporting.

Certain communicable/infectious diseases, suspected child abuse, suspected elder abuse, and vital statistics (births/deaths); also gunshot/stab wounds and certain injuries.

What are the four core principles of bioethics?

Autonomy (respect for patient self-determination), Beneficence (do good), Nonmaleficence (do no harm), and Justice (fairness in care and resource distribution).

Define the bioethical principle of 'autonomy.'

Respecting a patient's right to make their own informed decisions about their care, including the right to refuse treatment.

Define the bioethical principle of 'nonmaleficence.'

The obligation to 'do no harm' — avoid causing injury or suffering to patients.

What is the AAMA Medical Assistant Creed?

A statement of belief: to render service with full respect for human dignity, to uphold the honor of the profession, to be loyal to the physician and dedicated to patient welfare, and to be true to ethical principles.

What are the five principles of the AAMA Code of Ethics?

Render service with respect for human dignity; respect patient confidentiality; uphold the honor/principles of the profession; pursue continuing education to improve knowledge/skills; and participate in community service to improve public health.

What is the difference between ethics and law?

Laws are enforceable rules set by government with legal penalties; ethics are moral principles/standards of conduct that guide behavior but are not legally enforceable (though violations may bring professional consequences).

What is an ethical dilemma?

A situation with a conflict between two or more morally acceptable choices, or where any choice has undesirable consequences, requiring a decision between competing values.

What is an advance directive?

A legal document that states a patient's wishes regarding future medical care if they become unable to make or communicate decisions.

What is the difference between a living will and a durable power of attorney for health care?

A living will specifies the treatments a patient does/does not want at end of life; a durable power of attorney for health care (health care proxy) names another person to make medical decisions on the patient's behalf.

What does a DNR (Do Not Resuscitate) order direct?

That cardiopulmonary resuscitation (CPR) should not be performed if the patient's heart or breathing stops.

What is an incident report (occurrence report)?

A confidential document recording an unexpected event, error, injury, or near-miss involving a patient, visitor, or staff member, used for risk management and quality improvement — not part of the medical record.

What is the cardinal rule for documenting in a patient's medical record regarding errors?

Never erase or obliterate; draw a single line through the error, write 'error,' add the correction, then date and initial it. Document objectively and never falsify.

What does the phrase 'if it wasn't documented, it wasn't done' mean in health care?

That care/observations not recorded in the chart are legally treated as if they never occurred — thorough documentation is essential legal protection.

What does OSHA stand for and what is its purpose?

Occupational Safety and Health Administration — a federal agency that sets and enforces standards to ensure safe and healthful working conditions for employees.

What is the OSHA Bloodborne Pathogens Standard?

A regulation requiring employers to protect workers from exposure to blood and other potentially infectious materials through an exposure control plan, PPE, training, hepatitis B vaccination, and proper sharps disposal.

What is a Safety Data Sheet (SDS) and what does OSHA's Hazard Communication Standard require?

An SDS provides detailed information on a hazardous chemical (composition, hazards, handling, first aid). The Hazard Communication Standard requires labeling of hazardous chemicals and accessible SDS for each one.

What are Standard Precautions?

Infection-control practices treating all blood and body fluids as potentially infectious — including hand hygiene, PPE, safe injection practices, and proper handling of contaminated equipment.

What does CLIA stand for and what does it regulate?

Clinical Laboratory Improvement Amendments (1988) — federal standards regulating all laboratory testing on humans to ensure accuracy, reliability, and timeliness of results.

What are the three CLIA categories of laboratory tests based on complexity?

Waived tests, Moderate-complexity tests, and High-complexity tests.

What is a CLIA-waived test? Give an example.

A simple test with a low risk of error that is cleared for home/clinic use; examples include urine dipstick, fecal occult blood, blood glucose monitoring, and pregnancy tests.

What is a Quality Assurance (QA) program in a medical office?

A systematic, ongoing process to monitor, evaluate, and improve the quality of patient care and services, ensuring standards are met and identifying areas needing correction.