Written to NHA's CCMA test plan
- Foundational Knowledge and Basic Science 10%
- Anatomy and Physiology 5.3%
- Clinical Patient Care 56%
- Patient Care Coordination and Education 8%
- Administrative Assisting 8%
- Communication and Customer Service 8%
- Medical Law and Ethics 4.7%
Free · 2026 · 4.7% of the NHA CCMA CCMA Medical Law and Ethics practice questions
Medical Law and Ethics is 4.7% of the NHA CCMA. Answer 10 questions (6 on Medical Law and Ethics) and see your score by domain, with every answer explained. Free, no sign-up.
While rooming a 4-year-old, a medical assistant notices several bruises on the child's upper arms and back. The bruises are in different stages of healing. The parent says the child "bruises easily from playing," but the child flinches when the parent reaches toward them. What is the most appropriate action by the medical assistant?
Tap an answer, or press A to D
HIPAA and related laws, consent, advance directives, confidentiality, negligence and mandatory reporting.
What the NHA CCMA exam tests in Medical Law and Ethics
- Laws and regulations: HIPAA, ACA, HITECH, 21st Century Cures Act, Controlled Substances Act (and HERCA as listed by NHA)
- Patient's Bill of Rights; informed (verbal/written) vs implied consent, including minors and patients who cannot consent
- Advance directives (living will, DNR/DNI, MOLST/POLST, health care proxy); power of attorney and legal guardianship
- Privacy and confidentiality; release of information; retention, storage and disposal of records
- Criminal vs civil law, negligence and malpractice; professional codes of ethics; unbiased care regardless of personal beliefs; mandatory reporting (abuse signs, reportable incidents, reporting agencies)
High-yield medical law and ethics facts
- HIPAA Privacy Rule: protects PHI in any form. Disclosures for treatment, payment and health care operations (TPO) need no authorization. Apply the minimum-necessary standard (except for treatment). Patients receive the Notice of Privacy Practices.
- HIPAA patient rights: access and copies (provided within 30 days, one 30-day extension), amendment requests, an accounting of disclosures, and restrictions on disclosures to their insurer when they self-pay in full.
- HIPAA Security Rule: protects electronic PHI with administrative, physical and technical safeguards (unique logins, auto logoff, encryption, audit trails).
- Release of information requires a signed authorization stating what information, to whom, purpose, expiration, signature and the right to revoke. Psychotherapy notes need their own specific authorization.
- No authorization is needed for TPO, public health reporting, abuse reporting, a court order, or workers' compensation as allowed by law. A subpoena alone may require further steps per policy.
- Breaches (HITECH): notify affected individuals within 60 days of discovery and notify HHS. If 500 or more residents of a state are affected, notify the media as well.
| Law | Key point |
|---|---|
| HIPAA (1996) | Privacy Rule (PHI), Security Rule (ePHI), portability of coverage |
| HITECH (2009) | EHR incentives, breach notification, stronger HIPAA penalties |
| Affordable Care Act (2010) | preventive services without cost-sharing, no pre-existing condition denials, dependents covered to age 26, marketplaces |
| 21st Century Cures Act (2016) | bans information blocking; patients get prompt electronic access to notes and results |
| Controlled Substances Act (1970) | DEA schedules I-V, prescriber registration, record keeping |
| CLIA (1988) | lab quality standards; waived / moderate / high complexity |
| OSHA (1970) | workplace safety; Bloodborne Pathogens and Hazard Communication standards |
| Patient Self-Determination Act (1990) | facilities must inform patients of their right to advance directives |
The full CCMA High-Yield Cram Sheet comes with full prep.
Common medical law and ethics traps
- The provider obtains informed consent; the MA may only witness the signature.
- Assault is the threat; battery is the touching. Libel is written; slander is spoken.
- Releasing records to a spouse, employer or attorney requires the patient's written authorization; TPO disclosures do not.
- All 4 D's must be present for negligence.
- Misfeasance (right act done wrong) vs malfeasance (wrong act) vs nonfeasance (failure to act).
- A living will states wishes; a health care proxy names a person; a POLST is a medical order.
- A financial power of attorney cannot make health care decisions.
- Suspected abuse must be reported; proof is not required.
Free CCMA medical law and ethics practice questions
Question 1
A 17-year-old who has been legally emancipated by a court arrives alone for a visit and asks to sign his own consent-to-treatment form. What should the medical assistant do?
- ARequire a parent's signature because the patient is younger than 18
- BAllow him to sign his own consent form for treatment
- CAsk for a court-appointed guardian to sign on his behalf
- DLet him consent only for sexual health services and nothing else
Show answer and explanation
Answer: B. Emancipated minors are legally treated as adults and may consent to their own medical care.
Why not A: Legal emancipation gives the minor adult status for medical decisions, so a parent's signature is not required.
Why not C: Guardianship applies to people who cannot make their own decisions. An emancipated minor can make his own decisions.
Why not D: This confuses emancipation with limited minor-consent exceptions. Emancipation covers medical care in general.
Remember: A legally emancipated minor may consent to his or her own medical treatment.
Question 2
A patient with end-stage COPD returns from a hospital stay with a brightly colored POLST form. He asks the medical assistant how it differs from his living will. Which statement is accurate?
- AIt is a document that names a surrogate to decide for him if he loses capacity.
- BIt is meant for all healthy adults as a routine part of estate planning.
- CIt is a provider-signed medical order that emergency personnel can follow right away.
- DIt addresses only CPR and cannot include any other treatment preferences.
Show answer and explanation
Answer: C. A POLST/MOLST turns a seriously ill patient's wishes into actionable medical orders signed by a provider. The orders travel with the patient across care settings.
Why not A: Naming a surrogate is the job of a health care proxy or durable power of attorney for health care, not a POLST.
Why not B: A POLST/MOLST is meant for seriously ill or frail patients. It is not a routine document for healthy adults.
Why not D: A POLST/MOLST usually covers CPR plus the level of medical intervention and artificial nutrition. It is broader than a DNR order alone.
Remember: A POLST/MOLST is a portable, provider-signed medical order for seriously ill patients, unlike a living will, which is the patient's own statement of wishes.
Question 3
A patient calls the office asking the medical assistant to "call in a refill" of the oxycodone prescribed last month after surgery. According to federal law under the Controlled Substances Act, how should this request be handled?
- AApprove the refill if the patient's pain score is unchanged, because post-surgical opioids are exempt from schedule limits
- BPhone the refill to the pharmacy under the original prescription, because refills within 30 days are allowed
- CAuthorize one refill, because Schedule II drugs may be refilled up to five times within six months
- DTell the patient the provider must evaluate the request, because oxycodone is Schedule II and requires a new prescription rather than a refill
Show answer and explanation
Answer: D. Federal law prohibits refills of Schedule II drugs such as oxycodone. Any additional supply requires a new prescription issued by the provider.
Why not A: There is no post-surgical exemption. Oxycodone remains Schedule II regardless of the clinical situation.
Why not B: No time window permits a refill of a Schedule II prescription, and an MA cannot independently authorize controlled substances.
Why not C: The rule allowing up to five refills within six months applies to Schedule III and IV drugs, not Schedule II.
Remember: Schedule II controlled substances cannot be refilled under federal law, while Schedule III–IV drugs may be refilled up to five times within six months.
Question 4
A patient calls asking for a refill of an oxycodone prescription that was written with no refills. According to federal law, how should the medical assistant respond?
- ACall the pharmacy and authorize one refill under the provider's standing order
- BApprove the refill if the original prescription was written within the last 30 days
- CExplain that up to five refills are allowed within six months and send the request
- DTell the patient Schedule II drugs cannot be refilled and route the request to the provider
Show answer and explanation
Answer: D. Federal law prohibits refills of Schedule II drugs, so the provider must decide whether to issue a new prescription.
Why not A: Schedule II drugs cannot be refilled. A medical assistant also cannot authorize controlled substance prescriptions.
Why not B: No time window permits refilling a Schedule II prescription. A new prescription is always required.
Why not C: The five-refills-in-six-months rule applies to Schedule III and IV drugs, not Schedule II drugs such as oxycodone.
Remember: Schedule II controlled substances, such as oxycodone, cannot be refilled; each fill requires a new prescription.
Question 5
A medical assistant calls a patient to have him come in to discuss an abnormal lab result. The call goes to the voicemail of a phone shared by the household. Which message best protects the patient's privacy?
- AState the abnormal result and the provider's recommendation so the patient can act quickly
- BMention the name of the lab test so the patient understands how urgent the call is
- CGive your name and the clinic's callback number and ask the patient to return the call
- DAsk anyone who listens to the message to pass the lab result along to the patient
Show answer and explanation
Answer: C. A brief message with a name and callback number, and no clinical details, follows the minimum necessary principle.
Why not A: Clinical details left on a shared voicemail could be heard by others. That would be an unnecessary disclosure of PHI.
Why not B: Even naming the test reveals health information beyond what is needed to arrange a callback.
Why not D: This invites disclosure of PHI to unknown household members without the patient's permission.
Remember: Voicemail messages should include only the caller's name and a callback number, never test results or diagnoses.
Full CCMA prep
Practice every CCMA domain
7-Day Cram Access
Lowest upfront$157 days
$2.14 a day
One-time payment. We will never charge you again.
- 300+ CCMA practice questions, every answer choice explained
- Unlimited timed mock exams (180 questions)
- Order of Draw Sequencer and EKG Strip & Artifact Reader: all 15 rounds
- Full 23-page printable High-Yield Cram Sheet (PDF)
100% Pass Guarantee + 7-day money-back. How it works
CCMA Exam Pass
Best value$39$29120 days
$0.24 a day
One-time payment. Nothing renews.
- 300+ CCMA practice questions, every answer choice explained
- Unlimited timed mock exams (180 questions)
- Order of Draw Sequencer and EKG Strip & Artifact Reader: all 15 rounds
- Full 23-page printable High-Yield Cram Sheet (PDF)
100% Pass Guarantee + 7-day money-back. How it works