50 Free RHIT Practice Questions (With Full Rationale)

By GetCertPrep Editorial Team · 23 min read · Certification Guides

# 50 Free RHIT Practice Questions (With Full Rationale) > **Direct Answer:** Access 50 free RHIT practice questions, grouped by exam domain, with detailed answer rationales. These sample MCQs simulate the actual exam format, helping you identify knowledge gaps. The full-length RHIT exam differs with 150 scored questions across domains; unlock 500+ more questions for comprehensive prep. Are you preparing for the AHIMA Registered Health Information Technician (RHIT) exam? You’ve found the right starting point. These 50 free RHIT practice questions mirror the content domains, difficulty level, and question styles you’ll face on test day. But practice questions are only half the battle—depth of understanding and targeted study are what set successful candidates apart. Use this free set to gauge your baseline, then scroll down to discover how the actual exam differs and how you can unlock a massive 500+ question bank to fully prepare. --- ## 50 Free RHIT Practice Questions Grouped by Domain The following 50 multiple‑choice questions are organized by the six official RHIT exam domains. Work through each question, then check your answers in the rationales section. ### Domain I: Data Analysis and Management (20%) – Questions 1-10 1. A health information technician calculates the average length of stay for patients discharged in March. Which descriptive statistic is being used? A) Range B) Median C) Mean D) Mode 2. Which type of graph is most appropriate to display the frequency of various DRGs in a hospital? A) Line graph B) Bar chart C) Scatter plot D) Pie chart 3. Ensuring that health data is accurate, error‑free, and consistent across systems is known as: A) Data integrity B) Data accessibility C) Data definition D) Data granularity 4. A hospital wants to track 30‑day readmissions for heart failure patients. The best source for this data is a(n): A) Master Patient Index B) Disease‑specific registry C) Encounter abstract D) Operative report 5. Which of the following is an example of secondary data use? A) Direct patient care B) Clinical decision‑making at the bedside C) Aggregated data for clinical research D) Generating a patient bill 6. The process of correcting a duplicate medical record number in the MPI by combining the two records is called: A) Encoding B) Merging C) Overlaying D) Enumeration 7. When abstracting data for a birth registry, which element is universally required? A) Maternal smoking status B) Baby’s blood type C) 5‑minute Apgar score D) Insurance type 8. The hospital’s average daily census is calculated by: A) Dividing total discharges by the number of days B) Dividing total inpatient service days by the number of days C) Multiplying the occupancy rate by the number of beds D) Summing daily admissions and dividing by the number of days 9. A healthcare organization uses patient‑reported outcome survey results to select a new EHR module. This is an example of: A) Evidence‑based management B) Data‑driven decision‑making C) Regulatory compliance D) Risk management 10. Which data standard enables semantic interoperability for clinical concepts across EHR systems? A) HL7 v2 B) ICD‑10‑CM C) SNOMED CT D) LOINC ### Domain II: Coding (20-25%) – Questions 11-22 11. A patient is admitted with acute cholecystitis and undergoes a laparoscopic cholecystectomy. The principal diagnosis is: A) Calculus of gallbladder B) Acute cholecystitis C) Status post cholecystectomy D) Postoperative infection 12. In ICD‑10‑PCS, a biopsy of a sentinel lymph node where only a portion of the node is removed is coded to the root operation: A) Excision B) Resection C) Extraction D) Drainage 13. An established patient office visit that includes an expanded problem‑focused history, expanded problem‑focused exam, and low‑complexity medical decision‑making should be coded as: A) 99211 B) 99212 C) 99213 D) 99214 14. A patient with type 2 diabetes mellitus and diabetic peripheral neuropathy is assigned which ICD‑10‑CM code? A) E11.9 B) E11.40 C) E11.42 D) E10.40 15. A physician documents “COPD with acute exacerbation” and also lists emphysema. The correct code assignment is: A) J44.1 only B) J43.9 only C) Both J44.1 and J43.9 D) J44.9 16. A percutaneous endoscopic gastrostomy (PEG) tube placement is coded in ICD‑10‑PCS using the root operation: A) Insertion B) Bypass C) Change D) Creation 17. For a 90‑day major surgical procedure, the global surgical package includes: A) Only the procedure itself B) A preoperative visit one day before surgery C) Management of postoperative complications only D) All routine, uncomplicated postoperative care for 90 days 18. Insertion of a dual‑chamber pacemaker is coded in ICD‑10‑PCS to the root operation: A) Insertion B) Replacement C) Supplement D) Bypass 19. A standard manual wheelchair is reported with which HCPCS Level II code? A) E1399 B) K0001 C) A9270 D) E0181 20. In ICD‑10‑CM, a sequela (late effect) code is used for a condition that: A) Is acute and currently active B) Is the cause of an injury C) Remains after the acute phase of an illness or injury has resolved D) Is a manifestation of an underlying disease 21. A patient’s history of completely excised colon cancer is coded as: A) Z85.038 B) C18.9 C) Z80.0 D) Z12.11 22. A patient is admitted solely for scheduled chemotherapy for breast cancer. The principal diagnosis is: A) Malignant neoplasm of the breast B) Encounter for chemotherapy (Z51.11) C) Nausea and vomiting D) Personal history of breast cancer ### Domain III: Compliance (16-20%) – Questions 23-30 23. Under the HIPAA Privacy Rule, a covered entity must provide a Notice of Privacy Practices (NPP) to a patient at the: A) End of treatment B) First service encounter C) Every visit D) Patient’s request only 24. Which of the following is considered a technical safeguard under the HIPAA Security Rule? A) Facility access controls B) Audit controls C) Workforce security policies D) Business associate agreements 25. The Office of Inspector General (OIG) has the authority to exclude an individual from participation in Medicare for: A) A minor billing error B) A conviction for healthcare fraud C) Voluntary disclosure of an overpayment D) A low coding accuracy score 26. An employee discusses a patient’s condition in the cafeteria, and others can hear the conversation. This is best described as a(n): A) Incidental disclosure B) Impermissible disclosure C) Minimum necessary disclosure D) Permitted use 27. The Stark Law prohibits physician self‑referrals for designated health services unless a specific exception applies. One well‑known exception is: A) In‑office ancillary services B) Referral to any hospital C) Billing Medicare directly D) Payment of kickbacks 28. A release of information request for psychotherapy notes requires: A) A general patient authorization for medical records B) A subpoena without a court order C) A specific, separate authorization distinct from the general medical record authorization D) Verbal consent from the patient 29. Under the False Claims Act, “knowingly” submitting a false claim includes acting with: A) Only actual knowledge B) Deliberate ignorance or reckless disregard of the truth C) A written admission of fraud D) An honest mistake 30. The Joint Commission standard requires that all elements of the medical record be completed within how many days after discharge? A) 10 B) 15 C) 30 D) 60 ### Domain IV: Information Technology (10-14%) – Questions 31-37 31. A hospital uses a system that uniquely identifies patients and links their demographic data across all clinical applications. This system is the: A) EHR B) Master Patient Index (MPI) C) Laboratory Information System (LIS) D) Picture Archiving and Communication System (PACS) 32. The primary purpose of a clinical decision support system (CDSS) is to: A) Increase revenue cycle efficiency B) Eliminate transcription errors C) Provide evidence‑based patient‑specific recommendations at the point of care D) Manage appointment scheduling 33. Which function is typical of a patient portal? A) Online bill payment and appointment scheduling B) Managing the laboratory instrument interface C) Storing radiology images D) Processing insurance claims 34. The HL7 FHIR interoperability standard primarily uses which data exchange formats? A) XML only B) JSON and XML C) Comma‑separated values (CSV) D) HL7 version 2 pipes and hats 35. In EHR security, the process of verifying that a user is who they claim to be is known as: A) Data integrity B) Authentication C) Encryption D) Auditing 36. A comprehensive disaster recovery plan for an HIM department must address: A) Hardware replacement only B) Data backup, system restoration, and business continuity C) Marketing and public relations D) Employee payroll recovery 37. A Health Information Exchange (HIE) enables: A) Data sharing within a single organization only B) Secure electronic sharing of patient health information across different care settings C) Transfer of paper records D) Coding audits for a single facility ### Domain V: Legal (8-12%) – Questions 38-43 38. The legal doctrine of *res ipsa loquitur* applies when: A) The patient signed an informed consent B) The injury could not have occurred without negligence C) The physician is board‑certified D) The statute of limitations has expired 39. A *subpoena duces tecum* requires the recipient to: A) Appear and give oral testimony B) Produce documents or records C) Submit to a deposition D) Agree to a settlement 40. Which statement regarding minors’ medical records is correct? A) Parents always have an automatic right to access B) Emancipated minors can consent to their own treatment C) Minors can never consent to any treatment D) State laws have no impact on parental access 41. The legal health record is best defined as: A) The set of records designated for patient access B) The official business record of an organization C) All data contained in the EHR D) The billing record 42. The term *spoliation* refers to: A) Intentional destruction or alteration of evidence B) A routine amendment to a record C) An unauthorized disclosure of PHI D) A late entry to a record 43. The HIPAA “minimum necessary” standard requires covered entities to: A) Release all PHI upon patient request B) Limit use, disclosure, or request of PHI to the minimum necessary to accomplish the intended purpose C) Obtain patient consent for every disclosure D) Destroy records after seven years ### Domain VI: Revenue Cycle Management (10-12%) – Questions 44-50 44. The process of confirming a patient’s insurance coverage and benefits before a scheduled service is called: A) Pre‑authorization B) Eligibility verification C) Claims adjudication D) Medical necessity review 45. A standard electronic remittance advice (ERA) explains: A) The patient’s itemized charges B) The payment amount and any adjustments made by the payer C) The physician’s operative notes D) The laboratory results 46. The charge description master (CDM) is a: A) List of all services and items with their CPT/HCPCS codes and prices B) Patient history database C) Repository of nursing notes D) Collection of discharge summaries 47. Medical necessity for a service is primarily determined by: A) The patient’s ability to pay B) Payer coverage policies and clinical criteria C) The registration clerk’s assessment D) The coder’s preference 48. For Medicare billing of outpatient hospital services, which coding system is used for procedures? A) ICD‑10‑PCS B) CPT/HCPCS C) DSM‑5 D) SNOMED CT 49. A claim is denied because the service is not a covered benefit under the patient’s plan. The best next step is to: A) Immediately resubmit the same claim B) Verify benefits and consider an appeal based on medical necessity C) Write off the balance D) Change the diagnosis code 50. The Accountable Care Organization (ACO) reimbursement model emphasizes: A) Fee‑for‑service payments B) Value‑based care and shared savings C) Cost‑plus contracting D) Capitation only --- ## Answer Key and Detailed Rationales First, a quick‑reference answer key: | Question | Answer | Question | Answer | |----------|--------|----------|--------| | 1 | C | 26 | B | | 2 | B | 27 | A | | 3 | A | 28 | C | | 4 | B | 29 | B | | 5 | C | 30 | C | | 6 | B | 31 | B | | 7 | C | 32 | C | | 8 | B | 33 | A | | 9 | B | 34 | B | | 10 | C | 35 | B | | 11 | B | 36 | B | | 12 | A | 37 | B | | 13 | C | 38 | B | | 14 | C | 39 | B | | 15 | A | 40 | B | | 16 | A | 41 | B | | 17 | D | 42 | A | | 18 | A | 43 | B | | 19 | B | 44 | B | | 20 | C | 45 | B | | 21 | A | 46 | A | | 22 | B | 47 | B | | 23 | B | 48 | B | | 24 | B | 49 | B | | 25 | B | 50 | B | Now dive into the reasoning behind every answer. Studying these rationales will strengthen your understanding far more than memorizing the letters. ### Rationales – Domain I: Data Analysis and Management 1. **C** – The *mean* (average) is the sum of all values divided by the number of values. It is the appropriate statistic for describing the average length of stay. Range, median, and mode describe dispersion or central tendency but do not compute an average. 2. **B** – A *bar chart* is ideal for displaying the frequency of distinct categories such as DRGs. Line graphs show trends over time, scatter plots show correlations, and pie charts show parts of a whole but are less effective for many categories. 3. **A** – *Data integrity* refers to the accuracy, consistency, and reliability of data throughout its lifecycle. Accessibility, definition, and granularity are separate data quality characteristics. 4. **B** – A *disease‑specific registry* (e.g., heart failure registry) is designed to track outcomes like readmissions. The MPI identifies patients, encounter abstracts summarize a single stay, and operative reports are procedural. 5. **C** – Secondary data use is the re‑use of clinical data for purposes beyond direct patient care, such as clinical research, quality improvement, or public health reporting. Direct care and billing are primary uses. 6. **B** – *Merging* (or record consolidation) combines duplicate medical record numbers into a single, correct MPI entry. Encoding refers to assignment of codes; overlaying is a correction method; enumeration is numbering. 7. **C** – The *5‑minute Apgar score* is a mandatory standardized data element in birth registries. Smoking status and blood type are often collected but not universally required; insurance type is administrative. 8. **B** – Average daily census = total inpatient service days during a period divided by the number of days in the period. Option A gives the average length of stay, not census. 9. **B** – Using survey results to choose an EHR module is *data‑driven decision‑making*. Evidence‑based management often relies on external research, while this comes from internal data. 10. **C** – *SNOMED CT* is a comprehensive clinical terminology that enables semantic interoperability—meaning that the clinical meaning of data is consistently understood across systems. HL7 v2 is a messaging standard, ICD‑10‑CM is a classification, LOINC is for laboratory and clinical observations only. ### Rationales – Domain II: Coding 11. **B** – The principal diagnosis is the condition established after study to be chiefly responsible for the admission. The acute cholecystitis prompted the admission and surgery. 12. **A** – *Excision* is cutting out or off a portion of a body part. A biopsy that removes only part of a lymph node is excision. Resection is removing the entire body part; extraction is pulling out; drainage is releasing fluid. 13. **C** – CPT code 99213 requires an expanded problem‑focused history, expanded problem‑focused exam, and low‑complexity medical decision‑making. 99212 is problem‑focused with straightforward MDM. 14. **C** – E11.42 is Type 2 diabetes mellitus with diabetic polyneuropathy, which includes peripheral neuropathy. E11.40 is unspecified diabetic neuropathy; E11.9 is without complications; E10.40 is Type 1. 15. **A** – According to ICD‑10‑CM guidelines, code J44.1 (COPD with acute exacerbation) includes the conditions of emphysema and chronic bronchitis when they are components of COPD. Do not assign a separate code for emphysema. 16. **A** – PEG tube placement involves putting a non‑biological device (the feeding tube) into the stomach; the root operation is *Insertion* of a device. Creation is used for making a new permanent opening when the device is not the focus. 17. **D** – The global surgical package for a 90‑day major procedure includes all routine, uncomplicated postoperative care for 90 days. Pre‑operative visits after the decision for surgery, local anesthesia, and the procedure itself are also included, but option D best captures the follow‑up care. 18. **A** – Inserting a permanent pacemaker device is coded to the root operation *Insertion*. Replacement would be used if a previous device is taken out and a new one put in. 19. **B** – K0001 is the HCPCS Level II code for a standard manual wheelchair. E1399 is a miscellaneous durable medical equipment code, and the others are not wheelchair codes. 20. **C** – A sequela code (e.g., I69.‑) represents a residual condition after the acute phase of an illness or injury has resolved. The original condition is no longer present. 21. **A** – Z85.038 is the personal history code for malignant neoplasm of the colon. C18.9 would be used if the cancer were still present; Z80.0 is family history; Z12.11 is screening. 22. **B** – When a patient is admitted solely for chemotherapy, the principal diagnosis is Z51.11, Encounter for antineoplastic chemotherapy. The malignancy is coded as a secondary diagnosis. ### Rationales – Domain III: Compliance 23. **B** – The HIPAA Privacy Rule requires that the Notice of Privacy Practices be provided at the first service encounter and posted prominently. 24. **B** – *Audit controls* (hardware, software, and procedural mechanisms that record and examine activity in information systems) are a required technical safeguard under the Security Rule. Facility access controls are physical safeguards; workforce security is administrative. 25. **B** – The OIG may exclude individuals convicted of healthcare fraud, patient abuse, or other program integrity violations. Minor errors or voluntary self‑disclosure do not automatically lead to exclusion. 26. **B** – Even if inadvertent, discussing PHI where it can be overheard by others who do not need to know it is an *impermissible disclosure*. Incidental disclosures under HIPAA are those that occur despite reasonable safeguards, such as a receptionist audibly saying a name. 27. **A** – The in‑office ancillary services exception permits physicians to refer patients for certain DHS provided within the same group practice. The other options are not Stark Law exceptions. 28. **C** – Psychotherapy notes receive heightened protection under HIPAA; a separate, specific authorization is required, except for limited circumstances. A general authorization for medical records is insufficient. 29. **B** – Under the False Claims Act, “knowingly” includes actual knowledge, deliberate ignorance, or reckless disregard of the truth. An honest mistake does not meet the standard. 30. **C** – The Joint Commission requires that the medical record be completed within 30 days after discharge. Individual state laws or medical staff bylaws may impose stricter limits. ### Rationales – Domain IV: Information Technology 31. **B** – The Master Patient Index (MPI) links all patient identifiers across registration, clinical, and financial systems. The EHR contains clinical data; LIS manages lab data; PACS stores images. 32. **C** – A CDSS provides evidence‑based, patient‑specific alerts, reminders, and recommendations at the point of care to support clinical decision‑making. It is not primarily a billing or scheduling tool. 33. **A** – Patient portals typically offer functions like online bill pay, appointment scheduling, prescription refills, and secure messaging. Laboratory information systems and PACS are clinical backend systems. 34. **B** – FHIR is an interoperability standard that primarily uses RESTful APIs and supports JSON and XML for data exchange. HL7 v2 uses its own delimiter‑based syntax. 35. **B** – *Authentication* is the process of verifying a user’s identity (e.g., username/password, biometrics). Encryption protects data confidentiality, and auditing records access. 36. **B** – A disaster recovery plan must include procedures for data backup, system restoration, and the resumption of critical business functions. It must go beyond hardware replacement to ensure continuity. 37. **B** – An HIE facilitates secure electronic exchange of patient health information among disparate care settings, improving care coordination and data availability. ### Rationales – Domain V: Legal 38. **B** – *Res ipsa loquitur* (“the thing speaks for itself”) applies when the injury is of a type that would not normally occur in the absence of negligence, allowing a presumption of negligence. 39. **B** – A *subpoena duces tecum* commands the production of documents or records. A subpoena ad testificandum requires testimony. 40. **B** – Emancipated minors (by court order, marriage, or military service) have the legal right to consent to their own treatment. Parents do not always have access, and state laws do affect access rights. 41. **B** – The legal health record is the officially designated business record of a healthcare organization, used for patient care and documenting services. It may be a subset of the designated record set. 42. **A** – Spoliation is the intentional destruction, mutilation, or alteration of evidence relevant to litigation. Routine corrections that follow policy and are properly documented are not spoliation. 43. **B** – The minimum necessary standard requires that PHI use, disclosure, and requests be limited to the minimum necessary to achieve the intended purpose. It does not apply to disclosures for treatment. ### Rationales – Domain VI: Revenue Cycle Management 44. **B** – Eligibility verification confirms insurance coverage and benefits before services, preventing later denials. Pre‑authorization is obtaining approval for a specific service; adjudication occurs after the claim is submitted. 45. **B** – The remittance advice (ERA) details how the payer adjudicated the claim: paid amounts, adjustments, deductibles, and reasons for denial or reduction. 46. **A** – The CDM is a comprehensive list of all billable items and services (with their CPT/HCPCS codes, description, and charge) maintained by a hospital or healthcare facility. 47. **B** – Medical necessity is determined by the payer’s coverage policies, clinical criteria (such as InterQual or MCG), and regulatory requirements. The provider’s documentation must support it. 48. **B** – Outpatient hospital procedures are coded with CPT/HCPCS. ICD‑10‑PCS is used for inpatient procedures only. 49. **B** – A denial for a non‑covered service requires verifying the patient’s benefits and, if appropriate, filing an appeal with supporting documentation for medical necessity. 50. **B** – ACOs operate under value‑based care models, often with shared savings incentives that reward improved quality and cost efficiency, not pure fee‑for‑service. > **Ready for More? Unlock the Full RHIT Practice Test** > Get access to 500+ additional RHIT practice questions with detailed rationales, covering all exam domains. Simulate the real AHIMA exam and track your progress to ensure you’re fully prepared. > [**Unlock 500+ More RHIT Questions**](/rhit-full-practice-test) --- ## How the Full-Length RHIT Exam Differs These 50 free RHIT practice questions give you a solid introduction, but the official AHIMA RHIT exam is a significantly different beast. Understanding the structure will help you avoid surprises and focus your study where it matters most. ### Key Differences at a Glance | Feature | Free Practice Set (this page) | Official AHIMA RHIT Exam | |---------|-------------------------------|----------------------------| | **Number of scored questions** | 50 | 150 (plus 20 unscored pretest items) | | **Time limit** | Self‑paced | 3.5 hours (computer‑based) | | **Domains tested** | All six, weighted proportionally | All six, with official domain weights (see below) | | **Question format** | Stand‑alone multiple‑choice | Multiple‑choice with some image‑based or scenario‑driven items | | **Scoring** | Raw score | Scaled score (passing: 300 on a scale of 200–400) | | **Cognitive levels** | Primarily recall/application | Mix of recall, application, and analysis (especially in coding) | | **Retake policy** | Unlimited | Limited; AHIMA applies waiting periods after failed attempts | ### Official RHIT Exam Domain Weights AHIMA publishes the following domain weight breakdown for the RHIT exam. Use these percentages to budget your study time. | Domain | Weight | |--------|--------| | Data Analysis and Management | 20% | | Coding | 20–25% | | Compliance | 16–20% | | Information Technology | 10–14% | | Legal | 8–12% | | Revenue Cycle Management | 10–12% | Coding and Data Analysis together account for up to 45% of the exam; if you are weak in either, prioritize them. ### Step‑by‑Step Strategy to Bridge the Gap 1. **Diagnose with this free set** – After reviewing the rationales, note which domains caused the most errors. Make a simple tally. 2. **Overweight your weak domains** – Use the official weight percentages to allocate study time, but dedicate a little extra to your lowest‑scoring domain until you reach proficiency. 3. **Upgrade to a full question bank** – 50 questions provide only a snapshot. A larger bank (500+ questions) exposes you to a wider variety of scenarios, especially important in coding, where pattern recognition and guideline application are critical. 4. **Simulate the real exam** – Once you’ve covered the material, take a full‑length, timed practice test of 150 questions. This builds endurance and teaches you how to pace yourself over 3.5 hours. 5. **Review every rationale** – Wrong answers are your best teachers. Read the full explanation even for questions you answered correctly—you may have guessed or applied incomplete logic. 6. **Mix in flashcards and codebooks** – While practicing, keep your ICD‑10‑CM, ICD‑10‑PCS, and CPT codebooks handy. Real exam questions often require looking up codes or guidelines. 7. **Track your progress** – A quality practice test platform shows you performance trends by domain, question type, and cognitive level, so you can make data‑driven adjustments. > **Unlock Your Custom Study Plan** > These differences underscore why practice volume matters. The full 500+ question bank includes unlimited retakes, a timed simulation mode, and detailed analytics to pinpoint exactly where you stand. > [**Unlock 500+ More RHIT Questions**](/rhit-full-practice-test) --- ## Unlock Full 500+ RHIT Practice Questions (CTA) Your trial run with 50 free RHIT practice questions is only the beginning. To truly be ready for the AHIMA RHIT exam, you need depth, repetition, and realistic simulation. The complete question bank gives you: - **500+ additional MCQs** covering every official domain and sub‑topic - **Exam simulation mode** with a 3.5‑hour timer, 150 scored questions, and performance analytics - **Detailed rationales** that explain why the correct answer is right and—just as important—why the distractors are wrong - **Custom quizzes by domain** so you can target Data Analysis on Monday, Coding on Tuesday, and Legal on Wednesday - **Progress tracking** with color‑coded strengths and weaknesses to guide your final review weeks > **Ready for More? Unlock the Full RHIT Practice Test** > Get access to 500+ additional RHIT practice questions with detailed rationales, covering all exam domains. Simulate the real AHIMA exam and track your progress to ensure you’re fully prepared. > [**Unlock 500+ More RHIT Questions**](/rhit-full-practice-test) Stop guessing and start mastering the material that will appear on your certification exam. Click the button above and take the next decisive step toward earning your RHIT credential. --- ## 📚 Recommended Study Resources & Video Tutorials Access verified study guides, discount vouchers, and tutorial walkthroughs matching this certification: - **[AHIMA RHIT](https://getcertprep.com/ahima-rhit-exam-prep)**: - **[AHIMA CHPS Study Guide & Privacy Practice Questions](https://getcertprep.com/resources/ahima-chps-guide.pdf)**: Comprehensive 50-page downloadable PDF covering HIPAA privacy rules, breach notification protocols, and healthcare data security controls.