FREE RHIA Study Guide 2026: All 5 Domains

This free RHIA study guide walks through every knowledge domain the AHIMA Registered Health Information Administrator exam tests, organized to the current AHIMA content outline.^[2]

It’s interactive, not a wall of text: every module has built-in checkpoint quizzes, flashcards, and practice questions, so you learn by doing — not just reading.

The RHIA is the bachelor’s-level administrator credential. Where the RHIT is the technician — focused on the hands-on, operational HIM work — the RHIA tests whether you can govern information, run the revenue cycle, ensure enterprise compliance, and lead an HIM department.

That administrative and leadership depth is exactly what this guide emphasizes. We teach all five official domains, one module each, and lead with the heaviest.

Read a module, test yourself at each checkpoint, then drill gaps with our free practice test and flashcards. This is a high-yield overview mapped to the official content outline — not a substitute for your CAHIIM coursework.

RHIA Exam Snapshot

The RHIA covers five domains under the content outline effective March 1, 2021.^[2] Study by weight — PHI Compliance and Data Analytics together are half the exam:

Notice the shape of the exam: it is not a coding test. Coding accuracy lives inside Revenue Management, but the bulk of the RHIA is compliance, analytics, governance, and leadership— the work of running a health-information function, not processing individual records. Keep that administrator’s lens as you study every module.

Module 1 · Information Governance

19% of the exam. Information governance (IG) is the administrator’s mandate: treat information as a strategic asset and put accountability, policy, and decision rights around it across its whole lifecycle. Every later domain depends on governed, trustworthy data — so this is where the RHIA mindset begins.

1.1 Data Integrity & Quality

Data integrity means data is accurate, complete, consistent, and reliable across its lifecycle — unchanged from its source and fit for purpose. AHIMA’s data-quality model adds dimensions such as timeliness, relevance, and accessibility. The administrator evaluates the integrity of health data and completes data analysis to inform management,^[2] because every report, statistic, and reimbursement decision downstream is only as good as the data feeding it.

1.2 Data Standards & the Data Dictionary

A Data dictionary is the backbone of data standardization: a documented definition for every data element — its name, format, allowable values, and meaning. Managing data-dictionary standardization policies and managing data standards based on organizational policy are explicit IG tasks.^[2] When the same element is defined and captured consistently across systems, data can be aggregated, compared, and exchanged accurately; when it is not, you get unreliable statistics and duplicate or conflicting data.

1.3 Health Record Content & IG Policy

The administrator manages health-record content and documentation and develops the policies and procedures for data management and IG.^[2]

Two concepts are frequently tested. The Legal health record (LHR) is the organization’s formally defined official business record — what it will disclose in response to a legal request.

The Designated record set (DRS) is the HIPAA concept of the records used to make decisions about an individual — the set a patient has a right to access and amend. They overlap but are defined for different purposes.

Module 2 · Compliance: Access, Use & Disclosure of PHI

26% of the exam — the single largest domain. This is the heart of the RHIA. The administrator is the organization’s steward of patient privacy and security: managing patient access, processing information requests lawfully, monitoring PHI access, handling retention and destruction, following breach protocols, and ensuring privacy and security compliance.^[2]

Master HIPAA here and you master the biggest block of the test.

2.1 HIPAA Privacy & Patient Access

HIPAA protects Protected health information through two core rules. The Privacy Rule governs how PHI in any form may be used and disclosed and grants patients rights; the Security Rule protects electronic PHI specifically.^[3][4] A covered entity may use PHI for treatment, payment, and health-care operations (TPO) without authorization; most other uses require a valid authorization.

Throughout, the Minimum necessary standard applies — use or disclose only what the purpose requires (treatment is an exception). Patients have rights to access, amend, and receive an Accounting of disclosures.

2.2 Release of Information

Release of information (ROI) is where privacy law meets daily workflow. The administrator monitors ROI workflows and processes requests according to legal and regulatory standards.^[2] Every disclosure runs the same checklist: confirm a valid authorization or permitted purpose, verify the requester’s identity and authority, apply the minimum-necessary standard, check special protections, then disclose, log, and track.

Watch the special-protection traps. Psychotherapy notes get heightened protection and usually require specific authorization. Substance-use disorder records fall under 42 CFR Part 2, which is stricter than HIPAA.

And a subpoena is not a court order — a subpoena generally needs additional assurances (notice or a qualified protective order) before you disclose, while a court order compels disclosure.

2.3 Retention & Destruction

The administrator applies retention and destruction policies for healthcare information.^[2] A Retention schedule sets how long each record type is kept and how it is destroyed. The required period is the strictest of state law, federal rule, accreditation standard, and organizational policy.

When retention ends, records are destroyed by a method that renders PHI unreadable and unrecoverable (e.g., shredding, secure electronic destruction), and a destruction log is retained as proof.

2.4 Security & Breach Response

The Security Rule requires three categories of safeguards for electronic PHI: administrative (risk analysis, workforce training, access management), physical (facility and device controls), and technical (access control, audit controls, integrity, transmission security).^[4] When PHI is impermissibly used or disclosed, the administrator follows the Breach protocol: an impermissible disclosure of unsecured PHI is presumed to be a breach unless a Four-factor risk assessment shows a low probability of compromise.^[5]

Notification timing matters: affected individuals must be notified without unreasonable delay and no later than 60 days from discovery; breaches affecting 500 or more individuals require prompt notice to HHS and the media. HITECH strengthened these rules and extended them to business associates. Encrypted PHI is “secured” — a breach of properly encrypted data generally does not trigger notification.

Module 3 · Data Analytics & Informatics

24% of the exam. This domain is about turning governed data into insight and running the systems that hold it. The administrator develops productivity and summary reports, creates visual representations of data for decision-making, uses database techniques, manages the master patient index, audits documentation, optimizes health IT, supports HIE, and validates healthcare statistics for stakeholders.^[2]

3.1 Healthcare Statistics & Reporting

Healthcare statistics describe and monitor a facility’s performance. The administrator must compute and, critically, validate them before reporting. The most-tested measures are utilization and rate statistics.

3.2 Data Visualization & Databases

Administrators create visual representations of data for decision-making and use database management techniques.^[2] Choosing the right chart is a tested skill: a line graph shows a trend over time, a bar chart compares categories, a histogram shows a frequency distribution, a pie chart shows parts of a whole, and a scatter plot shows the relationship between two variables. On the database side, relational databases organize data into tables linked by keys and are queried with SQL.

3.3 The MPI & Data Integrity

The Master Patient Index is the permanent link between a patient and their unique enterprise identifier, and managing its integrity is an explicit task.^[2] Three error types dominate the exam — and they are not equally dangerous.

A Duplicate (two identifiers for one patient) is merged. An Overlay (one patient’s data under another patient’s identifier) is the most dangerous, because it mixes two patients’ clinical data — a patient-safety emergency that must be unmerged immediately. An overlap (the same patient with different identifiers across facilities) is reconciled in an enterprise MPI (EMPI).

3.4 EHR Systems & Health Information Exchange

The administrator prepares to support end users in EHR applications, optimizes health IT to improve workflow, and supports Health information exchange solutions.^[2] HIE depends on Interoperability — the ability of systems to exchange and use data — built on standards such as HL7 and the modern FHIR standard. The EHR also delivers clinical decision support (alerts, reminders, order sets) at the point of care.

Module 4 · Revenue Cycle Management

16% of the exam. Coding drives money, and the administrator oversees the cycle that turns documented care into collected revenue — validating coding accuracy, conducting CDI, verifying claims, educating providers on value-based care, and preventing fraud.^[2] This is where the RHIA’s coding knowledge is applied at the enterprise, revenue-integrity level — not chart by chart.

4.1 The Revenue Cycle & Claims

The Revenue cycle spans the front end (scheduling, registration, eligibility, authorization), the middle (charge capture, coding, CDI), and the back end (claims, payment posting, denials). HIM and coding sit in the middle — which is why documentation and coding quality determine whether the back end can collect.

Two metrics show up constantly. Discharged not final billed (DNFB) measures accounts discharged but not yet billed — a high DNFB usually signals a coding backlog. Accounts receivable (A/R) days measures how long it takes to collect after billing. Clean claims (no errors) and low denial rates keep both healthy.

4.2 CDI & Coding Validation

Clinical documentation improvement (CDI) improves the accuracy, completeness, and specificity of documentation so it fully reflects severity and supports correct codes. CDI specialists issue compliant, non-leading provider queries to clarify ambiguous, incomplete, or conflicting documentation before coding. The administrator also validates coding accuracy by auditing assigned codes against documentation and official guidelines.^[2][7]

4.3 Reimbursement, Value-Based Care & Fraud

The administrator educates providers on value-based care programs and performs fraud prevention.^[2] Fee-for-service pays per service (rewarding volume); Value-based care ties payment to quality and outcomes, shifting risk to providers through value-based purchasing, bundled payments, and accountable care organizations.^[6] On the integrity side, distinguish Fraud (knowing, intentional misrepresentation — e.g., billing for services not rendered, upcoding) from Abuse (improper practices causing unnecessary cost, without that intent).

Module 5 · Management & Leadership

15% of the exam. This is the domain that most distinguishes the RHIA from the RHIT. The administrator implements organizational strategy, manages people, redesigns processes, prepares budgets, manages contracts, facilitates training, and supports accreditation.^[2] You are being tested as a department leader, not a record processor.

5.1 Strategy & Organizational Leadership

Strategic planning defines the organization’s long-term direction — its mission, vision, and goals — and allocates resources to achieve them, often using a SWOT analysis and a balanced scorecard. The administrator implements strategies that support organizational initiatives,^[2] translating high-level strategy into department objectives, staffing, and process changes. Distinguish leadership (setting vision and motivating change) from management (planning, organizing, and controlling day-to-day operations).

5.2 Human Resource Management

The administrator performs human resource activities — recruiting staff, creating job descriptions, and resolving personnel issues.^[2] A job description defines a position’s duties and reporting relationships; a job specification defines the qualifications a person needs.

Performance is managed through appraisals and, when needed, progressive discipline (verbal warning → written warning → suspension → termination). Staffing is planned in Full-time equivalent (FTE) units against productivity standards.

5.3 Process Improvement & Projects

The administrator performs work design and process-improvement activities.^[2] The core tools: Lean eliminates waste, Six Sigma reduces variation through DMAIC (Define, Measure, Analyze, Improve, Control), and the PDSA cycle (Plan-Do-Study-Act) tests a change on a small scale before spreading it. Projects are planned and tracked with tools like a Gantt chart, guarding scope against scope creep.

5.4 Budgeting, Accreditation & Compliance

The administrator assists with preparing budgets and with entity accreditation, licensing, or certification.^[2] An Operating budget plans day-to-day revenue and expenses (salaries are usually the biggest line); a Capital budget plans major long-term purchases. Variance analysis compares budgeted to actual to control finances.

On the external side, distinguish Accreditation (voluntary, e.g., The Joint Commission) from licensure (mandatory government permission) and certification (meeting defined standards, e.g., CMS Conditions of Participation). All of it runs inside a Compliance program — policies, training, auditing, and reporting.

How to Use This RHIA Study Guide

This guide is built to be worked, not just read. The most efficient path to a pass:

• Study by weight. PHI Compliance (26%) and Data Analytics (24%) are half the exam — start there, then Information Governance (19%), Revenue Management (16%), and Management & Leadership (15%).
• Think like an administrator. The RHIA tests judgment at the department and enterprise level — governance, compliance decisions, revenue integrity, and leadership — not record-by-record processing.
• Use the RHIT guide for the technical side. If you’re shaky on the operational HIM and coding mechanics, our RHIT study guide covers that technician-level material in depth.
• Check off as you go. Use the Study Guide Contents to mark each section done; it raises your exam-readiness score.
• Take every checkpoint. The end-of-module quizzes show you exactly which domains need another pass.
• Drill the weak domain. Send your weak area into the flashcards and a practice test until the score climbs.

RHIA Glossary

The high-yield RHIA terms in one place — hover any dotted term in the guide, or flip the whole deck here as a self-grading flashcard set.

Abuse

Practices inconsistent with sound fiscal or medical practice causing unnecessary cost — improper but not necessarily intentional.

Accounting of disclosures

A patient's HIPAA right to a list of certain disclosures of their PHI made by the covered entity.

Accreditation

Voluntary review by an external body (e.g., The Joint Commission) confirming an organization meets quality standards.

Average length of stay

ALOS — total discharge days for a group of inpatients divided by the number of discharges in the period.

Breach

An impermissible use or disclosure of unsecured PHI that compromises its security or privacy, unless a risk assessment shows low probability of compromise.

Business associate

A person or entity performing functions involving PHI on behalf of a covered entity, bound by a business associate agreement (BAA).

Capital budget

A budget for major, long-term asset purchases such as a new EHR module or scanners.

Case mix index

CMI — the average DRG relative weight for a facility's patients; a measure of clinical complexity that drives reimbursement.

Clinical documentation improvement

CDI — a program improving documentation accuracy and completeness so it supports correct codes and reflects severity.

Compliance program

An organized system of policies, training, auditing, and reporting to prevent and detect violations of law and policy.

Covered entity

Under HIPAA, a health plan, health-care clearinghouse, or provider that transmits health information electronically.

Data dictionary

A documented set of standard definitions for every data element — name, format, allowable values, and meaning — enforcing consistency across systems.

Data governance

A subset of information governance focused specifically on the management, quality, and integrity of an organization's data.

Data integrity

The accuracy, completeness, consistency, and reliability of data throughout its lifecycle — unchanged from source and fit for purpose.

Designated record set

Under HIPAA, the records a covered entity uses to make decisions about an individual — what a patient may access and amend.

Diagnosis-Related Group

DRG — an inpatient classification paying a fixed amount per admission based on diagnoses and procedures.

Discharged not final billed

DNFB — accounts discharged but not yet billed; high values signal revenue-cycle bottlenecks, often in coding.

Duplicate

Two or more records or identifiers created for the same patient — must be merged to preserve a single record.

Four-factor risk assessment

The breach analysis of the PHI involved, who received it, whether it was actually acquired/viewed, and the extent of mitigation.

Fraud

Knowingly submitting false claims or misrepresenting services to obtain payment — illegal under the False Claims Act.

Full-time equivalent

FTE — a unit expressing staffing as the hours of one full-time employee (e.g., two half-time staff = 1.0 FTE).

Health information exchange

HIE — the electronic sharing of health information among organizations to improve coordination of care.

Healthcare statistics

Quantitative measures (census, length of stay, rates) computed from health data to describe and monitor organizational performance.

HIPAA

The Health Insurance Portability and Accountability Act — federal law setting national standards to protect health information.

HITECH

The Health Information Technology for Economic and Clinical Health Act, which strengthened HIPAA enforcement and added breach notification.

Incidence rate

The number of new cases of a condition in a population over a period.

Information governance

An organization-wide framework of accountability, policies, and decision rights for managing information as a strategic asset across its lifecycle.

Interoperability

The ability of different information systems and devices to exchange and use data, often via HL7 or FHIR standards.

Legal health record

The formally defined subset of records an organization discloses as its official business record in response to a legal request.

Master Patient Index

The MPI — the permanent database linking every medical record number a patient has to one unique enterprise identifier.

Minimum necessary

The HIPAA principle of using, disclosing, or requesting only the least PHI needed to accomplish the intended purpose.

Operating budget

A budget for day-to-day revenue and expenses (salaries, supplies) over a fiscal year.

Overlay

One patient's information recorded under another patient's identifier — a serious patient-safety error to resolve immediately.

PDSA cycle

Plan-Do-Study-Act — an iterative method for testing and implementing a process change on a small scale first.

Prevalence rate

The number of existing cases (new and old) of a condition in a population at a point in time.

Privacy Rule

The HIPAA rule setting national standards for how PHI may be used and disclosed and granting patients rights over their information.

Protected health information

PHI — individually identifiable health information held or transmitted by a covered entity or business associate, in any form.

Release of information

ROI — the HIM process of validating, fulfilling, and tracking requests for copies of a patient's health information.

Retention schedule

A policy specifying how long each record type is kept and how it is destroyed when retention ends.

Revenue cycle

All clinical and administrative functions that capture, manage, and collect patient-service revenue, from scheduling to final payment.

Security Rule

The HIPAA rule requiring administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Six Sigma

A data-driven methodology (DMAIC) that reduces process variation and defects.

Strategic planning

Defining an organization's long-term direction and allocating resources to achieve its mission, vision, and goals.

SWOT analysis

A planning tool assessing internal Strengths and Weaknesses and external Opportunities and Threats.

Value-based care

Reimbursement tied to quality and outcomes rather than volume, shifting financial risk toward providers.

RHIA Study Guide FAQ

References

1. 1.American Health Information Management Association. “Registered Health Information Administrator (RHIA) Certification.” ahima.org. ↑
2. 2.American Health Information Management Association. “RHIA Exam Content Outline (effective 03/01/2021).” ahima.org. ↑
3. 3.U.S. Department of Health & Human Services. “HIPAA for Professionals: The Privacy Rule.” hhs.gov. ↑
4. 4.U.S. Department of Health & Human Services. “HIPAA for Professionals: The Security Rule.” hhs.gov. ↑
5. 5.U.S. Department of Health & Human Services. “HIPAA Breach Notification Rule.” hhs.gov. ↑
6. 6.Centers for Medicare & Medicaid Services. “Medicare Value-Based Programs.” cms.gov. ↑
7. 7.Centers for Medicare & Medicaid Services. “ICD-10 and Official Coding Guidelines.” cms.gov. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

Follow Us:

All Posts