CERTIFIED TUMOR
REGISTRAR CTR ODS 2026
PRACTICE EXAM
COMPLETE
Question 1: A state law requires a hospital cancer registry to report newly
diagnosed malignancies to the state central registry. Which action best supports compliant reporting?
Choices:
1) Transmit the required data through the approved secure reporting process without obtaining a separate patient authorization when the law permits mandatory reporting 2) Wait for a signed patient authorization before every submission 3) Send the complete medical record by ordinary email 4) Report only cases for patients who are still receiving treatment at the hospital Correct Answer: Transmit the required data through the approved secure reporting process without obtaining a separate patient authorization when the law permits mandatory reporting Explanation: Cancer reporting statutes can authorize mandatory reporting to a public health registry. The registrar should follow the applicable law and the approved secure reporting method rather than adding an authorization requirement that the law does not require.Page 1
Question 2: A registrar needs access to pathology reports to perform case�nding but does not need access to employee payroll records. Which privacy principle is best illustrated?
Choices:
1) All hospital employees should have identical access to all information systems 2) Registry sta� should use shared passwords so coverage is easier 3) Access restrictions apply only to paper records 4) Access should be limited to information needed for the registrar’s assigned duties Correct Answer: Access should be limited to information needed for the registrar’s assigned duties Explanation: Role-based access supports the minimum-necessary concept by limiting users to information required for their work. Unrelated payroll data is not needed for cancer registry duties.Question 3: Which control most directly reduces the risk that an unattended registry workstation exposes protected health information?
Choices:
1) A larger monitor 2) A faster network connection 3) Automatic screen locking that requires reauthentication 4) A shared generic user account
Correct Answer: Automatic screen locking that requires reauthentication
Explanation: Automatic locking prevents casual viewing or use of a workstation when the authorized user steps away. Reauthentication also preserves accountability for system access.Page 2
Question 4: A researcher requests a dataset from which direct identi�ers have been removed and the risk of re-identi�cation has been appropriately addressed. What is the primary privacy advantage of this dataset?
Choices:
1) It guarantees that every research project is exempt from review 2) It reduces the chance that individual patients can be identi�ed from the released information 3) It permits publication of passwords used to access the registry 4) It eliminates the need for any data security controls Correct Answer: It reduces the chance that individual patients can be identi�ed from the released information Explanation: De-identi�cation is intended to reduce the ability to link data to a speci�c person.It does not remove all security responsibilities or automatically exempt every project from oversight.Question 5: An investigator wants identi�able registry data for a study and cannot practically obtain authorization from every patient. What should the registrar look for before releasing the data?
Choices:
1) Documented approval or waiver from the appropriate privacy and research oversight process 2) A verbal request from any member of the research team 3) Proof that the investigator has published before 4) A promise that the data will be deleted someday Correct Answer: Documented approval or waiver from the appropriate privacy and research oversight process Page 3