Related Laws and Data Analysis

Which is the correct description of "authenticity" among the 3 criteria for electronic storage of medical records?

1. Only authorized persons can access the information, and its content is kept from being known to third parties
2. Recorded information is stored, for the period prescribed by laws and regulations, in a state that maintains authenticity and can be made readable
3. For records created under legitimate authority, false entry, rewriting, erasure, and mixing are prevented, and responsibility for creating the record is clear to third parties
4. Content stored on electronic media can, at the request of an authorized person, easily be made readable to the naked eye as needed, and can be printed on paper as needed

Which is the correct description of "legibility" among the 3 criteria for electronic storage of medical records?

1. Content stored on electronic media can, at the request of an authorized person, easily be made readable to the naked eye as needed
2. Recorded information is stored, for the period prescribed by laws and regulations, in a state that maintains authenticity and remains readable
3. The system is kept available so that users can use it whenever needed
4. For records created under legitimate authority, false entry, rewriting, erasure, and mixing are prevented, and responsibility for creation is clear

Which is the correct description of "preservability" among the 3 criteria for electronic storage of medical records?

1. Recorded information is stored, for the period prescribed by laws and regulations, in a state that maintains authenticity and can be made readable
2. The information is accurate and complete, with no falsification or omission
3. Stored content can, at the request of an authorized person, easily be made readable to the naked eye as needed and can also be printed on paper
4. Responsibility for creating the record is clear to third parties

Which measure in an electronic medical record contributes directly to ensuring authenticity?

1. Distributing backup data across facilities at remote locations for storage
2. Shortening screen response times to improve usability
3. Copying data to new media before the storage media degrades
4. Saving, as an update history, the user who finalized a record and the date and time

Which is an appropriate measure for ensuring legibility in electronic storage of medical records?

1. Migrating storage media to a new format before the standard changes
2. Attaching the responsible creator's digital signature and a timestamp to scanned documents
3. Prohibiting shared user IDs and authenticating each individual
4. Preparing alternative means of reading so medical records can be consulted even during system failures

Which is an appropriate measure for ensuring preservability in electronic storage of medical records?

1. Providing functions to display records on screen and print them on paper at the request of authorized persons
2. Introducing two-factor authentication to prevent impersonation
3. Migrating to new media and formats in preparation for media degradation and standard changes during the statutory retention period
4. Having the finalizing person approve records entered by proxy

Which is correct about the relationship between the e-Document Act (e-文書法) and electronic storage of medical records?

1. With the enforcement of the e-Document Act, creating and storing paper medical records was prohibited
2. The e-Document Act itself prescribes the specific technical measures and operational criteria for ensuring the authenticity, legibility, and preservability of medical records
3. The e-Document Act is a law governing electronic storage of books and documents related to national taxes
4. It is a law that generally permits electromagnetic storage of documents whose paper storage is required by law, and by MHLW ministerial ordinance medical records are also covered

Which is the correct way of thinking when electronic medical record data is stored with an external service provider?

1. If external storage is outsourced, the duty to store the records and the responsibility transfer to the contractor
2. In external storage, the 3 criteria of authenticity, legibility, and preservability need not be met
3. Even when external storage is outsourced, the duty to store the records and the responsibility remain with the healthcare institution
4. For external storage, only the contractor needs to consider measures to protect personal information

Which body formulates the "Guidelines for the Safety Management of Medical Information Systems"?

1. The Personal Information Protection Commission
2. The Ministry of Internal Affairs and Communications
3. The Ministry of Economy, Trade and Industry
4. The Ministry of Health, Labour and Welfare

Which structure was adopted in version 6.0 of the Guidelines for the Safety Management of Medical Information Systems?

1. General provisions volume, technology volume, operations volume, audit volume, and forms volume
2. Management volume, legislation volume, network volume, and cloud volume
3. Overview volume, physician volume, nurse volume, pharmacist volume, and clerical staff volume
4. Overview volume, governance volume, planning and management volume, and system operation volume

In the Guidelines for the Safety Management of Medical Information Systems (version 6.0 and later), which volume is aimed mainly at staff who plan and manage the practical work of safety management, covering preparation of operating management regulations, risk assessment, and contractor management?

1. The system operation volume
2. The planning and management volume
3. The overview volume
4. The governance volume

Which is the correct combination making up the so-called 3-ministry, 2-guideline framework for handling medical information?

1. The MHLW's Guidelines for the Safety Management of Medical Information Systems, and the METI-MIC Safety Management Guidelines for Providers of Information Systems and Services Handling Medical Information
2. The MIC's guidelines for cloud service providers handling medical information, and the METI guidelines for contracted information processing providers
3. The Personal Information Protection Commission's guidelines and the Japan Medical Association's clinical information handling guidance
4. The MHLW's Guidelines for the Safety Management of Medical Information Systems, and the Ministry of Education's research ethics guidelines

Which is correct about responsibility when a healthcare institution outsources operation of its medical information system to a service provider?

1. If stipulated in the contract, the institution can be fully released from its responsibility to patients
2. Because the contractor performs safety management, there is no need to define the demarcation of responsibility in the contract
3. Even when outsourcing, the institution bears the ultimate responsibility to patients
4. Once outsourced, accountability to patients for information leaks transfers to the contractor

Which is the appropriate approach to backups as a ransomware countermeasure in healthcare institutions?

1. Keep multiple generations of backups offline or in areas that cannot be rewritten
2. To speed up recovery, keep only 1 generation of backups in the same area as the production server, permanently connected
3. Systems not connected to external networks need no backups
4. As long as backups exist, investigating the infection route and preventing recurrence are unnecessary

Which is the appropriate approach to contingency response (BCP) for a healthcare institution's information systems?

1. When a system failure occurs, keep no records about care until recovery
2. Define the procedures for switching to paper operation in advance and drill them in normal times
3. As long as backups are taken, recovery procedures need not be documented
4. The BCP covers only natural disasters and does not include cyberattacks

Which volume was newly added in version 7.0 of the Guidelines for the Safety Management of Medical Information Systems, issued in June 2026 (Reiwa 8)?

1. An audit volume
2. A maintenance contractor volume
3. A patient volume
4. A cloud services volume

Which of the following falls under special care-required personal information (要配慮個人情報) in the Act on the Protection of Personal Information?

1. The patient's medical history
2. The patient's income
3. The patient's nationality
4. The patient's telephone number

Which is correct about handling special care-required personal information?

1. When handled by healthcare institutions, it is exempt from the Act on the Protection of Personal Information
2. It can be provided to third parties by opt-out if notified to the Personal Information Protection Commission
3. Obtaining it requires, in principle, the person's prior consent
4. It cannot be obtained even with the person's consent

Which is correct about anonymized information and pseudonymized information under the Act on the Protection of Personal Information?

1. Anonymized information may remain in a state where a specific individual can be identified by matching it against other information
2. Pseudonymized information is information processed so that restoring the original personal information is technically impossible even by matching against other information
3. Anonymized information is processed so that no specific individual can be identified or restored, and can be provided to third parties without consent, subject to duties such as public disclosure
4. Pseudonymized information can be provided freely to third parties without the person's consent

Which of the following falls under individual identification codes in the Act on the Protection of Personal Information?

1. The patient's name and address
2. The symbol and number on a public health insurance card
3. The patient's date of birth and sex
4. The patient's mobile phone number and email address

Which is a correct description of the Next-Generation Medical Infrastructure Act (次世代医療基盤法)?

1. A law stipulating that healthcare institutions must always obtain the person's written consent to provide medical information for research
2. A law that abolished the Act on the Protection of Personal Information and unified protection of personal information in healthcare
3. A law establishing a mechanism in which government-certified businesses collect medical information from healthcare institutions, anonymize it, and provide it for research and development
4. A law stipulating that any private company can run an anonymized medical information business simply by filing a notification

Which is correct about how healthcare institutions provide medical information to certified anonymized medical information producers under the Next-Generation Medical Infrastructure Act?

1. Provision is possible after notifying the person in advance, unless the person or a bereaved family member requests that it stop
2. Provision is possible only after the institution itself has anonymized the information
3. Once deemed to have consented, the person cannot stop the provision even on request
4. Because medical information includes special care-required personal information, provision to certified businesses is entirely impossible

Which reflects the thinking of the "Guidance on the Proper Handling of Personal Information by Medical and Long-term Care Businesses"?

1. If the purposes of use are published, for example by posting in the facility, implied consent can be assumed for uses within the scope normally needed for care
2. Even where based on laws and regulations, provision to third parties always requires the person's consent
3. The purposes of use of personal information need be explained only when a patient asks
4. Even for uses within the scope normally needed for care, such as outsourcing tests, written consent must be obtained for each use

Which is an advantage of using a data warehouse (DWH) when analyzing hospital information system data?

1. The DWH becomes the original medical record, fulfilling the statutory storage duty
2. Data for analysis can be extracted without putting load on the operational databases
3. Screen responses in daily work such as order entry become faster
4. Using a DWH eliminates the need to preprocess missing values and outliers

Which is the appropriate handling of missing values in analyzing medical data?

1. Check why the values are missing and decide the handling — exclusion, imputation, and so on — according to the purpose of the analysis
2. Always exclude items containing missing values from the analysis, regardless of the reason
3. Missing values occur at random, so they can simply be ignored in aggregation
4. Treat all missing values as 0 and aggregate as-is

Which is the appropriate handling of outliers in analyzing medical data?

1. A dataset containing even 1 outlier cannot be used for analysis
2. Check whether each is an input error or a genuine abnormal value, and then decide the handling
3. Replace outliers with the mean automatically, without checking
4. Outliers are always input errors, so delete them all when found

Which is a correct description of "nayose" (record linkage) in preprocessing medical data?

1. Filling in missing values using statistical methods
2. When the same person has multiple patient IDs or records with inconsistent spellings, matching and merging them into that person's data
3. Deleting or replacing identifiers such as names and addresses so that no specific individual can be identified
4. Sorting the patient list into Japanese syllabary order

Which is the correct description of a hospital data warehouse (DWH)?

1. A core operational system that directly handles data entry in daily clinical work
2. A database that consolidates and accumulates data from each system for analysis and holds it in time series
3. A system for staff payroll and attendance management
4. A system for storing medical images and viewing them from terminals in the hospital

Which shows a correct understanding of the characteristics of hospital information system data when used for management analysis or quality-of-care evaluation?

1. Claims data contains the numerical results of every laboratory test
2. Disease names on insurance claims include names assigned for billing purposes and do not necessarily match the confirmed diagnosis
3. DPC data is research-only data collected with no relation to the medical fee system
4. Hospital information system data is designed for analysis, so extracts can be used for analysis as-is

Which of the following is not an appropriate point of care when putting data accumulated in a hospital information system to secondary use in clinical research?

1. When using it for research, follow the relevant frameworks such as personal information protection law and research ethics guidelines
2. Take into account the history of master and code revisions accompanying medical fee schedule revisions
3. Extract data after clearly defining the target patients, target period, and exclusion criteria
4. Electronic medical record data is designed for research, so extracted data can be used for analysis as-is