Chapter 3 of 518% of exam
Administrative and Legal Practice: HIPAA, Scope, Documentation, and Billing
This domain tests the rules that keep a medical office lawful and functional: patient privacy, the limits of your own scope of practice, consent, accurate charting, scheduling, and the basics of insurance and coding. Most questions here are about what you may do, what you must do, and what you must never do.
HIPAA and patient confidentiality
HIPAA sets the federal floor for protecting individually identifiable health information in any form, spoken, written, or electronic. Every staff member in the office is bound by it, and violations carry civil and criminal penalties as well as termination. The safest habit is to share the least amount of information with the fewest people needed to do the job.
Protected health information
PHI is any health information that can identify a patient, including name, address, dates, phone number, email, medical record number, insurance number, and photographs. Removing identifiers is what makes data de-identified.
HIPAA Privacy RuleMinimum necessary standard
Access, use, and disclose only the smallest amount of PHI needed to accomplish the purpose. This standard does not apply to disclosures to the patient or to the treating provider for treatment purposes.
HIPAA Privacy RuleTreatment, payment, and operations
Disclosures for treatment, payment, and health care operations generally do not require the patient's written authorization. Marketing, sale of PHI, and most psychotherapy notes do require specific written authorization.
HIPAA Privacy RuleNotice of Privacy Practices
The practice must give each patient a Notice of Privacy Practices describing how PHI is used and disclosed, and must make a good-faith effort to obtain written acknowledgment of receipt.
HIPAA Privacy RuleSecurity Rule safeguards for electronic PHI
Electronic PHI requires administrative safeguards such as workforce training, physical safeguards such as locked workstations, and technical safeguards such as unique user IDs, automatic logoff, and encryption.
HIPAA Security RuleBreach notification
Following a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 days from discovery, with additional notice to the Secretary of HHS and, for large breaches, the media.
HIPAA Breach Notification RuleScope of practice, delegation, and informed consent
A medical assistant is an unlicensed clinical professional who works under the delegation and supervision of a licensed provider, and the exact boundaries are set by state law. Performing a task outside your scope exposes you and your employer to liability, no matter who told you to do it. If a task requires independent clinical judgment, it is almost certainly outside your scope.
Delegated authority, not independent authority
Medical assistants act on the specific delegation of a supervising physician or provider. Scope varies by state, so verify your state's rules rather than assuming a task allowed in one state is allowed in another.
Tasks generally outside the MA scope
Medical assistants generally do not diagnose, do not independently triage or assess, do not give medical advice by telephone beyond provider-approved protocols, and in most states do not administer intravenous medications or perform independent nursing assessments.
Elements of informed consent
Valid informed consent requires the nature of the procedure, the risks and benefits, reasonable alternatives, the risks of refusing, and the patient's voluntary agreement. The provider must obtain and explain consent; the medical assistant may witness the signature.
Implied versus expressed consent
Implied consent is inferred from the patient's actions, such as rolling up a sleeve for an injection, or from an emergency in which the patient cannot respond. Expressed consent is stated in words and is documented in writing for invasive procedures.
Consent for minors
A parent or legal guardian consents for a minor, except where state law allows a mature or emancipated minor, or a minor seeking care for specific conditions, to consent independently.
Liability terms you must know
Negligence is failing to act as a reasonable person would, malpractice is professional negligence, standard of care is what a similarly trained person would do, and respondeat superior makes the employer responsible for employees acting within their duties.
SOAP documentation and medical records
The medical record is a legal document, a communication tool, and the basis for billing. It must be accurate, timely, legible, objective, and complete, and it must never be altered to hide something. Chart what you observed and what you did, using facts rather than opinions.
The SOAP format
S is subjective information the patient reports, O is objective data such as vital signs and exam and laboratory findings, A is the provider's assessment or impression, and P is the plan including treatment, medications, testing, and follow-up.
Correcting a paper record
Draw a single line through the error so the original remains readable, write the word error or the correction above or beside it, then add your initials and the date. Never erase, black out, or use correction fluid.
Late entries and addenda
Label a delayed entry as a late entry, state the date and time of the event and the date and time of the entry, then sign it. In an electronic record the system creates an audit trail automatically.
Objective, factual charting
Record what you can see, hear, measure, or quote, such as patient states she vomited twice, rather than subjective labels such as patient seems drunk or patient is uncooperative.
Ownership versus access
The physical record or its electronic file belongs to the practice, but the information in it belongs to the patient. Patients have a right to inspect and obtain a copy of their record, generally within 30 days of a request.
HIPAA Right of AccessRetention
Retention periods are set by state law and payer rules, commonly several years for adults, while records for minors are typically kept until the patient reaches the age of majority plus an additional period.
Scheduling and patient flow
Efficient scheduling reduces wait times, prevents provider downtime, and gets urgent patients seen quickly. The first step is always to build the matrix, blocking out the times the provider is unavailable. Every scheduling decision should balance patient need against realistic appointment length.
Matrix the schedule first
Block hospital rounds, meetings, lunch, vacations, and any other unavailable time before booking a single patient, so appointments are never made when the provider cannot be there.
Common scheduling systems
Stream scheduling gives each patient a specific time slot, wave scheduling books several patients at the top of the hour, modified wave staggers arrivals within the hour, double booking places two patients in the same slot, and open hours lets patients come without appointments.
Clustering and grouping
Clustering books similar visit types together, such as all physicals in one morning, which streamlines room setup and equipment use and reduces turnover time.
Triage urgent symptoms immediately
Chest pain, difficulty breathing, uncontrolled bleeding, signs of stroke, severe allergic reaction, and suicidal statements are escalated to the provider or to emergency services at once rather than given the next available appointment.
Document no-shows and cancellations
Record every no-show, cancellation, and reschedule in both the appointment system and the patient's chart, because repeated no-shows are clinically and legally significant.
Referrals and prior authorization
Many plans require prior authorization or a referral before a specialty visit, imaging, or surgery. Obtaining it before the service protects the patient from a denied claim.
Insurance, coding basics, and patient communication
Coding translates the visit into the standardized language payers use, and communication translates the visit into language the patient can act on. Diagnosis codes explain why a service was needed and procedure codes explain what was done. Errors in either area cost the practice money and cost the patient trust.
ICD versus CPT versus HCPCS
ICD-10-CM codes report the diagnosis or reason for the visit, CPT codes report the procedures and services performed, and HCPCS Level II codes report supplies, durable medical equipment, and certain drugs and services.
ICD-10-CM code structure
Codes are three to seven characters, always begin with a letter, and must be reported to the highest level of specificity available. Never code a suspected diagnosis in the outpatient setting; code the signs and symptoms instead.
Evaluation and management codes
Office visits are reported with evaluation and management CPT codes, and modifiers are two-character additions that explain a special circumstance without changing the definition of the code.
Core insurance vocabulary
The premium is the recurring cost of coverage, the deductible is what the patient pays before benefits begin, the copay is a fixed per-visit amount, coinsurance is a percentage split, and the out-of-pocket maximum caps annual patient cost.
Major payer types
Medicare Part A covers hospital care, Part B covers outpatient and provider services, Part C is Medicare Advantage, and Part D covers prescription drugs, while Medicaid is jointly funded with each state, TRICARE covers military families, and workers' compensation covers job-related injury.
CMSCommunicating so the patient can act
Use plain language, avoid jargon, and confirm understanding with the teach-back method by asking the patient to explain the plan in their own words. Use a qualified interpreter for patients with limited English proficiency rather than family members or minors.
HHS National CLAS StandardsTest your knowledge
Practice questions on Administrative and Legal Practice: HIPAA, Scope, Documentation, and Billing
← Previous
Clinical Procedures: Injections, EKG, Phlebotomy, and Instrument Processing
Next →
Infection Control and Workplace Safety
Last updated: July 2026