NHA Medical Billing & Coding (CBCS) — All Questions

If a service is specifically excluded (non-covered) under the patient's plan, the patient is generally:

• a.Entitled to have the provider write off the entire charge
• b.Covered at the standard in-network rate
• c.Not responsible for any part of the payment
• d.Responsible for the full charge, since the plan pays nothing✓

A non-covered (excluded) service is not a plan benefit, so the patient owes the full amount. This differs from a covered service that is denied for other reasons. Informing the patient in advance supports collection and transparency.

The most effective time to collect a patient copayment is:

• a.When the account has already reached collections
• b.At the time of service, during check-in or checkout✓
• c.Solely after the deductible is fully satisfied
• d.Only after the claim has been denied

Copays are due at the time of service, and collecting then improves cash flow and lowers bad debt. Waiting until after billing makes collection harder and costlier. Point-of-service collection is a revenue-cycle best practice.

Collecting known patient responsibility at the point of service primarily helps the practice by:

• a.Increasing the Medicare conversion factor
• b.Eliminating the need to file any claim
• c.Reducing bad debt and the cost of billing patients later✓
• d.Raising the payer's contracted allowed amount for the services

Point-of-service collection captures money while the patient is present, cutting later statement and collection costs. Balances left to bill after the visit are harder to collect. It lowers accounts receivable and bad debt.

A patient has $200 left on the deductible. A service has an allowed amount of $700 with 20% coinsurance applied after the deductible. Total patient responsibility is:

• a.$700
• b.$140
• c.$200
• d.$300✓

The patient first pays the $200 deductible, leaving $500 of the allowed amount subject to coinsurance. Twenty percent of $500 is $100, so total responsibility is $200 + $100 = $300. The payer pays the remaining $400.

A service has an allowed amount of $450, the deductible is already met, and coinsurance is 30%. The patient owes:

• a.$135✓
• b.$150
• c.$315
• d.$450

Coinsurance is calculated on the allowed amount, so 0.30 x $450 = $135. The payer covers the remaining 70 percent, or $315. Coinsurance is always a percentage of the allowed amount, not the billed charge.

A participating provider bills $1,500 and the payer's allowed amount is $900. The contractual write-off is:

• a.$600✓
• b.$1,500
• c.$900
• d.$300

A participating provider accepts the allowed amount as payment in full, so the write-off is $1,500 - $900 = $600. That contractual adjustment cannot be billed to the patient. Only cost-sharing based on the $900 allowed amount is collectible.

Two procedures are performed in one session. The primary is allowed at $1,000 (100%) and the second is subject to a 50% multiple-procedure reduction on its $600 allowed amount. The total allowed is:

• a.$800
• b.$1,600
• c.$1,500
• d.$1,300✓

The second procedure is reduced by 50 percent, so $600 becomes $300, and the total allowed is $1,000 + $300 = $1,300. Multiple-procedure reductions apply to the lesser procedures in a session. The primary procedure is paid at full allowed amount.

A patient has reached the plan's out-of-pocket maximum for the year. For the next covered, in-network service the patient generally owes:

• a.Only the contractual write-off portion
• b.The full billed charge for the service, because the maximum resets at each visit
• c.The usual 20% coinsurance amount
• d.Nothing, since the plan then pays 100% of covered services✓

Once the out-of-pocket maximum is met, the plan pays 100 percent of covered in-network services for the rest of the benefit period. Premiums still apply but do not count toward the maximum. Verifying this helps set correct patient expectations.

An account moved to 'bad debt' differs from a 'charity' write-off in that bad debt is:

• a.The same thing as a patient copayment
• b.An amount deemed uncollectible after real collection efforts✓
• c.Always rebilled to the insurance payer
• d.A contractual adjustment that the payer requires to be written off

Bad debt is written off when the practice cannot collect despite reasonable effort, while charity (financial assistance) is granted intentionally based on documented need. Both remove a balance but for different reasons. Consistent policies govern each.

The federal Fair Debt Collection Practices Act (FDCPA) primarily regulates:

• a.How providers assign CPT procedure codes
• b.The layout of the CMS-1500 claim form
• c.The Medicare physician fee schedule amounts
• d.The conduct of third-party debt collectors✓

The FDCPA restricts abusive or deceptive practices by third-party debt collectors, which affects how overdue medical balances may be pursued. It generally targets outside collection agencies rather than the original creditor. Compliance protects patients and the practice.FDCPA

Under the Affordable Care Act, an identified overpayment from Medicare or Medicaid generally must be reported and returned within:

• a.The following calendar year only
• b.24 hours of receiving any payment
• c.60 days of identifying the overpayment✓
• d.10 years of the date of service

The ACA requires reporting and returning an identified overpayment within 60 days. Keeping a known overpayment past that window can create False Claims Act liability. Prompt refunds are a compliance necessity.CMS

A 'credit balance' on a patient account usually means that:

• a.The claim has not yet been submitted to the payer
• b.The account was overpaid and a refund or adjustment may be owed✓
• c.The patient still owes an additional amount on the account balance
• d.The provider undercharged for the service

A credit balance signals overpayment, often from a duplicate payment or combined primary and secondary payments. Credit balances must be reviewed and resolved, and Medicare uses the CMS-838 credit balance report. Ignoring them creates compliance risk.

If both primary and secondary insurers pay and the combined payment exceeds the allowed amount, the provider should:

• a.Bill the patient for the difference
• b.Refund the overpayment to the correct party✓
• c.Keep the extra amount as additional revenue
• d.Ignore it as long as the amount is small

Payments exceeding the allowed amount create a credit balance that must be refunded to the correct party. Retaining a known overpayment can trigger False Claims Act exposure. Coordination of benefits limits total payment to the allowed amount.

A 'contractual adjustment' on a participating provider's account represents:

• a.An amount the payer still owes the provider after the patient coinsurance is applied
• b.The patient's coinsurance obligation
• c.The charge above the allowed amount, written off per contract✓
• d.A penalty assessed for late filing

The contractual adjustment is the portion of the charge above the contracted allowed amount that a participating provider agrees to write off. It is not billable to the patient. Only deductible, copay, or coinsurance based on the allowed amount is collectible.

A 'predetermination of benefits' obtained from a payer is:

• a.The final remittance advice for the claim
• b.An advance estimate of what the plan will likely cover✓
• c.A demand for immediate full payment directly from the patient
• d.A binding guarantee of full payment

A predetermination estimates coverage before a service is rendered, helping set patient expectations. Unlike some prior authorizations, it is generally not a payment guarantee. Final payment still depends on eligibility and claim adjudication.

Sending patients periodic statements for balances remaining after insurance has paid is part of:

• a.The charge-capture step
• b.Front-end patient registration
• c.The back-end collections process of the revenue cycle✓
• d.Insurance eligibility verification performed during front-end registration

Patient billing and collections occur on the back end, after claims are adjudicated and payments posted. Statements show the balance the patient owes. Effective follow-up here improves cash flow and reduces bad debt.

Practices often set a 'small balance write-off' threshold because:

• a.Collecting small balances is prohibited by law
• b.Doing so increases the contracted allowed amount
• c.Payers legally require all small balances to be waived
• d.The cost of billing tiny balances can exceed the amount owed✓

Writing off very small balances under a consistent policy avoids spending more on statements than the balance is worth. The policy must be applied uniformly, not selectively. Routine waiver of cost-sharing, however, can raise compliance concerns.

Routinely waiving Medicare patient copayments and deductibles without a genuine financial-hardship determination can:

• a.Have no compliance implications whatsoever
• b.Violate fraud and abuse laws by inducing use of services✓
• c.Always be required under the HIPAA Privacy Rule
• d.Increase the Medicare-approved amount for the service

Routine, blanket waiver of cost-sharing can be viewed as an unlawful inducement and can misstate the actual charge to Medicare. Case-by-case waivers based on documented hardship are permitted. Blanket waivers are a recognized fraud and abuse risk.CMS

A retrospective (cost-based) reimbursement method pays the provider:

• a.After services are delivered, based on the costs actually incurred✓
• b.A fixed amount set before any care is given
• c.A single monthly rate per enrolled member
• d.Nothing at all until the patient reaches the out-of-pocket maximum

Retrospective, cost-based payment reimburses providers after the fact for allowable costs. Prospective systems such as DRGs and APCs instead set rates in advance. The prospective model shifts more financial risk to the provider.

Billing a routine follow-up visit that falls within a surgery's global period will typically result in:

• a.An automatic increase in the assigned inpatient DRG weight
• b.A denial, since routine post-op care is already bundled✓
• c.A refund issued to the patient
• d.A separate full payment for the follow-up visit

The global surgical package includes routine postoperative care, so related follow-up visits are not paid separately during the global period. Unrelated care or a return to the operating room may be billed with an appropriate modifier. Otherwise the visit is denied as included.

In some managed-care contracts, a 'withhold' is:

• a.The patient's coinsurance amount
• b.A financial penalty charged to the patient
• c.An extra bonus automatically added to every claim
• d.Payment held back, returned only if targets are met✓

A withhold reserves part of the provider's payment, released only if cost or quality goals are achieved. It aligns provider behavior with the plan's targets in risk arrangements. Failing to meet targets can forfeit the withheld amount.

The 'paid amount' on a remittance differs from the 'allowed amount' because the paid amount:

• a.The allowed amount minus patient responsibility✓
• b.Includes the contractual write-off portion
• c.Equals the provider's full billed charge
• d.Is always larger than the allowed amount

The allowed amount is the maximum the payer recognizes, while the paid amount is what the payer actually sends after subtracting deductible, copay, and coinsurance. The remaining patient responsibility is billed to the patient or a secondary payer. Reconciling the two ensures correct posting.

If a claim is denied solely for exceeding the payer's timely-filing limit, the balance usually:

• a.Increases the provider's contracted fee schedule
• b.Must be paid in full by the patient
• c.Cannot be billed to the patient; it is a provider loss✓
• d.Is automatically reprocessed and paid

Missing the timely-filing deadline is generally the provider's error, so the amount is not patient responsibility and becomes a write-off. Tracking deadlines prevents this avoidable revenue loss. Some payers allow appeals with proof of timely submission.

Verifying eligibility and benefits before a visit supports reimbursement mainly by:

• a.Eliminating the need to submit a claim
• b.Assigning the diagnosis codes for the encounter
• c.Confirming coverage and cost-sharing before the visit✓
• d.Setting the hospital's inpatient DRG weight

Eligibility verification, often via the 270/271 transactions, confirms active coverage and reveals copays, deductibles, and authorization requirements. This front-end step reduces denials and clarifies what to collect. It protects revenue before services are rendered.

A provider bills $1,000; the allowed amount is $400; the deductible is met and coinsurance is 20%. The patient's coinsurance is:

• a.$400
• b.$120
• c.$200
• d.$80✓

Coinsurance is 20 percent of the allowed amount, so 0.20 x $400 = $80. The $600 difference between the billed charge and the allowed amount is a contractual write-off. The payer pays the remaining $320 of the allowed amount.

Which agency is responsible for enforcing the HIPAA Privacy and Security Rules?

• a.The HHS Office for Civil Rights (OCR)✓
• b.The Internal Revenue Service
• c.The Office of Inspector General
• d.The Federal Trade Commission

The HHS Office for Civil Rights investigates HIPAA complaints and can impose penalties for violations. The OIG focuses on fraud, waste, and abuse in federal health programs. Knowing the enforcer helps staff understand HIPAA accountability.HIPAA

Under HIPAA, PHI may be used or disclosed WITHOUT patient authorization for:

• a.Treatment, payment, and health care operations✓
• b.Any purpose the staff member chooses
• c.Selling patient lists to outside marketers
• d.Posting patient cases on social media

HIPAA permits use and disclosure for treatment, payment, and health care operations (TPO) without authorization. Most other uses, such as marketing or sale of PHI, require the patient's written authorization. Billing falls under the permitted payment purpose.HIPAA

Health information that has been properly de-identified under HIPAA:

• a.Can never be used for any research purpose
• b.Must be reported to the Office for Civil Rights
• c.Still requires a signed business associate agreement
• d.Is no longer PHI subject to the Privacy Rule✓

Properly de-identified data, using Safe Harbor removal of the 18 identifiers or expert determination, is not PHI and is not subject to Privacy Rule limits. Re-identification would restore protection. De-identification enables broader analytic use.HIPAA

Protected health information (PHI) under HIPAA includes identifiable health information that is:

• a.Oral, paper, or electronic✓
• b.Only information written on paper charts
• c.Only information stored in electronic systems
• d.Only information that is spoken aloud

PHI covers individually identifiable health information in any form, including spoken, written, and electronic. The Security Rule adds specific safeguards for electronic PHI (ePHI). Staff must protect PHI regardless of its format.HIPAA

If a patient pays in full out of pocket and asks the provider not to disclose that service to the health plan, HIPAA requires the provider to:

• a.Refuse the patient's request and bill the plan anyway
• b.Honor the restriction and withhold it from the plan✓
• c.Charge the patient an additional penalty
• d.Report the patient's request to Medicare

Under HITECH-era rules, a provider must grant a requested restriction when the patient pays in full out of pocket for the service. This is one restriction request the provider cannot decline. It gives patients control over disclosures to their plan.HIPAA

The HIPAA right to an 'accounting of disclosures' allows a patient to:

• a.View other patients' medical records
• b.Set the provider's fee schedule
• c.Request a list of certain disclosures of their PHI✓
• d.Demand the practice's internal financial statements

Patients may request an accounting of specified disclosures of their PHI over a defined period, generally excluding routine TPO disclosures. It is one of several patient rights under the Privacy Rule. The practice must respond within required timeframes.HIPAA

An 'incidental' disclosure of PHI, such as a patient overhearing a name at a counter, is permitted under HIPAA when the covered entity has:

• a.Notified both the Office for Civil Rights and the patient beforehand
• b.Applied reasonable safeguards and the minimum necessary standard✓
• c.Obtained a court order in advance
• d.Charged the patient a disclosure fee

Incidental disclosures are not violations when reasonable safeguards and the minimum necessary standard are already in place. Speaking quietly and limiting information are examples of such safeguards. HIPAA does not require eliminating every incidental exposure.HIPAA

HIPAA permits disclosing relevant PHI to a family member involved in a patient's care when:

• a.The family member simply asks for it
• b.The patient agrees or does not object✓
• c.The information is already public
• d.The information concerns anyone's care

Disclosure to those involved in a patient's care is allowed with the patient's agreement, when the patient does not object, or based on professional judgment if the patient is not present. Only relevant information should be shared. Minimum necessary still applies.HIPAA

Under HIPAA, psychotherapy notes receive special protection and generally:

• a.Are never considered PHI at all
• b.May be shared like any other part of the record
• c.Require a specific authorization to disclose✓
• d.Must be posted in the waiting room

Psychotherapy notes are held to a higher standard, and most disclosures require a separate, specific authorization. They are kept apart from the general medical record. This extra protection reflects their sensitivity.HIPAA

HIPAA gives patients the right to request that a covered entity:

• a.Delete all of their medical records from the system permanently
• b.Waive the plan deductible
• c.Change a diagnosis to lower their bill
• d.Amend PHI they believe is inaccurate or incomplete✓

Patients may request an amendment to PHI they believe is wrong or incomplete. The provider may deny the request under defined conditions but must document the decision. The original entry is not erased when an amendment is made.HIPAA

The HIPAA 'minimum necessary' standard does NOT apply to disclosures:

• a.Shared with a business associate
• b.Made to the patient or for treatment purposes✓
• c.Made to a payer in order to adjudicate a submitted claim
• d.Sent to an outside marketing vendor

Minimum necessary does not restrict disclosures to the individual, for treatment, or those made under the patient's authorization. It does apply to routine payment and operations disclosures. This ensures clinicians can share what treatment requires.HIPAA

Which of the following is a HIPAA 'covered entity'?

• a.A health care clearinghouse that processes claims✓
• b.A patient receiving medical care
• c.A software vendor that never handles any PHI at all
• d.A newspaper reporter writing a story

Covered entities are health plans, health care clearinghouses, and providers who transmit health information in standard electronic transactions. Patients and unrelated third parties are not covered entities. Business associates are separately regulated.HIPAA

Before a medical practice shares PHI with an outside billing company, HIPAA requires:

• a.A signed business associate agreement (BAA)✓
• b.Approval from the patient's employer
• c.A public press release to the community
• d.A copy of the patient's insurance ID card

A business associate agreement obligates the outside vendor to safeguard PHI and use it only as permitted. It must be in place before PHI is disclosed for services. Business associates are directly liable for certain HIPAA requirements.HIPAA

The HITECH Act strengthened HIPAA mainly by:

• a.Raising penalties and extending liability to business associates✓
• b.Removing the breach-notification requirements that apply to business associates
• c.Eliminating the Privacy Rule entirely
• d.Making PHI freely shareable with anyone

HITECH boosted HIPAA enforcement, raised penalty amounts, added breach-notification duties, and made business associates directly liable. It also promoted electronic health record adoption. These changes tightened protection of health information.HITECH

HIPAA civil monetary penalties are tiered primarily according to:

• a.The medical specialty of the provider
• b.The number of employees at the practice
• c.The dollar size of the patient's medical bill
• d.The covered entity's level of culpability✓

Penalty tiers rise with culpability, from unknowing violations up to willful neglect that is not corrected. Higher culpability carries larger per-violation penalties. Prompt correction can reduce exposure.HIPAA

Following discovery of a breach of unsecured PHI, HIPAA generally requires that affected individuals be notified without unreasonable delay and no later than:

• a.1 year after discovery
• b.60 days after discovery of the breach✓
• c.24 hours after discovery
• d.The end of the following calendar quarter

Individuals must be notified within 60 days of discovering a breach of unsecured PHI. Breaches affecting 500 or more individuals also require prompt notice to HHS and the media. Timely notification is a legal obligation.HIPAA

A breach of unsecured PHI affecting 500 or more individuals additionally requires the covered entity to notify:

• a.No one, as long as the data was on paper
• b.Only the affected patients, and no one else
• c.HHS and prominent media in the affected area✓
• d.The patient's current employer

Large breaches of 500 or more individuals trigger prompt notification to HHS and to prominent media in the area. Smaller breaches are logged and reported to HHS annually. The size of the breach drives the notification requirements.HIPAA

A required administrative safeguard under the HIPAA Security Rule is:

• a.Sharing a single password among all staff
• b.Conducting a security risk analysis of ePHI✓
• c.Encrypting the office's marketing brochures
• d.Publishing patient names on a public website

A security risk analysis is a required administrative safeguard that drives other protections. Administrative safeguards also include workforce training and sanction policies. Physical and technical safeguards address facilities and systems.HIPAA

Which is an example of a HIPAA Security Rule PHYSICAL safeguard?

• a.Assigning unique user login IDs
• b.Conducting workforce sanction and disciplinary policies
• c.Encrypting data during transmission
• d.Facility access controls and workstation security✓

Physical safeguards cover facility access controls, workstation use and security, and device and media controls. Encryption and unique IDs are technical safeguards, and sanction policies are administrative. Each category protects ePHI in a different way.HIPAA

Which is a HIPAA Security Rule TECHNICAL safeguard for electronic PHI?

• a.Training staff on privacy policies
• b.Shredding old paper records
• c.Access controls, audit logs, and encryption✓
• d.Locking the medical-record file room

Technical safeguards include access control, audit controls, integrity controls, authentication, and transmission security such as encryption. Locking rooms is a physical safeguard and training is administrative. Together they protect ePHI.HIPAA

An 'addressable' implementation specification under the HIPAA Security Rule means the covered entity must:

• a.Assess it and implement it or a documented equivalent✓
• b.Ignore the specification entirely
• c.Obtain written permission from the Office for Civil Rights before acting
• d.Always skip it to reduce costs

Addressable does not mean optional; the entity must evaluate the specification and either implement it, adopt an equivalent measure, or document why it is not reasonable. Required specifications must always be implemented. Both types protect ePHI.HIPAA

Assigning each staff member a unique login and prohibiting password sharing supports HIPAA by:

• a.Enabling audit trails that trace activity to individuals✓
• b.Increasing the payer's allowed amount
• c.Speeding up insurance claim payment
• d.Replacing the need for a business associate agreement

Unique user IDs and audit controls are technical safeguards that let a practice trace who accessed ePHI. Shared logins defeat accountability and audit trails. This supports both security and investigation of misuse.HIPAA

Proper disposal of paper records containing PHI requires that they be:

• a.Recycled along with general office paper
• b.Mailed back to the insurance payer
• c.Left in an unlocked collection bin
• d.Shredded or otherwise rendered unreadable✓

PHI must be destroyed so it cannot be read or reconstructed, typically by shredding. Tossing PHI in regular trash is a common breach source. Proper disposal is part of reasonable safeguards.HIPAA

When emailing PHI to an external party, a reasonable HIPAA safeguard is to:

• a.Post it to a publicly shared folder
• b.Send it from a personal webmail account
• c.Include the entire record for convenience
• d.Use encryption and verify the recipient address✓

Encrypting the message and confirming the recipient reduces the risk of an impermissible disclosure. Minimum necessary still applies, so only needed information should be sent. These safeguards help prevent email breaches.HIPAA

A staff member posting a patient's identifiable information on social media is:

• a.Allowed when the patient is well known
• b.A HIPAA violation and a reportable breach of PHI✓
• c.Permitted as long as the post is later deleted quickly
• d.Required as part of marketing

Posting identifiable PHI without authorization is an impermissible disclosure and a reportable breach, regardless of intent or how briefly it appears. Fame does not remove HIPAA protection. Such conduct can lead to penalties and discipline.HIPAA