NHA Medical Billing & Coding (CBCS) — All Questions

The HIPAA standard transactions for an electronic eligibility inquiry and its response are the:

• a.270 and 271✓
• b.276 and 277
• c.278 and 275
• d.837 and 835

The 270 is the eligibility inquiry and the 271 is the response. The 276/277 pair handles claim status and the 278 handles prior authorization. Standard transactions streamline electronic exchange with payers.HIPAA

The HIPAA standard transaction used to request prior authorization or referral certification is the:

• a.835
• b.837I
• c.278✓
• d.271

The 278 is the services review transaction used for prior authorization and referral requests and responses. The 837 is the claim and the 835 is the remittance advice. Standardizing these exchanges reduces administrative burden.HIPAA

Under HIPAA, the required code set for reporting diagnoses is:

• a.HCPCS Level II
• b.ICD-10-CM✓
• c.ICD-10-PCS
• d.CPT Category I

ICD-10-CM is the adopted code set for diagnoses. ICD-10-PCS is for hospital inpatient procedures, and CPT and HCPCS report services and supplies. Using the correct code set is required for standard transactions.HIPAA

The HIPAA-adopted code set for reporting hospital INPATIENT procedures is:

• a.ICD-10-CM
• b.CPT Category I
• c.National Drug Codes
• d.ICD-10-PCS✓

ICD-10-PCS codes hospital inpatient procedures, while CPT is used for physician and outpatient procedures. ICD-10-CM reports diagnoses, not procedures. Selecting the right set depends on the setting.HIPAA

The National Drug Code (NDC) is the HIPAA-adopted code set used to identify:

• a.Patient diagnoses
• b.Physician work RVUs
• c.Drugs and biologics✓
• d.Places of service

The NDC identifies specific drug products by manufacturer, product, and package. It is often required on drug claims alongside HCPCS J-codes. Correct NDC reporting supports accurate drug reimbursement.HIPAA

The HIPAA standard national identifier for employers used in transactions is the:

• a.Employer Identification Number (EIN)✓
• b.National Provider Identifier
• c.Patient's Social Security Number
• d.Medicare Beneficiary Identifier

HIPAA adopted the EIN as the standard employer identifier and the NPI as the provider identifier. Standard identifiers make electronic transactions consistent across payers. Correct identifiers help prevent rejections.HIPAA

The key difference between health care 'fraud' and 'abuse' is that fraud:

• a.Involves knowing intent to deceive, unlike abuse✓
• b.Is always purely accidental
• c.Never involves federal programs or the beneficiaries they cover
• d.Cannot result in any penalties

Fraud is intentional deception or misrepresentation for gain, while abuse involves practices inconsistent with sound fiscal or medical norms that may lack intent. Both waste program dollars and can carry penalties. Intent is the distinguishing factor.

Which of the following is an example of health care FRAUD?

• a.Appealing a denial with medical records
• b.Collecting the correct patient copay
• c.Billing Medicare for a service that was never provided✓
• d.Submitting a properly coded claim that is later denied by the payer

Billing for services never rendered is classic fraud, as are upcoding and deliberate unbundling to gain payment. A denied claim or a proper appeal is not fraud. Fraud requires intent to obtain unearned payment.

Which situation best illustrates 'abuse' rather than outright fraud?

• a.Creating entirely fake patient encounters
• b.Forging a physician's signature on a note
• c.Billing inconsistent with accepted practices, without proven intent✓
• d.Deliberately falsifying a diagnosis on the claim in order to be paid a higher amount

Abuse involves improper practices that waste resources without established intent to deceive. Deliberate falsification, forgery, and fabricated encounters are fraud because intent is present. The line between them is the presence of intent.

Selecting a higher-level evaluation and management code than the documentation supports, to increase payment, is:

• a.Upcoding, a form of fraudulent billing✓
• b.Downcoding, which payers require
• c.A routine contractual adjustment
• d.A permitted rounding practice

Upcoding misrepresents the level of service to obtain higher payment and is fraudulent. Codes must match what the record documents. Both upcoding and its opposite, deliberate downcoding, distort accurate billing.

Reporting the separate components of a procedure that has a single comprehensive code, in order to increase payment, is called:

• a.Bundling
• b.Unbundling✓
• c.Sequencing
• d.Crosswalking

Unbundling fragments a comprehensive procedure into separate codes to raise reimbursement. NCCI edits are designed to detect it. When done to gain higher pay, unbundling is abusive or fraudulent.

Beyond repaying the claim, the federal False Claims Act can impose:

• a.A reduction in the Medicare conversion factor for the year
• b.Automatic loss of the patient's coverage
• c.A simple warning letter only
• d.Civil penalties per claim plus multiple (treble) damages✓

The False Claims Act allows per-claim civil penalties and up to treble (three times) the government's damages. It is a powerful tool against health care fraud. Liability attaches to knowingly submitting false claims.False Claims Act

The Civil Monetary Penalties Law (CMPL) allows the government to:

• a.Impose penalties for specified improper billing conduct✓
• b.Approve the prior authorization requests that providers submit to payers
• c.Set physician fee schedules
• d.License new health care providers

The CMPL authorizes financial penalties and assessments for conduct such as false claims, kickbacks, and employing excluded individuals. It complements other fraud and abuse laws. Penalties can be substantial per violation.CMS

The OIG List of Excluded Individuals and Entities (LEIE) is checked by employers to ensure they do not:

• a.Exceed the Medicare limiting charge on a submitted claim
• b.Overpay their own staff
• c.Employ parties barred from federal health programs✓
• d.Miss a timely-filing deadline

Paying an excluded individual or entity with federal health care funds can trigger civil monetary penalties. Employers screen the LEIE before hiring or contracting and periodically thereafter. Exclusion screening is a compliance safeguard.CMS

Compared with the Stark Law, the Anti-Kickback Statute is distinctive because it:

• a.Is a strict-liability civil law that contains no intent element at all
• b.Governs medical-record retention periods
• c.Applies only to dental services
• d.Requires knowing and willful intent and can carry criminal penalties✓

The Anti-Kickback Statute requires knowing and willful intent and can bring criminal, civil, and administrative penalties. The Stark Law, by contrast, is strict-liability and civil. Both target improper financial arrangements tied to referrals.Anti-Kickback Statute

'Safe harbors' under the Anti-Kickback Statute are:

• a.Penalties assessed for late claims
• b.Loopholes in the statute that permit any kickback arrangement so long as it is disclosed
• c.Arrangements protected from prosecution if all conditions are met✓
• d.Codes entered on the CMS-1500 form

Safe harbors describe specific arrangements that, when every condition is satisfied, are shielded from Anti-Kickback prosecution. Failing to fit a safe harbor is not automatically illegal but loses that protection. They guide lawful business relationships.Anti-Kickback Statute

A distinguishing feature of the Stark Law is that it:

• a.Requires proof of criminal intent to violate
• b.Applies only to private-pay cosmetic patients
• c.Sets the OPPS payment rates
• d.Imposes liability even without proof of intent✓

The Stark Law is a strict-liability civil statute, so a prohibited self-referral can violate it regardless of intent. Claims from prohibited referrals are not payable. This differs from the intent-based Anti-Kickback Statute.CMS

The Stark Law restricts physician self-referral specifically for:

• a.Certain designated health services under Medicare✓
• b.All cash-pay cosmetic procedures performed in a physician office
• c.Any referral to any specialist
• d.Employee wage decisions

Stark applies when a physician refers Medicare patients for designated health services to an entity with which the physician has a financial relationship, unless an exception applies. It does not bar all referrals. Designated services include labs, imaging, and therapy.CMS

The OIG's guidance on an effective compliance program includes designating a compliance officer, training, auditing, and:

• a.Eliminating clinical documentation
• b.Corrective action for detected offenses✓
• c.Waiving all patient cost-sharing
• d.Maximizing every claim's payment

The seven elements include written standards, a compliance officer, training, open lines of communication, auditing and monitoring, enforcement, and prompt corrective action for detected problems. These reduce fraud and abuse risk. Corrective action closes the loop.CMS

A designated compliance officer in a practice is primarily responsible for:

• a.Approving prior authorization requests
• b.Setting the chargemaster prices
• c.Overseeing the compliance program✓
• d.Negotiating the Medicare conversion factor

The compliance officer implements policies, coordinates training and auditing, and responds to reported issues. This role is a core element of an effective compliance program. It supports a culture of accurate, lawful billing.CMS

A Corporate Integrity Agreement (CIA) is typically entered when a provider:

• a.Wants to raise its contracted fee schedule
• b.Applies for a new National Provider Identifier to use for billing
• c.Settles fraud allegations and accepts compliance obligations✓
• d.Requests faster claim payment

A CIA imposes detailed compliance obligations, monitoring, and reporting after a fraud settlement, often as an alternative to program exclusion. It lets the provider continue participating under oversight. Breaching a CIA can lead to penalties or exclusion.CMS

Medicare Recovery Audit Contractors (RACs) are hired to:

• a.Identify and recover improper Medicare payments✓
• b.Assign diagnosis codes on behalf of providers
• c.Set each patient's deductible amount
• d.Sell Medicare Advantage plans to beneficiaries

RACs review claims after payment to detect and correct improper payments, which can require repayment or, less often, additional payment. Providers may appeal RAC findings. The program protects Medicare trust funds.CMS

The Comprehensive Error Rate Testing (CERT) program measures:

• a.Average physician office wait times experienced by patients
• b.The number of NPIs issued each year
• c.Patient satisfaction survey scores
• d.The Medicare fee-for-service improper payment rate✓

CERT samples Medicare fee-for-service claims to estimate the improper payment rate and identify common error causes. Findings inform education and program-integrity efforts. It is a measurement, not an enforcement, program.CMS

Medical necessity for a billed service is primarily demonstrated by:

• a.The provider's specialty alone
• b.The overall size of the practice
• c.A diagnosis that supports the procedure performed✓
• d.The patient's own personal request for the service

Payment for a covered service requires that the diagnosis support the procedure and that the record document the clinical need. Services lacking medical necessity are denied even when coded correctly. Diagnosis-to-procedure linkage is key.

A Local Coverage Determination (LCD) differs from a National Coverage Determination (NCD) in that an LCD:

• a.Is set by a regional contractor for its jurisdiction✓
• b.Applies nationwide to every Medicare contractor equally
• c.Overrides all federal statutes
• d.Is written by the patient's employer

NCDs apply nationally, while LCDs are issued by Medicare Administrative Contractors for their regions when no NCD governs. Coverage can therefore vary by locality. Checking the applicable determination supports medical-necessity decisions.CMS

An Advance Beneficiary Notice (ABN) is generally NOT appropriate to give a Medicare patient when:

• a.The provider expects the service to be non-covered
• b.Medicare is likely to deny the service as not medically necessary
• c.A screening test exceeds Medicare's frequency limit
• d.The service is being furnished in a genuine emergency✓

An ABN must be given in advance and never under duress, so it is not appropriate during a true emergency. It is used when denial is expected for lack of medical necessity or frequency limits. The patient must be able to make an informed choice.CMS

Modifier GA on a Medicare claim indicates that:

• a.The provider forgot to issue an ABN
• b.A required Advance Beneficiary Notice is on file for the service✓
• c.The service is statutorily excluded from all Medicare coverage
• d.The claim is for a bilateral procedure

Modifier GA signals that a required ABN was properly issued and is on file when a denial is expected. GZ indicates no ABN was obtained, and GY indicates a statutorily excluded service. Correct ABN modifiers determine who is liable for a denied charge.CMS

Modifier GZ is reported when a service is expected to be denied as not reasonable and necessary and:

• a.The patient has no Medicare coverage
• b.No ABN was obtained from the patient✓
• c.The service is always fully covered
• d.An ABN is properly on file for the service

GZ marks an expected denial for which no ABN was obtained, meaning the provider generally cannot bill the patient for the denied amount. Had an ABN been issued, GA would apply. It flags a likely non-billable denial.CMS

Modifier GY indicates that an item or service is:

• a.Covered but pending medical review
• b.Subject to a 50 percent payment reduction
• c.Bundled into a surgical global package
• d.Statutorily excluded and not a Medicare benefit✓

GY identifies a service that is statutorily excluded or not a Medicare benefit, often used to obtain a denial for secondary billing. The patient is liable for such non-covered services. It differs from GA and GZ, which involve medical-necessity ABNs.CMS

The billing principle 'if it was not documented, it was not done' means that:

• a.Verbal orders never need to be recorded
• b.Only the busiest visits require any notes
• c.Services must be supported by the medical record to be billable✓
• d.Documentation may be added at any later time without dating it

A service that is not documented is treated as not performed and is not billable. The record is the basis for code assignment and survives audits. Complete, contemporaneous documentation supports the codes reported.

A proper amendment or late entry in a medical record must:

• a.Be backdated to the visit date
• b.Be labeled, dated, and signed, keeping the original✓
• c.Be made anonymously by any available staff member on duty
• d.Erase the original text entirely

Amendments and late entries must be identifiable, dated, signed, and must preserve the original entry. Backdating or altering records improperly can constitute fraud. Proper documentation practices protect both patient and provider.

'Cloned' documentation, where notes are copied identically across visits, is a compliance concern because it:

• a.Removes the need for provider signatures
• b.May misrepresent the services at each visit✓
• c.Is specifically required by Medicare
• d.Always improves coding accuracy

Cloned or copy-forward notes can misrepresent what happened at each encounter and are a frequent audit target. Each visit needs individualized documentation. Overreliance on cloning can lead to denials and fraud findings.

Medicare generally requires that services in the medical record be:

• a.Authenticated by a legible or valid electronic signature✓
• b.Left unsigned to save time
• c.Signed only by the billing clerk
• d.Approved and countersigned by the patient before any claim is billed

Entries must be authenticated by the rendering provider through a legible handwritten or valid electronic signature. Missing or illegible signatures are a common cause of audit denials. Authentication confirms who performed and documented the service.CMS

National Correct Coding Initiative (NCCI) Procedure-to-Procedure (PTP) edits identify:

• a.Which diagnoses a plan will cover
• b.The maximum number of units of a single code that are allowed per day
• c.The patient's remaining deductible
• d.Code pairs that should not be reported together the same day✓

PTP edits flag code pairs that generally should not be billed together, using column one and column two logic. A supporting modifier may override the edit when a distinct service is documented. They help prevent improper unbundling.CMS

A Medically Unlikely Edit (MUE) sets:

• a.The maximum units billable per patient per day✓
• b.The provider's contracted fee-schedule amount
• c.The minimum charge for a service
• d.The list of covered diagnoses

MUEs cap the units of a HCPCS or CPT code reportable for one patient on one day to catch errors and abuse. Units above the limit may be denied. MUEs complement the PTP edits within NCCI.CMS

When an NCCI Procedure-to-Procedure edit has a modifier indicator of '1', it means:

• a.No modifier can ever bypass the edit
• b.A modifier may bypass the edit when documented✓
• c.The two codes must always be billed together
• d.The edit does not apply to Medicare claims

A modifier indicator of 1 allows a supporting modifier to override the edit when the services are truly distinct. An indicator of 0 means no modifier can bypass the edit. Documentation must justify any modifier used.CMS

Reviewing electronic health record access logs helps a practice:

• a.Increase the payer's allowed amount
• b.Set the timely-filing deadline
• c.Assign procedure codes automatically and set the payer timely-filing deadline
• d.Detect impermissible access to PHI, such as staff snooping✓

Audit controls and access logs are technical safeguards that reveal snooping and other impermissible access. Reviewing them supports HIPAA compliance and appropriate sanctions. Monitoring deters misuse of PHI.HIPAA

A HIPAA-required 'sanction policy' means the covered entity must:

• a.Report every submitted claim to the Office for Civil Rights
• b.Waive penalties for managers
• c.Discipline staff who violate privacy or security policies✓
• d.Reward staff for accessing more records

A sanction policy, an administrative safeguard, requires consistent discipline for workforce HIPAA violations. It reinforces accountability and deters misconduct. Applying it uniformly is part of an effective program.HIPAA

Under the False Claims Act, an employee who reports suspected fraud in good faith is:

• a.Automatically terminated from employment
• b.Barred from sharing in any recovery
• c.Required to pay the resulting penalties
• d.Protected from employer retaliation✓

The False Claims Act includes anti-retaliation protections for good-faith whistleblowers, who may also share in qui tam recoveries. Retaliation can create additional liability for the employer. These protections encourage reporting of fraud.False Claims Act

HIPAA requires covered entities to retain required HIPAA documentation, such as policies and the Notice of Privacy Practices, for at least:

• a.6 years from creation or last effective date✓
• b.1 year after creation
• c.30 days after creation
• d.At least 100 years, the same period required for medical records

The Privacy and Security Rules require HIPAA compliance documentation to be kept for six years. This is separate from medical-record retention, which is set by state and other law. Retaining documentation supports audits and investigations.HIPAA

CMS requires records related to Medicare Advantage (Part C) and Part D to be retained for at least:

• a.2 years
• b.10 years✓
• c.6 months
• d.No set period under HIPAA

CMS mandates a 10-year retention period for Medicare Advantage and Part D records. Retention requirements vary by program and by state law. Practices should follow the most stringent applicable rule.CMS

When federal HIPAA and a state privacy law both apply and the state law is MORE protective of the patient, the practice should generally:

• a.Follow whichever rule is easier
• b.Ignore the state law entirely
• c.Follow the more stringent state law✓
• d.Apply neither requirement

HIPAA sets a federal floor, and more protective state privacy laws are generally not preempted. The practice must follow the stricter requirement. This ensures patients receive the greater protection.HIPAA

Before disclosing PHI over the phone to a caller who claims to be the patient, staff should:

• a.Ask the caller for a credit card number in order to confirm the account
• b.Release all information immediately
• c.Refuse to speak with any patient
• d.Verify the caller's identity before releasing information✓

Verifying identity is a reasonable safeguard that prevents improper disclosure to an impostor. Only the minimum necessary information should then be shared. Identity verification protects the patient's PHI.HIPAA

A valid HIPAA authorization to disclose PHI for a non-routine purpose must:

• a.Be signed by the payer or a family member instead of the patient, with no description of the information or an expiration date
• b.Omit any expiration date
• c.Describe the information, the recipient, the purpose, and an expiration, and be signed✓
• d.Be verbal and undocumented

A valid authorization contains core elements: a specific description of the information, who may disclose and receive it, the purpose, an expiration, the patient's signature, and the right to revoke. It is required for uses beyond treatment, payment, and operations. Missing elements make it invalid.HIPAA

A patient who has signed a HIPAA authorization to release PHI generally may:

• a.Revoke it only with a court order
• b.Never revoke it once it is signed
• c.Revoke it in order to undo disclosures already made
• d.Revoke it in writing, but only going forward✓

Authorizations are revocable in writing, but the revocation is prospective and does not undo disclosures already made in reliance on it. Patients retain control going forward. The right to revoke must be stated in the authorization.HIPAA

A periodic internal coding and billing audit is a compliance activity that primarily:

• a.Guarantees higher reimbursement on every claim
• b.Replaces the need for clinical documentation
• c.Identifies coding errors and overpayment risks✓
• d.Sets the payer's fee schedule

Proactive auditing and monitoring is a core compliance-program element that finds and corrects errors before they grow. It reduces fraud and abuse exposure and supports accurate billing. Self-identified overpayments should be refunded promptly.CMS

Knowingly retaining a Medicare overpayment beyond the deadline to return it can create liability under the:

• a.False Claims Act✓
• b.Fair Debt Collection Practices Act
• c.Truth in Lending Act
• d.HIPAA Security Rule

The Affordable Care Act made retaining an identified overpayment past the 60-day deadline a potential reverse false claim under the False Claims Act. Timely refunds avoid this exposure. It links overpayment handling to fraud enforcement.False Claims Act

HIPAA permits disclosure of PHI WITHOUT patient authorization for:

• a.Legally required public health reporting✓
• b.Sharing with an employer for hiring decisions
• c.Posting patient outcomes on the internet
• d.Selling the information to a marketer

HIPAA allows specified disclosures without authorization, including required public health reporting and certain oversight and law-enforcement purposes. Marketing and sale of PHI require authorization. Knowing the permitted disclosures guides lawful sharing.HIPAA

When documentation is ambiguous or conflicting, the compliant action for a coder is to:

• a.Leave the encounter permanently unbilled
• b.Query the provider rather than assume a code✓
• c.Assign the highest-paying plausible code
• d.Guess based on the patient's history

A non-leading provider query resolves ambiguous or conflicting documentation before coding. Codes must reflect the clarified record, never assumptions made to increase payment. Querying supports both accuracy and compliance.