NHA Medical Billing & Coding (CBCS) — All Questions

The HIPAA Privacy Rule primarily protects:

• a.Only electronic billing software
• b.A provider's business financial records only
• c.The design of insurance ID cards
• d.The privacy of individually identifiable health information (protected health information)✓

The HIPAA Privacy Rule sets national standards protecting individuals' protected health information (PHI) held or transmitted by covered entities and their business associates. It limits how PHI may be used and disclosed and grants patients rights over their information. Billing staff must safeguard PHI and disclose only the minimum necessary.HIPAA

The HIPAA 'minimum necessary' standard requires that covered entities:

• a.Never share information even for treatment
• b.Disclose all available patient information on every request
• c.Limit the use and disclosure of PHI to the least amount needed to accomplish the intended purpose✓
• d.Encrypt only paper records

The minimum necessary standard directs that when using or disclosing PHI, or requesting it, covered entities limit the information to what is reasonably needed for the specific purpose. It does not apply to disclosures for treatment or those authorized by the patient. Applying it in billing means sharing only the data a payer needs to adjudicate a claim.HIPAA

The HIPAA Security Rule specifically addresses the protection of:

• a.The provider's marketing materials
• b.Electronic protected health information through administrative, physical, and technical safeguards✓
• c.Paper records stored in a basement only
• d.Employee salary information

The HIPAA Security Rule establishes standards for safeguarding electronic protected health information (ePHI), requiring administrative, physical, and technical safeguards such as access controls, encryption where appropriate, and audit controls. It complements the Privacy Rule, which covers PHI in all forms. Billing systems that store ePHI must meet these safeguards.HIPAA

A 'business associate' under HIPAA is:

• a.Any employee of the covered entity
• b.A patient's family member
• c.A competing medical practice
• d.A person or entity that performs functions involving PHI on behalf of a covered entity, such as a billing company✓

A business associate is an outside person or organization that creates, receives, maintains, or transmits PHI to perform services for a covered entity, such as a third-party billing service or clearinghouse. HIPAA requires a written business associate agreement defining safeguards. Business associates are directly liable for certain HIPAA obligations.HIPAA

Under HIPAA, a patient generally has the right to:

• a.Demand that the provider delete all records permanently
• b.Prevent all billing to their insurance
• c.Set the provider's fee schedule
• d.Access and request a copy of their own medical records✓

HIPAA grants individuals the right to access and obtain copies of their protected health information held in a designated record set, subject to limited exceptions. Patients may also request amendments and an accounting of certain disclosures. Providers must respond within the timeframes the rule specifies.HIPAA

The HIPAA transactions and code sets standards were established to:

• a.Replace the need for medical records
• b.Standardize the electronic exchange of health care data, such as claims, using uniform formats and code sets✓
• c.Set physician salaries
• d.Determine which drugs are covered

HIPAA's transactions and code sets standards require covered entities to use uniform electronic formats, such as the 837 claim and 835 remittance, and standard code sets like ICD-10-CM, CPT, and HCPCS. Standardization streamlines electronic data interchange between providers and payers. It reduces the administrative burden of differing payer formats.HIPAA

The federal False Claims Act imposes liability primarily on those who:

• a.Charge a patient a copayment
• b.Submit any claim that is later denied
• c.Knowingly submit, or cause to be submitted, false or fraudulent claims for payment to the government✓
• d.Use an outdated fax machine

The False Claims Act creates liability for knowingly presenting false or fraudulent claims to federal programs such as Medicare and Medicaid, including billing for services not rendered or upcoding. 'Knowingly' includes acting with reckless disregard or deliberate ignorance, not just actual knowledge. Penalties can include substantial fines and multiplied damages.False Claims Act

A 'qui tam' provision under the False Claims Act allows:

• a.A private individual (a whistleblower) to file suit on behalf of the government and potentially share in any recovery✓
• b.Patients to change their diagnosis
• c.Payers to set fee schedules
• d.Providers to appeal any denial

The qui tam provision lets a private person, often an employee who discovers fraud, bring a lawsuit on the government's behalf and receive a portion of amounts recovered. This encourages insiders to report false claims. The law also protects such whistleblowers from retaliation.False Claims Act

The federal Anti-Kickback Statute prohibits:

• a.Knowingly offering, paying, soliciting, or receiving anything of value to induce referrals of federal health program business✓
• b.Accepting Medicare assignment
• c.Providing free educational pamphlets to patients
• d.Billing a patient's secondary insurance

The Anti-Kickback Statute makes it a crime to knowingly and willfully exchange, or offer to exchange, remuneration to induce or reward referrals of items or services payable by a federal health care program. Violations can bring criminal, civil, and administrative penalties. Certain safe harbors protect specified legitimate business arrangements.Anti-Kickback Statute

The physician self-referral law (the Stark Law) generally prohibits a physician from:

• a.Referring any patient to a specialist
• b.Billing Medicare for office visits
• c.Accepting insurance
• d.Referring Medicare patients for certain designated health services to an entity with which the physician has a financial relationship, unless an exception applies✓

The Stark Law bars physicians from referring Medicare patients for specific designated health services to entities in which the physician or an immediate family member has a financial interest, absent a qualifying exception. Unlike the Anti-Kickback Statute, Stark is a strict-liability civil law that does not require intent. Claims resulting from prohibited referrals are not payable.CMS

The Office of Inspector General (OIG) of the Department of Health and Human Services is primarily responsible for:

• a.Setting physician office hours
• b.Selling insurance policies
• c.Detecting and preventing fraud, waste, and abuse in federal health care programs✓
• d.Assigning CPT codes

The OIG protects the integrity of HHS programs, including Medicare and Medicaid, by investigating fraud and abuse, conducting audits, and issuing compliance guidance. It maintains a list of individuals and entities excluded from federal health programs. Providers check this exclusion list to avoid employing or contracting with excluded parties.CMS

An Advance Beneficiary Notice of Noncoverage (ABN) is given to a Medicare patient to:

• a.Collect the copay in advance for all visits
• b.Inform the patient in advance that Medicare may not pay for a service so the patient can decide whether to accept financial responsibility✓
• c.Guarantee that Medicare will pay
• d.Serve as the patient's insurance card

An ABN notifies a Medicare beneficiary before a service is provided that Medicare is likely to deny payment, allowing the patient to choose whether to receive the service and accept liability. Without a properly executed ABN, the provider generally cannot bill the patient for the denied amount. It must be given in advance and clearly explain the reason coverage may be denied.CMS

The National Provider Identifier (NPI) is required under HIPAA to:

• a.Determine patient copayments
• b.Uniquely identify covered health care providers in standard transactions✓
• c.Track patient diagnoses
• d.Set the Medicare conversion factor

The NPI is a unique ten-digit identifier assigned to covered health care providers and required on HIPAA standard transactions such as claims. It standardizes provider identification across payers, replacing legacy identifiers. Accurate NPI reporting is essential to avoid claim rejections.

Accurate and complete medical record documentation is important for billing because:

• a.It determines the patient's premium
• b.It replaces the need for coding
• c.It sets the provider's tax rate
• d.It supports the codes billed and demonstrates the medical necessity of services✓

Documentation in the medical record must support every code reported and justify that services were medically necessary; the principle is that if it was not documented, it was not done. Insufficient documentation is a leading cause of denials and audit findings. Coders should assign codes based only on what the record supports.

If a billing staff member accesses a patient's record out of curiosity, with no job-related reason, this is:

• a.Required by the minimum necessary rule
• b.Always permitted because the staff works there
• c.An impermissible use of PHI that violates HIPAA✓
• d.Allowed if the patient is famous

Accessing PHI without a legitimate work-related purpose, sometimes called snooping, is an impermissible use that violates the HIPAA Privacy Rule and the minimum necessary standard. Covered entities must limit access to what each role requires and may discipline violators. Such breaches can trigger penalties for both the individual and the organization.HIPAA

A compliance program in a medical practice is designed to:

• a.Prevent and detect violations of law and promote ethical, accurate billing practices✓
• b.Increase the number of claims denied
• c.Eliminate the need for documentation
• d.Set higher charges than competitors

An effective compliance program establishes policies, training, auditing, and reporting mechanisms to help a practice follow coding, billing, and privacy laws and catch problems early. The OIG has published guidance outlining key elements of such programs. A strong compliance culture reduces the risk of fraud, abuse, and penalties.

A breach of unsecured protected health information under HIPAA generally requires the covered entity to:

• a.Ignore it if fewer than 100 records are involved
• b.Charge the affected patients a fee
• c.Immediately delete all patient records
• d.Notify affected individuals, and in some cases HHS and the media, within required timeframes✓

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, and depending on the breach's size, HHS and sometimes the media, within specified timeframes after discovering a breach of unsecured PHI. Business associates must notify the covered entity of breaches. Timely, proper notification is a legal obligation, not optional.HIPAA

Medical record retention requirements are generally set by:

• a.The patient's preference alone
• b.The number of pages in the record
• c.The provider's mood
• d.Federal and state laws and payer requirements, which specify minimum retention periods✓

How long medical and billing records must be kept is governed by a combination of federal rules, state laws, and payer contracts, with retention periods that vary by record type and jurisdiction. Practices should follow the most stringent applicable requirement. Proper retention supports audits, appeals, and legal defense.

Obtaining a patient's signed authorization is generally required before a provider may:

• a.Share information with another treating provider for care
• b.Disclose PHI for purposes not otherwise permitted, such as many marketing uses✓
• c.Report a communicable disease as required by law
• d.Submit a claim to the patient's insurer for treatment

HIPAA permits certain uses and disclosures of PHI without authorization, including for treatment, payment, and health care operations, and for legally required public-health reporting. However, disclosures outside these permitted purposes, such as most marketing or the sale of PHI, require the patient's written authorization. Billing staff should know which activities need a signed authorization.

A Notice of Privacy Practices (NPP) is a document that a covered entity must:

• a.Send only to insurance companies
• b.Provide to patients describing how their PHI may be used and disclosed and their privacy rights✓
• c.Use to set the fee schedule
• d.Keep hidden from patients

HIPAA requires covered entities to give patients a Notice of Privacy Practices explaining how the practice may use and disclose PHI and outlining patients' rights regarding their information. Providers with a direct treatment relationship must make a good-faith effort to obtain acknowledgment of receipt. The notice promotes transparency about privacy practices.HIPAA

Which agency is responsible for enforcing the HIPAA Privacy and Security Rules?

• a.The HHS Office for Civil Rights (OCR)✓
• b.The Internal Revenue Service
• c.The Office of Inspector General
• d.The Federal Trade Commission

The HHS Office for Civil Rights investigates HIPAA complaints and can impose penalties for violations. The OIG focuses on fraud, waste, and abuse in federal health programs. Knowing the enforcer helps staff understand HIPAA accountability.HIPAA

Under HIPAA, PHI may be used or disclosed WITHOUT patient authorization for:

• a.Treatment, payment, and health care operations✓
• b.Any purpose the staff member chooses
• c.Selling patient lists to outside marketers
• d.Posting patient cases on social media

HIPAA permits use and disclosure for treatment, payment, and health care operations (TPO) without authorization. Most other uses, such as marketing or sale of PHI, require the patient's written authorization. Billing falls under the permitted payment purpose.HIPAA

Health information that has been properly de-identified under HIPAA:

• a.Can never be used for any research purpose
• b.Must be reported to the Office for Civil Rights
• c.Still requires a signed business associate agreement
• d.Is no longer PHI subject to the Privacy Rule✓

Properly de-identified data, using Safe Harbor removal of the 18 identifiers or expert determination, is not PHI and is not subject to Privacy Rule limits. Re-identification would restore protection. De-identification enables broader analytic use.HIPAA

Protected health information (PHI) under HIPAA includes identifiable health information that is:

• a.Oral, paper, or electronic✓
• b.Only information written on paper charts
• c.Only information stored in electronic systems
• d.Only information that is spoken aloud

PHI covers individually identifiable health information in any form, including spoken, written, and electronic. The Security Rule adds specific safeguards for electronic PHI (ePHI). Staff must protect PHI regardless of its format.HIPAA

If a patient pays in full out of pocket and asks the provider not to disclose that service to the health plan, HIPAA requires the provider to:

• a.Refuse the patient's request and bill the plan anyway
• b.Honor the restriction and withhold it from the plan✓
• c.Charge the patient an additional penalty
• d.Report the patient's request to Medicare

Under HITECH-era rules, a provider must grant a requested restriction when the patient pays in full out of pocket for the service. This is one restriction request the provider cannot decline. It gives patients control over disclosures to their plan.HIPAA

The HIPAA right to an 'accounting of disclosures' allows a patient to:

• a.View other patients' medical records
• b.Set the provider's fee schedule
• c.Request a list of certain disclosures of their PHI✓
• d.Demand the practice's internal financial statements

Patients may request an accounting of specified disclosures of their PHI over a defined period, generally excluding routine TPO disclosures. It is one of several patient rights under the Privacy Rule. The practice must respond within required timeframes.HIPAA

An 'incidental' disclosure of PHI, such as a patient overhearing a name at a counter, is permitted under HIPAA when the covered entity has:

• a.Notified both the Office for Civil Rights and the patient beforehand
• b.Applied reasonable safeguards and the minimum necessary standard✓
• c.Obtained a court order in advance
• d.Charged the patient a disclosure fee

Incidental disclosures are not violations when reasonable safeguards and the minimum necessary standard are already in place. Speaking quietly and limiting information are examples of such safeguards. HIPAA does not require eliminating every incidental exposure.HIPAA

HIPAA permits disclosing relevant PHI to a family member involved in a patient's care when:

• a.The family member simply asks for it
• b.The patient agrees or does not object✓
• c.The information is already public
• d.The information concerns anyone's care

Disclosure to those involved in a patient's care is allowed with the patient's agreement, when the patient does not object, or based on professional judgment if the patient is not present. Only relevant information should be shared. Minimum necessary still applies.HIPAA

Under HIPAA, psychotherapy notes receive special protection and generally:

• a.Are never considered PHI at all
• b.May be shared like any other part of the record
• c.Require a specific authorization to disclose✓
• d.Must be posted in the waiting room

Psychotherapy notes are held to a higher standard, and most disclosures require a separate, specific authorization. They are kept apart from the general medical record. This extra protection reflects their sensitivity.HIPAA

HIPAA gives patients the right to request that a covered entity:

• a.Delete all of their medical records from the system permanently
• b.Waive the plan deductible
• c.Change a diagnosis to lower their bill
• d.Amend PHI they believe is inaccurate or incomplete✓

Patients may request an amendment to PHI they believe is wrong or incomplete. The provider may deny the request under defined conditions but must document the decision. The original entry is not erased when an amendment is made.HIPAA

The HIPAA 'minimum necessary' standard does NOT apply to disclosures:

• a.Shared with a business associate
• b.Made to the patient or for treatment purposes✓
• c.Made to a payer in order to adjudicate a submitted claim
• d.Sent to an outside marketing vendor

Minimum necessary does not restrict disclosures to the individual, for treatment, or those made under the patient's authorization. It does apply to routine payment and operations disclosures. This ensures clinicians can share what treatment requires.HIPAA

Which of the following is a HIPAA 'covered entity'?

• a.A health care clearinghouse that processes claims✓
• b.A patient receiving medical care
• c.A software vendor that never handles any PHI at all
• d.A newspaper reporter writing a story

Covered entities are health plans, health care clearinghouses, and providers who transmit health information in standard electronic transactions. Patients and unrelated third parties are not covered entities. Business associates are separately regulated.HIPAA

Before a medical practice shares PHI with an outside billing company, HIPAA requires:

• a.A signed business associate agreement (BAA)✓
• b.Approval from the patient's employer
• c.A public press release to the community
• d.A copy of the patient's insurance ID card

A business associate agreement obligates the outside vendor to safeguard PHI and use it only as permitted. It must be in place before PHI is disclosed for services. Business associates are directly liable for certain HIPAA requirements.HIPAA

The HITECH Act strengthened HIPAA mainly by:

• a.Raising penalties and extending liability to business associates✓
• b.Removing the breach-notification requirements that apply to business associates
• c.Eliminating the Privacy Rule entirely
• d.Making PHI freely shareable with anyone

HITECH boosted HIPAA enforcement, raised penalty amounts, added breach-notification duties, and made business associates directly liable. It also promoted electronic health record adoption. These changes tightened protection of health information.HITECH

HIPAA civil monetary penalties are tiered primarily according to:

• a.The medical specialty of the provider
• b.The number of employees at the practice
• c.The dollar size of the patient's medical bill
• d.The covered entity's level of culpability✓

Penalty tiers rise with culpability, from unknowing violations up to willful neglect that is not corrected. Higher culpability carries larger per-violation penalties. Prompt correction can reduce exposure.HIPAA

Following discovery of a breach of unsecured PHI, HIPAA generally requires that affected individuals be notified without unreasonable delay and no later than:

• a.1 year after discovery
• b.60 days after discovery of the breach✓
• c.24 hours after discovery
• d.The end of the following calendar quarter

Individuals must be notified within 60 days of discovering a breach of unsecured PHI. Breaches affecting 500 or more individuals also require prompt notice to HHS and the media. Timely notification is a legal obligation.HIPAA

A breach of unsecured PHI affecting 500 or more individuals additionally requires the covered entity to notify:

• a.No one, as long as the data was on paper
• b.Only the affected patients, and no one else
• c.HHS and prominent media in the affected area✓
• d.The patient's current employer

Large breaches of 500 or more individuals trigger prompt notification to HHS and to prominent media in the area. Smaller breaches are logged and reported to HHS annually. The size of the breach drives the notification requirements.HIPAA

A required administrative safeguard under the HIPAA Security Rule is:

• a.Sharing a single password among all staff
• b.Conducting a security risk analysis of ePHI✓
• c.Encrypting the office's marketing brochures
• d.Publishing patient names on a public website

A security risk analysis is a required administrative safeguard that drives other protections. Administrative safeguards also include workforce training and sanction policies. Physical and technical safeguards address facilities and systems.HIPAA

Which is an example of a HIPAA Security Rule PHYSICAL safeguard?

• a.Assigning unique user login IDs
• b.Conducting workforce sanction and disciplinary policies
• c.Encrypting data during transmission
• d.Facility access controls and workstation security✓

Physical safeguards cover facility access controls, workstation use and security, and device and media controls. Encryption and unique IDs are technical safeguards, and sanction policies are administrative. Each category protects ePHI in a different way.HIPAA

Which is a HIPAA Security Rule TECHNICAL safeguard for electronic PHI?

• a.Training staff on privacy policies
• b.Shredding old paper records
• c.Access controls, audit logs, and encryption✓
• d.Locking the medical-record file room

Technical safeguards include access control, audit controls, integrity controls, authentication, and transmission security such as encryption. Locking rooms is a physical safeguard and training is administrative. Together they protect ePHI.HIPAA

An 'addressable' implementation specification under the HIPAA Security Rule means the covered entity must:

• a.Assess it and implement it or a documented equivalent✓
• b.Ignore the specification entirely
• c.Obtain written permission from the Office for Civil Rights before acting
• d.Always skip it to reduce costs

Addressable does not mean optional; the entity must evaluate the specification and either implement it, adopt an equivalent measure, or document why it is not reasonable. Required specifications must always be implemented. Both types protect ePHI.HIPAA

Assigning each staff member a unique login and prohibiting password sharing supports HIPAA by:

• a.Enabling audit trails that trace activity to individuals✓
• b.Increasing the payer's allowed amount
• c.Speeding up insurance claim payment
• d.Replacing the need for a business associate agreement

Unique user IDs and audit controls are technical safeguards that let a practice trace who accessed ePHI. Shared logins defeat accountability and audit trails. This supports both security and investigation of misuse.HIPAA

Proper disposal of paper records containing PHI requires that they be:

• a.Recycled along with general office paper
• b.Mailed back to the insurance payer
• c.Left in an unlocked collection bin
• d.Shredded or otherwise rendered unreadable✓

PHI must be destroyed so it cannot be read or reconstructed, typically by shredding. Tossing PHI in regular trash is a common breach source. Proper disposal is part of reasonable safeguards.HIPAA

When emailing PHI to an external party, a reasonable HIPAA safeguard is to:

• a.Post it to a publicly shared folder
• b.Send it from a personal webmail account
• c.Include the entire record for convenience
• d.Use encryption and verify the recipient address✓

Encrypting the message and confirming the recipient reduces the risk of an impermissible disclosure. Minimum necessary still applies, so only needed information should be sent. These safeguards help prevent email breaches.HIPAA

A staff member posting a patient's identifiable information on social media is:

• a.Allowed when the patient is well known
• b.A HIPAA violation and a reportable breach of PHI✓
• c.Permitted as long as the post is later deleted quickly
• d.Required as part of marketing

Posting identifiable PHI without authorization is an impermissible disclosure and a reportable breach, regardless of intent or how briefly it appears. Fame does not remove HIPAA protection. Such conduct can lead to penalties and discipline.HIPAA

The HIPAA standard transactions for an electronic eligibility inquiry and its response are the:

• a.270 and 271✓
• b.276 and 277
• c.278 and 275
• d.837 and 835

The 270 is the eligibility inquiry and the 271 is the response. The 276/277 pair handles claim status and the 278 handles prior authorization. Standard transactions streamline electronic exchange with payers.HIPAA

The HIPAA standard transaction used to request prior authorization or referral certification is the:

• a.835
• b.837I
• c.278✓
• d.271

The 278 is the services review transaction used for prior authorization and referral requests and responses. The 837 is the claim and the 835 is the remittance advice. Standardizing these exchanges reduces administrative burden.HIPAA

Under HIPAA, the required code set for reporting diagnoses is:

• a.HCPCS Level II
• b.ICD-10-CM✓
• c.ICD-10-PCS
• d.CPT Category I

ICD-10-CM is the adopted code set for diagnoses. ICD-10-PCS is for hospital inpatient procedures, and CPT and HCPCS report services and supplies. Using the correct code set is required for standard transactions.HIPAA

The HIPAA-adopted code set for reporting hospital INPATIENT procedures is:

• a.ICD-10-CM
• b.CPT Category I
• c.National Drug Codes
• d.ICD-10-PCS✓

ICD-10-PCS codes hospital inpatient procedures, while CPT is used for physician and outpatient procedures. ICD-10-CM reports diagnoses, not procedures. Selecting the right set depends on the setting.HIPAA

The National Drug Code (NDC) is the HIPAA-adopted code set used to identify:

• a.Patient diagnoses
• b.Physician work RVUs
• c.Drugs and biologics✓
• d.Places of service

The NDC identifies specific drug products by manufacturer, product, and package. It is often required on drug claims alongside HCPCS J-codes. Correct NDC reporting supports accurate drug reimbursement.HIPAA