Deck 2: Electronic Health Records, HIPAA, and Hitech: Sharing and Protectin

Question 1

Which is necessary and permitted through the HIPAA Privacy Rule for patients' treatment, payment, and health care operations (TPO)?

A) use of PHI
B) disclosure of PHI
C) both use of PHI and disclosure of PHI
D) neither use of PHI nor disclosure of PHI

Answer 1

both use of PHI and disclosure of PHI

Question 2

What establishes standards for the exchange of financial and administrative data among covered entities?

A) Office of Inspector General
B) Transactions and Code Sets
C) Department Of Justice
D) Office Civil Rights

Answer 2

Transactions and Code Sets

Question 3

If a practice is being investigated for fraud, what may be the first document to research?

A) compliance plan
B) Privacy Notice
C) ICD book
D) HCPCS reference manual

Answer 3

compliance plan

Question 4

Which code set is used for billing dental procedures?

A) ICD
B) IRS
C) CDT-4
D) HCPCS

Question 5

Which complies with the HIPAA Security Rule?

A) selecting a mixture of characters for the password
B) sharing your password with the office manager or doctor
C) writing down your password and hiding it
D) keeping user ID and password the same

Question 6

Which is a future benefit of the Affordable Care Act?

A) legal residents cannot obtain insurance in order to keep premiums low
B) the cost of pharmaceutical drugs will be lowered
C) preventative services will be completely covered
D) the benefits will not change

Question 7

Which federal agency detects health care fraud and abuse?

A) Office for Civil Rights (OCR)
B) Department of Justice (DOJ)
C) Office of E-Health Standards and Services (OESS)
D) Office of the Inspector General (OIG)

Question 8

Which federal agency enforces criminal violations under federal law?

A) Office for Civil Rights (OCR)
B) Department of Justice (DOJ)
C) Office of E-Health Standards and Services (OESS)
D) Office of the Inspector General (OIG)

Question 9

Which scenario best describes abuse?

A) the doctor tells you to bill for an undocumented procedure
B) the doctor tells you to bill for an unnecessary procedure that was done
C) the medical assistant cashes an insurance check in their personal account
D) sending an invoice to multiple insurance companies

Question 10

Which scenario best describes fraud?

A) the doctor tells you to bill for an undocumented procedure
B) the doctor tells you to bill for an unnecessary procedure that was done
C) the medical assistant bills for a preauthorized procedure
D) sending an invoice to multiple insurance companies to see who pays

Question 11

Which of the following will be introduced in the future?

A) patient identifier
B) health plan identifier
C) both patient and health plan identifiers
D) neither patient nor health plan identifiers

Question 12

Which measure does not enforce the HIPAA Security Rule?

A) secure internet connections
B) backup file procedures
C) transmitting unencrypted data
D) enforced security policies

Question 13

Which is also known as the Stimulus Package?

A) HITECH
B) HIPAA
C) CMS
D) ARRA

Question 14

What is the best description of an encounter?

A) telephone call
B) face-to-face meeting
C) something that should be billed
D) something that should be investigated

Question 15

Which is not a goal of compliance plans?

A) prevent fraud and abuse
B) enhance patient education guidelines
C) ensure compliance with laws
D) defend the practice if it is investigated or prosecuted

Question 16

A social security number is an example of a (n):

A) EIN
B) code set
C) identifier
D) NPI

Question 17

Which act requires covered entities to notify affected individuals following the discovery of a breach of unsecured health information?

A) HITECH
B) HIPAA
C) Privacy rule
D) breach notification

Question 18

Which law guides the use of federal stimulus money to promote the adoption and meaningful use of health information technology, mainly using electronic health records?

A) OIG
B) HIPAA
C) ARRA
D) HITECH

Question 19

What are people or organizations that furnish, bill, or are paid for health care in the normal course of business called?

A) clearinghouses
B) insurers
C) providers
D) business associates

Question 20

What type of program encrypts data traveling between the office and the internet, such as patients' Social Security numbers, so that the information is secure?

A) medical management
B) practice management
C) backup software
D) data software

Question 21

Who has the authority to authorize the release of information on a patient to anyone not directly involved in their care?

A) doctor
B) "next of kin"
C) office manager
D) legal representative

Question 22

What are the Centers for Medicare and Medicaid Services (CMS) responsible for?

A) implementing annual federal budget acts and laws
B) lowers the costs of screening procedures for diseases
C) coding and billing
D) enforcing new rules and regulations

Question 23

A compliance plan does not cover which of the following?

A) EEO (Equal Employment Opportunity)
B) OSHA (Occupational Safety and Hazard Administration)
C) coding and billing
D) referrals and authorizations

Question 24

What did the NPI (National Provider Identifier) replace?

A) NPPES
B) EIN
C) Medicare UPIN
D) CMS

Question 25

If a violation is found during a medical practice investigation and a compliance plan is typically followed, what may it indicate to the Office of Inspector General (OIG)?

A) direct negligence
B) lack of communication
C) practice of abuse
D) may be simple errors

Question 26

Which main federal government agency is responsible for health care?

A) Health Care Financing Administration (HCFA)
B) Centers for Medicare and Medicaid Services (CMS)
C) Department of Health and Human Services (HHS)
D) Health Department

Question 27

What is the impermissible use or disclosure of PHI that could pose significant risk to the affected person called?

A) hack
B) pirate
C) breach
D) decrypt

Question 28

What is a medical practice's written plan for complying with regulations?

A) compliance plan
B) HIPAA notice
C) privacy notice
D) regulation plan

Question 29

Which is not a valid component of a compliance plan?

A) audit and monitor compliance with government regulations
B) to have inconsistent policies and procedures
C) provide staff with training and communication
D) having a guideline by which to correct errors

Question 30

Which is (are) elements included in a compliance plan according to the Office of the Inspector General?

A) training
B) ongoing communication
C) both training and ongoing communication
D) dependents will be covered under their parent's private plan until age 26

Question 31

Which is a valid aspect of the Affordable Care Act?

A) preventive services will be covered by insurance with no copayment required
B) illegal aliens will not be denied health insurance
C) pre-existing conditions will not be covered
D) young adults up to age 22 will remain as a dependent on their parent's private insurance

Question 32

Which standards have been set to govern the electronic exchange of health information?

A) identifiers
B) code sets
C) standard transactions
D) All of these

Question 33

A compliance plan constitutes which of the following

A) a written document
B) a committee
C) both a written document and a committee
D) neither a written document nor a committee

Question 34

What is any group of codes used for encoding data elements?

A) ICD
B) CPT
C) code set
D) transaction codes

Question 35

Which is a valid Breach Notification Procedure?

A) Notify patients of breaches "without reasonable delay" within 90 days
B) Notice to business associates from covered entities
C) Notice to ex-spouses on breaches involving patients who are deceased.
D) None of these

Question 36

Which code set is for specifying diseases, injuries, impairments, and other health related problems?

A) ICD
B) CPT
C) HCPS
D) CDT-4

Question 37

Which are covered entities under HIPAA/HITECH that must follow the regulations?

A) Patients
B) Health Providers
C) Business Associates
D) Collection Agencies

Question 38

A retention schedule

A) explains what records to keep
B) explains how long records must be saved
C) covers the method(s) of record storage
D) all of these

Question 39

The standards for written documentation include

A) clarity
B) legibility
C) signed and dated entries
D) all the above

Question 40

Which one of these would be the most secure password?

A) 123456
B) july14
C) f1H*%4hs
D) forwork

Question 41

What standards are set under the rules of the HIPAA Electronic Health Care Transactions and Code Sets?

A) electronic formats
B) identifiers
C) codes
D) All of these

Question 42

In electronic health records, documents may be created in a variety of ways, but they are

A) ultimately viewed on a computer screen
B) always printed out in the medical office
C) always annotated by handwriting
D) None of these

Question 43

The provider owns the actual medical records, but the information in a record belongs to

A) any medical professional
B) the patient
C) the payer
D) None of these

Question 44

Which of the following is fraudulent behavior?

A) making a mistake on a claim
B) deception with the intent to benefit
C) Both making a mistake on a claim and deception with the intent to benefit
D) Neither making a mistake on a claim nor deception with the intent to benefit

Question 45

The HIPAA Privacy Rule is enforced by the OCR. What does OCR stand for?

A) Office for Claim Returns
B) Office for Certified Rules
C) Office for Civil Rights
D) Office for Civil Responsibility

Question 46

Under what conditions should a medical assistant change the facts on an insurance claim?

A) if the patient requests the change
B) if the patient fails to make a payment
C) if the change will save the practice money
D) The facts must never be changed

Question 47

When can information about a patient's drug abuse be disclosed without authorization?

A) if a prospective employer requests it
B) if a physician from another practice requests it
C) if the patient's spouse requests it
D) None of these

Question 48

A standard and unique identifier for health care providers to use in filing health care claims is called

A) Employer Identification Number (EIN)
B) National Provider Identifier (NPI)
C) research data
D) code sets

Question 49

Collecting payment in full for a procedure from both the patient and the insurance carrier is an example of

A) liability
B) fraud
C) libel
D) audits

Question 50

Altering a patient's chart to increase the payment the physician receives is an example of

A) medical liability
B) subpoena
C) accountability
D) fraud

Question 51

SOAP is a format for patients' medical

A) documentation
B) records
C) both documentation and records
D) neither documentation nor records

Question 52

What do patients' medical records contain about their health history?

A) facts
B) observations
C) findings
D) All of these

Question 53

Entries in patients' medical records should be descending or ascending in what type of order?

A) chronological
B) alphabetical
C) numerical
D) the order is not important

Question 54

The abbreviation TPO refers to

A) treatment, payment, and health care operations
B) terms, policies, and financial obligations
C) treatment, providers, and organizations
D) terms, providers, and organizations

Question 55

What type of schedule do medical offices use to control how long patient information is stored?

A) financial schedule
B) retention schedule
C) referral schedule
D) None of these

Question 56

For up to how long can a medical office's financial records be audited after a patient's last visit (assuming that embezzlement or government funding has not occurred)?

A) 3 years
B) 7 years
C) 5 years
D) 10 years

Question 57

A form signed by a patient to permit release of medical information under specific stated conditions is called a(n)

A) acceptance form
B) authorization to disclose information
C) medical release form
D) None of these

Question 58

A clearinghouse is a company that helps medical offices and health plans exchange

A) claim data in correct formats
B) employment records
C) accounts payable
D) record retention schedules

Question 59

Under HIPAA, patients' protected health information may be shared without authorization for:

A) payment
B) health care operations
C) treatment
D) All of these

Question 60

______ Releasing protected health information for reasons other than treatment, payment, or health care operations requires which type of patient authorization?

A) written
B) verbal
C) either written or verbal
D) None of these; it cannot be released

Question 61

What is the relationship between documentation and billing?

A) If a service is not documented, it did not happen.
B) If a service is not documented, it cannot be billed.
C) If a service is not billed, the documentation can be destroyed.
D) If a service has been billed, the documentation can be shredded.

Question 62

Which of these subjects would you not expect to find information about in a patient's medical record?

A) medical allergies and reactions
B) a record of missed or canceled appointments
C) employment and salary records
D) biographical and personal information

Question 63

A medical office's compliance plan should include

A) staff training
B) internal communications
C) a record of all subpoenas received recently
D) both staff training and internal communications

Question 64

Under what circumstances might a patient's protected health information be shared without authorization?

A) court orders
B) workers' compensation cases
C) both court orders and workers' compensation cases
D) it can never be shared

Question 65

What is one way that providers can follow the guidelines for the HITECH rule?

A) frequently change passwords
B) access controls
C) make copies of all data
D) all of these

Question 66

Following OIG's guidance can help in the defense against which of the following?

A) a false claims accusation
B) a workers' compensation claim
C) unemployment claim
D) breach of ethical conduct

Question 67

If a physician requests that you bill a procedure that is not documented, what would be the best course of action?

A) bill whatever the doctor requests
B) say that you will comply and avoid the request altogether
C) report it to CMS
D) report it to the compliance officer

Question 68

If a practice has discovered that the security or privacy of more than 500 people's PHI has been breached, which establishment must be notified (through the HITECH Act)?

A) prominent media outlets
B) Office of the Inspector General
C) all credit bureaus
D) it can never be shared