Deck 2: Electronic Health Records, Hipaa, and Hitech: Sharing and Protecting Patients Health Information

Question 1

Which of the following laws makes it illegal for physicians to have financial relationships with clinics to which they refer patients?

A) FCA
B) Sarbanes-Oxley
C) Stark Rules
D) Antikickback statute

Answer 1

Stark Rules

Question 2

OESS is the abbreviation for

A) Office of E-Health Security Services.
B) Office of E-Health Standards and Services.
C) Office of E-Health Standards and Selections.
D) Office of E-Health Security and Standards.

Answer 2

Office of E-Health Standards and Services.

Question 3

Which of the following is not a type of history documented in the chart?

A) family/social
B) past medical
C) present Illness
D) spiritual

Answer 3

spiritual

Question 4

CMS stands for

A) Centers for Medical Services.
B) Center for Medicaid Services.
C) Centers for Medicare & Medicaid Services.
D) Center for Medicare Services.

Question 5

The abbreviation for treatment, payment, and health care operations is

A) TPH.
B) TPHC.
C) TPO.
D) TPHO.

Question 6

Which agency advises against using a patient's name in the body of a medical report?

A) American Heart Association (AHA)
B) American Association of Professional Coders (AAPC)
C) Association for Health Care Documentation Integrity (AHDI)
D) American Medical Association (AMA)

Question 7

Disclosure of which of the following conditions requires a specific authorization from the patient other than for TPO?

A) angina
B) muscular dystrophy
C) schizophrenia
D) lupus

Question 8

Which of the following acts strengthened the provisions of the FCA?

A) HITECH
B) FERA
C) HIPAA
D) Stark

Question 9

OIG is the abbreviation for

A) Office of the Internal General.
B) Office of the Inspector General.
C) Office of the Informed General.
D) Office of the Investigative General.

Question 10

A valid authorization must include all of the following except

A) a statement of the individual's right to revoke the authorization in writing.
B) a statement about whether the CE is able to base prescriptions on the authorization.
C) a statement about whether the CE is able to base payment on the authorization.
D) a statement about whether the CE is able to base treatment on the authorization.

Question 11

Which of these laws was designed to tighten the HIPAA Privacy Rule?

A) HITECH Act
B) HIPAA Electronic Transaction and Code Sets Standards
C) Security Rule
D) CMS

Question 12

Some state statutes differ from HIPAA in the following areas except

A) psychotherapy notes.
B) legal size of practices.
C) designated record set.
D) rights of inmates.

Question 13

Which of the following is America's "law office"?

A) OIG
B) HIPAA
C) DOJ
D) FCA

Question 14

A complete H&P is documented with how many type(s) of information?

A) three
B) four
C) two
D) one

Question 15

__________ are numbers of predetermined length and structure, such as people's Social Security numbers.

A) Identifiers
B) Minimum data sets
C) Code sets
D) NPIs

Question 16

When personal identifiers have been removed, protected health information is called

A) minimum data set.
B) covered.
C) research data.
D) de-identified.

Question 17

Patients' medical records must document all of the following except

A) diagnosis.
B) next of kin.
C) allergies.
D) signature of provider who saw the patient.

Question 18

The electronic equivalent of a business document is called a(n)

A) meaningful use
B) audit
C) electronic data interchange
D) transaction

Question 19

When protected health information is shared, which of the following should be observed?

A) code set
B) informed consent
C) encryption
D) minimum necessary standard

Question 20

The __________ make(s) it illegal to knowingly offer incentives to induce referrals.

A) Sarbanes-Oxley
B) antikickback statute
C) FCA
D) Stark rules

Question 21

Which of the following laws prohibits submitting a fraudulent claim?

A) FCA
B) HIPAA
C) OIG
D) HITECH

Question 22

All of the following should be completed on notes except

A) signature.
B) date.
C) verification.
D) time.

Question 23

Which of the following acts provided additional funding to strengthen the tools that the DOJ and HHS used to pursue fraud investigations?

A) HITECH
B) FCA
C) FERA
D) ACA

Question 24

Which of the following acts contains additional provisions concerning the standards for electronic transmission of health care data?

A) HIPAA
B) TCS
C) HITECH
D) HIE

Question 25

What did HIPAA create to uncover and prosecute fraud and abuse?

A) The National Provider Identifier (NPI)
B) The Health Care Fraud and Abuse Control Program
C) The Centers for Medicare and Medicaid Services (CMS)
D) The HIPAA Privacy Rule

Question 26

The HIPAA rules for protecting patients' health information are in the

A) Electronic Transaction Rule.
B) Privacy Rule.
C) Code Sets Rule.
D) Security Rule.

Question 27

OCR is the abbreviation for

A) Office of Civil Reporting.
B) Office for Civil Rights.
C) Office of Civilians Rights.
D) Office for Common Rights.

Question 28

During the process of informed consent, the physician advises the patient as to all of the following except

A) cost.
B) assessment.
C) risks.
D) recommendations.

Question 29

Which act requires publicly traded corporations to attest that their financial management is sound?

A) Sarbanes-Oxley
B) Stark rules
C) FERA
D) FCA

Question 30

A court order to appear and testify is a

A) respondeat superior.
B) none of these answers are correct.
C) subpoena duces tecum.
D) subpoena.

Question 31

An encounter is defined as a

A) phone call between a provider and family of the patient.
B) meeting between a clinician and a patient.
C) face-to-face meeting between an administrator and a patient.
D) face-to-face meeting between a provider and a patient.

Question 32

__________ is deception with intent to benefit from the behavior.

A) Abuse
B) Kick backs
C) Fraud
D) Self-referrals

Question 33

With the HIPAA transactions standard set, each standard is labeled with a

A) both a number and a name.
B) either a number or a name.
C) name.
D) number.

Question 34

In a SOAP format, which of the following is information from the patient?

A) Objective
B) Plan
C) Subjective
D) Assessment

Question 35

The minimum necessary standard means to

A) take reasonable safeguards to protect PHI.
B) complete the general business management functions.
C) release partial patient record to the hospital that requests it.
D) provide minimum care.

Question 36

How have most privacy complaints under HIPAA been resolved?

A) legal action
B) court battles
C) voluntary compliance
D) by jail terms

Question 37

When leaving a message on a patient's answering machine, what is to be followed?

A) minimum necessary standard
B) data record set restrictions
C) compliance plans policy
D) no messages should be left

Question 38

For release of PHI for treatment, payment, and health care operations

A) a limited authorization is required.
B) informed authorization is required.
C) a specific authorization is required.
D) no authorization is required from the patient.

Question 39

Patients have the right to __________ and inspect their complete health record.

A) change
B) remove
C) access
D) document

Question 40

What group is charged with detecting health care fraud and abuse?

A) ACA
B) OIG
C) RCA
D) CMS

Question 41

Which of the following terms means using the expertise reasonably expected of a medical professional?

A) adjudication
B) designated record set
C) medical standards of care
D) informed consent

Question 42

E/M is the abbreviation for

A) examination and management.
B) evaluation and management.
C) examination and medical history.
D) evaluation and medical history.

Question 43

Under which act can a patient restrict the access of health plans to their medical records if they pay for the service in full at the time of visit?

A) HITECH
B) ARRA
C) HIPAA
D) HIE

Question 44

Which excludes a provider from being considered a covered entity?

A) only files Medicare claims electronically
B) pays a clearinghouse to submit electronic claims on their behalf
C) doesn't send any claims electronically or employ any other firm to do it
D) employs less than 10 full-time employees

Question 45

According to the OIG compliance plans should contain how many elements?

A) nine
B) five
C) seven
D) eleven

Question 46

Breach notifications must contain all of the following except

A) a brief description of what happened.
B) a description of the damages awarded for ill consequences from the breach.
C) a description of the types of unsecured PHI involved.
D) a description of what the CE is doing to investigate the breach.

Question 47

The document notifying an individual of a breach is called a

A) breach report.
B) breach alert.
C) breach notification.
D) breach observation.

Question 48

An authorization to disclose PHI that a patient signs must have all of the following except

A) expiration date.
B) signature of the nurse who treated the patient.
C) be in plain language.
D) describe the information that is to be used or disclosed.

Question 49

Electronic health records are considered to have significant advantages, including all of the following except

A) patient support.
B) electronic communication.
C) clinical decision support.
D) reduced costs.

Question 50

When are covered entities required to give patients their Notice of Privacy Practices?

A) when the patient receives the bill
B) if the patient is referred elsewhere
C) when the patient is scheduled for surgery
D) at the first contact or encounter

Question 51

The HIPAA Electronic Health Care Transactions and Code Set standards specify certain code sets for all of the following except

A) supplies
B) procedures
C) diagnoses
D) facilities

Question 52

Which of the following is required for releasing protected health information for reasons other than treatment, payment, or health care operations?

A) patient's signed authorization
B) patient's verbal approval
C) informed consent
D) provider's written approval

Question 53

A __________ is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI.

A) spill
B) breach
C) release
D) leak

Question 54

Which of the following states the HIPAA rules for administrative, technical, and physical safeguards of patients' health information?

A) Security Rule
B) Code Sets Rule
C) Electronic Transaction Rule
D) Privacy Rule

Question 55

__________ is the activity of copying files to another medium so that they will be preserved in case the originals are no longer available.

A) Critical data recovery
B) Backing up
C) Antivirus software programs
D) Encrypting

Question 56

Discharge summaries include all of the following except

A) current condition of patient.
B) physical examination.
C) reason for discharge.
D) final diagnosis.

Question 57

The standard for the identification of providers when filing claims and other transactions is the

A) HITECH Act.
B) HIPAA Electronic Health Care Transactions and Code Sets (TCS).
C) National Provider Identifier (NPI).
D) Employer Identification Number (EIN).

Question 58

Which of the following conditions requires a specific authorization from the patient other than for TPO?

A) tobacco cessation
B) multiple sclerosis
C) diabetes
D) alcohol abuse

Question 59

Which of the following are organizations that work for covered entities but are not themselves covered entities?

A) health plans
B) electronic data interchanges
C) clearinghouses
D) business associates

Question 60

__________ is the process of encoding information in such a way that only the person (or computer) with the key can decode it.

A) Encryption
B) Meaningful use
C) Fraud
D) Code set

Question 61

Patient information may be released without the patient's authorization under which of the following circumstances?

A) all of these are correct
B) research
C) statutory reports
D) court order

Question 62

The HIPAA Security Rule specifies how to secure PHI on which of the following?

A) computer networks
B) storage disks
C) the Internet
D) all of these answers are correct.

Question 63

Workers' compensation cases may require release of records to all the following except:

A) employers in workers' compensation cases.
B) state workers' compensation administration board.
C) insurance company that handles the state's claims.
D) the employee's direct supervisor.

Question 64

In qui tam, or whistleblower, cases the person who makes the accusation of suspected fraud is called the

A) detector.
B) relator.
C) provider.
D) respondeat superior.

Question 65

Under the HITECH Act, unprotected health information that is not secured through the use of technologies or methods that HHS has specified is referred to as

A) medical records.
B) PHI.
C) documentation.
D) unsecured PHI.

Question 66

Which of the following makes it possible for physicians and health plans to exchange electronic data using a standard format and standard code sets?

A) The HITECH Act
B) The HIPAA Security Rule
C) The HIPAA Electronic Health Care Transactions and Code Sets (TCS)
D) The HIPAA Privacy Rule

Question 67

Which of the following is a systematic, logical, and consistent recording of a patient's health status in a medical record?

A) documentation
B) operating rules
C) code set
D) encounter

Question 68

When a provider injures a patient due to failure to follow medical standards of care, it is called

A) malpractice.
B) fraud.
C) abuse.
D) none of these answers are correct.

Question 69

Disclosure of which of the following conditions requires a specific authorization from the patient other than for TPO?

A) HIV status
B) otitis media
C) Alzheimer's disease
D) pharyngitis

Question 70

__________ make(s) it possible for physicians and health plans to exchange electronic data using a standard format.

A) HIPAA Security Rule
B) HIPAA
C) HIPAA Privacy Rule
D) HIPAA Electronic Transactions and Code Sets

Question 71

CE is the abbreviation for

A) covered emergency.
B) compliance entity.
C) covered entity.
D) covered exchange.

Question 72

When completely implemented, HIPAA National Identifiers will be available for which of the following?

A) providers
B) health plans
C) employers
D) all of these are included

Question 73

A vendor such as a software firm that does business with a covered entity is called a(n)

A) HIPAA firm.
B) provider.
C) business associate.
D) HIPAA vendor.

Question 74

A __________ is a person who makes an accusation of fraud or abuse.

A) stark
B) relator
C) whistle-blower
D) qui tam

Question 75

An impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI is called a

A) breach.
B) violation.
C) notification.
D) fraud case.

Question 76

All of the following are uses for the medical record except

A) scheduling.
B) continuity of care.
C) education.
D) communication among providers.

Question 77

Which of the following can be used by providers to transmit claims in the proper format for carriers?

A) business associate
B) electronic data interchange
C) health plan
D) clearinghouse

Question 78

Which group is charged with enforcing the Electronic Health Care Transaction and Code Set Rule?

A) OIG
B) OESS
C) IRS
D) CMS

Question 79

HIPAA contains how many provisions (titles) that focus on various aspects of health care?

A) 4
B) 2
C) 5
D) 3

Question 80

Disclosure of which of the following conditions requires a specific authorization from the patient other than for TPO?

A) croup
B) hives
C) obesity
D) AIDS