Chapter 01
Legal and Ethical Issues

Multiple Choice Questions
 
1.  The following individuals are responsible in the health care practice except a(n):  
A.  physician. 
B.  transporter. 
C.  insurance coder and biller. 
D.  therapist. 
 A patient's information is easily accessible to those who should have access to it, such as the physician, insurance coder and biller, and therapist. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
CAHIIM: V.A.3. Adhere to the legal and regulatory requirements related to the health information management 
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
2.  What are professional coding specialists obligated to do?  
A.  Comply with the Privacy Rule 
B.  Work for clearinghouses 
C.  Release unauthorized private health information 
D.  Unbundle codes 
 HIPAA requires that all business-covered entities comply with the terms of the law. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: II.A.2. Identify the use of legal documents 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
3.  What were the HIPAA Privacy Rules written to protect?  
A.  Coding professional rights 
B.  Physician's privacy rights 
C.  An individual's personal health information 
D.  A business associate's privacy rights 
 HIPAA's Privacy Rule was written to protect an individual's privacy with regard to personal health information. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: II.A.2. Identify the use of legal documents 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
4.  Blue Cross Blue Shield is an example of a:  
A.  health care provider. 
B.  health care clearinghouse. 
C.  health community liaison. 
D.  health plan. 
 A health plan is an entity that provides or pays the cost of medical care on behalf of enrolled individuals; it includes group health plans, health insurance issuers, health maintenance organizations, and other welfare benefit plans such as Medicare, Medicaid, CHAMPUS, and Indian Health Services. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: None
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
5.  Covered entities are defined as businesses that:  
A.  provide transportation services. 
B.  have access to the personal health information of patients. 
C.  create the Health Care Fraud and Abuse Control Program. 
D.  forbid the submission of health care claims. 
 Under the Department of Health and Human Services HIPAA regulations, covered entities are any health plan, healthcare clearinghouse, or healthcare provider that transmits specific healthcare transactions in electronic form. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
6.  In a company workforce, all of the following must obey the rules of HIPAA except:  
A.  full-time employees. 
B.  part-time employees. 
C.  volunteers. 
D.  descendants. 
 A covered entity's workforce consists of every person who is involved with the company regardless of employment status. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
7.  What is protected health information?  
A.  Any personal identifiable health information 
B.  The sharing of information between people who are working in the same health care facility 
C.  The sharing of information between health care professionals working in separate entities, or facilities 
D.  A workforce of covered entities 
 PHI is individually identifiable health information transmitted electronically or maintained in any other form that is created or received by a healthcare provider or any other entity subject to HIPAA requirements. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
8.  What does the sharing of information with someone outside of the health care facility require?  
A.  Written permission for treatment and operation 
B.  Written permission for payment 
C.  Oral permission under HIPAA 
D.  Written permission under HIPAA 
 The healthcare provider must get a patient's written permission to disclose the PHI. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
9.  When Dr. Mason speaks to Nurse Adams about a patient, he is using:  
A.  incidental use. 
B.  protected health information. 
C.  private health record. 
D.  disclosure. 
 Use of PHI allows sharing of information between people who work together in the same office to better serve the patient. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
10.  Providers are not permitted to use or disclose PHI without a patient's written permission in which instance?  
A.  Treatment 
B.  Payment 
C.  Operations 
D.  Detailed data sets 
 Only limited data sets can be used without a patient’s written permission. PHI can be revealed but only after it has been depersonalized. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI
 
11.  What must written approvals to release PHI include?  
A.  Specifically identify the person or organization that will be disclosing the information 
B.  Give the name of person delivering the information 
C.  Have no definite expiration date 
D.  Have no specific date of service 
 The Privacy Rule of HIPAA insists written approvals must specifically identify the person or organization that will be disclosing the information and clearly explain that the person signing this release may retract this authorization in writing at any time. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
12.  PHI can be revealed after being:  
A.  de-identified. 
B.  disclosed. 
C.  used. 
D.  incidentally used. 
 PHI can be revealed but only after it has been depersonalized. 

ABHES: 4.b. Institute federal and state guidelines when releasing medical records or information
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Permitted Uses and Disclosures
 
13.  Someone convicted of violating HIPAA rules can be charged with:  
A.  civil penalties. 
B.  malpractice. 
C.  criminal penalties. 
D.  both civil penalties and criminal penalties. 
 Congress included specifications for both civil and criminal penalties to be applied against any covered entity that fails to protect its patients PHI. 

ABHES: 4.b. Institute federal and state guidelines when releasing medical records or information
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Violating HIPAA’s Privacy Rule

 
14.  What is the responsibility of a privacy officer?  
A.  To review and validate the qualifications of physicians and other licensed independent practitioners 
B.  To organize patient care plans that meet the standards set forth by law for managed care plans 
C.  To recognize risk that a given procedure may include functional impairment, injury, morbidity, or mortality 
D.  To develop and implement privacy policies and procedures 
 This is a position mandated under the HIPAA Privacy Rule—all covered entities must designate an individual to be responsible for developing and implementing privacy policies and procedures. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Privacy Notices
 
15.  In which instance will state law allow disclosure of patient information?  
A.  The reporting of suspected abuse 
B.  The reporting of STDs and other contagious diseases 
C.  In no instance are you allowed to disclose patient information. 
D.  Both the reporting of suspected abuse and the reporting of STDs and other contagious diseases 
 Public interest is the only instance in which disclosure is mandated by law, for suspected abuse, STDs, and other contagious diseases. 

ABHES: 4.b. Institute federal and state guidelines when releasing medical records or information
ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
16.  HIPAA violations are reported to which of the following agencies?  
A.  Office of Civil Rights in the Department of Health and Human Services 
B.  Office of Inspector General 
C.  Office of the National Coordinator of Health Information Technology 
D.  State’s Attorney Office 
 The OCR has the authority to investigate alleged violations of the HIPAA Privacy Rule. 

ABHES: 4.b. Institute federal and state guidelines when releasing medical records or information
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAAHEP: X.P.6. Report an illegal activity in the healthcare setting following proper protocol
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
17.  What amount can one expect to pay in civil penalties for violating HIPAA rules?  
A.  Up to $50,000 
B.  Up to $75,000 
C.  Up to $100,000 
D.  Up to $25,000 
 The general civil monetary penalty for anyone violating the HIPAA rules is not more than $100 for each violation, with civil fines capped at $25,000 per calendar year for each provision violated. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: V.A.3. Adhere to the legal and regulatory requirements related to the health information management 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Civil Penalties

 
18.  Which department or act was the Health Care Fraud and Abuse Control Program created by?  
A.  Health Insurance Portability and Accountability Act 
B.  State attorney general offices 
C.  Office of the National Coordinator of Health Information Technology 
D.  Health Information Security and Privacy Collaboration 
 HIPAA authorizes the OIG to investigate cases of healthcare fraud that involve private health plans as well as federally funded programs. 

ABHES: 4.a. Follow documentation guidelines
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAAHEP: XI.C.1a. Define ethics.
CAAHEP: XI.C.1b. Define morals.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.02
Topic: Health Care Fraud and Abuse Control Program
 
19.  In order to properly code, coders are permitted to:  
A.  code if the documentation is not there. 
B.  take a physician's word for a patient's diagnosis. 
C.  code documentation written in the medical record. 
D.  code documentation not authored by a clinician. 
 Codes should only support documentation in the medical record. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: IX.P.1. Perform procedural coding
CAAHEP: IX.P.2. Perform diagnostic coding
CAHIIM: I.A.1. Apply diagnosis/procedure codes according to current guidelines 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding

 
20.  What does the Federal False Claims Act forbid?  
A.  Late submission of claims 
B.  Inaccurate submission of health care claims for financial gain 
C.  Bundled code submissions 
D.  Claims submitted with coding, supported by documentation 
 Legislation was passed during the Civil War that prohibits contractors from making a false claim to a governmental program; it is used to reinforce the prevention of healthcare fraud and abuse. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: V.D.1. Identify discrepancies between supporting documentation and coded data
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.03
Topic: Federal False Claims Act
 
21.  What can the lack of accuracy of coding affect?  
A.  It can directly influence reimbursement to providers. 
B.  It can correctly alter healthcare policies and guidelines. 
C.  It can direct research endeavors. 
D.  It can decrease a patient's deductible. 
 Inaccurate coding can cause overpayment or underpayment on a claim. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: IX.C.1. Describe how to use the most current procedural coding system
CAHIIM: I.A.2. Evaluate the accuracy of diagnostic and procedural coding 
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.03
Topic: National Correct Coding Initiative

 
22.  What is upcoding?  
A.  Coding by the insurance company's rules of what it will pay 
B.  Codes that corroborate the documentation in the medical record 
C.  A code on a claim form that indicates a higher level of service than that which was actually performed 
D.  Codes that are identified as those that are not permitted 
 Upcoding is using a billing code that provides a higher reimbursement rate than the code applicable to the service actually furnished to the patient. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: IX.C.4a. Discuss the effects of upcoding.
CAAHEP: X.A.1. Demonstrate sensitivity to patient rights
CAHIIM: I.A.2. Evaluate the accuracy of diagnostic and procedural coding 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding
 
23.  What are the two main coding professional organizations that have published a code of ethics guide?  
A.  AAPC and AHIMA 
B.  AAMT and AAMC 
C.  ACHE and ACS 
D.  AHRQ and AMIA 
 The two main coding professional organizations are the American Academy of Professional Coders and the American Health Information Management Association. 

ABHES: None
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: XI.C.1a. Define ethics.
CAAHEP: XI.C.1b. Define morals.
CAHIIM: VI.H.1. Comply with ethical standards of practice
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.05
Topic: Code of Ethics

 
24.  It is illegal to bill for a component service when:  
A.  codes corroborate the documentation in the medical record. 
B.  codes are identified as those that are not permitted. 
C.  a comprehensive code or combination code is available. 
D.  a code is identified as a separate procedure. 
 The practice of using multiple codes to bill for various individual steps in a single procedure rather than using a single code that includes all of the steps of the comprehensive procedure is illegal. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: IX.C.1. Describe how to use the most current procedural coding system
CAHIIM: I.A.1. Apply diagnosis/procedure codes according to current guidelines 
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding
 
25.  Which office strongly recommends or mandates a formal compliance program?  
A.  AAPC 
B.  AMIA 
C.  AHIMA 
D.  OIG 
 The Office of Inspector General strongly recommends compliance programs. The goal of the compliance programs is to prevent accusations of fraud and abuse, make operations run smoothly, improve services, and contain costs. 

ABHES: 4.g. Display compliance with Code of Ethics of the profession
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: V.A.3. Adhere to the legal and regulatory requirements related to the health information management 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.06
Topic: Compliance Programs

 
26.  Under HIPAA, a covered entity includes all except a:  
A.  health care provider. 
B.  health plan. 
C.  health care school. 
D.  health care clearinghouse. 
 Under The Department of Health and Human Services HIPAA regulations, covered entities are any health plan, healthcare clearinghouse, or healthcare provider that transmits specific healthcare transactions in electronic form. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
27.  What does the acronym "HIPAA" abbreviate?  
A.  Health Information Protection Act of America 
B.  Health Insurance Portability and Accountability Act 
C.  Health Information Prevention Activities Act 
D.  Health Insurance Prevention Alliance Act 
 The Health Insurance Portability and Accountability Act of 1996 was enacted to provide continuity of health coverage, control fraud and abuse in healthcare, reduce healthcare costs, and guarantee the security and privacy of health information. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: II.A.2. Identify the use of legal documents 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
28.  An example of a health care provider, under HIPAA, is:  
A.  a dentist. 
B.  a computer software manufacturer. 
C.  WebMD. 
D.  Abbott Health insurance. 
 A healthcare provider is a provider of diagnostic, medical, and surgical care as well as the services or supplies related to the health of an individual and any other person or organization that issues reimbursement claims or is paid for healthcare in the normal course of business. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: II.A.2. Identify the use of legal documents 
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
29.  Which of the following is not a section of HIPAA?  
A.  The Privacy Rule 
B.  The Security Rule 
C.  Health Care Fraud and Abuse Control Program 
D.  Federal False Claims Act 
 HIPAA is responsible for the privacy and security of health information and fraud and abuse. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
30.  A covered entity's workforce, under HIPAA, includes all except a(n):  
A.  outside computer repair company. 
B.  full-time employee. 
C.  intern from local college. 
D.  volunteer. 
 Under the Department of Health and Human Services HIPAA regulations, covered entities are any health plan, healthcare clearinghouse, or healthcare provider that transmits specific healthcare transactions in electronic form. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
31.  What is the primary purpose of HIPAA's Privacy Rule?  
A.  Protecting a patient's health information 
B.  Assuring legal abortions 
C.  Providing free care for the poor 
D.  Obtaining proper reimbursement 
 The Privacy rule is a federal regulation created to implement the privacy requirements of the simplification subtitle of HIPAA. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
32.  When Dr. Sanders "uses" PHI, according to HIPAA, it means he is discussing a patient with the:  
A.  pharmacist at the drug store. 
B.  radiologist at the imaging center. 
C.  appointment scheduler in his office. 
D.  lab technician at the laboratory. 
 Use is internal to a covered entity or its business associate. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI
 
33.  When Dr. Katlyn "discloses" PHI, according to HIPAA, it means she is discussing a patient with:  
A.  her nurse. 
B.  her appointment scheduler. 
C.  her biller/coder. 
D.  a physical therapist at the hospital. 
 Disclosure is the dissemination of PHI from a covered entity or its business associate. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
34.  According to HIPAA, if Dr. Briscoe asks John if he would like his wife to also hear about his test results, this falls under:  
A.  incidental use and disclosure. 
B.  opportunity to agree or object. 
C.  treatment, payment, and/or operations. 
D.  public interest. 
 The covered entity may orally inform the individual of and obtain the individual's oral agreement or objection to a use or disclosure. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI
 
35.  According to HIPAA, if Dr. Rappier diagnoses Charlene with a contagious disease, he must notify the Department of Health. What circumstance does this fall under?  
A.  Incidental use and disclosure 
B.  Opportunity to agree or object 
C.  Treatment, payment, and/or operations 
D.  Public interest 
 Specific conditions may require that PHI is shared for the purpose of public interest. Public interest may outweigh the need for a patient’s personal privacy. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
36.  According to HIPAA, if Renee accidentally overhears Dr. Moore talking with Nurse Johnson about her neighbor, what does this falls under?  
A.  Incidental use and disclosure 
B.  Opportunity to agree or object 
C.  Treatment, payment, and/or operations 
D.  Public interest 
 An incidental use or disclosure is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and occurs as a result of another use or disclosure that is permitted by the Rule. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI
 
37.  According to HIPAA, a Privacy Notice must include:  
A.  contact information for the Department of Health and Human Services. 
B.  the exact location where patient records are stored. 
C.  contact information for the facility’s privacy officer. 
D.  both contact information for the Department of Health and Human Services and contact information for the facility’s privacy officer. 
 Health plans and covered healthcare providers are required to develop and distribute a notice that provides a clear explanation of these rights and practices. The notice is intended to focus individuals on privacy issues and concerns and to prompt them to have discussions with their health plans and healthcare providers and exercise their rights. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
38.  A $100 fine with no prison time is the penalty for a HIPAA:  
A.  criminal violation. 
B.  civil violation. 
C.  ethical violation. 
D.  fraud conviction. 
 Congress included specifications for both civil and criminal penalties to be applied against any covered entity that fails to protect its patients' PHI. 

ABHES: 4.b. Institute federal and state guidelines when releasing medical records or information
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI
 
39.  Codes chosen according to insurance company policies rather than what actually occurred with the patient is called:  
A.  upcoding. 
B.  unbundling. 
C.  mutually exclusive coding. 
D.  coding for coverage. 
 Coding for coverage is coding according to what the insurance company will pay. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: IX.C.1. Describe how to use the most current procedural coding system
CAHIIM: I.A.2. Evaluate the accuracy of diagnostic and procedural coding 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding

 
40.  Choosing a code that represents a more intense procedure than that which was actually provided is called:  
A.  upcoding. 
B.  unbundling. 
C.  mutually exclusive coding. 
D.  coding for coverage. 
 Upcoding is using a billing code that provides a higher reimbursement rate than the code applicable to the service actually furnished to the patient. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: IX.C.4a. Discuss the effects of upcoding.
CAAHEP: X.A.1. Demonstrate sensitivity to patient rights
CAHIIM: I.A.2. Evaluate the accuracy of diagnostic and procedural coding 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding
 
41.  Using three codes to report procedures rather than one combination code is called:  
A.  upcoding. 
B.  unbundling. 
C.  mutually exclusive coding. 
D.  coding for coverage. 
 Unbundling is the practice of expanding into individual units a group of diagnostic or procedural test codes—based on the 4th edition of Current Procedural Terminology (CPT) coding. 

ABHES: 9.a. Practice standard precautions and perform disinfection/sterilization techniques
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: IX.C.1. Describe how to use the most current procedural coding system
CAHIIM: I.A.2. Evaluate the accuracy of diagnostic and procedural coding 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding

 
42.  Before placing a code on a claim, what must a professional coding specialist make certain he or she has?  
A.  An Internet connection 
B.  A hospital affiliated with the procedure 
C.  Supporting documentation 
D.  A notarized testimony from the patient 
 If is not documented, it cannot be coded. 

ABHES: 8.c.3. Perform diagnostic and procedural coding
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: IX.P.1. Perform procedural coding
CAAHEP: IX.P.2. Perform diagnostic coding
CAHIIM: I.A.1. Apply diagnosis/procedure codes according to current guidelines 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding
 
43.  An example of a federal law is:  
A.  AAPC. 
B.  AHIMA. 
C.  HIPAA. 
D.  CMS. 
 The Health Insurance Portability and Accountability Act of 1996 was enacted to provide continuity of health coverage, control fraud and abuse in healthcare, reduce healthcare costs, and guarantee the security and privacy of health information. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: II.A.2. Identify the use of legal documents 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.03
Topic: National Correct Coding Initiative

 
44.  It is fraudulent for a coder to:  
A.  code for services not rendered. 
B.  change the date of service. 
C.  overcode. 
D.  All of these 
 Altering, overcoding, and coding for services not rendered are all cases of fraud. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: V.A.3. Adhere to the legal and regulatory requirements related to the health information management 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding
 
45.  A release of information form must:  
A.  include words in plain language. 
B.  have a definite expiration date. 
C.  specify exactly what information is to be released. 
D.  All of these 
 A release of information form must include words that are in plain language, have a definite expiration date, and specify what information is to be released. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.P.2. Apply HIPAA rules.
CAHIIM: II.C.1. Apply policies and procedures surrounding issues of access and disclosure of protected health information 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: The Use and Disclosure of PHI

 
46.  What is an example of a health plan, under HIPAA?  
A.  County health department 
B.  Aetna health insurance 
C.  WebMD Network Services 
D.  Home health aide 
 A plan is an entity that provides or pays the cost of medical care on behalf of enrolled individuals; it includes group health plans, health insurance issuers, health maintenance organizations, and other welfare benefit plans. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Understand
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: None
Difficulty: 2 Medium
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act
 
47.  HIPAA applies to:  
A.  an actuary. 
B.  a Realtor. 
C.  a business retail manager. 
D.  all health care workers. 
 HIPAA applies to all covered entities and business associates. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: VIII.C.1a. Identify types of third party plans.
CAHIIM: II.B.1. Apply confidentiality, privacy and security measures and policies and procedures for internal and external use and exchange to protect electronic health information
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act

 
48.  What does a compliance program officially do?  
A.  Absolves anyone in the organization from following the law 
B.  Affects only clinicians and does not apply to coders 
C.  Creates policies and procedures to be followed within an organization 
D.  Establishes performance bonuses for all health care workers 
 Compliance programs have been recommended by the OIG to help all healthcare facilities line up with the laws and agree to follow the direction of those laws. 

ABHES: 4.f. Comply with federal, state, and local health laws and regulations as they relate to healthcare settings
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: V.A.1. Analyze policies and procedures to ensure organizational compliance with regulations and standards
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.06
Topic: Compliance Programs
 
49.  To know the correct code to use, you should:  
A.  disregard the rules of ethical and legal coding. 
B.  follow all guidelines. 
C.  participate in fraud. 
D.  unbundle codes. 
 All coders should follow all guidelines and rules of ethical and legal coding. 

ABHES: 4.g. Display compliance with Code of Ethics of the profession
Accessibility: Keyboard Navigation
Blooms: Apply
CAAHEP: XI.C.1a. Define ethics.
CAAHEP: XI.C.1b. Define morals.
CAHIIM: I.A.1. Apply diagnosis/procedure codes according to current guidelines 
Difficulty: 3 Hard
Estimated Time: 0-1 minute
Learning Outcome: 01.04
Topic: Rules for Ethical and Legal Coding

 
50.  As a coder, if you are involved in fraud in your facility, you can:  
A.  not be found responsible if the physician told you to do it. 
B.  be fined. 
C.  go to jail. 
D.  both be fined and go to jail. 
 HIPAA authorized the OIG to investigate cases of healthcare fraud that involve private health plans as well as federally funded programs. 

ABHES: 7.c. Comply with federal, state, and local laws relating to exchange of information and describe elements of meaningful use and reports generated
Accessibility: Keyboard Navigation
Blooms: Remember
CAAHEP: X.C.1. Differentiate between scope of practice and standards of care for medical assistants
CAHIIM: V.A.3. Adhere to the legal and regulatory requirements related to the health information management 
Difficulty: 1 Easy
Estimated Time: 0-1 minute
Learning Outcome: 01.01
Topic: Health Insurance Portability and Accountability Act