AAPC-CIC Certified Inpatient Coder - Set 1 - Part 2

Correct Answer: Use results to develop, review, and revise the care plan

Under the Use requirement, a facility keeps assessments completed within the previous 15 months in the active record and uses their results to develop, review, and revise the resident's comprehensive plan of care. Option a is incorrect because coordination requires incorporating the PASARR level II determination and evaluation report recommendations into assessment, care planning, and transitions of care, not isolating them. Option b is incorrect because the regulation requires assessments completed within the previous 15 months to stay in the active record, so a 12-month cutoff would remove required documents. Option d is incorrect because assessments are also required within 14 calendar days of admission or significant change, and a quarterly review is due at least every 3 months.

Correct Answer: Functional capacity

The resident assessment requirement directs the facility to conduct a comprehensive, accurate, standardized, reproducible assessment of each resident's functional capacity, both initially and periodically, using the resident assessment instrument specified by CMS. Option b is incorrect because these are a separate admission requirement; the facility must have them at the time of admission, and they are not what the periodic assessment evaluates. Option c is incorrect because this program is an operational duty of the skilled nursing facility or nursing facility, aimed at preventing and detecting violations, and is not a resident measure. Option d is incorrect because a transfer agreement with a hospital is a facility-level requirement under the Act, so it describes the facility rather than any individual resident.

Correct Answer: Resident assessment instrument specified by CMS

Under 42 CFR 483.20(b)(1), a facility must make the comprehensive assessment of a resident's needs, strengths, goals, life history and preferences using the resident assessment instrument (RAI) specified by CMS. Option a is incorrect because this program exists to prevent and detect criminal, civil, and administrative violations, so it does not gather individual resident assessment data. Option b is incorrect because a facility must have this arrangement in effect with a hospital, which is an administrative requirement and not a tool for assessing residents. Option d is incorrect because they cover the resident's immediate care at the time of admission and are a separate requirement from the comprehensive assessment.

Correct Answer: I, II, and III

The automated data processing requirement calls for encoding within 7 days after assessment completion, lists quarterly review assessments among the encoded items, and requires transmitted MDS data to follow standard record layouts and data dictionaries. Face-sheet information applies only without an admission assessment. Option a is incorrect because leaves out statement III, which is also accurate, because transmitted MDS information must conform to standard record layouts and data dictionaries. Option c is incorrect because includes statement IV and drops statement I, yet the 7-day encoding deadline is a stated requirement. Option d is incorrect because relies on statement IV, but face-sheet information is encoded only if there is no admission assessment, and it omits quarterly reviews.

Correct Answer: Check the EHR Limitation box

The SAFER checklist tells organizations to check the EHR Limitation box when the EHR does not offer the features or functionality needed to fully implement a recommendation or its implementation guidance. Option b is incorrect because the checklist keeps every recommended practice, and nothing in it permits deleting a practice because of EHR constraints. Option c is incorrect because that rating, 0%, means the organization has not implemented the recommendation; it does not record a functionality gap in the EHR. Option d is incorrect because Fully Implemented, 91-100%, describes an organization that follows the recommendation consistently, which a missing EHR feature would prevent.

Correct Answer: patient safety

The SAFER Contingency Planning Guide states that EHR unavailability, which will occur in every EHR-enabled healthcare environment, represents a significant potential patient safety hazard that directly affects patient care. Option a is incorrect because staffing is not the hazard category named; the guide lists medication errors, unavailable images, delayed test follow-up and canceled procedures as documented hazards. Option b is incorrect because billing compliance is not how the SAFER guide frames EHR unavailability; it describes a hazard that directly affects patient care, not a payment issue. Option c is incorrect because data privacy relates to the HIPAA Security Rule's confidentiality focus, whereas the SAFER guide names EHR unavailability a hazard to patient care.

Correct Answer: Exigent circumstances, such as hidden or destroyed documents

When the Secretary determines that exigent circumstances exist, such as documents that may be hidden or destroyed, a covered entity or business associate must permit access at any time and without notice, instead of only during normal business hours. Option a is incorrect because protected health information is simply one of the sources of information open to the Secretary during normal business hours, so it does not trigger no-notice access. Option c is incorrect because the rule requires cooperation with complaint investigations, but access still occurs during normal business hours unless the Secretary determines that exigent circumstances exist. Option d is incorrect because in that case the covered entity or business associate must certify the failure and set forth its efforts to obtain the information; no timing change results.

Correct Answer: Disclosure for treatment and payment purposes

The definition of sale of protected health information excludes disclosures for treatment and payment purposes made under the permitted-uses provision. Remuneration received for such a disclosure therefore does not make it a sale. Option a is incorrect because the business associate exclusion requires that the only remuneration come from the covered entity to the business associate, not from an outside party. Option b is incorrect because the research exclusion applies only where the sole remuneration is a reasonable cost-based fee to prepare and transmit the information. Option c is incorrect because this describes the sale itself: the covered entity receives remuneration from or on behalf of the recipient in exchange for the information.

Correct Answer: Communication strategy for downtime and recovery periods

The SAFER Domain 2 practice on using health IT safely calls for a communication strategy for downtime and recovery periods that is independent of the computing infrastructure supporting the EHR, so staff can still be reached. Option a is incorrect because this practice covers computing and networking infrastructure for critical applications, including hardware duplication, network redundancy and data replication, and says nothing about how staff are reached. Option b is incorrect because this practice concerns having forms available to stand in for EHR functions during downtimes, not the channel used to contact people. Option d is incorrect because this practice describes policies for halting and resuming data exchange across system interfaces after a downtime event, which is a technical sequence rather than staff contact.

Correct Answer: Those permitted or required by the HIPAA rules

The general standard in 45 CFR 164.502(a) bars a covered entity or business associate from using or disclosing protected health information except as permitted or required by the subpart or by subpart C of part 160. Option b is incorrect because treatment is just one permitted category, listed alongside payment, health care operations, disclosures to the individual, valid authorizations and others, so the standard is broader. Option c is incorrect because the standard sets no test based on the entity's own judgment of benefit; it ties every use or disclosure to what the rules permit or require. Option d is incorrect because a written request alone gives no authority; a disclosure still needs a basis in the rules, such as a valid authorization or another permitted category.

Correct Answer: It is a subset of health information

HIPAA defines individually identifiable health information as a subset of health information, including demographic information collected from an individual. Protected health information is then built on that narrower category, with stated exclusions. Option a is incorrect because protected health information is individually identifiable health information in any form or medium, with listed exclusions, so the two terms are not identical. Option c is incorrect because the definition places it inside health information, so it is narrower than health information and cannot contain it as a larger group. Option d is incorrect because the definition expressly includes demographic information collected from an individual, so demographic data falls within it rather than outside it.

Correct Answer: Supporting medical care evaluation studies

The hospital must have a system of coding and indexing medical records that allows timely retrieval by diagnosis and procedure, in order to support medical care evaluation studies, under the medical record services condition of participation. Option a is incorrect because author identification belongs to a separate system that protects the integrity of authentication and the security of record entries. Option b is incorrect because confidentiality is handled by a separate procedure that limits release to authorized individuals; it is not the stated purpose of the coding and indexing system. Option d is incorrect because retention is a different requirement, calling for original or legally reproduced form to be kept for at least 5 years.

Correct Answer: Disclosure made as part of a limited data set

The accounting-of-disclosures provision lists disclosures made as part of a limited data set under the HIPAA Privacy Rule among those excluded from the accounting. Business associate and recent disclosures are included, and oversight disclosures face only temporary suspension. Option a is incorrect because the accounting expressly covers disclosures to or by business associates of the covered entity, so these appear in it rather than being excluded. Option c is incorrect because such a disclosure is not excluded outright; the right to an accounting of it is only temporarily suspended when the agency provides a statement. Option d is incorrect because six years before the request is the standard look-back period for the accounting, so disclosures inside it are included unless an exclusion applies.

Correct Answer: Documentation standard

The Documentation standard requires a covered entity to maintain any writing the Privacy Rule requires, or an electronic copy, as documentation. It also covers policies, procedures and required actions, activities or designations. Option a is incorrect because it addresses whether a covered entity is bound by practices stated in its notice unless it reserved the right to change them, not record keeping. Option b is incorrect because it sets how long required documentation must be kept, whereas the excerpt describes what must be maintained, which is a separate duty. Option c is incorrect because that specification lets a covered entity revise a policy that does not materially affect the notice, provided the revision complies and is documented before taking effect.

Correct Answer: Right to approve the covered entity's fundraising budget

The notice must state the rights to request restrictions, receive confidential communications, inspect and copy, amend, receive an accounting of disclosures, and obtain a paper copy. Approving a fundraising budget is not among them. Option b is incorrect because the notice must list this right, which is provided by the amendment provision and sits among the enumerated individual rights. Option c is incorrect because HIPAA names this right, tied to the confidential communications provision, among the statements the notice has to contain. Option d is incorrect because the notice is required to include it; the accounting provision supplies this right in the same list of rights.

Correct Answer: Comply with the standards applicable to each function performed

Under 45 CFR 164.504(g), a covered entity performing multiple covered functions, any combination of health plan, covered health care provider and health care clearinghouse, must comply with the standards applicable to each covered function it performs. Option a is incorrect because clearinghouse standards apply only if the entity performs that function, and this entity is described as a health plan and provider, not a clearinghouse. Option b is incorrect because following just the provider standards would leave the health plan function uncovered, yet the rule requires compliance for every covered function the entity performs. Option c is incorrect because the rule does not let the entity choose one function's standards; it must follow the requirements for each covered function it performs, including the provider function.

Correct Answer: Group health plan

The Security Rule's requirements for group health plans state that plan documents must be amended to require the plan sponsor to implement administrative, physical, and technical safeguards for electronic protected health information, so the group health plan carries this duty. Option a is incorrect because a business associate is bound through a business associate contract or other arrangement, not through amended plan documents, which belong to the group health plan. Option c is incorrect because workforce members are not assigned the duty to amend plan documents; the Security Rule places that requirement on the group health plan itself. Option d is incorrect because a subcontractor's obligations arise from the contract or other arrangement with the business associate, so plan documents are not the vehicle for those requirements.

Correct Answer: Baroreceptors

Baroreceptors are specialized stretch receptors in the aorta and carotid arteries. They respond to the degree of stretch from blood and send impulses to the cardiovascular center to regulate blood pressure. Option a is incorrect because this is the blood pressure cuff, an instrument used in clinical practice to measure pressure, not a structure in the vessel wall. Option b is incorrect because they monitor levels of oxygen, carbon dioxide, and hydrogen ions (pH) rather than the stretch produced by pressure within the vessels. Option d is incorrect because these are epinephrine and norepinephrine, hormones released by the adrenal medulla as part of the fight-or-flight response, not sensory structures.

Correct Answer: The costs of security measures

Under the flexibility of approach, a covered entity or business associate must consider size, complexity, capabilities, technical infrastructure, the costs of security measures, and the probability and criticality of potential risks. Option a is incorrect because vendor preference is not named by the rule, which ties the decision to the entity's own infrastructure, costs, and risks. Option b is incorrect because payer mix does not appear among the factors the Security Rule lists for choosing security measures under the flexibility of approach. Option c is incorrect because visit volume is not a listed factor; the rule points to size, complexity, and capabilities of the entity instead.

Correct Answer: Electronic mail

Under the HIPAA breach notification rule, written notice goes by first-class mail to the last known address or, if the individual agrees and has not withdrawn that agreement, by electronic mail. Option a is incorrect because this is not a written notice method in the individual notification provision, which centers on mail to the last known address or agreed electronic mail. Option b is incorrect because HIPAA's written notice provision names first-class mail or, with agreement, electronic mail; a telephone call alone is not listed as that form. Option d is incorrect because a Web site appears only as a possible contact procedure within the notice content, not as a way to deliver the written notice.