AAPC-CPCO Certified Professional Compliance Officer - Set 5 - Part 1

Correct Answer: HIPAA Privacy Rule

The HIPAA Privacy Rule addresses the use and disclosure of protected health information by covered entities. It sets limits and conditions on disclosures made without an individual's authorization while allowing the flow of information needed for quality care. Option a is incorrect because it created a voluntary reporting system to improve patient safety and quality data, and has no role in setting disclosure conditions for PHI. Option c is incorrect because it is a statute aimed at regulatory overhaul and expanded coverage, best known for the individual mandate, not for rules on health information disclosure. Option d is incorrect because it sets national standards for protecting electronic personal health information as it is created, received, used, or maintained, rather than governing when disclosures are allowed.

Correct Answer: Psychotherapy notes

The access standard gives an individual a right to inspect and obtain a copy of protected health information in a designated record set, except for psychotherapy notes and information compiled in anticipation of a legal proceeding. Option a is incorrect because this describes how a covered entity must accommodate reasonable requests to receive communications, not a category of information excluded from access. Option b is incorrect because this is a record a covered entity must retain for 6 years; the access standard does not list it as an exception. Option c is incorrect because this is the very information the right of access covers, for as long as it is maintained in the designated record set.

Correct Answer: A reasonable cost-based fee

The HIPAA Privacy Rule excludes a research disclosure from the definition of sale of PHI when the only remuneration received is a reasonable cost-based fee covering the cost to prepare and transmit the PHI. Option a is incorrect because the research exclusion names one permitted remuneration, a reasonable cost-based fee, and a profit percentage is a different arrangement that the exclusion does not describe. Option b is incorrect because a price set per record is not described in the research exclusion, which allows only the reasonable cost-based fee for preparing and transmitting the PHI. Option d is incorrect because the rule ties the permitted fee to the cost of preparing and transmitting the PHI, and a flat licensing fee is not that cost-based fee.

Correct Answer: revoked

The defective authorizations provision lists several defects, including that the authorization is known by the covered entity to have been revoked. A revoked authorization is therefore not valid. Option a is incorrect because the rule lists no witness requirement, so the lack or presence of a witness is not a defect named in the provision. Option c is incorrect because translation is not listed among the defects that make an authorization invalid under the Privacy Rule's defective authorization provision. Option d is incorrect because the defect list does not mention amendment; an authorization that merely contains additional, consistent elements remains valid.

Correct Answer: Terminate the contract or arrangement, if feasible

Under the business associate contract standard, a covered entity that knew of a pattern of material breach is out of compliance unless it took reasonable steps to cure or end the violation and, if unsuccessful, terminated the contract, if feasible. Option b is incorrect because the standard directs the covered entity to cure, end the violation, or terminate; it gives no duty to notify the subcontractor. Option c is incorrect because amending a designated record set concerns an individual's right to correct PHI and has no role in responding to a business associate's breach. Option d is incorrect because the standard calls for curing the breach or ending the violation, then termination if those steps fail, not a replacement assurance.

Correct Answer: First-class mail to the personal representative

When the covered entity knows the individual is deceased and has the address of the next of kin or personal representative, the rule requires written notification by first-class mail to either of them. Option a is incorrect because substitute notice applies when contact information is insufficient or out of date, but here the covered entity has a usable address. Option b is incorrect because electronic mail is allowed only when the living individual has agreed to electronic notice, and that agreement cannot be assumed for a deceased individual. Option d is incorrect because the rule expressly provides for written notice to the next of kin or personal representative when the covered entity knows of the death and has the address.

Correct Answer: The Attorney General

The civil remedies section of RICO states that the Attorney General may institute proceedings, and that pending final determination the court may at any time enter restraining orders or prohibitions as it deems proper. Option a is incorrect because the civil remedies section does not name this office as the one that institutes proceedings; that power belongs to the Attorney General. Option c is incorrect because the statute gives no role in instituting RICO civil proceedings to this official; the authority to bring them is stated for another office. Option d is incorrect because a grand jury receives evidence of alleged racketeering violations from government attorneys, but it does not start civil proceedings under the civil remedies section.

Correct Answer: Filed in writing, on paper or electronically

Under the complaint provision, a complaint must be filed in writing, either on paper or electronically. It must also name the subject of the complaint, describe the acts or omissions, and meet the 180-day time limit. Option b is incorrect because the regulation lets a person who believes a covered entity or business associate is not complying file, so filing is not limited to the affected patient. Option c is incorrect because the complaint provision sends the complaint to the Secretary and sets no prior filing with the covered entity as a condition. Option d is incorrect because the filing requirements list a written form, a named subject with described acts or omissions, and a time limit; notarization is not among them.

Correct Answer: The capability of the hospital's emergency department

The statute and 42 CFR 489.24 require the screening examination to be provided within the capability of the hospital's emergency department, including ancillary services routinely available to the emergency department, to determine whether an emergency medical condition exists. Option a is incorrect because bylaws or rules and regulations determine who is qualified to conduct the examination, which is a personnel requirement rather than a limit on the examination's scope. Option c is incorrect because the duty applies whether or not the individual is eligible for Medicare benefits, so eligibility sets no boundary on the examination. Option d is incorrect because the regulation applies regardless of ability to pay, so payment capacity does not define the scope of the examination the hospital owes.

Correct Answer: Transfer to another medical facility under subsection (c)

Under the EMTALA statute, once a hospital determines an emergency medical condition exists, it must either stabilize the individual within its staff and facilities or arrange transfer to another medical facility in accordance with subsection (c). Option b is incorrect because CMS interpretive guidelines call it inappropriate to merely log in an individual and not provide a screening examination, so it satisfies no duty. Option c is incorrect because such policies are the standard for Medicare hospitals that do not provide emergency services, and they do not replace stabilization or transfer. Option d is incorrect because the screening examination is the process that determines whether an emergency medical condition exists, so it has already served its purpose once that determination is made.

Correct Answer: The appropriate quality improvement organization

Before imposing sanctions or terminating a hospital's participation, the Secretary must request the appropriate quality improvement organization to assess whether an emergency medical condition had not been stabilized and to report its findings. Option a is incorrect because an internal committee of the accused hospital is not the reviewer the Secretary must consult; the statute directs the request to an outside organization. Option b is incorrect because the statute assigns this assessment to a quality improvement organization under contract, and it does not name a state licensing board for the role. Option d is incorrect because the on-call physician is a person who may face penalties for failing or refusing to appear, not the reviewer who reports findings to the Secretary.

Correct Answer: A certificate issued by the Secretary

The CLIA statute's certificate requirement bars any person from soliciting or accepting human-body materials for laboratory examination unless a certificate issued by the Secretary is in effect for the laboratory and covers that category of examination. Option a is incorrect because the QMB program pays Medicare premiums and cost-sharing for low-income beneficiaries; it addresses beneficiary costs, not a laboratory's authority to accept specimens. Option b is incorrect because prospective payment is a Medicare hospital payment method based on patient diagnoses, which replaced cost-based payments and has no role in authorizing laboratory examinations. Option c is incorrect because the hospice benefit lets beneficiaries choose all-inclusive care for pain and symptom relief at home, which is unrelated to laboratory certification.

Correct Answer: The use or disclosure is permitted or required by the subpart

The standard in the general rules states that a covered entity or business associate may not use or disclose protected health information except as permitted or required by the subpart or by subpart C of part 160. Option a is incorrect because the rule lists several permitted recipients and purposes, including the individual, treatment, payment and operations, so it is not confined to the individual's own provider. Option b is incorrect because authorization is only one permitted route; the rule also allows disclosures to the individual, for treatment, payment, or health care operations, and under other provisions. Option d is incorrect because the rule contains no written verification condition for business associates; it ties every use or disclosure to what the subpart permits or requires.

Correct Answer: The United States Postal Service

The Act defines employer as a person engaged in a business affecting commerce who has employees, excluding the United States and any State or political subdivision. The United States Postal Service is carved out of that exclusion and is an employer subject to the Act. Option a is incorrect because State government is carved out of the definition of employer, so an agency of a State falls outside the Act's coverage as an employer. Option b is incorrect because a county is a political subdivision of a State, and the definition of employer expressly excludes any State or political subdivision of a State.thus it is not covered. Option c is incorrect because the definition excludes the United States itself, so a federal agency is not an employer even though it has employees.

Correct Answer: A public health authority

OSHA allows voluntary disclosure of the forms with personally identifying information to a public health authority or law enforcement agency for disclosures that HIPAA privacy rule provisions permit without consent, authorization or opportunity to agree or object. Option a is incorrect because an applicant has no role in evaluating safety programs or processing claims, and is not a listed exception, so the forms would need to be de-identified. Option c is incorrect because a reporter is not among the recipients OSHA lists for voluntary disclosure with identifying information, so names and other personal identifiers would have to be removed or hidden. Option d is incorrect because a competitor is outside the narrow exceptions OSHA sets out, which cover auditors, claims processing and certain public authorities, so identifiers must be hidden.

Correct Answer: Listing unrelated diagnoses in the opinion

The standard limits the post-exposure written opinion to two items: the employee was informed of the evaluation results, and was told of any exposure-related conditions needing further evaluation or treatment. All other findings or diagnoses stay confidential. Option a is incorrect because the written opinion comes from the evaluating healthcare professional after the evaluation, so tying it to the evaluation matches the standard and creates no conflict. Option b is incorrect because the standard expressly lists this as one of the two permitted items in a post-exposure written opinion, so it is consistent with the standard. Option d is incorrect because the standard calls for a written opinion from the evaluating healthcare professional following an exposure incident, so timing and occasion are not the problem.

Correct Answer: Yes, research-related treatment may be conditioned on that authorization

HIPAA prohibits conditioning treatment, payment, enrollment or eligibility on an authorization, with exceptions. One exception lets a covered health care provider condition research-related treatment on an authorization for use or disclosure of protected health information for that research. Option a is incorrect because psychotherapy notes do not create the research exception; they appear only as a limit on the health plan's enrollment and eligibility exception. Option c is incorrect because the rule lists exceptions, and research-related treatment provided by a covered health care provider is one of them, so conditioning is allowed here. Option d is incorrect because enrollment in a health plan is unrelated to the provider's exception, which turns on research-related treatment and an authorization for research use.

Correct Answer: Ensure each plan has an anti-fraud plan in effect

The statute's special rules for parts C and D require recovery audit contractors to ensure each MA plan under part C has an anti-fraud plan in effect and to review the effectiveness of that plan. Option a is incorrect because the statute ties this review to estimates submitted by prescription drug plans, so it concerns part D plans rather than MA plans. Option b is incorrect because this duty is given to the contractors for prescription drug plans under part D, not for MA plans under part C. Option c is incorrect because the statute assigns Medicaid coordination to the Secretary, acting through CMS, and not to recovery audit contractors reviewing MA plans.

Correct Answer: The Medicaid agency reviews the Unit's activities before referrals reach prosecutors.

The regulation requires the Unit to be separate and distinct from the Medicaid agency and gives no Medicaid agency official authority to review the Unit's activities or its referrals. Agency review before referral therefore contradicts the rule. Option b is incorrect because the regulation states the Unit will not receive funds either from or through the Medicaid agency, which makes this a true statement. Option c is incorrect because the regulation opens its relationship section with exactly this requirement, so it is a true statement about the Unit and the Medicaid agency. Option d is incorrect because the regulation denies Medicaid agency officials any authority to review or overrule a referral to a prosecuting authority, so this statement holds.

Correct Answer: The universe of claims/services

OIG guidance says the codes tied to identified risk areas may become the universe of claims/services, and the random sample is selected from that universe. The universe can also be all claims reimbursed or all claims from one payor. Option a is incorrect because routine monitoring covers ongoing checks of known risks, such as screening exclusion lists, and does not describe the set of claims a sample comes from. Option b is incorrect because a compliance work plan is the document scheduling audits and monitoring based on identified risks, so it does not name the claims population being sampled. Option c is incorrect because OIG guidance describes a focused review as something a practice may conduct more frequently when problems are found, not the pool from which a sample is drawn.