AAPC-CPCO Certified Professional Compliance Officer - Set 4 - Part 2

Correct Answer: Any known prior expressed preference of the individual

When the individual is deceased, a covered entity may disclose relevant protected health information to family members or others involved in care or payment, unless this is inconsistent with a prior expressed preference of the individual known to the covered entity. Option b is incorrect because the family member's involvement in care or payment before death is what supports the disclosure, and the provision names no authorization from that person as a condition. Option c is incorrect because the provision on deceased individuals states no waiting period; it permits disclosure to involved persons and names a different limiting condition. Option d is incorrect because the provision covers family members or other persons involved in care or payment, so personal representative status is not the condition it sets.

Correct Answer: Remuneration must be reasonably related to the cost of the communication

The marketing definition excludes refill reminders and communications about a currently prescribed drug or biologic, but only if any financial remuneration the covered entity receives is reasonably related to its cost of making the communication. Option a is incorrect because the exclusion covers a drug or biologic that is currently being prescribed for the individual, not one newly introduced to the individual. Option b is incorrect because the exclusion exists precisely so that qualifying refill communications fall outside marketing, so no authorization requirement attaches to them under this definition. Option d is incorrect because the definition sets no written disclosure condition; it limits the remuneration itself by tying it to the covered entity's cost of making the communication.

Correct Answer: Hybrid entity

A hybrid entity is a single legal entity that is a covered entity, has both covered and non-covered business activities, and designates health care components. The organization described meets all three parts of that definition. Option a is incorrect because it describes one entity having power to significantly influence or direct the actions or policies of another entity, which is a relationship between entities, not a single entity's structure. Option c is incorrect because it refers to the functions whose performance makes an entity a health plan, health care provider, or health care clearinghouse, so it labels activities rather than an organization. Option d is incorrect because it names only the designated component or combination of components within the organization, not the single legal entity that makes the designation.

Correct Answer: Continued maintenance of the information in the designated record set

The right to amend under the Privacy Rule lasts for as long as the protected health information is maintained in the designated record set. Continued maintenance there, not a fixed term, controls the right. Option b is incorrect because review of a denial of access is a separate process handled by a designated licensed health care professional and does not set the amendment period. Option c is incorrect because the retention requirement applies to documentation a covered entity must keep, such as designated record sets subject to access, not to how long amendment rights last. Option d is incorrect because that phrase describes how quickly a designated reviewing official must decide on a denial of access; the amendment right is tied to where the information is maintained.

Correct Answer: Facility

The HIPAA Security Rule definitions state that facility means the physical premises and the interior and exterior of a building(s). This term supports the physical safeguards, which protect a covered entity's physical environment. Option a is incorrect because the rule uses this word for the ability or means necessary to read, write, modify, or communicate data, which concerns use rather than buildings. Option b is incorrect because these are actions, policies and procedures managing security measures and workforce conduct, so they belong to a different category from a physical location. Option c is incorrect because it is defined as an interconnected set of information resources under the same direct management control that shares common functionality, not as physical premises.

Correct Answer: Administrative safeguards

Administrative safeguards are administrative actions, policies and procedures that manage the selection, development, implementation, and maintenance of security measures protecting electronic PHI, and that manage workforce conduct in relation to that information. Option a is incorrect because the Security Rule defines it as the ability or means necessary to read, write, modify, or communicate data, not as policies managing security measures. Option b is incorrect because it means corroborating that a person is the one claimed, which is identity verification rather than management of security measures or workforce conduct. Option d is incorrect because that section states that a covered entity or business associate must comply with the applicable standards; it sets who is bound, not what actions are taken.

Correct Answer: Presumed to be a breach

The HIPAA definition of breach presumes that an impermissible acquisition, access, use, or disclosure of PHI is a breach. The covered entity or business associate must demonstrate a low probability of compromise through a risk assessment. Option b is incorrect because whether PHI is unsecured depends on whether it was rendered unusable, unreadable, or indecipherable through a specified technology or methodology, which is a separate question from the presumption. Option c is incorrect because the presumption applies to activity already not permitted under subpart E, so labeling it permitted contradicts the rule's starting point. Option d is incorrect because good faith belief that the recipient could not retain the information is a specific exception to the definition, not the default treatment of impermissible activity.

Correct Answer: I, II, and III

Under the HIPAA notification standard for business associates, the business associate notifies the covered entity after discovery. A breach is treated as discovered on the first day it is known or, with reasonable diligence, would have been known. Option a is incorrect because it leaves out Statement III, yet the regulation also treats a breach as discovered when reasonable diligence would have revealed it to the business associate. Option c is incorrect because it includes Statement IV, but notification of the Secretary is a duty of the covered entity under its own standard, not the business associate. Option d is incorrect because it pairs the correct notice duty with Statement IV, which misassigns Secretary notification to the business associate, and it drops both discovery rules.

Correct Answer: Refraining from intimidation or retaliation

A covered entity or business associate may not threaten, intimidate, coerce, harass, discriminate against, or retaliate against a person for testifying, assisting, or participating in an investigation. Reducing the witness's hours falls within that prohibition. Option a is incorrect because those terms sort violations into levels of culpability within the civil money penalty subpart; they do not prohibit retaliatory action against a participant. Option b is incorrect because it addresses a witness who fails to sign or correct a transcript within 30 days of notice, not treatment of a witness by an employer. Option c is incorrect because it lets HHS use testimony and other evidence in its activities and in proceedings; it places no limit on employer conduct toward witnesses.

Correct Answer: Accompanied by a signed patient authorization

The complaint rule requires a writing, the naming of the subject person with a description of the acts or omissions, and filing within 180 days. A signed patient authorization is not among the stated requirements. Option a is incorrect because the regulation sets a 180-day filing period running from when the complainant knew or should have known of the act or omission. Option b is incorrect because the regulation requires the complaint to name the person that is the subject of the complaint, so this is a genuine filing requirement. Option d is incorrect because the regulation states that a complaint must be filed in writing, and it allows either paper or electronic submission, so this is a genuine requirement.

Correct Answer: I and IV

The regulation applies to a hospital that has an emergency department when an individual comes to the emergency department. The duty applies whether or not the individual is eligible for Medicare benefits and regardless of ability to pay. Option b is incorrect because it treats Medicare eligibility as a condition, but the regulation applies the duty to an individual whether or not eligible for Medicare benefits. Option c is incorrect because both statements fail: eligibility for Medicare benefits and ability to pay are expressly set aside, and it also omits the emergency department requirement. Option d is incorrect because it is right on the emergency department and the individual's arrival, yet it wrongly adds ability to pay, which the regulation says is irrelevant.

Correct Answer: Determining whether an emergency medical condition exists

EMTALA requires a hospital with an emergency department to provide an appropriate medical screening examination within its capability, including routinely available ancillary services, to determine whether or not an emergency medical condition exists. Option a is incorrect because the statute applies to any individual whether or not eligible for benefits, so eligibility is not what the screening examination is meant to establish. Option b is incorrect because stabilization concerns treatment that follows a finding; the screening examination comes first and is aimed at finding out whether such a condition is present. Option d is incorrect because the screening provision does not frame the examination as a transfer decision; transfer is a separate matter from the screening duty in subsection (a).

Correct Answer: No action more than two years after the violation

The civil enforcement provision, covering personal harm and financial loss to another medical facility, states that no action may be brought more than two years after the date of the violation giving rise to it. Option a is incorrect because the 60-day period is the minimum time the Secretary allows after requesting a quality improvement organization review before a sanction, not a limit on civil actions. Option b is incorrect because the statute makes the quality improvement organization review part of the Secretary's sanction and termination process, and does not make it a precondition for a private civil action. Option c is incorrect because the statute points to damages available under the law of the State where the hospital is located, so federal damages do not set the limit.

Correct Answer: Whistleblower protections

The whistleblower protections in the EMTALA statute bar a participating hospital from penalizing or taking adverse action against any hospital employee because the employee reports a violation of a requirement of that section. Option b is incorrect because this provision stops a hospital from postponing screening or treatment to ask about payment or insurance, so it protects patients rather than staff. Option c is incorrect because it addresses how EMTALA relates to State or local law, leaving conflicting requirements displaced, and says nothing about employer retaliation. Option d is incorrect because it bars a hospital with specialized capabilities from refusing an appropriate transfer when it has capacity, which concerns patients, not employee reports.

Correct Answer: The hospital is deemed to meet the requirement

Under the refusal-to-consent provision, a hospital is deemed to meet its stabilization requirement when it offers further examination and treatment, informs the individual of the risks and benefits, and the individual refuses to consent. Option a is incorrect because transfer is a separate alternative to stabilizing treatment under the general rule, and a refusal after a proper offer does not make it mandatory. Option b is incorrect because the screening requirement concerns determining whether an emergency medical condition exists, which the hospital here has already determined, so a refusal does not restart it. Option d is incorrect because the statute does not require treatment against the individual's refusal once the offer and risk-and-benefit information have been given; the duty is treated as met.

Correct Answer: Validity that continues indefinitely once issued

The CLIA statute limits a certificate's term to 2 years or a shorter period set by the Secretary. A certificate that stays valid indefinitely after issuance is therefore not part of the certificate requirement. Option a is incorrect because the statute bars soliciting or accepting human materials without a certificate issued by the Secretary, so the Secretary's issuance is part of the requirement. Option b is incorrect because the statute permits the Secretary to issue or renew a certificate only when the laboratory meets the subsection (d) requirements, so this is a genuine condition. Option c is incorrect because the statute ties the certificate to the category of examinations or procedures that includes the work being done, which makes this a genuine feature.

Correct Answer: Decontaminate it immediately or as soon as feasible

Under the Housekeeping requirements, contaminated work surfaces are decontaminated with an appropriate disinfectant after procedures, and immediately or as soon as feasible when surfaces are overtly contaminated. Option a is incorrect because end-of-day timing is not the standard's rule; overtly contaminated surfaces call for prompt decontamination, and the employer's schedule rests on location, surface, soil and tasks. Option c is incorrect because the written schedule sets routine cleaning, but overtly contaminated surfaces must be decontaminated immediately or as soon as feasible, not held for the next cycle. Option d is incorrect because gowns, aprons and similar garments are protective body clothing for employees, not a method for decontaminating a work surface after blood contact.

Correct Answer: CLIA-exempt laboratory

A CLIA-exempt laboratory is licensed or approved by a State that CMS has determined has laboratory laws equal to or more stringent than CLIA, with the State licensure program approved by CMS. Option b is incorrect because holds a registration certificate enabling moderate or high complexity testing until a survey by CMS or its agent finds the entity compliant. Option c is incorrect because holds a certificate allowing only waived tests to be performed, which is a federal certificate type and not a status based on State licensure. Option d is incorrect because is recognized through an accreditation organization approved by CMS, so its deemed status comes from accreditation rather than from a State licensure program.

Correct Answer: Tests of moderate complexity

The CLIA regulation on categories of tests by complexity lists tests of moderate complexity as including the subcategory of PPM procedures. Waived tests and tests of high complexity are separate categories. Option a is incorrect because the regulation names only waived, moderate and high complexity, so low complexity is not a recognized category at all. Option b is incorrect because waived tests are a separate complexity category in the regulation and are not described as containing the PPM subcategory. Option d is incorrect because high complexity is listed as its own third category, with no PPM subcategory placed beneath it in the regulation.

Correct Answer: experience

The CLIA application must describe the qualifications of personnel directing and supervising the laboratory and performing the tests, stated as educational background, training, and experience. Option b is incorrect because references from colleagues are not named as part of the personnel qualifications the application must describe, which are educational background, training, and one other element. Option c is incorrect because the application provision lists three qualification elements, and licensure status is not among them; the third element is a different term. Option d is incorrect because scores from competency assessments are not part of the application's qualification description; the regulation names a plain background element instead, not a measured result.