AAPC-CPMA Certified Professional Medical Auditor - Set 1 - Part 2

Correct Answer: Once every 10 treatment days

The Medicare manual sets the minimum progress report period at at least once every 10 treatment days. The reporting period ends on a date the clinician chooses or the 10th treatment day, whichever is shorter. Option b is incorrect because a single report at the end would leave reporting periods unaddressed; the manual sets a recurring minimum period measured in treatment days. Option c is incorrect because the manual says a re-evaluation should not be required before every progress report routinely, so re-evaluation does not set the report schedule. Option d is incorrect because daily documentation is the role of the treatment note, while the progress report covers a reporting period of multiple treatment days.

Correct Answer: Treatment notes for each treatment day

The Medicare manual lists treatment notes for each treatment day among the therapy documentation expected in response to any records request. They may also serve as progress reports when the required information is included. Option a is incorrect because such tools are recommended to quantify progress but are not required, though their use enhances the justification for needed therapy. Option b is incorrect because the Medicare manual makes this statement optional, included if the provider wishes to explain extensive services, and not required when the record justifies treatment. Option c is incorrect because re-evaluation is not required routinely before progress reports; it is appropriate only when assessment suggests changes not anticipated in the original plan of care.

Correct Answer: In the treatment note or the progress report

When treatment is added or changed between progress reports, the change must be recorded and justified in the medical record, either in the treatment note or the progress report, as determined by the provider's or supplier's policies. Option a is incorrect because the guidance places the record of the change in the medical record, not in the claim form, which only reports services documented there. Option b is incorrect because recertification is not required for changes made on clinical judgment unless the physician/NPP requests it, so a new certification is not the place for this record. Option d is incorrect because a re-evaluation is not routinely required before progress reports and is appropriate only when assessment suggests changes not anticipated in the original plan.

Correct Answer: The day it was dictated

The Medicare manual states that dictated therapy documentation is considered completed on the day it was dictated. The qualified professional may edit and electronically sign it at a later date without changing that completion day. Option b is incorrect because transcription is not named by the Medicare manual as the completion point; the manual ties completion to the act of dictating, not typing. Option c is incorrect because certification is the physician/NPP approval of the plan, a separate requirement that does not determine when dictated notes are considered completed. Option d is incorrect because the qualified professional may sign at a later date, so the signature date does not set when the documentation counts as complete.

Correct Answer: A formal determination by a qualified statistician

HHS guidance states there are two ways to de-identify information: a formal determination by a qualified statistician, or removal of specified identifiers that is adequate only if the covered entity has no actual knowledge the remainder could identify the individual. Option a is incorrect because the guidance assigns de-identification to a statistician's determination or to removal of specified identifiers, and names no compliance officer review as a method. Option b is incorrect because the method involves removing specified identifiers of the individual and of relatives, household members and employers, not clinical content such as a diagnosis. Option d is incorrect because authorization is the written permission by which the individual allows a use or disclosure of protected health information; it is not described as a way to de-identify information.

Correct Answer: Its business associate contract or other arrangement

Under the HIPAA general rules, a business associate may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement, or as required by law. Option b is incorrect because valid authorization is listed as a permitted disclosure basis for a covered entity, not as the governing source of a business associate's permissions. Option c is incorrect because disclosure to the individual appears among the covered entity's permitted uses, and a business associate's limits come from its agreement rather than from individual requests. Option d is incorrect because this permission is granted to a covered entity in the general rules; a business associate's uses are tied to its contract or arrangement instead.

Correct Answer: Designate the clinic in writing as a health care component

A single legal entity with covered and non-covered functions may elect to be a hybrid entity. It must designate in writing its operations performing covered functions as health care components, after which most requirements apply only to them. Option a is incorrect because a business associate is a person performing functions on behalf of a covered entity; the product unit is part of the same legal entity. Option b is incorrect because this describes a relationship in which participating covered entities share protected health information for joint operations; it does not limit which parts of one entity the rule covers. Option d is incorrect because an affiliated covered entity joins legally separate covered entities under common ownership or control, but this organization is one legal entity.

Correct Answer: Employment records held in its role as employer

The definition of protected health information excludes individually identifiable health information in employment records that a covered entity holds in its role as employer, along with certain education records and information on persons deceased more than 50 years. Option a is incorrect because genetic information falls within health information, and a health plan is barred from using or disclosing it for underwriting, which shows it remains protected. Option b is incorrect because electronic transmission or maintenance is one of the forms that places individually identifiable health information inside the definition, so it is covered rather than excluded. Option c is incorrect because the definition excludes information only about a person deceased for more than 50 years, and the Privacy Rule still applies for 50 years after death.

Correct Answer: I, II, and III

Business associates are directly regulated: they must notify the covered entity of a breach, disclose protected health information when the Secretary requires it, and comply with the Security Standards. They are also subject to civil money penalties. Option a is incorrect because it leaves out the application of the Security Standards to business associates, which the regulation also states as a direct obligation. Option b is incorrect because statement IV is false, since the Secretary may impose civil money penalties on a business associate as well as on a covered entity. Option d is incorrect because it pairs two true statements with IV, which is false because business associates face civil money penalties, and it omits the required disclosure to the Secretary.

Correct Answer: Permitted incidental disclosure

The Privacy Rule does not require every risk of an incidental use or disclosure to be eliminated. An incidental disclosure is permitted when it results from an otherwise permitted disclosure, reasonable safeguards exist, and minimum necessary applies. Option b is incorrect because the Privacy Rule permits a use or disclosure that is incident to an otherwise permitted one, so no authorization is needed when safeguards and minimum necessary are met. Option c is incorrect because required disclosures are a separate category, and an overheard remark gives the visitor no such entitlement; the exchange is simply incident to permitted treatment communication. Option d is incorrect because that category covers 12 national priority purposes permitted without authorization, and a conversation between clinicians about treatment is not one of those purposes.

Correct Answer: Health plan use of genetic information for underwriting

A health plan, other than a long-term care policy issuer, may not use or disclose protected health information that is genetic information for underwriting purposes. The other three appear in the list of permitted uses and disclosures. Option a is incorrect because the Privacy Rule's general rules list the individual first among the permitted uses and disclosures, so this one is allowed. Option c is incorrect because the rule expressly permits incidental uses and disclosures, provided the entity has complied with the applicable minimum necessary and safeguard requirements. Option d is incorrect because these three purposes are named together in the permitted list, subject to compliance with the related Privacy Rule provision, so they are allowed.

Correct Answer: specific and meaningful

HIPAA's core elements require the description of the information to be used or disclosed to identify that information in a specific and meaningful fashion. This is the first core element of a valid authorization. Option a is incorrect because the regulation does not require a chronological or exhaustive listing, only a description that is specific and meaningful about what will be used or disclosed. Option b is incorrect because the core element calls for identification of the information in a specific and meaningful fashion, which a general summary would not provide. Option c is incorrect because HIPAA sets no standard of brevity or informality for this element; the description must instead identify the information precisely enough to be meaningful.

Correct Answer: The covered entity's obligation to notify the individual of each later disclosure

The required statements in the authorization rule cover the right to revoke in writing, the ability or inability to condition treatment, payment, enrollment or eligibility, and potential redisclosure. A duty to notify the individual of each later disclosure is not among them. Option a is incorrect because the rule names this as a required statement, since disclosed information may no longer be protected once the recipient holds it. Option c is incorrect because this is a listed required statement, completed by saying the covered entity may not condition, or by stating the consequences of refusing to sign. Option d is incorrect because the regulation lists this as the first required statement, with either the exceptions and how to revoke or a reference to the covered entity's notice.

Correct Answer: I and III

The research exception allows a research study authorization to be combined with a consent to participate in research and with an authorization for a research database or repository. Statements I and III match this rule. Option b is incorrect because statement II reverses the rule, since a psychotherapy notes authorization may only be combined with another authorization for psychotherapy notes, not with any other authorization. Option c is incorrect because both statements fail: psychotherapy notes authorizations have a narrow combination limit, and research compound authorizations must clearly differentiate conditioned from unconditioned components. Option d is incorrect because statement III is accurate, but statement IV contradicts the requirement to clearly differentiate components and give the individual an opportunity to opt in to unconditioned research activities.

Correct Answer: A statement reserving the right to make such a change

A covered entity may apply a changed privacy practice to protected health information created or received before the notice revision's effective date only if the notice included a statement reserving its right to make such a change. Option a is incorrect because documentation and implementation govern other policy changes made at any time; they do not substitute for what the notice must state to cover earlier information. Option b is incorrect because a change in law triggers prompt documentation, implementation and notice revision, but it is not what permits a revised practice to reach earlier protected health information. Option c is incorrect because scaling concerns how reasonably designed policies and procedures must be to ensure compliance; it does not decide whether a revision covers information created earlier.

Correct Answer: Inform the individual of the acceptance and provide access

When a covered entity grants an access request, in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested, and it must do so within the required time. Option b is incorrect because a reviewing official examines a denial of access on request; nothing has been denied in this situation, so no review applies. Option c is incorrect because that determination relates to a denial ground for a personal representative's request, and it has no role when access is simply granted. Option d is incorrect because a written denial is the required response when a request is denied in whole or in part, which is not the decision made here.

Correct Answer: Explanation of the reason for the request

A covered health care provider may not require an explanation of the basis for the request as a condition of providing confidential communications. Requiring a writing, payment information, and an alternative address or contact method are all permitted conditions. Option a is incorrect because the rule lets a covered entity require the individual to submit a request for a confidential communication in writing. Option b is incorrect because the provision permits conditioning accommodation on naming another address or other method of contact, so it belongs among the allowed conditions. Option c is incorrect because a reasonable accommodation can depend on payment information, when appropriate, so this is a permitted condition.

Correct Answer: The amendment request and the denial

The written denial must tell the individual that, without a statement of disagreement, the individual may request that the covered entity provide the request for amendment and the denial with any future disclosures of the protected health information. Option b is incorrect because complaints are a separate route described in the denial, directed to the covered entity or the Secretary, and not tied to future disclosures. Option c is incorrect because the scenario states none was submitted, so no such statement exists to accompany later disclosures. Option d is incorrect because a rebuttal is something the covered entity may prepare at its own discretion, and the rule requires only that a copy go to the individual.

Correct Answer: Provide a copy to the individual

Under the HIPAA amendment standard, the covered entity may prepare a written rebuttal to a statement of disagreement. Whenever it prepares one, it must provide a copy to the individual who submitted that statement. Option a is incorrect because the rule allows reasonable limits on the length of the statement of disagreement, not on the covered entity's own rebuttal. Option b is incorrect because the regulation sends the Secretary only complaints about the denial, and it sets no approval step for a rebuttal prepared by the covered entity. Option d is incorrect because the individual's statement of disagreement stays part of the process; nothing in the rule lets a rebuttal take its place.

Correct Answer: Document the sanctions that were applied

Under the sanctions standard, a covered entity must have and apply appropriate sanctions against workforce members who fail to comply, and the documentation implementation specification requires it to document the sanctions applied, if any. Option b is incorrect because the standard requires covered entities to have and apply appropriate sanctions, and its only exceptions involve specific disclosure provisions, not first-time violations. Option c is incorrect because training documentation is a separate requirement that records training provided; the sanctions standard sets no retraining deadline tied to a violation. Option d is incorrect because the sanctions standard contains no duty to inform patients about discipline; the complaint process is how individuals raise concerns with the covered entity.