AAPC-CPPM Certified Physician Practice Manager - Set 5 - Part 1

Correct Answer: Resolution by informal means

When an investigation or compliance review indicates noncompliance, the Secretary may attempt resolution by informal means, such as demonstrated compliance, a completed corrective action plan or another agreement. The regulation applies this to covered entities and business associates alike. Option a is incorrect because this outcome applies when no violation is found after an investigation, whereas here noncompliance has been indicated and a resolution is being sought. Option b is incorrect because this notice is issued only after informal means fail and the Secretary finds a civil money penalty should be imposed, so it starts a penalty rather than avoiding one. Option d is incorrect because the entity submits this evidence after informal resolution fails, for consideration before any penalty finding; it is not itself a way of reaching a settlement.

Correct Answer: Member of the covered entity's workforce

HIPAA defines workforce as employees, volunteers, trainees and other persons whose conduct is under the direct control of the covered entity, whether or not they are paid. An unpaid volunteer directed by the practice qualifies. Option a is incorrect because that term describes a person to whom a business associate delegates a function; nothing here involves a business associate delegating work. Option b is incorrect because covered entities are health plans, clearinghouses and certain providers, and a volunteer working under a practice's direction fits none of those categories. Option c is incorrect because a business associate performs a function on behalf of the covered entity other than as a member of its workforce, and this volunteer works under direct control.

Correct Answer: Falls within underwriting purposes

Underwriting purposes, with respect to a health plan, include rules for or determination of eligibility, including enrollment. Using genetic information for that is therefore within underwriting purposes, which the health plan may not use or disclose it for. Option a is incorrect because that term describes clinically integrated care settings or joint arrangements among covered entities, which says nothing about how a plan may use genetic information. Option b is incorrect because a contract permits a business associate to act only as the covered entity could, and the prohibition on this use still applies to the plan. Option d is incorrect because required disclosures by a business associate involve responding to the Secretary's compliance investigations or supplying electronic copies, not a plan's own eligibility rules.

Correct Answer: on an individual basis

Under the minimum necessary standard, disclosures other than routine and recurring ones require criteria that limit the PHI disclosed, and the covered entity must review requests for disclosure on an individual basis according to those criteria. Option a is incorrect because identifying workforce classes belongs to the minimum necessary rule for uses, which sets who needs access, and does not govern review of disclosure requests. Option c is incorrect because the regulation sets no periodic review cycle for these requests; it requires each request to be reviewed against the criteria. Option d is incorrect because standard protocols are allowed for disclosures made on a routine and recurring basis, not for the other disclosures that call for case-by-case review.

Correct Answer: Limited data set

A limited data set is protected health information from which specified direct identifiers of individuals and their relatives, household members, and employers have been removed. A covered entity may use or disclose it for research without authorization. Option b is incorrect because documentation of death supports research on decedents' information and is not information stripped of direct identifiers of individuals and relatives. Option c is incorrect because this is the group of records to which access rights apply, not a version of information stripped of direct identifiers. Option d is incorrect because they are excluded from the right of access and are not described as a research data form with identifiers removed.

Correct Answer: Administrative safeguards

The Security Rule defines administrative safeguards as administrative actions, policies and procedures that manage the selection, development, implementation and maintenance of security measures and manage workforce conduct in relation to protecting electronic protected health information. Option a is incorrect because it names the property that data is accessible and useable on demand by an authorized person, so it describes a data condition, not workforce policies. Option c is incorrect because it is the corroboration that a person is the one claimed, a single identity check rather than a body of policies and procedures. Option d is incorrect because the Security Rule defines it as a property of data, meaning information is not disclosed to unauthorized persons or processes, not as management actions.

Correct Answer: A transaction that complies with an applicable standard and associated operating rules adopted under the regulation

The HIPAA transaction regulations define a standard transaction as a transaction that complies with an applicable standard and the associated operating rules adopted under that part. Conformity to adopted requirements is what makes it standard. Option a is incorrect because this describes a segment, a structural building block inside a transaction, and says nothing about compliance with an adopted standard or operating rules. Option b is incorrect because the regulation calls this a data set, which is the information exchanged, whereas a standard transaction is defined by conformity to adopted requirements. Option d is incorrect because that is direct data entry, such as using web browsers or dumb terminals, which is a method of entering data and not a transaction definition.

Correct Answer: Use of systems meeting adopted standards, where available

The statute on application to private entities directs each agency to require, in contracts with providers, health plans, or issuers, that systems implemented, acquired, or upgraded meet adopted standards and implementation specifications, where available. Option a is incorrect because the President, not a contracting agency, takes measures to make federal information collection activities consistent with an adopted standard, and that duty concerns federal activities rather than private plans. Option b is incorrect because reporting to the House and Senate committees on nationwide system adoption is a duty of the Secretary of Health and Human Services, not a contract term for plans. Option c is incorrect because that application belongs to institutions of higher education seeking funding for a research center, so it has no connection to agency contracts with health plans.

Correct Answer: Performing regular data backups

With a locally hosted EHR, software and data sit on servers at the practice, so the organization is responsible for regular data backups, along with physical server security and equipment costs. Option b is incorrect because service level agreements are part of reducing risk with a cloud EHR vendor, and a practice hosting its own servers has no such vendor. Option c is incorrect because reduced access and control compared with a locally hosted EHR is listed as a cloud-based challenge, so it does not describe local hosting. Option d is incorrect because shared responsibility for data security is a challenge of cloud-based EHRs, where the practice and the cloud EHR vendor both hold duties.

Correct Answer: Transmitting, storing and modifying ePHI

The risk analysis should specifically examine whether EHR security safeguards are adequate as the system transmits, stores, and allows modifications to ePHI. These three functions define the scope of the safeguard review. Option a is incorrect because these are not the functions the guidance names; the risk analysis looks at how the system transmits, stores and allows modifications to ePHI. Option b is incorrect because encryption is described as one method of protection within the safeguards, not as one of the three ePHI functions the risk analysis must examine. Option c is incorrect because these terms belong to Privacy Rule limits on uses and disclosures, not to the system functions assessed when judging EHR safeguards.

Correct Answer: Conducting due diligence

Part A of ONC's EHR contracts guide highlights critical planning steps for the acquisition process. Its listed topics include conducting due diligence to find the best EHR for the practice's needs. Option a is incorrect because it is named as a tool in the AMA STEPS Forward selection resources, not as a topic in the Part A list of the ONC guide. Option b is incorrect because goal setting belongs to the AMA tools that guide a practice's decision-making process, and the Part A topics of the ONC guide do not list it. Option d is incorrect because the AMA STEPS Forward resources for selecting and testing EHRs offer this as a tool, and the ONC guide's Part A topic list does not name it.

Correct Answer: incomplete understanding of the organization's information needs

ONC guidance lists incomplete understanding of the organization's information needs as a common roadblock, along with uncertain costs and the effort required to identify and implement an appropriate EHR system. Option b is incorrect because stakeholders who see EHRs as useful are named as a helpful factor in the readiness assessment, not as an obstacle. Option c is incorrect because eagerness among personnel appears in the guidance as a readiness factor to assess before starting, which supports implementation instead of blocking it. Option d is incorrect because a champion is listed among the factors that help an organization overcome implementation roadblocks, so it is a strength rather than a barrier.

Correct Answer: Workflow analysis

Workflow analysis maps administrative and clinical work and ensures the EHR is used safely to deliver care. It is conducted prior to implementation of the EHR and identifies inefficiencies and bottlenecks. Option a is incorrect because it creates guidance and a stewardship plan focused on data safety and integrity, which differs from mapping how work is performed. Option b is incorrect because it concerns which paper record information is imported into the EHR, not the mapping of tasks and clinician interaction. Option c is incorrect because it reviews what worked and what did not after the EHR is in place, rather than mapping work processes beforehand.

Correct Answer: Replacement of the EHR vendor

Redesigned workflows require realigned jobs, staff time, roles and responsibilities, which in turn change policies and procedures, job descriptions, training and accountability or reporting systems. Replacing the EHR vendor is not listed among these changes. Option a is incorrect because these systems are what ensure tasks are completed under the new workflow, so the guidance names them among the expected changes. Option b is incorrect because when jobs are realigned and staff time allocation changes, job descriptions must follow, so this is a named requirement of new workflows. Option d is incorrect because the guidance lists policy and procedure changes as a direct consequence of realigning roles and responsibilities to fit a redesigned workflow.

Correct Answer: I, II, and IV

The guide calls for collaboration among administrative leaders, technical specialists, clinicians, and staff, engages clinician leadership, and notes that periodic self-assessments may help identify areas affected by changes. Statement III conflicts with this broad engagement. Option a is incorrect because this pair omits statement IV, and the guide also says periodic self-assessments may help organizations identify areas affected by changes in technology, practice, or policy. Option c is incorrect because it includes statement III, but the guide calls for engagement of a wide variety of people at all levels, not technical specialists alone. Option d is incorrect because it relies on statement III, which contradicts the collaboration of leaders, specialists, clinicians, and staff, and it leaves out the clinician leadership role in statement II.

Correct Answer: Designated staff for EHR technical operations

The Domain 1 checklist, Structures Required for Safe Health IT, recommends that organizations designate staff to conduct testing, implementation, maintenance, continuous monitoring and resolution of problems with EHR hardware, software and network/ISP components. Option b is incorrect because delegation policies address when and how clinicians may hand off order entry, medication reconciliation and documentation, which is a different task from technical upkeep. Option c is incorrect because training teams provide education on safe EHR use to users and IT staff, not the technical testing and maintenance of hardware, software and network components. Option d is incorrect because assistance procedures ensure users can obtain help quickly when problems arise, rather than assigning staff to test, maintain and continuously monitor components.

Correct Answer: Free-text orders

SAFER guidance explains that clinical decision support alerting requires structured data elements. Free-text orders may be misspelled, inconsistent or use unsafe abbreviations, and will not trigger automated interaction checking or other warnings. Option a is incorrect because navigable pick lists based on structured orders mapped to standard vocabularies are described as supporting accurate, reliable CPOE functionality. Option b is incorrect because they are the recommended practice, built on a controlled vocabulary so that decision support alerting has the data elements it requires. Option d is incorrect because the guide lists them as CDS content that clinical staff develop, review and update from current best practice guidance, not as an unsafe entry method.

Correct Answer: Message escalation

EHR secure messaging guidance calls for escalation of messages that remain unread within a time period or draw no response. Escalation could automatically forward the message to an alternate or supervising clinician when the recipient is unavailable. Option b is incorrect because it tells the sender that an inbox is not being monitored, but it does not itself send the unread message on to another clinician. Option c is incorrect because it makes urgent messages visually distinct to the recipient, but it does not redirect an unread message to anyone else. Option d is incorrect because it re-sends a message as a new message on a date the user chose, not because a response period passed.

Correct Answer: Exchange for marketing by a third party

The statute lists exceptions for public health, research, treatment, a specified health care operation, business associate remuneration, and individual copies. Marketing by a third party is not among them, so a valid authorization is still required. Option a is incorrect because the statute names providing an individual with a copy of the individual's protected health information under the access provision as an exception. Option b is incorrect because the statute lists treatment of the individual as an exception, subject to any regulation the Secretary promulgates to prevent inappropriate access, use, or disclosure. Option d is incorrect because public health activities are listed in the statute as an exception, so remuneration is permitted for that purpose without a valid authorization.

Correct Answer: Minimum necessary requirement extends to de-identified protected health information

The statute's rule of construction says the minimum necessary subsection does not affect the use, disclosure, or request of de-identified protected health information, so extending the requirement to such information is not a provision. Option a is incorrect because the statute states that the HIPAA accounting exception does not apply to EHR disclosures, so individuals can receive an accounting of them. Option b is incorrect because the statute gives that determination to the covered entity or business associate making the disclosure, so this statement is a genuine provision. Option c is incorrect because the statute carries over the exceptions in the HIPAA Privacy Rule, applying them to the new requirement as they applied before.