AAPC-CPPM Certified Physician Practice Manager - Set 5 - Part 2

Correct Answer: Researching and comparing EHR products and vendors

Part A of the EHR contracts guide highlights critical planning steps, including researching and comparing EHR products and vendors. Part B covers negotiating and contracting topics, such as dispute resolution, transition issues and interoperability. Option a is incorrect because the guide lists it among the Part B topics, the section on negotiating and contracting, not among the planning steps of Part A. Option c is incorrect because Part B, which focuses on negotiating and contracting, includes this topic, so a manager looking for planning steps in Part A will not find it there. Option d is incorrect because this belongs to the contract-negotiation strategies in Part B; Part A covers planning topics such as understanding the acquisition process.

Correct Answer: Technical safeguards

Electronic exchanges of patient information that are not encrypted or otherwise secured are listed as a vulnerability under technical safeguards. Encrypting data is the matching mitigation strategy within that same component. Option b is incorrect because administrative safeguards cover items like a designated security officer, workforce training, and periodic risk assessment, which do not describe a failure to secure transmissions. Option c is incorrect because organizational standards deal with breach notification policies and Business Associate agreements, so they do not cover the lack of encryption on exchanged data. Option d is incorrect because physical safeguards address barriers to facility and equipment access, such as locks, accessible computers, and untracked portable devices, not the protection of data in transit.

Correct Answer: Conduct it as a standard transaction

The general rule in the HIPAA transaction requirements says a covered entity that conducts an adopted transaction electronically with another covered entity, or within the same covered entity, must conduct it as a standard transaction. Option a is incorrect because trading partner agreements are restricted; a covered entity must not use one to change a data element's definition, add data elements, or alter the implementation specification's intent. Option b is incorrect because direct data entry is an exception available to a health care provider electing it, not the duty the general rule places on covered entities. Option c is incorrect because the general rule imposes no requirement to use a clearinghouse; it simply requires that the transaction itself be conducted in standard form.

Correct Answer: Translate a nonstandard transaction from the covered entity into a standard transaction

When acting as a business associate for another covered entity, a clearinghouse may receive a nonstandard transaction from the covered entity and translate it into a standard transaction for transmission on the entity's behalf. Option b is incorrect because the statute gives that authority to the Secretary under special rules, so a clearinghouse has no role in adopting standards. Option c is incorrect because storing coordination of benefits data is a duty the rules place on a health plan, not on a clearinghouse acting as business associate. Option d is incorrect because that is a request an organization makes to the Secretary under the exceptions rule, and it is not a business associate function of a clearinghouse.

Correct Answer: The individual's written authorization

The Privacy Rule requires written authorization for any disclosure not for treatment, payment, or health care operations or otherwise permitted. Disclosure to a pharmaceutical firm for its own marketing is a listed example requiring authorization. Option a is incorrect because a data use agreement is the safeguard promise tied to a limited data set used for research, health care operations, or public health, not marketing. Option b is incorrect because this agreement sets duties of parties exchanging electronic transactions, and it does not substitute for permission from the individual for a marketing disclosure. Option c is incorrect because workers' compensation provisions permit disclosures to comply with laws on work-related injuries or illnesses, which has no connection to a pharmaceutical firm's marketing.

Correct Answer: Business associate

The HIPAA definition states that a business associate includes a Health Information Organization, E-prescribing Gateway, or other person providing data transmission services for protected health information to a covered entity and requiring routine access to it. Option a is incorrect because the business associate definition applies to persons acting other than in the capacity of a workforce member, so a Health Information Organization is not placed in that group. Option b is incorrect because a patient is the individual the protected health information describes; the definition names data transmission services as the role of the Health Information Organization, not that of the individual. Option d is incorrect because accreditation is listed only as one service a business associate may provide to a covered entity, and it does not describe data transmission with routine access to protected health information.

Correct Answer: Directing a copy of PHI to a designated person

The HIPAA Privacy Rule gives individuals the right to inspect or obtain a copy of PHI, or both, and to direct the covered entity to transmit a copy to a designated person or entity of their choice. Option a is incorrect because that describes the purpose of the Security Rule, a separate HIPAA regulation, and does not describe anything an individual can request. Option c is incorrect because breach notification is a duty the Breach Notification Rule places on covered entities, not an access right of the individual. Option d is incorrect because a BAA is the agreement a business associate holds with a covered entity, so it is a contractual duty rather than an individual's right.

Correct Answer: Tracking the order to completion

Closed loop orders require referral and transition of care orders to be supported by functionality that tracks the order to completion. Patient-level status tracking with automated notification of open referrals is the guidance's example of this practice. Option a is incorrect because directory selection concerns choosing the order recipient from an up-to-date list, which happens when the order is created, not follow-up of open referrals. Option b is incorrect because routing monitoring watches notifications and error queues for delivery problems, whereas this policy follows referral status at the patient level after delivery. Option d is incorrect because a structured format standardizes the content of the order so relevant data is included, but it does not monitor status after sending.

Correct Answer: Assessment Completion Date

The Assessment Completion Date section records when the self-assessment was finished and can also serve as a reminder for periodic reassessments, which matches the manager's goal of prompting a later repeat review. Option b is incorrect because this section records considerations or conclusions from the assessment, such as pending software updates or barriers, rather than serving as the date reminder for reassessment. Option c is incorrect because it documents the person or persons responsible for ensuring the self-assessment is completed, and it carries no date or reminder function. Option d is incorrect because it lists the individuals, departments or outside organizations that contributed to the self-assessment, so it identifies contributors and does not track timing.

Correct Answer: A Checklist of recommended practices

Each of the eight SAFER Guides begins with a Checklist of recommended practices. The checklist lets an organization indicate, on a 5-point Likert scale, how fully each recommended practice has been implemented. Option a is incorrect because sources of input name the stakeholders who can inform assessment of a practice and appear within each Practice Worksheet, not at the start of a guide. Option c is incorrect because the Team Worksheet documents the names, roles and activities of the self-assessment team; it is a separate page, not how a guide opens. Option d is incorrect because the Practice Worksheet supplies a rationale and implementation examples for one recommended practice, so it follows the checklist rather than opening the guide.

Correct Answer: Review by clinical staff from varied specialties

SAFER Guide Recommended Practice 1.3 states that CDS content and configuration are developed, reviewed and updated by clinical staff representing a variety of specialties and disciplines, supported by a CDS governance committee. Option a is incorrect because order utilization data is used to update content, yet the guide assigns developing, reviewing and updating the content itself to multidisciplinary clinical staff, not managers. Option b is incorrect because IT staff are one set of representatives on a governance committee, but the guide places development and review with practicing clinicians who are most affected. Option d is incorrect because the guide says vendor-provided CDS assets are to be reviewed and optimized by organization clinical staff before implementation, so developer-only configuration falls short.

Correct Answer: High override rates

CDS governance should have a process for developing, maintaining and regularly revising alerts based on clinical user feedback, emerging knowledge and high override rates. High override rates signal alerts that clinicians find unhelpful and need review. Option b is incorrect because license renewals are not named as a trigger; the guidance bases revision on user feedback, emerging knowledge and override rates. Option c is incorrect because patient volume is not listed among the revision drivers, which center on how clinicians respond to alerts and on new clinical knowledge. Option d is incorrect because payer contracts belong to reimbursement matters; the guidance ties alert revision to clinical feedback, knowledge and override behavior instead.

Correct Answer: Data migration processes and protocols

Safety guidance calls for data migration processes and protocols to ensure data integrity after data is transmitted from one EHR system to another or its format is changed, such as free text to structured. Option a is incorrect because sorting overrides helps identify potential improvements to alerts; it does not address whether data stayed intact when transmitted or reformatted. Option c is incorrect because this monitoring watches alert firing logs for unusual patterns, which is a different task from verifying the integrity of migrated records. Option d is incorrect because this tool is used yearly on the production system to evaluate CPOE and CDS safety and effectiveness, not to protect data moved between systems.

Correct Answer: Data integrity issues and impeded reliability

SAFER Recommended Practice 2.5 states that failure to adequately test hardware, software, and configuration or customization of clinical applications can lead to data integrity issues and impede response time, reliability, and error-free operation. Option b is incorrect because the guidance says poor testing can impede response time, so a faster response is the opposite of the stated risk. Option c is incorrect because alert overrides are classified and analyzed to find improvements; the guidance does not tie them to a lack of testing. Option d is incorrect because utilization rates are a monitoring metric compared with benchmarks, not a stated result of failing to test updates or customizations.

Correct Answer: Add AI experts to the existing EHR or CDS oversight committee

The guidance says healthcare organizations should add people with AI expertise, such as data scientists and informaticians, to the existing multidisciplinary EHR or CDS oversight committee, which meets regularly and proactively monitors AI-enabled applications in use. Option a is incorrect because the guidance advises conducting, or waiting for, real-world clinical evaluations in high-quality medical journals before routine use starts, so immediate routine use contradicts it. Option b is incorrect because the guidance keeps the existing multidisciplinary oversight committee and adds AI expertise to it, rather than replacing it with a developer group. Option c is incorrect because the guidance describes AI safety as a shared responsibility among developers, EHR vendors and healthcare organizations, so monitoring is not handed to the vendor alone.

Correct Answer: An inventory of AI-enabled systems

Guidance on AI governance says the oversight committee should maintain an inventory of clinically deployed, AI-enabled systems, covering deployment date, current version, responsible personnel, last reviewed date, authorized users, authorized purpose, data source and external validation. Option a is incorrect because regular meetings let members review new requests and monitor performance, but a meeting schedule says nothing about each system's deployment date or authorized users. Option c is incorrect because override rates help revise CDS alerts, but they do not record each deployed AI system's version, users, purpose or data sources. Option d is incorrect because high-quality journals supply external clinical evaluations before routine use, yet they are evidence sources and not a record of what the organization has deployed.

Correct Answer: Put a plan in place naming who is responsible for each aspect

Health IT resources guidance calls for a plan outlining who is responsible for each aspect of EHR safety monitoring, such as hardware/software, clinical content, usability, training and communication breakdowns. This fixes the lack of accountability described. Option a is incorrect because dashboards and reports are encouraged monitoring tools for providers and others, but they do not assign responsibility for each safety aspect. Option b is incorrect because the guidance stresses proactive assessment and monitoring, since EHR changes can have unpredictable effects that cause harm before reports arrive. Option d is incorrect because the guidance mentions outside help only when guidelines call for it in small practices, not as a replacement for assigned internal responsibility.

Correct Answer: Detailed Standard Operating Procedures

Under the delegation policies recommended practice, detailed Standard Operating Procedures (SOPs) are developed for each delegated EHR task to ensure consistency and accuracy. They also address competency and include steps to evaluate delegated work. Option b is incorrect because attendance monitoring supports access to the production EHR after training, but it does not set out the steps for performing each delegated task. Option c is incorrect because root cause analysis is a safety analysis technique used to find underlying causes of high-priority harm events, not a document written for each delegated task. Option d is incorrect because vendor safety analyses review high-priority harm events involving health IT and are discussed by stakeholders; they do not guide routine delegated work.

Correct Answer: Rates of unacknowledged inbox messages and tasks

Inbox message monitoring identifies quality improvement projects and targets interventions for clinicians with higher rates of unacknowledged inbox messages and tasks, so those rates are the measure the organization monitors. Option a is incorrect because automatic forwarding to a surrogate is a configuration capability for absences, and the monitoring guidance does not name its volume as a targeting measure. Option b is incorrect because urgency levels are an inbox design and secure messaging feature, not the monitored rate used to target clinician interventions in the monitoring guidance. Option c is incorrect because out-of-office messaging is an inbox configuration feature that tells senders an inbox is unmonitored; it is not the monitoring measure for targeting clinicians.

Correct Answer: Annual subscription pricing

A contingency plan typically stipulates the chain of command, standard operating procedures, and communication channels for an emergency. Annual subscription pricing appears only as an example of an operational plan's outcome, not as part of a contingency plan. Option b is incorrect because it is named in the guidance as a core element, since the plan sets out who directs the response during an emergency. Option c is incorrect because these are listed among the contents of the plan, covering how the organization exchanges information while the emergency is under way. Option d is incorrect because they are one of the three items the plan typically stipulates, giving staff the routine steps to follow in a crisis.