AAPC-CPPM Certified Physician Practice Manager - Set 4 - Part 3

Correct Answer: Program principally making grants for direct care

The health plan definition excludes a government-funded program whose principal activity is the direct provision of health care or the making of grants to fund the direct provision of health care to persons. Option a is incorrect because the definition lists a high risk pool as a mechanism under State law that provides health insurance coverage, so it counts as a health plan. Option b is incorrect because a plan providing or paying for the cost of medical care falls within the catch-all category of covered health plans, not the exclusions. Option c is incorrect because exclusion applies to programs whose principal purpose is something other than providing or paying for health care, which is the opposite of this description.

Correct Answer: E-prescribing Gateway

The business associate definition expressly includes a Health Information Organization, E-prescribing Gateway, or other person providing data transmission services for protected health information to a covered entity and needing routine access to that information. Option b is incorrect because the definition expressly excludes a plan sponsor with respect to disclosures by a group health plan, provided the requirements of the cited rule are met. Option c is incorrect because a provider receiving disclosures from a covered entity about the treatment of the individual falls under the exclusions, not the included data transmission group. Option d is incorrect because the definition lists this among the exclusions, covering eligibility or enrollment determinations for a government health plan administered by another government agency.

Correct Answer: A data use agreement

A limited data set is PHI with specified direct identifiers removed. It may be disclosed for research, health care operations and public health only if the recipient enters into a data use agreement promising specified safeguards. Option a is incorrect because this covers essential functions such as military missions or correctional institution safety, not a university research request for a limited data set. Option b is incorrect because authorization is required for disclosures the Privacy Rule does not otherwise permit, but a limited data set may be disclosed for research without it. Option d is incorrect because this applies to disclosures made to comply with laws for work-related injuries or illnesses, which has no bearing on a research request.

Correct Answer: Required disclosure to the individual

The Privacy Rule lists two required disclosures. One is to individuals or their personal representatives when they request access to, or an accounting of disclosures of, their protected health information. The covered entity must comply. Option a is incorrect because an authorization is the individual's written permission for other uses; the Privacy Rule already compels the covered entity to respond to this request. Option b is incorrect because health care operations is a permitted purpose that a covered entity may choose to use, whereas an accounting request creates a mandatory duty. Option c is incorrect because incidental disclosure describes a secondary exposure arising from an otherwise permitted use, not a direct request the entity has to answer.

Correct Answer: HHS during a compliance investigation

The Privacy Rule requires disclosure in only two situations: to individuals who request access or an accounting of disclosures, and to HHS when it undertakes a compliance investigation, review, or enforcement action. Option a is incorrect because the Privacy Rule lists only two required disclosures, and law enforcement requests are not among them; such disclosures fall under public interest activities, which are permitted but not required. Option c is incorrect because public health activities sit within public interest and benefit activities, a group the rule describes as permitted, not required, without an individual's authorization. Option d is incorrect because payment disclosures belong to the permitted treatment, payment, and health care operations category, which allows disclosure without authorization but does not compel it.

Correct Answer: State law making dual compliance impossible for a covered entity

A State law that makes it impossible for a covered entity to comply with both State and federal requirements is the definition of a contrary provision. It triggers preemption rather than qualifying as an exception to it. Option b is incorrect because certain health plan reporting, such as for management or financial audits, is named as an exception, so a State law of this kind remains in force. Option c is incorrect because disease and injury reporting, along with child abuse, birth, death and public health surveillance, appears among the Privacy Rule's listed exceptions, so such laws are not preempted. Option d is incorrect because the Privacy Rule lists State laws relating to privacy of individually identifiable health information that give greater privacy protections or rights as a stated exception to preemption.

Correct Answer: Demonstrate a low probability of compromise through a risk assessment

An impermissible acquisition, access, use, or disclosure of protected health information is presumed to be a breach unless the covered entity demonstrates a low probability of compromise based on a risk assessment of at least four factors. Option a is incorrect because the presumption of breach applies from the impermissible access or use itself, and the entity must act through a documented risk assessment rather than waiting for later events. Option b is incorrect because the definition places the burden on the covered entity to demonstrate low probability of compromise; whether a complaint exists is not a factor in that assessment. Option d is incorrect because the definition covers any acquisition, access, use, or disclosure of protected health information not permitted under subpart E, and does not limit the presumption to electronic records.

Correct Answer: It complements the Privacy Rule, and the billing company must comply as a regulated entity.

The Security Rule complements the Privacy Rule, and covered entities and business associates are collectively regulated entities. Under the applicability standard, a business associate must comply with the Security Rule's standards for the covered entity's ePHI. Option a is incorrect because HHS describes the Security Rule as working alongside the Privacy Rule and Breach Notification Rule, and business associates are bound by the safeguards too. Option c is incorrect because direct application to covered entities alone describes the Security Rule as originally issued; the applicability standard now extends its requirements to business associates as well. Option d is incorrect because this reverses the scope, since the Security Rule protects health information maintained or transmitted in electronic form, meaning ePHI.

Correct Answer: Environmental safeguards

The action plan should address administrative, physical and technical safeguards, organizational standards, and policies and procedures. Environmental safeguards are not among the five HIPAA security components listed, so that option is the exception. Option b is incorrect because action plan guidance names physical safeguards among the five components, so it belongs in the plan rather than standing outside it. Option c is incorrect because it is a listed component; risk analysis and risk management are themselves administrative safeguards under the security management process standard. Option d is incorrect because technical safeguards appear in the list of five components, alongside administrative and physical safeguards, so the plan must address them.

Correct Answer: Direct data entry

Direct data entry is the entry of data, for example through dumb terminals or web browsers, that is immediately transmitted into a health plan's computer. The staff member's website entry matches that definition. Option a is incorrect because it is an agreement between parties about exchanging electronic transactions, specifying duties and responsibilities, not a method of keying information into a plan's system. Option b is incorrect because it refers to the data elements that control the enveloping or hierarchical structure of a transaction, which is a structural feature rather than a submission method. Option c is incorrect because it is a rule describing when a covered entity must use a particular data element or segment, so it says nothing about how information is submitted.