AAPC-CPPM Certified Physician Practice Manager - Set 5 - Part 3

Correct Answer: Drought

The annex list places drought under meteorological hazards, together with flood, windstorm, extreme temperatures, and lightning strikes. Tsunami is geological, pandemic is biological, and utility failure is a technology caused event. Option a is incorrect because it belongs to the biological hazards group, which also includes foodborne illnesses, and is a separate subgroup from meteorological hazards. Option b is incorrect because it is listed under geological hazards alongside earthquake, volcano, and landslide, mudslide, subsidence, not under meteorological hazards. Option c is incorrect because the annex lists it as a technology caused event, a separate heading from the natural hazards subgroups.

Correct Answer: Pull the fire alarm

The fire emergency plan directs that when a fire is reported, the fire alarm is pulled if available and not already activated, warning occupants to evacuate. Dialing 911 and directing evacuation follow. Option a is incorrect because a lockdown warning is part of the separate lockdown plan, where trained persons use the warning system; it is not a fire response step. Option c is incorrect because meeting the Fire Department Incident Commander happens later in the procedures, once the department has arrived and occupants are being accounted for. Option d is incorrect because damage assessment and salvage belong to property conservation, which addresses recovery after an incident rather than the first response to a reported fire.

Correct Answer: Assembly Area Monitor

In the evacuation team structure of an emergency response plan, Assembly Area Monitors account for evacuees at the assembly area and inform the incident commander if anyone is missing or injured. Option a is incorrect because searchers are assigned one per floor to check the building, while another role handles the headcount of people who have gathered outside. Option b is incorrect because floor wardens are assigned one for each floor of the building, not to the outside assembly area where evacuees are accounted for. Option c is incorrect because this role is listed on the evacuation team for the building's stairwells and elevators, not for accounting at the assembly area.

Correct Answer: Mobile workplaces such as vehicles or vessels

The coverage provision states that the rules apply to workplaces in general industry except mobile workplaces such as vehicles or vessels. Every employer in general industry is covered, so only mobile workplaces fall outside. Option a is incorrect because general industry is exactly where the rules apply, because the coverage provision says every employer is covered in that setting. Option c is incorrect because exit routes are themselves covered, since the rules set minimum requirements for the routes employers must provide so employees can evacuate safely. Option d is incorrect because the same group of sections sets minimum requirements for emergency action plans, so such workplaces are inside the coverage, not excluded.

Correct Answer: Succession of management

The business continuity organization section defines roles and responsibilities and identifies lines of authority, succession of management, and delegation of authority. Succession of management states who takes over when a manager cannot serve. Option a is incorrect because it sets the target for data restoration within the business impact analysis and does not name who takes over leadership duties. Option b is incorrect because it records who receives copies of the plan, such as team members and management, not who steps into a vacated leadership role. Option c is incorrect because these procedures belong to the strategies and requirements section and cover moving operations, not the chain of leadership.

Correct Answer: Crisis Communications Plan

The appendix References to Related Policies & Procedures lists the Emergency Response Plan, the Information Technology Disaster Recovery Plan, the Crisis Communications Plan and the Employee Assistance Plan. Crisis Communications Plan is one of these. Option a is incorrect because a testing schedule belongs to Training, Testing & Exercising and covers recovery strategies, rather than appearing as a separate related plan in the appendix. Option b is incorrect because an incident action plan is developed and approved during incident management procedures; it is not among the related plans the appendix references. Option d is incorrect because the corrective action program is described under Program Maintenance and Improvement as a way to address deficiencies, so it is not a referenced related plan.

Correct Answer: Ensure formal agreements state specific requirements

In the Develop Recovery Strategy key activity, NIST states that when part of the strategy depends on external organizations for support, formal agreements must be in place with specific requirements stated. Option a is incorrect because a call list is a recovery-strategy sample question for notifying staff, but the guidance does not use it to secure support from external organizations. Option b is incorrect because a coordinator is a separate sample question about managing and maintaining the plan, and it does not address reliance on an outside organization's support. Option c is incorrect because this is the preceding key activity, which looks at preventing loss of critical services, whereas the dependency here arises while finalizing the recovery strategy.

Correct Answer: Applications and Data Criticality Analysis

Under the Contingency Plan standard, Applications and Data Criticality Analysis is labeled Addressable, along with Testing and Revision Procedure. The Data Backup Plan, Disaster Recovery Plan and Emergency Mode Operation Plan are labeled Required. Option a is incorrect because the Security Rule table marks it Required, which places it among the mandatory Contingency Plan items, not the flexible ones. Option b is incorrect because it is labeled (R) under the Contingency Plan standard, so a covered entity must implement it rather than assess it. Option d is incorrect because it carries the Required label too, since the standard expects a plan for protecting ePHI security during emergency operation.

Correct Answer: Practicing clinicians

The Contingency Planning SAFER Guide says the planning team should include practicing clinicians so technical components align with and support affected clinical processes and workflows. Substitute downtime workflows are particularly sensitive to clinician input and cooperation. Option b is incorrect because legal counsel is named as a resource for questions about how HIPAA requirements apply, not as the group that aligns technical components with clinical workflows. Option c is incorrect because vendors appear only in developer documentation holding contact details and serial numbers, and are not described as shaping substitute workflows during downtime. Option d is incorrect because the guidance ties downtime workflow design to clinician input and cooperation, and does not name billing staff as the group that must be on the team.

Correct Answer: Unique temporary patient record numbers

SAFER's patient identification practice calls for a mechanism to register new patients during downtime, including unique temporary patient record numbers, plus a process to reconcile those new patient IDs once the EHR is back online. Option a is incorrect because scanning is described as a way to bring downtime paperwork into the EHR after reactivation, not as a way to register new patients. Option b is incorrect because checking a link's URL destination is a ransomware-prevention training step for suspicious emails, which addresses a different problem than registering patients. Option c is incorrect because keeping at least one backup offsite is a data-recovery safeguard from security planning questions, and it does not assign identifiers to patients registered during downtime.