Question 1

Select the FALSE statement regarding code sets and identifiers.

Accepted Answer

A)  The CPT-4 code set is maintained by the American Medical Association (AM
A) . 
B)  A covered entity must use the applicable medical code set that is valid at the time the health care is delivered. 
C)  The National Provider Identifier (NPI) will be assigned by the National Provider System (NPS). 
D)  The Centers for Medicare and Medicaid Services is responsible for updating the HCPCS code set. 
E)  The National Provider Identifier (NPI) will be assigned to health plans. 
A)  The CPT-4 code set is maintained by the American Medical Association (AM
A) . 
B)  A covered entity must use the applicable medical code set that is valid at the time the health care is delivered. 
C)  The National Provider Identifier (NPI) will be assigned by the National Provider System (NPS). 
D)  The Centers for Medicare and Medicaid Services is responsible for updating the HCPCS code set. 
E)  The National Provider Identifier (NPI) will be assigned to health plans.

Question 2

Which of the following is example of "Payment" as defined in the HIPAA regulations?

Accepted Answer

A)  Annual Audits 
B)  Claims Management 
C)  Salary disbursement to the workforce having direct treatment relationships 
D)  Life Insurance underwriting 
E)  Cash given to the pharmacist for the purchase of an over-the-counter drug medicine 
A)  Annual Audits 
B)  Claims Management 
C)  Salary disbursement to the workforce having direct treatment relationships 
D)  Life Insurance underwriting 
E)  Cash given to the pharmacist for the purchase of an over-the-counter drug medicine

Question 3

A provider is in compliance with the Privacy Rule. She has a signed Notice of Privacy Practices from her patient. To provide treatment, the doctor needs to consult with an independent provider who has no relationship with the patient to comp with the Privacy Rule the doctor MUST:

Accepted Answer

A)  Establish a business partner relationship with the other provider. 
B)  Obtain a signed authorization from the patient to cover the disclosure. 
C)  Make a copy of the signed Notice available to the other provider 
D)  Obtain the patients signature on the second providers Notice of Privacy Practices. 
E)  Do nothing more - the Notice of Privacy Practices covers treatment activities. 
A)  Establish a business partner relationship with the other provider. 
B)  Obtain a signed authorization from the patient to cover the disclosure. 
C)  Make a copy of the signed Notice available to the other provider 
D)  Obtain the patients signature on the second providers Notice of Privacy Practices. 
E)  Do nothing more - the Notice of Privacy Practices covers treatment activities.

Question 4

Patient identifiable information may include:

Accepted Answer

A)  Country of birth 
B)  Telephone number 
C)  Information on past 3 employers 
D)  Patient credit reports 
E)  Smart card-based digital signatures 
A)  Country of birth 
B)  Telephone number 
C)  Information on past 3 employers 
D)  Patient credit reports 
E)  Smart card-based digital signatures

Question 5

The Security Incident Procedures standard requires just one implementation specification. That implementation specification is:

Accepted Answer

A)  Termination Procedures 
B)  Automatic Logoff 
C)  Emergency Access Procedure 
D)  Contingency Operations 
E)  Response and Reporting 
A)  Termination Procedures 
B)  Automatic Logoff 
C)  Emergency Access Procedure 
D)  Contingency Operations 
E)  Response and Reporting

Question 6

Select the FALSE statement regarding health-related communications and marketing in The I-IIPAA regulations:

Accepted Answer

A)  A covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form allowed by the regulations. 
B)  A face-to-face communication made by a covered entity to an individual is allowed by the regulations without an authorization. 
C)  A promotional gift of nominal value provided by the covered entity is NOT allowed by the regulations without an authorization. 
D)  If the marketing is expected to result in direct or indirect remuneration to the covered entity from a third party, the authorization must state that such remuneration is expected. 
E)  Disclosure of PHI for marketing purposes is limited to disclosure to business associates (which could be a telemarketer) that undertakes marketing activities on behalf of the covered entity. 
A)  A covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form allowed by the regulations. 
B)  A face-to-face communication made by a covered entity to an individual is allowed by the regulations without an authorization. 
C)  A promotional gift of nominal value provided by the covered entity is NOT allowed by the regulations without an authorization. 
D)  If the marketing is expected to result in direct or indirect remuneration to the covered entity from a third party, the authorization must state that such remuneration is expected. 
E)  Disclosure of PHI for marketing purposes is limited to disclosure to business associates (which could be a telemarketer) that undertakes marketing activities on behalf of the covered entity.

Question 7

As part of their HIPAA compliance process, a small doctor's office formally puts the office manager in charge of security related issues. This complies with which security rule standard?

Accepted Answer

A)  Security Awareness and Training 
B)  Security Management Process 
C)  Access Control 
D)  Assigned Security Responsibility 
E)  Security incident Procedures 
A)  Security Awareness and Training 
B)  Security Management Process 
C)  Access Control 
D)  Assigned Security Responsibility 
E)  Security incident Procedures

Question 8

The State of Nebraska's Medicaid Program has decided to implement an EDI solution to comply with the HIPAA transaction rule. Select the transaction or code set that would not apply to them.

Accepted Answer

A)  270 
B)  835 
C)  837 - Professional 
D)  CPT-4 
E)  U8-92 
A)  270 
B)  835 
C)  837 - Professional 
D)  CPT-4 
E)  U8-92

Question 9

The code set that must be used to describe or identify outpatient physician services and procedures is:

Accepted Answer

A)  lCD-SCM, Volumes 1 and 2 
B)  CPT-4 
C)  CDT 
D)  lCD-SCM, Volume 3 
E)  NDC 
A)  lCD-SCM, Volumes 1 and 2 
B)  CPT-4 
C)  CDT 
D)  lCD-SCM, Volume 3 
E)  NDC

Question 10

A business associate:

Accepted Answer

A)  Requires PKI for the provider and the patient. 
B)  Is electronically stored information about an individual's lifetime health status and health care. 
C)  Is another name for an HMO. 
D)  Identifies all non-profit organizations. 
E)  Is a person or an entity that on behalf of the covered entity performs or assists in the performance of a function or activity involving the use or disclosure of health-related information. 
A)  Requires PKI for the provider and the patient. 
B)  Is electronically stored information about an individual's lifetime health status and health care. 
C)  Is another name for an HMO. 
D)  Identifies all non-profit organizations. 
E)  Is a person or an entity that on behalf of the covered entity performs or assists in the performance of a function or activity involving the use or disclosure of health-related information.

Question 11

Select the correct statement regarding the responsibilities of providers and payers under HIPAA's privacy rule.

Accepted Answer

A)  Optionally, they might develop a mechanism of accounting for all disclosures of PHI for purposes other than TPO. 
B)  They must redesign their offices, workspaces, and storage systems to afford maximum protection to PHI from intentional and unintentional use and disclosure. 
C)  They must develop methods for disclosing only the minimum amount of protected information necessary to accomplish any intended purpose. 
D)  They must obtain a "top secret" security clearance for all member of their workforce. 
E)  They must identify business associates that need to use PHI to accomplish their function and develop authorization forms to allow PHI to be shared with these business associates. 
A)  Optionally, they might develop a mechanism of accounting for all disclosures of PHI for purposes other than TPO. 
B)  They must redesign their offices, workspaces, and storage systems to afford maximum protection to PHI from intentional and unintentional use and disclosure. 
C)  They must develop methods for disclosing only the minimum amount of protected information necessary to accomplish any intended purpose. 
D)  They must obtain a "top secret" security clearance for all member of their workforce. 
E)  They must identify business associates that need to use PHI to accomplish their function and develop authorization forms to allow PHI to be shared with these business associates.

Question 12

Which one of the following security standards is part of Technical Safeguards?

Accepted Answer

A)  Access control 
B)  Security Management Process 
C)  Facility Access Controls 
D)  Workstation Use 
E)  Device and Media Controls 
A)  Access control 
B)  Security Management Process 
C)  Facility Access Controls 
D)  Workstation Use 
E)  Device and Media Controls

Question 13

Select the FALSE statement regarding the responsibilities of providers with direct treatment relationships under HIPAA's privacy rule.

Accepted Answer

A)  Provide the individual with a Notice of Privacy Practices that describes the use of PHI. 
B)  Obtain a written authorization for each and every TPO event. 
C)  Obtain a written authorization for any disclosure or use of PHI other than for the purposes of TPO. 
D)  Provide access to the PHI that it maintains to the individual and make reasonable efforts to correct possible errors when requested by the individual. 
E)  Establish procedures to receive complaints relating to the handling of PHI. 
A)  Provide the individual with a Notice of Privacy Practices that describes the use of PHI. 
B)  Obtain a written authorization for each and every TPO event. 
C)  Obtain a written authorization for any disclosure or use of PHI other than for the purposes of TPO. 
D)  Provide access to the PHI that it maintains to the individual and make reasonable efforts to correct possible errors when requested by the individual. 
E)  Establish procedures to receive complaints relating to the handling of PHI.

Question 14

Physical access to workstations such as, whether or not patients can easily see a screen with PHI on it, is addressed by:

Accepted Answer

A)  Workstation Use 
B)  Workstation Security 
C)  Sanction Policy 
D)  Termination Procedures 
E)  Facility Security Plan 
A)  Workstation Use 
B)  Workstation Security 
C)  Sanction Policy 
D)  Termination Procedures 
E)  Facility Security Plan

Question 15

A business associate must agree to:

Accepted Answer

A)  Report to the covered entity any security incident of which it becomes aware. 
B)  Ensure the complete safety of all electronic protected health information. 
C)  Compensate the covered entity for penalties incurred because of the business associate's security incidents. 
D)  Register as a business associate with HHS. 
E)  Submit to periodic audits by HHS of critical systems containing electronic protected health information. 
A)  Report to the covered entity any security incident of which it becomes aware. 
B)  Ensure the complete safety of all electronic protected health information. 
C)  Compensate the covered entity for penalties incurred because of the business associate's security incidents. 
D)  Register as a business associate with HHS. 
E)  Submit to periodic audits by HHS of critical systems containing electronic protected health information.

Question 16

The key objective of a contingency plan is that the entity must establish and implement policies and procedures to ensure The:

Accepted Answer

A)  Creation and modification of health information during and after an emergency. 
B)  Integrity of health information during and after an emergency. 
C)  Accountability of health information during and after an emergency. 
D)  Vulnerability of health information during and after an emergency. 
E)  Non-repudiation of the entity. 
A)  Creation and modification of health information during and after an emergency. 
B)  Integrity of health information during and after an emergency. 
C)  Accountability of health information during and after an emergency. 
D)  Vulnerability of health information during and after an emergency. 
E)  Non-repudiation of the entity.

Question 17

One mandatory requirement for the Notice of Privacy Practices set by HIPAA regulations is:

Accepted Answer

A)  If the notice must state that the covered entity reserves the right to disclose PHI without obtaining the individuals authorization. 
B)  The notice must prominently include an expiration date. 
C)  The notice must describe every potential use of PHI. 
D)  The notice must describe an individual's rights under the rule such as to inspect, copy and amend PHI and to obtain an accounting of disclosures of PHI. 
E)  The notice must clearly identify that the covered entity is in compliance with HIPAA regulations as of April 16, 2003. 
A)  If the notice must state that the covered entity reserves the right to disclose PHI without obtaining the individuals authorization. 
B)  The notice must prominently include an expiration date. 
C)  The notice must describe every potential use of PHI. 
D)  The notice must describe an individual's rights under the rule such as to inspect, copy and amend PHI and to obtain an accounting of disclosures of PHI. 
E)  The notice must clearly identify that the covered entity is in compliance with HIPAA regulations as of April 16, 2003.

Question 18

The office manager of a small doctor's office wants to donate several of their older workstations to the local elementary school. Which Security Rule Standard addresses this situation?

Accepted Answer

A)  Security Management Process 
B)  Device and Media Controls 
C)  information Access Management 
D)  Facility Access Controls 
E)  Workstation Security 
A)  Security Management Process 
B)  Device and Media Controls 
C)  information Access Management 
D)  Facility Access Controls 
E)  Workstation Security

Question 19

A grouping of functional groups, delimited by a header/trailer pair, is called a:

Accepted Answer

A)  Data element 
B)  Data segment 
C)  Transaction set 
D)  Functional envelope 
E)  Interchange envelope 
A)  Data element 
B)  Data segment 
C)  Transaction set 
D)  Functional envelope 
E)  Interchange envelope

Question 20

Within the context of a transaction set, the fields that comprise a hierarchical level are referred to as a(n):

Accepted Answer

A)  Loop 
B)  Enumerator 
C)  Identifier 
D)  Data segment 
E)  Code set 
A)  Loop 
B)  Enumerator 
C)  Identifier 
D)  Data segment 
E)  Code set

Exam 1: Certified HIPAA Professional (CHP)