Question 1

This transaction is the response to a Health Care Claim (837):

Accepted Answer

A)  Eligibility (270/271) 
B)  Premium Payment (B20) 
C)  Claim Status Notification (277) 
D)  Remittance Advice (35) 
E)  Functional Acknowledgment (997) 
A)  Eligibility (270/271) 
B)  Premium Payment (B20) 
C)  Claim Status Notification (277) 
D)  Remittance Advice (35) 
E)  Functional Acknowledgment (997)

Question 2

This transaction type is a "response" transaction that may include information such as accepted/rejected claim, approved claim(s) pre-payment, or approved claim(s) post-payment:

Accepted Answer

A)  270. 
B)  820. 
C)  837. 
D)  277. 
E)  278. 
A)  270. 
B)  820. 
C)  837. 
D)  277. 
E)  278.

Question 3

Select the correct statement regarding the requirements of HIPAA regulations.

Accepted Answer

A)  A covered entity must have and apply sanction against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity. 
B)  A covered entity does not need to train all members of its workforce whose functions are affected by a change in policy or procedure. 
C)  A covered entity must designate, and document, a privacy officer, and a HIPAA compliance officer, 
D)  A covered entity may require individuals to waive their rights. 
E)  A covered entity must require the individual to sign the Notice of Privacy Practices prior to delivering any treatment related service. 
A)  A covered entity must have and apply sanction against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity. 
B)  A covered entity does not need to train all members of its workforce whose functions are affected by a change in policy or procedure. 
C)  A covered entity must designate, and document, a privacy officer, and a HIPAA compliance officer, 
D)  A covered entity may require individuals to waive their rights. 
E)  A covered entity must require the individual to sign the Notice of Privacy Practices prior to delivering any treatment related service.

Question 4

When PHI is sent or received over an electronic network there must be measures to guard against unauthorized access. This is covered under which security rule standard?

Accepted Answer

A)  Device and Media Controls 
B)  Access Controls 
C)  Transmission Security 
D)  Integrity 
E)  Audit Controls 
A)  Device and Media Controls 
B)  Access Controls 
C)  Transmission Security 
D)  Integrity 
E)  Audit Controls

Question 5

Select the correct statement regarding the requirements for oral communication in the HIPAA regulations.

Accepted Answer

A)  Covered entities must reasonably safeguard PHI, including oral communications, from any intentional or unintentional use or disclosure that is in violation of the Privacy Rule. 
B)  Covered entities must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of de-Identified data. 
C)  Covered entities are prohibited from marketing through oral communications. 
D)  The Privacy Rule requires covered entities to document any information, including oral communications, which is used or disclosed for TPO purposes. 
E)  The Privacy Rule will often require major structural changes, such as soundproof rooms and encryption of telephone systems, to provide the "reasonable safeguards" of oral communications required by the regulations. 
A)  Covered entities must reasonably safeguard PHI, including oral communications, from any intentional or unintentional use or disclosure that is in violation of the Privacy Rule. 
B)  Covered entities must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of de-Identified data. 
C)  Covered entities are prohibited from marketing through oral communications. 
D)  The Privacy Rule requires covered entities to document any information, including oral communications, which is used or disclosed for TPO purposes. 
E)  The Privacy Rule will often require major structural changes, such as soundproof rooms and encryption of telephone systems, to provide the "reasonable safeguards" of oral communications required by the regulations.

Question 6

Select the correct statement regarding the administrative requirements of the HIPAA privacy rule

Accepted Answer

A)  A covered entity must apply disciplinary sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity. 
B)  A covered entity need not train all members of its workforce whose functions are materially affected by a change in policy or procedure. 
C)  A covered entity must designate, and document, a contact person responsible for receiving acknowledgements of Notice of Privacy Practice. 
D)  A covered entity may require individuals to waive their rights. 
E)  A covered entity must provide maximum safeguards for PHI from any intentional or unintentional use or disclosure that is in violation of the regulations and to limit incidental uses and disclosures made pursuant to permitted or required use or disclosure. 
A)  A covered entity must apply disciplinary sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity. 
B)  A covered entity need not train all members of its workforce whose functions are materially affected by a change in policy or procedure. 
C)  A covered entity must designate, and document, a contact person responsible for receiving acknowledgements of Notice of Privacy Practice. 
D)  A covered entity may require individuals to waive their rights. 
E)  A covered entity must provide maximum safeguards for PHI from any intentional or unintentional use or disclosure that is in violation of the regulations and to limit incidental uses and disclosures made pursuant to permitted or required use or disclosure.

Question 7

This transaction supports multiple functions. These functions include: telling a bank to move money OR telling a bank to move money while sending remittance information.

Accepted Answer

A)  277 
B)  276 
C)  271 
D)  820 
E)  270 
A)  277 
B)  276 
C)  271 
D)  820 
E)  270

Question 8

A covered entity that fails to implement the HIPAA Privacy Rule would risk:

Accepted Answer

A)  $5 .000 in fines. 
B)  $5000 in fines and six months in prison. 
C)  An annual cap of $50000 in fines. 
D)  A fine of up to $50000 if they wrongfully disclose PHI. 
E)  Six months in prison. 
A)  $5 .000 in fines. 
B)  $5000 in fines and six months in prison. 
C)  An annual cap of $50000 in fines. 
D)  A fine of up to $50000 if they wrongfully disclose PHI. 
E)  Six months in prison.

Question 9

Workstation Use falls under which Security Rule area?

Accepted Answer

A)  Person or Entity Authentication 
B)  Technical Safeguards 
C)  Administrative Safeguards 
D)  Physical Safeguards 
E)  Transmission Security 
A)  Person or Entity Authentication 
B)  Technical Safeguards 
C)  Administrative Safeguards 
D)  Physical Safeguards 
E)  Transmission Security

Question 10

A doctor is sending a patient's lab work to a lab That is an external business partner. The lab and the doctor's staff are all trained on the doctor's Privacy Practices. The doctor has a signed Notice from the patient. In order to use or disclose PHI, the lab MUST:

Accepted Answer

A)  Request that the patient sign the lab's Notice of Privacy Practices. 
B)  Do nothing more - the activity is covered by the doctor's Notice of Privacy Practices. 
C)  Obtain a specific authorization from the patient. 
D)  Obtain a specific authorization from the doctor. 
E)  Verify that the doctor's Notice of Privacy Practices has not expired. 
A)  Request that the patient sign the lab's Notice of Privacy Practices. 
B)  Do nothing more - the activity is covered by the doctor's Notice of Privacy Practices. 
C)  Obtain a specific authorization from the patient. 
D)  Obtain a specific authorization from the doctor. 
E)  Verify that the doctor's Notice of Privacy Practices has not expired.

Question 11

This code set is used to describe or identity radiological procedures and clinical laboratory tests:

Accepted Answer

A)  ICD-9-CM. Volumes 1 and 2 
B)  CPT-4 
C)  CDT 
D)  ICD-9-CM, Volume 3 
E)  HCPCS 
A)  ICD-9-CM. Volumes 1 and 2 
B)  CPT-4 
C)  CDT 
D)  ICD-9-CM, Volume 3 
E)  HCPCS

Question 12

The National Provider File (NPF) includes information such as:

Accepted Answer

A)  Effective date 
B)  CPT-4 
C)  CDT 
D)  ICD-9-CM 
E)  Enrollment date 
A)  Effective date 
B)  CPT-4 
C)  CDT 
D)  ICD-9-CM 
E)  Enrollment date

Question 13

Select the best statement regarding the definition of a business associate of a covered entity. A business associate is:

Accepted Answer

A)  A person who acts on behalf of a non-covered entity. 
B)  A person whose function may involve claims processing, administration, data analysis or practice management with access to PHI. 
C)  A person who is a member of the covered entity's workforce. 
D)  A clearinghouse. 
E)  A person that performs or assists in the performance of a function or activity that involves the use or disclosure of de-identified health information. 
A)  A person who acts on behalf of a non-covered entity. 
B)  A person whose function may involve claims processing, administration, data analysis or practice management with access to PHI. 
C)  A person who is a member of the covered entity's workforce. 
D)  A clearinghouse. 
E)  A person that performs or assists in the performance of a function or activity that involves the use or disclosure of de-identified health information.

Question 14

Formal, documented instructions for reporting security breaches are referred to as:

Accepted Answer

A)  Business Associate Contract 
B)  Response and Reporting 
C)  Emergency Access Procedure 
D)  Sanction policy 
E)  Risk Management 
A)  Business Associate Contract 
B)  Response and Reporting 
C)  Emergency Access Procedure 
D)  Sanction policy 
E)  Risk Management

Question 15

In terms of Security, the best definition of "Access Control" is:

Accepted Answer

A)  A list of authorized entities, together with their access rights. 
B)  Corroborating your identity 
C)  The prevention of an unauthorized use of a resource. 
D)  Proving that nothing regarding your identity has been altered. 
E)  Being unable to deny you took part in a transaction. 
A)  A list of authorized entities, together with their access rights. 
B)  Corroborating your identity 
C)  The prevention of an unauthorized use of a resource. 
D)  Proving that nothing regarding your identity has been altered. 
E)  Being unable to deny you took part in a transaction.

Exam 1: Certified HIPAA Professional (CHP)