Question 1

A key date in the transaction rule timeline is:

Accepted Answer

A)   October 16, 2003 - small health plans to begin testing without ASCA extension
B)   October 16, 2004 - full compliance deadline for small health plans
C)   April 16, 2004 - small health plans to begin testing with ASCA extension
D)   April 16, 2003 - deadline to begin testing with ASCA extension
E)   April 14, 2003; deadline to begin testing with ASCA extension. D

Question 2

Dr. Jones, a practicing dentist, has decided to directly implement an EDI solution to comply with the HIPAA transaction rule. Dr. Jones employs a small staff of 4 persons for whom he has sponsored a health care plan. Dr. Jones has revenues of less than $1 million. Select the code set that Dr. Jones should consider supporting for his EDI system.

Accepted Answer

A)   837 - Professional
B)   834
C)   CPT•4
D)   837 - Institutional
E)   CDT E

Question 3

This transaction, which is not a HIPAA standard, may be used as the first response when receiving a Health Care Claim (837):

Accepted Answer

A)   Eligibility (270/271) .
B)   Premium Payment (820) .
C)   Unsolicited Claim Status (277) .
D)   Remittance Advice (835) .
E)   Functional Acknowledgment (997) . E

Question 4

Within the context of a transaction set, the fields that comprise a hierarchical level are referred to as a(n):

Accepted Answer

A)   Loop
B)   Enumerator
C)   Identifier
D)   Data segment
E)   Code set

Question 5

Select the correct statement regarding the definition of the term "disclosure" as used in the HIPAA regulations.

Accepted Answer

A)   "Disclosure" refers to employing IIHI within a covered entity.
B)   "Disclosure" refers to utilizing, examining, or analyzing IIHI within a covered entity.
C)   "Disclosure" refers to the release, transfer, or divulging of IIHI to another covered entity.
D)   "Disclosure" refers to the movement of information within an organization.
E)   "Disclosure" refers to the sharing of information within the covered entity.

Question 6

Which one of the following is a required implementation specification of the Security Management Process?

Accepted Answer

A)   Risk Analysis
B)   Access Control and Validation Procedures
C)   Integrity Controls
D)   Access Authorization
E)   Termination Procedures

Question 7

Which of the following is NOT a HIPAA national health care identifier?

Accepted Answer

A)   National Provider Identifier (NPI) 
B)   Social Security Number (SSN) 
C)   National Health Plan Identifier (PlanI
D)  
D)   National Employer Identifier for Health Care (EIN) 
E)   National Health Identifier for Individuals (NI-UI)

Question 8

Information in this transaction is generated by the payer's adjudication system:

Accepted Answer

A)   Eligibility (2701271) 
B)   Premium Payment (2O) 
C)   Unsolicited Claim Status (277) 
D)   Remittance Advice (35) 
E)   Functional Acknowledgment (997)

Question 9

A doctor sends patient records to another company for data entry services. A bonded delivery service is used for the transfer. The records are returned to the doctor after entry is complete, using the same delivery service. The entry facility and the network they use are secure. The doctor is named as his own Privacy Officer in written policies. The doctor has written procedures for this process and all involved parties are documented as having been trained in them The doctor does not have written authorizations to disclose Protected Health Information (PHI). Is the doctor in violation of the Privacy Rule?

Accepted Answer

A)   No - This would be considered an allowed "routine disclosure between the doctor and his business partner.
B)   Yes - There is no exception to the requirement for an authorization prior to disclosure, no matter how well intentioned or documented.
C)   Yes - a delivery service is not considered a covered entity.
D)   Yes - to be a "routine disclosure" all the parties must have their own Privacy Officer as mandated by l-IIPAA.
E)   Yes - this is not considered a part of "treatment", which is one of the valid exceptions to the Privacy Rule.

Question 10

The Health Care Claim Status Response (277) can be used in a number of ways. Select the correct usage.

Accepted Answer

A)   As a response to a health care claim status request.
B)   As a health care claim payment advice.
C)   Electronic funds transfer.
D)   As a request for health care claims status.
E)   Request for the psychotherapy notes of a patient.

Question 11

Policies requiring workforce members to constantly run an updated anti-virus program on their workstation might satisfy which implementation specification?

Accepted Answer

A)   Risk Management
B)   Protection from Malicious Software
C)   Facility Security Plan
D)   Response and Reporting
E)   Emergency Access Procedure

Question 12

The security standard that has the objective of implementing mechanisms to record and examine system activity is:

Accepted Answer

A)   Access Control
B)   Audit Controls
C)   Authorization Controls
D)   Data Authentication
E)   Person or Entity Authentication

Question 13

In an emergency treatment situation, a health care provider:

Accepted Answer

A)   Must obtain the signature of the patient before disclosing PHI to another provider.
B)   Must contact a relative of the patient before disclosing PHI to another provider.
C)   May use their best judgment in order to provide appropriate treatment.
D)   May use PHI but may not disclose it to another provider
E)   Must inform the patient about the Notice of Privacy Practices before delivering treatment.

Question 14

ANSI X12 specifies the use of a (an):

Accepted Answer

A)   Simple flat file structure for transactions.
B)   Envelope structure for transactions.
C)   Employer identifier.
D)   Health plan identifier.
E)   Provider identifier.

Question 15

This rule covers the policies and procedures that must be in place to ensure that the patients' health information is respected and their rights upheld:

Accepted Answer

A)   Security rule.
B)   Privacy rule.
C)   Covered entity rule.
D)   Electronic Transactions and Code Sets rule.
E)   Electronic Signature Rule

Question 16

The code set that must be used to describe or identify dentist's services and procedures is:

Accepted Answer

A)   lcD-9-cM, Volumes 1 and 2
B)   CPT-4
C)   CDT
D)   ICD-9-CM, Volume 3
E)   HCPCS

Question 17

Select the FALSE statement regarding the administrative requirements of the HIPAA privacy rule.

Accepted Answer

A)   A covered entity must mitigate, to the extent practicable, any harmful effect that it becomes aware of from the use or disclosure of PHI in violation of its policies and procedures or HIPAA regulations.
B)   A covered must not in any way intimidate, retaliate, or discriminate against any individual or other entity, which tiles a compliant.
C)   A covered entity may not require individuals to waive their rights as a condition for treatments payment, enrollment in a health plan, or eligibility for benefits.
D)   A covered entity must retain the documents required by the regulations for a period of six years.
E)   A covered entity must change its policies and procedures to comply with HIPAA regulations no later than three years after the change in law.

Question 18

HIPAA Security standards are designed to be:

Accepted Answer

A)   Technology specific
B)   State of the art
C)   Non-Comprehensive
D)   Revolutionary
E)   Scalable

Question 19

Select the FALSE statement regarding violations of the HIPAA Privacy rule.

Accepted Answer

A)   Covered entities that violate the standards or implementation specifications will be subjected to civil penalties of up to $100 per violation except that the total amount imposed on any one person in each calendar year may not exceed $25,000 for violations of one requirement.
B)   Criminal penalties for non-compliance are fines up to $65,000 and one year in prison for each requirement or prohibition violated.
C)   Criminal penalties for willful violation are fines up to $60,000 and one year in prison for each requirement or prohibition violated.
D)   Criminal penalties for violations committed under "false pretenses are fines up to $100,000 and five years in prison for each requirement or prohibition violated.
E)   Criminal penalties for violations committed with the intent to sell, transfer, or use PHI for commercial advantage, personal gain or malicious harm are fines up to $250,000 and ten years in prison for each requirement or prohibition violated.

Question 20

Select the best statement regarding organized health care arrangements (OHCA).

Accepted Answer

A)   An organized health care arrangement is a clinically integrated setting in which patients receive care from multiple providers.
B)   Independent providers participating in an organized health care arrangement are business associates of each other.
C)   An example of an OHCA is a nurse employed in a physician's office.
D)   An example of an OHCA is a laboratory attached to a physician's office.
E)   An example of an OHCA is a health insurance company and its affiliated life insurance company.

Exam 1: Certified HIPAA Professional (CHP)