HCCA - CHPC Exam 1 Questions and Answers
Latest Versions 2025 Top Rated A+
a. WhatAis the intent of HIPAA?
a. standardize healthcare billing and coding to comply with national accounting principle
s
b. increase paymentAfrom providers given the rising cost of healthcare and fraud violatio
ns
c. allow group health plans collect premiums after individual has left a job/employer
d. improve healthcare programs and data flow between providers to data mine for fraud
ulent behavior - CORRECT ANSWERS -
d. improve healthcare programs and data flow between providers to data mine for fraud
ulent behavior
The intent of HIPAAAis to improve healthcare programs and the delivery of services thro
ugh the two largest health plans in the U.S., This is accomplished by improved data flow
s that leads to better outcomes using national standards formats and specific transactio
ns to increase accuracy and rapid way to data mine ad detect fraudulent behavior.
The specific data flows are outlined in the Transaction & Code Set Rules 45 CFR 162.1
00 - 162.1902
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-162
True or False:
A physician is required to have a business associate contractAwith a laboratory as a con
dition of disclosing protected health information for the treatment of an individual. -
CORRECT ANSWERS -FALSE
Remember, use and disclosure of PHI for purposes of TPO requires no specific authoriz
ation
True or False:
A hospital laboratory is not required to have a business associate contract to disclose pr
otected health information to a reference laboratory for treatment of the individual. -
CORRECT ANSWERS -TRUE
Remember, use and disclosure of PHI for purposes of TPO requires no specific authoriz
ation
True or False:
Research use/disclosure with individual authorization does not expire or continue until t
he end of the research study - CORRECT ANSWERS -TRUE
https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
True or False:
Research use/disclosure with individual authorization may be combined with an authoriz
ation for a differentAresearch activity if research related treatment is conditioned on the p
rovision of one of the authorizations - CORRECT ANSWERS -TRUE
,https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
True or False:
Research use/disclosure with individual authorization may be combined with other legal
permission or consent to participate in the research - CORRECT ANSWERS -TRUE
https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
True of False:
Is it possible for a facility with multiple provider functions to have certain isolated provide
rs or groups who are subject to PartA2, while the facility as a whole is not subject to Part
2. For example, a large facility may have primary care providers and a separate unit that
provides SUD services. - CORRECT ANSWERS -TRUE
Explanation:
The SUD unit is subject to PartA2, but the rest of the facility is not.
True or False:
An individual provider who works in a general medical facility could also be a Part 2 pro
gram IF the provider's primary function is to provide SUD services. -
CORRECT ANSWERS -TRUE
Explanation:
For example, a primary care physician who provides medication-
assisted treatment would only meet the requirement if providing services to persons wit
h SUD is their primary function. However, If a patient were to receive both primary care
and SUD treatment, the SUD providers are still subject to Part 2 and could not share inf
ormation with the patient's primary care provider withoutAconsent.
True or False:
A program or facility that provides both, SUD services and Mental Health Services, and
a patientAhas been admitted to receiving both services, his/her records will be subject to
the Part 2 regulations - CORRECT ANSWERS -FALSE
Explanation:
Mental health information is not subject to the standards in 42 CFR Part 2 and can be s
hared without consent for treatment purposes, including care coordination, as allowed u
nder HIPAA. More details.
Only records or information about patients receiving SUD services will be subject to Part
2 and its use/disclosure is more restrictive. However, to allow appropriate mental/behav
ioral health information sharing with SUD information, a Qualified Service Organization
Agreement (QSOA) would be needed as defined in 42 CFR 2.11 "Qualified service orga
nization" section.
What are the 4 federal regulations and/or government agencies that govern the privacy
of individually identifiable info in research - CORRECT ANSWERS -1. HHS-
FDA (protections of human subject and IRBs)
2. HHS-NIH (certificate of confidentiality)
3. HHS-Office of Human Research Protections (Common Rule)
4. HHS-OCR - HIPAAAPrivacy Rule
Ref. HCCA Privacy Handbook 3rd Ed
Certificates of Confidentiality (CoC) is a formal confidentiality to protect the privacy of hu
man research participants enrolled in biomedical, behavioral, clinical and other forms of
,sensitive research. CoC are issued by the NIH or the FDA, and are authorized by law by
the P H S Act - CORRECT ANSWERS -Public Health Services Act.
The Privacy Act of 1974 was created in response to the government creating and using
computer databases. The Act places restrictions on how government can share the infor
mation with other individuals and agencies, and ultimately protect the privacy of individu
als that is maintained in Systems of Records by federal agencies. Before a federal agen
cy begins to collect personal information for a system of records, an advanced public no
tice must be published in the Federal Register, which outlines the administrative, techni
cal, and physical safeguards for protecting the personally identifiable information being
collected. This "public notice" is called" - S of R N (SORN) -
CORRECT ANSWERS -system of records notice (SORN)
ref. HCCA privacy handbook 3rd ed. "Privacy Act 1974" section
WhatAis a research IRB?
1. Institutional Research Board
2. A group of executives thatAreview all research activities conducted by the Board of Dir
ectors
3. A group of individuals that review proposed research to protectAthe privacy of subject
s
4. Can make changes to the research or alter its content as they seemed appropriate -
CORRECT ANSWERS -
3. A group of individuals that review proposed research to protectAthe privacy of subject
s
An individual must authorize these marketing communications before they can occur, ex
cept:
a. when the communication is notAfor the purpose of providing treatment advice
b. communication from a health insurer to promote their products/services
c. communication in training material using their photo
d. hospital uses its patientAlistAto announce the arrival of a new specialty group in genera
l mailing - CORRECT ANSWERS -Except:
d. hospital uses its patient listAto announce the arrival of a new specialty group
This activity does notAmeetAthe "marketing" definition, for instance, the disclosure of PHI
in this example is notAfor exchange of remuneration, or to encourage use of product, pro
mote services.
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html
True or False:
It is important that when contracting with payers or health plans they follow not only the
HIPAAAsecurity but also the privacy rule to protectAbeneficiaries PHI including use/disclo
sure during payer's marketing activities - CORRECT ANSWERS -TRUE
Which of the following requires a Business Associate contract/agreement:
a. independent medical transcriptionist
b. entities that participate in an OHCA (organized healthcare arrangement)
c. when a provider simply accepts a discounted rate to participate in the health plan's ne
twork
d. US Postal Services or private carriers - CORRECT ANSWERS -
a. independent medical transcriptionist
, explanation: this is an outsourced service that handles PHI on behalf of the CE. The tra
nscriptionist is performing an activity for the CE that contains PHI and a BAA is required
to ensure proper use and disclosure.
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-
associates/index.html
Is a covered entity required to provide notice to individuals about its disclosures of PHI t
o a PHA for public health purposes? - CORRECT ANSWERS -Yes.
This is in the covered entity's Notice of Privacy Practices (NPP).
The Privacy Rule requires a covered entity to include in its NPP a description of the pur
poses, which would include public health purposes, for which the covered entity may us
e or disclose PHI without an individual's authorization.
However, the Privacy Rule does not require a business associate (such as an HIE that i
s a business associate) to provide individuals with a NPP.
True of False:
OHCAs and ACEs are able to produce a jointANotice of Privacy Practice (NPP) -
CORRECT ANSWERS -FALSE
Explanation:
OHCAs are joint arrangements, have an Integrated Delivery System, and therefore agre
e to abide by the terms of the notice with respectAto PHI created or received by the cove
red entity as part of its participation in the OHCA.
ACEs are legally separate covered entities working together and unable to use a joint N
PP and they might still have separate EHRs, separate HIM/ROI functions, etc. and there
fore, the PHI data is not create or receive in the same manner.
See 45 CFR 164.520(d) https://www.law.cornell.edu/cfr/text/45/164.520
True or False:
It is your last day at your pediatric clinical site and you are saying goodbye to all of your
favorite patients. You take a picture on your phone of a few of the patients posing togeth
er and later post itAto your private blog as an illustration of your last day. Since your blog
is private and can only be accessed by those who know the URL, you are not Ain violatio
n of HIPAA regulations. - CORRECT ANSWERS -FALSE
Fill in the blank:
In the mid-
1990s, OIG began to require providers settling civil health care fraud cases to enter into
specific type of agreements as a condition for OIG not pursuing exclusion. These agree
ments are referred as: - CORRECT ANSWERS -Corporate integrity Agreements (CIA)
The foundation for establishing a good relationship with a vendor is the Contract. AAcont
ract is an exchange of promise, services for money, with a specificAremedy for breach of
contract. What are some of the key basic elements to contracts. -
CORRECT ANSWERS -Basic key elements to contacts include:
I. Agreement (Offer and Acceptance)
Latest Versions 2025 Top Rated A+
a. WhatAis the intent of HIPAA?
a. standardize healthcare billing and coding to comply with national accounting principle
s
b. increase paymentAfrom providers given the rising cost of healthcare and fraud violatio
ns
c. allow group health plans collect premiums after individual has left a job/employer
d. improve healthcare programs and data flow between providers to data mine for fraud
ulent behavior - CORRECT ANSWERS -
d. improve healthcare programs and data flow between providers to data mine for fraud
ulent behavior
The intent of HIPAAAis to improve healthcare programs and the delivery of services thro
ugh the two largest health plans in the U.S., This is accomplished by improved data flow
s that leads to better outcomes using national standards formats and specific transactio
ns to increase accuracy and rapid way to data mine ad detect fraudulent behavior.
The specific data flows are outlined in the Transaction & Code Set Rules 45 CFR 162.1
00 - 162.1902
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-162
True or False:
A physician is required to have a business associate contractAwith a laboratory as a con
dition of disclosing protected health information for the treatment of an individual. -
CORRECT ANSWERS -FALSE
Remember, use and disclosure of PHI for purposes of TPO requires no specific authoriz
ation
True or False:
A hospital laboratory is not required to have a business associate contract to disclose pr
otected health information to a reference laboratory for treatment of the individual. -
CORRECT ANSWERS -TRUE
Remember, use and disclosure of PHI for purposes of TPO requires no specific authoriz
ation
True or False:
Research use/disclosure with individual authorization does not expire or continue until t
he end of the research study - CORRECT ANSWERS -TRUE
https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
True or False:
Research use/disclosure with individual authorization may be combined with an authoriz
ation for a differentAresearch activity if research related treatment is conditioned on the p
rovision of one of the authorizations - CORRECT ANSWERS -TRUE
,https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
True or False:
Research use/disclosure with individual authorization may be combined with other legal
permission or consent to participate in the research - CORRECT ANSWERS -TRUE
https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
True of False:
Is it possible for a facility with multiple provider functions to have certain isolated provide
rs or groups who are subject to PartA2, while the facility as a whole is not subject to Part
2. For example, a large facility may have primary care providers and a separate unit that
provides SUD services. - CORRECT ANSWERS -TRUE
Explanation:
The SUD unit is subject to PartA2, but the rest of the facility is not.
True or False:
An individual provider who works in a general medical facility could also be a Part 2 pro
gram IF the provider's primary function is to provide SUD services. -
CORRECT ANSWERS -TRUE
Explanation:
For example, a primary care physician who provides medication-
assisted treatment would only meet the requirement if providing services to persons wit
h SUD is their primary function. However, If a patient were to receive both primary care
and SUD treatment, the SUD providers are still subject to Part 2 and could not share inf
ormation with the patient's primary care provider withoutAconsent.
True or False:
A program or facility that provides both, SUD services and Mental Health Services, and
a patientAhas been admitted to receiving both services, his/her records will be subject to
the Part 2 regulations - CORRECT ANSWERS -FALSE
Explanation:
Mental health information is not subject to the standards in 42 CFR Part 2 and can be s
hared without consent for treatment purposes, including care coordination, as allowed u
nder HIPAA. More details.
Only records or information about patients receiving SUD services will be subject to Part
2 and its use/disclosure is more restrictive. However, to allow appropriate mental/behav
ioral health information sharing with SUD information, a Qualified Service Organization
Agreement (QSOA) would be needed as defined in 42 CFR 2.11 "Qualified service orga
nization" section.
What are the 4 federal regulations and/or government agencies that govern the privacy
of individually identifiable info in research - CORRECT ANSWERS -1. HHS-
FDA (protections of human subject and IRBs)
2. HHS-NIH (certificate of confidentiality)
3. HHS-Office of Human Research Protections (Common Rule)
4. HHS-OCR - HIPAAAPrivacy Rule
Ref. HCCA Privacy Handbook 3rd Ed
Certificates of Confidentiality (CoC) is a formal confidentiality to protect the privacy of hu
man research participants enrolled in biomedical, behavioral, clinical and other forms of
,sensitive research. CoC are issued by the NIH or the FDA, and are authorized by law by
the P H S Act - CORRECT ANSWERS -Public Health Services Act.
The Privacy Act of 1974 was created in response to the government creating and using
computer databases. The Act places restrictions on how government can share the infor
mation with other individuals and agencies, and ultimately protect the privacy of individu
als that is maintained in Systems of Records by federal agencies. Before a federal agen
cy begins to collect personal information for a system of records, an advanced public no
tice must be published in the Federal Register, which outlines the administrative, techni
cal, and physical safeguards for protecting the personally identifiable information being
collected. This "public notice" is called" - S of R N (SORN) -
CORRECT ANSWERS -system of records notice (SORN)
ref. HCCA privacy handbook 3rd ed. "Privacy Act 1974" section
WhatAis a research IRB?
1. Institutional Research Board
2. A group of executives thatAreview all research activities conducted by the Board of Dir
ectors
3. A group of individuals that review proposed research to protectAthe privacy of subject
s
4. Can make changes to the research or alter its content as they seemed appropriate -
CORRECT ANSWERS -
3. A group of individuals that review proposed research to protectAthe privacy of subject
s
An individual must authorize these marketing communications before they can occur, ex
cept:
a. when the communication is notAfor the purpose of providing treatment advice
b. communication from a health insurer to promote their products/services
c. communication in training material using their photo
d. hospital uses its patientAlistAto announce the arrival of a new specialty group in genera
l mailing - CORRECT ANSWERS -Except:
d. hospital uses its patient listAto announce the arrival of a new specialty group
This activity does notAmeetAthe "marketing" definition, for instance, the disclosure of PHI
in this example is notAfor exchange of remuneration, or to encourage use of product, pro
mote services.
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html
True or False:
It is important that when contracting with payers or health plans they follow not only the
HIPAAAsecurity but also the privacy rule to protectAbeneficiaries PHI including use/disclo
sure during payer's marketing activities - CORRECT ANSWERS -TRUE
Which of the following requires a Business Associate contract/agreement:
a. independent medical transcriptionist
b. entities that participate in an OHCA (organized healthcare arrangement)
c. when a provider simply accepts a discounted rate to participate in the health plan's ne
twork
d. US Postal Services or private carriers - CORRECT ANSWERS -
a. independent medical transcriptionist
, explanation: this is an outsourced service that handles PHI on behalf of the CE. The tra
nscriptionist is performing an activity for the CE that contains PHI and a BAA is required
to ensure proper use and disclosure.
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-
associates/index.html
Is a covered entity required to provide notice to individuals about its disclosures of PHI t
o a PHA for public health purposes? - CORRECT ANSWERS -Yes.
This is in the covered entity's Notice of Privacy Practices (NPP).
The Privacy Rule requires a covered entity to include in its NPP a description of the pur
poses, which would include public health purposes, for which the covered entity may us
e or disclose PHI without an individual's authorization.
However, the Privacy Rule does not require a business associate (such as an HIE that i
s a business associate) to provide individuals with a NPP.
True of False:
OHCAs and ACEs are able to produce a jointANotice of Privacy Practice (NPP) -
CORRECT ANSWERS -FALSE
Explanation:
OHCAs are joint arrangements, have an Integrated Delivery System, and therefore agre
e to abide by the terms of the notice with respectAto PHI created or received by the cove
red entity as part of its participation in the OHCA.
ACEs are legally separate covered entities working together and unable to use a joint N
PP and they might still have separate EHRs, separate HIM/ROI functions, etc. and there
fore, the PHI data is not create or receive in the same manner.
See 45 CFR 164.520(d) https://www.law.cornell.edu/cfr/text/45/164.520
True or False:
It is your last day at your pediatric clinical site and you are saying goodbye to all of your
favorite patients. You take a picture on your phone of a few of the patients posing togeth
er and later post itAto your private blog as an illustration of your last day. Since your blog
is private and can only be accessed by those who know the URL, you are not Ain violatio
n of HIPAA regulations. - CORRECT ANSWERS -FALSE
Fill in the blank:
In the mid-
1990s, OIG began to require providers settling civil health care fraud cases to enter into
specific type of agreements as a condition for OIG not pursuing exclusion. These agree
ments are referred as: - CORRECT ANSWERS -Corporate integrity Agreements (CIA)
The foundation for establishing a good relationship with a vendor is the Contract. AAcont
ract is an exchange of promise, services for money, with a specificAremedy for breach of
contract. What are some of the key basic elements to contracts. -
CORRECT ANSWERS -Basic key elements to contacts include:
I. Agreement (Offer and Acceptance)
