2026 AAPC CPB FINAL EXAM QUESTIONS
AND ANSWERS (VERIFIED ANSWERS)
AGRADE// AAPC CPB FINAL EXAM
A new radiology company opens in town. The manager calls your practice and
offers to pay $20 for every Medicare patient you send to them for radiology
services. What does this offer violate? Correct Answer: anti kickback laws
A private practice hires a consultant to come in and audit some medical records.
Under the Privacy Rule, what is this consultant considered? Correct Answer: biz
associate
Medicare overpayments should be returned within days after the overpayment
has been identified Correct Answer: 60
HIPAA mandated what entity to adopt national standards for electronic
transactions and code sets? Correct Answer: HHS
Health plan, clearinghouses, and any entity transmitting health information is
considered by the Privacy Rule to be a: Correct Answer: covered entity
Which of the following is not a covered entity in the Privacy Rule Correct
Answer: healthcare consulting firm
A request for medical records is received for a specific date of service from
patient's insurance company with regards to a submitted claim. No authorization
for release of information is provided. What action should be taken? Correct
Answer: release reqt to ins co
How many national priority purposes under the Privacy Rules for disclosure of
specific PHI without an individual's authorization or permission? Correct Answer:
12
A health plan sends a request for medical records in order to adjudicate a claim.
Does the office have to notify the patient or have them sign a release to send the
information? Correct Answer: no
A practice sets up a payment plan with a patient. If more than four installments are
,extended to the patient, what regulation is the practice subject to that makes the
practice a creditor? Correct Answer: Truth in Lending Act
Which of the following situations allows release of PHI without authorization from
the patient? Correct Answer: workers comp
misusing any information on the claim, charging excessively for services or
supplies, billing for services not medically necessary, failure to maintain adequate
medical or financial records, improper billing practices, or billing Medicare
patients at a higher fee scale that non-Medicare patients. Correct Answer: abuse
, A claim is submitted for a patient on Medicare with a higher fee than a patient on
Insurance ABC. What is this considered by CMS? Correct Answer: abuse
According to the Privacy Rule, what health information may not be de-identified?
Correct Answer: phys provider number
making false statements or misrepresenting facts to obtain an undeserved benefit or
payment from a federal healthcare program Correct Answer: fraud
All the following are considered Fraud, EXCEPT: Correct Answer: inadequate
med recd
A hospital records transporter is moving medical records from the hospital to an
off-site building. During the transport, a chart falls from the box on to the street. It
is discovered when the transporter arrives at the off-site building and the number of
charts is not correct. What type of violation is this? Correct Answer: breach
impermissible release or disclosure of information is discovered Correct
Answer: breach
What standard transactions is NOT included in EDI and adopted under HIPAA?
Correct Answer: waiver of liability
The Federal False Claim Act allows for claims to be reviewed for a standard of
how many years after an incident? Correct Answer: 7
AND ANSWERS (VERIFIED ANSWERS)
AGRADE// AAPC CPB FINAL EXAM
A new radiology company opens in town. The manager calls your practice and
offers to pay $20 for every Medicare patient you send to them for radiology
services. What does this offer violate? Correct Answer: anti kickback laws
A private practice hires a consultant to come in and audit some medical records.
Under the Privacy Rule, what is this consultant considered? Correct Answer: biz
associate
Medicare overpayments should be returned within days after the overpayment
has been identified Correct Answer: 60
HIPAA mandated what entity to adopt national standards for electronic
transactions and code sets? Correct Answer: HHS
Health plan, clearinghouses, and any entity transmitting health information is
considered by the Privacy Rule to be a: Correct Answer: covered entity
Which of the following is not a covered entity in the Privacy Rule Correct
Answer: healthcare consulting firm
A request for medical records is received for a specific date of service from
patient's insurance company with regards to a submitted claim. No authorization
for release of information is provided. What action should be taken? Correct
Answer: release reqt to ins co
How many national priority purposes under the Privacy Rules for disclosure of
specific PHI without an individual's authorization or permission? Correct Answer:
12
A health plan sends a request for medical records in order to adjudicate a claim.
Does the office have to notify the patient or have them sign a release to send the
information? Correct Answer: no
A practice sets up a payment plan with a patient. If more than four installments are
,extended to the patient, what regulation is the practice subject to that makes the
practice a creditor? Correct Answer: Truth in Lending Act
Which of the following situations allows release of PHI without authorization from
the patient? Correct Answer: workers comp
misusing any information on the claim, charging excessively for services or
supplies, billing for services not medically necessary, failure to maintain adequate
medical or financial records, improper billing practices, or billing Medicare
patients at a higher fee scale that non-Medicare patients. Correct Answer: abuse
, A claim is submitted for a patient on Medicare with a higher fee than a patient on
Insurance ABC. What is this considered by CMS? Correct Answer: abuse
According to the Privacy Rule, what health information may not be de-identified?
Correct Answer: phys provider number
making false statements or misrepresenting facts to obtain an undeserved benefit or
payment from a federal healthcare program Correct Answer: fraud
All the following are considered Fraud, EXCEPT: Correct Answer: inadequate
med recd
A hospital records transporter is moving medical records from the hospital to an
off-site building. During the transport, a chart falls from the box on to the street. It
is discovered when the transporter arrives at the off-site building and the number of
charts is not correct. What type of violation is this? Correct Answer: breach
impermissible release or disclosure of information is discovered Correct
Answer: breach
What standard transactions is NOT included in EDI and adopted under HIPAA?
Correct Answer: waiver of liability
The Federal False Claim Act allows for claims to be reviewed for a standard of
how many years after an incident? Correct Answer: 7
