CPSS Test- Ophthalmology Questions And Answers
HIPAA stands for
a. Health Information Portability and Accountability Act
b. Health Insurance Portability and Accountability Act
c. Health Insurance Protection and Activity Act
d. Home Information Protection and Accountability Act. - Answer b. Health Insurance
Portability and Accountability Act
One significant difference the HIPAA Omnibus Final Rule of 2013 brings about is a
requirement for a business associate of the covered entity-the physician practice-to
have a Business Associate Agreement with:
a. Business associates' subcontractors
b. Business associates' subcontractors
c. Optometrists' subcontractors
d. Affiliated hospitals' subcontractors - Answer b. Business associates' subcontractors
T/F. Under the rules as set forth in the Omnibus Final Rule of 2013, a patient has a right
to obtain a copy of his/her medical record in electronic form if the relevant provider uses
electronic health records. - Answer True
HIPAA covered entities include:
a. Attorneys
b. Health care providers
c. Health care facilities
d. Librarians
e. a and d.
f. b and c. - Answer b and c.
,Health care providers and Health care facilities
Protected Health Information includes:
a. Individual demographic data
b. Insurance eligibility and coverage
c. Billing records, claims data, referral authorizations
d. Medical records, diagnosis, genetic information and testing
e. c and d
f. All of the above. - Answer f. All of the above.
T/F. Covered entities under HIPAA must establish a Notice of Privacy Practices or NPP
and make those available to individuals receiving services through the covered entity. -
Answer True
For which of the following does the individual need to provide a signed permission to
disclose?
a. Physician Referrals
b. Physician Consultations on patient treatment
c. Information requested by an attorney without a subpoena
d. Information requested by insurance companies for payment purposes. - Answer c.
Information requested by an attorney without a subpoena
T/F. Patient names on a sign-in form are considered an intentional breach of PHI. -
Answer False; incidental breach
T/F. Under the HITECH Act, the Breach Notification Act does NOT require notification to
HHS of the intentional or unintentional disclosure of PHI to unapproved entities on an
annual basis unless the breach has affected more than 500 individuals. - Answer False
Notice of Privacy Practices (NPP) must be updated in 2013 to include which of the
,following?
a. Names of the owners of the covered entity
b. Names of entities that have access to PHI
c. Patient's right to restrict disclosures of PHI to a health plan when the patient pays out
of pocket and in full for the health care item or service.
d. Profitability of the covered entity. - Answer c. Patient's right to restrict disclosures of
PHI to a health plan when the patient pays out of pocket and in full for the health care
item or service.
If an individual or staff member has a complaint regarding the use of PHI, the individual
must speak with the facility's:
a. Manager
b. Owner
c. Maintenance coordinator
d. Privacy Officer
e. Chief Physician - Answer d. Privacy officer.
Which of the following is NOT an administrative safeguard requirement?
a. Designating a privacy officer
b. Developing a cost analysis of HIPAA requirements.
c. Obtaining HIPAA-compliant business associate agreements for subcontractors
d. Establishing procedures to prevent terminated employees from obtaining access to
confidential information after termination - Answer b. Developing a cost analysis of
HIPAA requirements.
Physical safeguards do NOT include which of the following?
a. Posting PHI on a white board in the facility
b. Storage of PHI in a secure place
c. Shredding of PHI
, d. Use of surge-protectors - Answer a. Posting PHI on a white board in the facility
Technical safeguards include which of the following?
a. Encryption of data
b. Computer system log-ins and passwords
c. Anti-virus software and firewalls
d. IT certification review
e. All of the above - Answer e. All of the above
"Safe" computing includes which of the following?
a. Sharing passwords with other staff members
b. Remaining "logged on" always, to save time
c. Using email and the internet ONLY as allowed by practice protocols
d. Installing personal software on the computer - Answer c. Using email and the internet
ONLY as allowed by practice protocols
T/F. Most elective care focused practices answer the telephone within one or two rings.
-Answer True
T/F. There is no reason to identify your name if you have already stated the name of the
practice in your greeting. -Answer False
If a caller is inquiring about a procedure the receptionist should:
a. Simply confirm that they offer the procedure by saying "Yes we do."
b. Try to reach callers by asking if they have ever had the procedure.
c. Put the caller on hold until they can find time to speak to them
d. Tell the caller to call back later when we are less busy. - Answer b. Try to reach
callers by asking if they have ever had the procedure.
HIPAA stands for
a. Health Information Portability and Accountability Act
b. Health Insurance Portability and Accountability Act
c. Health Insurance Protection and Activity Act
d. Home Information Protection and Accountability Act. - Answer b. Health Insurance
Portability and Accountability Act
One significant difference the HIPAA Omnibus Final Rule of 2013 brings about is a
requirement for a business associate of the covered entity-the physician practice-to
have a Business Associate Agreement with:
a. Business associates' subcontractors
b. Business associates' subcontractors
c. Optometrists' subcontractors
d. Affiliated hospitals' subcontractors - Answer b. Business associates' subcontractors
T/F. Under the rules as set forth in the Omnibus Final Rule of 2013, a patient has a right
to obtain a copy of his/her medical record in electronic form if the relevant provider uses
electronic health records. - Answer True
HIPAA covered entities include:
a. Attorneys
b. Health care providers
c. Health care facilities
d. Librarians
e. a and d.
f. b and c. - Answer b and c.
,Health care providers and Health care facilities
Protected Health Information includes:
a. Individual demographic data
b. Insurance eligibility and coverage
c. Billing records, claims data, referral authorizations
d. Medical records, diagnosis, genetic information and testing
e. c and d
f. All of the above. - Answer f. All of the above.
T/F. Covered entities under HIPAA must establish a Notice of Privacy Practices or NPP
and make those available to individuals receiving services through the covered entity. -
Answer True
For which of the following does the individual need to provide a signed permission to
disclose?
a. Physician Referrals
b. Physician Consultations on patient treatment
c. Information requested by an attorney without a subpoena
d. Information requested by insurance companies for payment purposes. - Answer c.
Information requested by an attorney without a subpoena
T/F. Patient names on a sign-in form are considered an intentional breach of PHI. -
Answer False; incidental breach
T/F. Under the HITECH Act, the Breach Notification Act does NOT require notification to
HHS of the intentional or unintentional disclosure of PHI to unapproved entities on an
annual basis unless the breach has affected more than 500 individuals. - Answer False
Notice of Privacy Practices (NPP) must be updated in 2013 to include which of the
,following?
a. Names of the owners of the covered entity
b. Names of entities that have access to PHI
c. Patient's right to restrict disclosures of PHI to a health plan when the patient pays out
of pocket and in full for the health care item or service.
d. Profitability of the covered entity. - Answer c. Patient's right to restrict disclosures of
PHI to a health plan when the patient pays out of pocket and in full for the health care
item or service.
If an individual or staff member has a complaint regarding the use of PHI, the individual
must speak with the facility's:
a. Manager
b. Owner
c. Maintenance coordinator
d. Privacy Officer
e. Chief Physician - Answer d. Privacy officer.
Which of the following is NOT an administrative safeguard requirement?
a. Designating a privacy officer
b. Developing a cost analysis of HIPAA requirements.
c. Obtaining HIPAA-compliant business associate agreements for subcontractors
d. Establishing procedures to prevent terminated employees from obtaining access to
confidential information after termination - Answer b. Developing a cost analysis of
HIPAA requirements.
Physical safeguards do NOT include which of the following?
a. Posting PHI on a white board in the facility
b. Storage of PHI in a secure place
c. Shredding of PHI
, d. Use of surge-protectors - Answer a. Posting PHI on a white board in the facility
Technical safeguards include which of the following?
a. Encryption of data
b. Computer system log-ins and passwords
c. Anti-virus software and firewalls
d. IT certification review
e. All of the above - Answer e. All of the above
"Safe" computing includes which of the following?
a. Sharing passwords with other staff members
b. Remaining "logged on" always, to save time
c. Using email and the internet ONLY as allowed by practice protocols
d. Installing personal software on the computer - Answer c. Using email and the internet
ONLY as allowed by practice protocols
T/F. Most elective care focused practices answer the telephone within one or two rings.
-Answer True
T/F. There is no reason to identify your name if you have already stated the name of the
practice in your greeting. -Answer False
If a caller is inquiring about a procedure the receptionist should:
a. Simply confirm that they offer the procedure by saying "Yes we do."
b. Try to reach callers by asking if they have ever had the procedure.
c. Put the caller on hold until they can find time to speak to them
d. Tell the caller to call back later when we are less busy. - Answer b. Try to reach
callers by asking if they have ever had the procedure.
