RHIT Healthcare Compliance and Regulations 4 — Questions and Answers
Question 1: A covered entity discloses PHI to a vendor that manages its medical transcription services. Which document must govern this relationship under HIPAA?
- Data Use Agreement
- Business Associate Agreement (BAA) (Correct answer)
- Qualified Protective Order
- Notice of Privacy Practices
Correct answer: Business Associate Agreement (BAA)
A Business Associate Agreement is required when a covered entity shares PHI with a vendor performing functions on its behalf.
Question 2: Under the Medicare Conditions of Participation for medical records, which timeframe is required for completion of a medical record after patient discharge?
- 7 days
- 24 hours
- 30 days (Correct answer)
- 60 days
Correct answer: 30 days
CMS Conditions of Participation at 42 CFR §482.24 require that medical records be completed within 30 days following patient discharge.
Question 3: Which of the following activities would constitute Medicare fraud, as opposed to Medicare abuse?
- Billing for a service that is not medically necessary due to a coding error
- Intentionally billing for services never rendered (Correct answer)
- Inadvertently using an incorrect code that results in a higher payment
- Failing to document a service that was provided
Correct answer: Intentionally billing for services never rendered
Fraud involves intentional deception; knowingly billing for services never rendered is a clear fraudulent act under the False Claims Act.
Question 4: Which of the following best describes the purpose of the National Provider Identifier (NPI)?
- It tracks physician licensing across state lines
- It is a unique 10-digit identification number assigned to covered healthcare providers for HIPAA administrative transactions (Correct answer)
- It replaces the DEA number for controlled substance prescribing
- It is issued by the Joint Commission for accreditation purposes
Correct answer: It is a unique 10-digit identification number assigned to covered healthcare providers for HIPAA administrative transactions
The NPI is a unique 10-digit identifier required by HIPAA for covered healthcare providers in standard electronic administrative transactions.
Question 5: The Anti-Kickback Statute (AKS) prohibits offering, paying, soliciting, or receiving remuneration to induce referrals for items or services covered by federal healthcare programs. Which category provides legal protection for certain business arrangements?
- Stark Law exceptions
- Safe harbors (Correct answer)
- Compliance shields
- Non-prosecution agreements
Correct answer: Safe harbors
OIG safe harbors describe specific arrangements that, if structured correctly, are protected from AKS prosecution.
Question 6: A patient requests access to their electronic health record. Under the HIPAA Right of Access rule, the covered entity must provide access within how many days?
- 10 business days
- 30 days, with one 30-day extension possible (Correct answer)
- 60 days with no extension
- 14 calendar days
Correct answer: 30 days, with one 30-day extension possible
Under 45 CFR §164.524, covered entities must act on a request for access within 30 days and may extend by 30 days with written notice.
Question 7: In ICD-10-CM, sequencing the principal diagnosis for inpatient records follows the UHDDS definition, which defines principal diagnosis as:
- The most resource-intensive condition treated during the stay
- The condition established after study to be chiefly responsible for occasioning the admission (Correct answer)
- The admitting diagnosis documented by the attending physician
- The condition that poses the greatest mortality risk to the patient
Correct answer: The condition established after study to be chiefly responsible for occasioning the admission
UHDDS defines principal diagnosis as the condition established after study to be chiefly responsible for causing the inpatient admission.
RHIT Healthcare Compliance and Regulations 4
A covered entity discloses PHI to a vendor that manages its medical transcription services.
Which document must govern this relationship under HIPAA?