CCCP Healthcare Compliance & HIPAA 4 — Questions and Answers
Question 1: Under HIPAA, psychotherapy notes receive special protection because:
- They are excluded from the definition of PHI entirely
- They require patient authorization for most disclosures, even those permitted for other PHI (Correct answer)
- They may never be disclosed under any circumstances
- They are protected only if the therapist is a licensed psychiatrist
Correct answer: They require patient authorization for most disclosures, even those permitted for other PHI
Psychotherapy notes have heightened protections under the Privacy Rule, requiring written patient authorization for disclosures that would otherwise be permitted for general PHI.
Question 2: The OIG's seven elements of an effective compliance program include all of the following EXCEPT:
- Implementing written policies and procedures
- Conducting effective training and education
- Establishing a guaranteed whistleblower immunity program (Correct answer)
- Conducting internal monitoring and auditing
Correct answer: Establishing a guaranteed whistleblower immunity program
The OIG's seven elements do not include a guaranteed whistleblower immunity program; they focus on policies, training, communication, monitoring, enforcement, response, and standards.
Question 3: A healthcare entity subject to a Corporate Integrity Agreement (CIA) with the OIG is typically required to:
- Cease all Medicare billing for the duration of the agreement
- Retain an Independent Review Organization (IRO) to audit claims (Correct answer)
- Disclose all audit findings publicly on its website
- Suspend the compliance officer pending OIG review
Correct answer: Retain an Independent Review Organization (IRO) to audit claims
CIAs typically require entities to engage an IRO to conduct independent reviews of billing practices and submit findings to the OIG.
Question 4: Under HIPAA, a covered entity's Notice of Privacy Practices (NPP) must be provided to patients:
- Only upon patient request
- No later than the date of first service delivery (Correct answer)
- At every subsequent healthcare encounter
- Only when the entity changes its privacy policies
Correct answer: No later than the date of first service delivery
Covered entities must provide the NPP no later than the date of first service delivery to a new patient, with good-faith efforts to obtain written acknowledgment.
Question 5: Which scenario would most likely trigger mandatory reporting to HHS under the HIPAA Breach Notification Rule for a large breach (500+ individuals)?
- A nurse verbally discusses a patient's condition with a treating physician
- An unencrypted laptop containing ePHI is stolen from an employee's car (Correct answer)
- A fax containing PHI is sent to the wrong physician within the same hospital system
- A patient leaves their paper records at the reception desk and another patient sees them
Correct answer: An unencrypted laptop containing ePHI is stolen from an employee's car
Theft of an unencrypted device containing ePHI constitutes a breach of unsecured PHI requiring notification to HHS and affected individuals.
Question 6: The Exclusion Database maintained by the OIG lists individuals and entities that are excluded from participating in federal healthcare programs. A healthcare organization that employs an excluded individual:
- Must report the hire to OIG but may allow the individual to continue working
- May face civil monetary penalties and repayment of any claims submitted during the exclusion period (Correct answer)
- Is protected from liability if it performed a database check at initial hiring only
- Must terminate the individual only if the exclusion was for fraud-related offenses
Correct answer: May face civil monetary penalties and repayment of any claims submitted during the exclusion period
Employing an excluded individual can result in civil monetary penalties and require repayment of all federal healthcare program reimbursements attributable to that individual.
Question 7: In healthcare compliance, 'upcoding' refers to:
- Using outdated procedure codes that have been superseded
- Submitting claims using codes that reflect a higher level of service than actually provided (Correct answer)
- Assigning multiple codes to a single procedure to maximize reimbursement
- Coding services before they are rendered to secure prior authorization
Correct answer: Submitting claims using codes that reflect a higher level of service than actually provided
Upcoding involves billing for a higher-complexity or more expensive service than was actually delivered, which constitutes healthcare fraud.
CCCP Healthcare Compliance & HIPAA 4
Under HIPAA, psychotherapy notes receive special protection because: