CRCR Healthcare Compliance and Regulations 3 — Questions and Answers
Question 1: A revenue cycle staff member accesses a celebrity patient's record out of curiosity without a treatment need. Which HIPAA rule is violated?
- Security Rule
- Privacy Rule minimum necessary standard (Correct answer)
- Breach Notification Rule
- Omnibus Rule
Correct answer: Privacy Rule minimum necessary standard
The HIPAA Privacy Rule's minimum necessary standard limits access to PHI to only what is needed for a legitimate job function.
Question 2: Under the Medicare Conditions of Participation, how long must hospitals generally retain medical records for adult patients?
- 3 years from date of discharge
- 5 years from date of discharge (Correct answer)
- 7 years from date of discharge
- 10 years from date of discharge
Correct answer: 5 years from date of discharge
Medicare Conditions of Participation require hospitals to retain patient medical records for at least 5 years from the date of discharge.
Question 3: Which element is NOT required for a valid HIPAA-compliant authorization for the release of PHI?
- Expiration date or event
- Description of information to be disclosed
- Patient's Social Security Number (Correct answer)
- Statement of the patient's right to revoke
Correct answer: Patient's Social Security Number
A valid HIPAA authorization does not require the patient's Social Security Number; required elements focus on purpose, recipient, and patient rights.
Question 4: An exclusion from participation in federal healthcare programs is managed by which federal office?
- Centers for Medicare & Medicaid Services (CMS)
- Office of Inspector General (OIG) (Correct answer)
- Department of Justice (DOJ)
- Office for Civil Rights (OCR)
Correct answer: Office of Inspector General (OIG)
The OIG maintains the List of Excluded Individuals/Entities (LEIE) and has authority to impose exclusions from federal healthcare programs.
Question 5: What is the primary purpose of a Corporate Integrity Agreement (CIA) entered with the OIG?
- To establish billing rates for Medicare services
- To outline compliance obligations as an alternative to exclusion (Correct answer)
- To define covered service benefits for payers
- To set HIPAA privacy training schedules
Correct answer: To outline compliance obligations as an alternative to exclusion
A CIA is a negotiated agreement requiring a healthcare entity to implement specific compliance measures in exchange for not being excluded from federal programs.
Question 6: Which regulatory body oversees enforcement of HIPAA's Privacy and Security Rules?
- Office of Inspector General (OIG)
- Centers for Medicare & Medicaid Services (CMS)
- Office for Civil Rights (OCR) (Correct answer)
- Department of Justice (DOJ)
Correct answer: Office for Civil Rights (OCR)
HHS Office for Civil Rights (OCR) is responsible for enforcing HIPAA's Privacy and Security Rules and investigating complaints.
Question 7: Under the No Surprises Act, which document must providers give patients before scheduled services involving potential out-of-network costs?
- Explanation of Benefits (EOB)
- Good Faith Estimate (GFE) (Correct answer)
- Advanced Beneficiary Notice (ABN)
- Notice of Privacy Practices (NPP)
Correct answer: Good Faith Estimate (GFE)
The No Surprises Act requires providers to give uninsured and self-pay patients a Good Faith Estimate of expected charges before scheduled services.
CRCR Healthcare Compliance and Regulations 3
A revenue cycle staff member accesses a celebrity patient's record out of curiosity without a treatment need.
Which HIPAA rule is violated?