CTP Cheat Sheet 2026

The 30 highest-yield CTP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. When using remote patient monitoring (RPM) devices as part of a virtual clinical assessment, the provider should PRIMARILY ensure: → Patient has been trained on correct device use and data is transmitted securely
2. A telehealth provider using a third-party video platform must ensure the vendor signs which type of agreement under HIPAA? → A Business Associate Agreement (BAA)
3. Which chronic condition is most frequently managed through RPM programs due to daily weight monitoring needs? → Congestive heart failure
4. Which of the following BEST describes 'data at rest' in a telehealth environment? → ePHI stored on servers, databases, or backup media when not actively in use
5. Which factor most distinguishes remote crisis management from in-person crisis management? → Reduced ability to directly control the client's environment
6. Remote Patient Monitoring (RPM) setup and patient education on device use is billed using which CPT code? → 99453
7. What is the role of a 'middleware' layer in a telehealth technology stack? → It connects and enables communication between disparate software systems
8. Which of the following is an example of a HIPAA minimum necessary standard violation in telehealth? → A billing coordinator accessing full psychiatric notes to process a payment
9. What is a primary security concern specific to RPM devices and their data transmission? → Unauthorized access to transmitted patient health data through unsecured networks
10. In a remote setting, a 'warm handoff' during a mental health crisis refers to: → A direct, real-time introduction of the client to the crisis resource provider
11. When a telehealth visit is conducted across state lines, which state's billing regulations typically govern the claim submission? → The state where the patient is located
12. A post-surgical patient sends daily wound photos through a secure patient portal for nurse review. This most closely represents: → Asynchronous store-and-forward wound care monitoring
13. How can rapport be built virtually? → Active listening
14. What type of consent is required before enrolling a patient in an RPM program? → Written informed consent explaining RPM benefits, risks, and data use
15. Patient-reported outcomes (PROs) improve engagement in telehealth PRIMARILY because they: → Give patients a structured way to communicate symptoms and track progress over time
16. Which encryption standard is most commonly required for video conferencing platforms used in telehealth to ensure HIPAA compliance? → AES-256
17. Which protocol ensures encrypted communication? → SSL/TLS
18. Which minimum upload speed is commonly recommended for conducting a stable, high-definition telehealth video session? → 5 Mbps
19. Under Medicare rules, what is the role of the 'originating site' in telehealth billing? → It is the patient's physical location during the telehealth visit
20. Which law specifically prohibits healthcare providers from offering remuneration to induce patient referrals for federally reimbursed services? → Anti-Kickback Statute (AKS)
21. As part of the informed consent process for telehealth, what must a practitioner clearly explain to the patient regarding digital privacy? → That absolute confidentiality of electronic communications cannot be guaranteed.
22. Which of the following scenarios would most likely result in a telehealth claim denial due to place of service (POS) code error? → Using POS 02 for a video visit to a patient in a hospital outpatient clinic
23. What is the recommended approach when a telehealth provider cannot adequately assess a patient's condition via video? → Refer the patient for in-person evaluation and document the clinical rationale
24. A patient with poor health literacy is struggling to understand discharge instructions delivered via telehealth. Which technique should the provider use? → Use the teach-back method to confirm patient understanding during the video visit
25. Under HIPAA, how long must a covered entity retain documentation of its security policies and procedures? → 6 years from creation or last effective date
26. Which encryption standard is currently recommended by NIST for protecting electronic protected health information (ePHI) in transit? → TLS 1.2 or higher
27. For a telehealth program targeting elderly patients, which strategy MOST effectively addresses technology barriers? → Provide a dedicated tech-support helpline and offer caregiver-assisted onboarding
28. Under the Ryan Haight Online Pharmacy Consumer Protection Act, what is generally required before prescribing controlled substances via telehealth? → At least one in-person medical evaluation
29. Which legislation expanded Medicare telehealth originating sites to include federally qualified health centers (FQHCs) and rural health clinics (RHCs)? → Bipartisan Budget Act of 2018
30. The primary purpose of an emergency contact on file for telehealth clients is to: → Provide an alternative contact during a safety emergency