Medical Billing Software Risk Assessment & Management 4

Question 1

A medical practice's billing software vendor is acquired by a competitor. What risk management step should the practice take immediately?

Accepted Answer

Review the existing BAA and contract for change-of-control clauses and data portability rights

Answer

Change-of-control clauses determine whether the BAA and service terms survive an acquisition and whether the practice can exit the contract.

Question 2

Which of the following is a key indicator of potential upcoding risk in a billing software audit report?

Accepted Answer

A provider's E&M code distribution that is heavily skewed toward level 4 and 5 codes compared to peers

Answer

Bell-curve outliers in E&M code distribution—particularly clustering at higher complexity levels—are a primary red flag for upcoding.

Question 3

What is the purpose of a 'segregation of duties' control in medical billing?

Accepted Answer

To ensure no single employee can both post payments and adjust account balances, reducing embezzlement risk

Answer

Segregation of duties prevents fraud by requiring different individuals to perform authorization, recording, and custody functions.

Question 4

A practice experiences ransomware that encrypts its billing system. According to HIPAA, when must HHS be notified if 600 patients' ePHI is affected?

Accepted Answer

Within 60 days of discovering the breach

Answer

HIPAA Breach Notification Rule requires notification to HHS within 60 days of discovery for breaches affecting fewer than 500 individuals in a state.

Question 5

A risk assessment reveals that the billing software stores credit card numbers in plain text. Which control addresses this risk most directly?

Accepted Answer

Implementing tokenization or encryption for stored cardholder data to meet PCI DSS requirements

Answer

PCI DSS prohibits storing sensitive cardholder data in plain text; tokenization replaces card numbers with non-sensitive tokens.

Medical Billing Software Practice Test