NHI Healthcare Regulations & Compliance 4 — Questions and Answers
Question 1: Which element is NOT required in a valid healthcare Advance Directive?
- Patient's signature
- Witness signatures or notarization
- Physician countersignature (Correct answer)
- Patient's stated healthcare wishes
Correct answer: Physician countersignature
Advance directives require patient signature and witness/notarization per state law, but a physician countersignature is not a standard legal requirement for validity.
Question 2: The Centers for Medicare & Medicaid Services (CMS) requires that hospitals implement a Corporate Compliance Program. Which of the following is a core element of such a program?
- Hiring only certified compliance officers
- Written policies, procedures, and standards of conduct (Correct answer)
- Annual external audits by the OIG
- Mandatory employee stock options
Correct answer: Written policies, procedures, and standards of conduct
The OIG's compliance program guidance identifies written standards of conduct, policies, and procedures as a foundational element of an effective corporate compliance program.
Question 3: Protected Health Information (PHI) under HIPAA includes which of the following when combined with health data?
- Patient's favorite color
- Patient's zip code (Correct answer)
- Generic disease statistics
- Anonymized research data
Correct answer: Patient's zip code
A patient's zip code combined with health information can constitute PHI if it could be used to identify the individual, especially in smaller geographic areas.
Question 4: Under the Health Information Technology for Economic and Clinical Health (HITECH) Act, which type of business associate agreement (BAA) provision became mandatory?
- Subcontractors of business associates must also comply with HIPAA (Correct answer)
- Business associates must purchase cyber liability insurance
- BAAs must be renewed annually
- Business associates must be US-based companies only
Correct answer: Subcontractors of business associates must also comply with HIPAA
HITECH extended HIPAA obligations directly to business associates and their subcontractors, requiring that downstream subcontractors also execute BAAs and comply with HIPAA.
Question 5: A medical assistant overhears a patient's diagnosis in the waiting room because the provider spoke too loudly. Under HIPAA, this is considered:
- A reportable breach requiring patient notification
- An incidental disclosure that is permissible if reasonable safeguards were in place (Correct answer)
- A willful neglect violation subject to maximum fines
- A criminal violation requiring law enforcement notification
Correct answer: An incidental disclosure that is permissible if reasonable safeguards were in place
HIPAA recognizes incidental disclosures as permissible when they occur despite reasonable safeguards and minimum necessary policies being in place.
Question 6: Which federal agency oversees the Drug Enforcement Administration (DEA) registration required for healthcare providers who prescribe controlled substances?
- Department of Health and Human Services
- Department of Justice (Correct answer)
- Food and Drug Administration
- Department of Homeland Security
Correct answer: Department of Justice
The DEA operates under the Department of Justice and administers the Controlled Substances Act, requiring providers who prescribe controlled substances to obtain DEA registration.
Question 7: The anti-kickback statute makes it illegal to offer, pay, solicit, or receive anything of value to induce or reward referrals of items or services covered by:
- Private insurance plans only
- Federal healthcare programs such as Medicare and Medicaid (Correct answer)
- Any insurance plan including commercial payers
- Only inpatient hospital services
Correct answer: Federal healthcare programs such as Medicare and Medicaid
The Anti-Kickback Statute (AKS) applies to federal healthcare programs including Medicare, Medicaid, CHIP, and TRICARE — not private payer arrangements.
NHI Healthcare Regulations & Compliance 4
Which element is NOT required in a valid healthcare Advance Directive?