CBCS - Certified Billing and Coding Specialist Regulatory Compliance and HIPAA Questions and Answers

Question 1

A billing specialist notices a pattern of a specific provider consistently using a higher-level evaluation and management (E/M) code for routine office visits, which is not supported by the medical documentation. Under which federal law could this practice be considered fraudulent?

Accepted Answer

The False Claims Act (FCA)

Answer

The False Claims Act (FCA) makes it illegal to knowingly submit false or fraudulent claims to a government healthcare program. Consistently billing at a higher code level than what is supported by the documentation, a practice known as 'upcoding,' is a classic example of a false claim because it seeks reimbursement for services that were not medically necessary at that level or not actually performed to that extent.

Question 2

A business associate of a covered entity discovers a breach of unsecured protected health information (PHI) affecting 600 individuals. According to the HIPAA Breach Notification Rule, what is the business associate's primary and most immediate responsibility?

Accepted Answer

Notify the covered entity of the breach without unreasonable delay.

Answer

The HIPAA Breach Notification Rule requires a business associate to notify the covered entity after discovering a breach of unsecured PHI. This notification must happen 'without unreasonable delay and in no case later than 60 days' following the discovery. It is then the covered entity's responsibility to notify the affected individuals, HHS, and potentially the media.

Question 3

Which of the following is an example of a 'technical safeguard' under the HIPAA Security Rule?

Accepted Answer

Implementing unique user IDs and password requirements for EHR access.

Answer

The HIPAA Security Rule mandates three types of safeguards: administrative, physical, and technical. Technical safeguards are technology-based and relate to the policies and procedures for its use that protect electronic PHI (ePHI) and control access to it. Implementing unique user IDs, passwords, and other access controls is a core requirement of the technical safeguards.

Question 4

A hospital owns a diagnostic imaging center. A physician employed by the hospital routinely refers their Medicare patients to this imaging center for services. This arrangement could potentially violate which of the following laws if no exception is met?

Accepted Answer

The Stark Law

Answer

The Stark Law, also known as the Physician Self-Referral Law, prohibits physicians from referring Medicare or Medicaid patients for 'designated health services' (DHS) to an entity with which the physician or an immediate family member has a financial relationship, unless an exception applies. In this scenario, the physician has a financial relationship (employment) with the hospital, which owns the imaging center (a provider of DHS).

Question 5

A patient's friend calls the billing office to ask about the details of a recent bill. The billing specialist, wanting to be helpful, confirms the patient's recent surgery date and the outstanding balance. This action is a violation of which HIPAA principle?

Accepted Answer

The Minimum Necessary Standard

Answer

The HIPAA Privacy Rule establishes the principle of 'minimum necessary,' which requires covered entities to make reasonable efforts to limit the use or disclosure of Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose. Disclosing details of a patient's bill and surgery to an unauthorized individual, like a friend, without the patient's explicit consent is a violation of their privacy and goes against this standard.

(CBCS) Certified Billing and Coding Specialist Practice Test

(CBCS) Certified Billing and Coding Specialist Practice Test

CBCS - Certified Billing and Coding Specialist Regulatory Compliance and HIPAA Questions and Answers