Hardest CPC Practice Questions — Can You Answer These?

The Covered Entity (CE) is ultimately responsible for the notification to HHS and the patients. However, the Business Associate (BA) is required to notify the CE of the breach without unreasonable delay and no later than 60 days after discovery. Clinical Pearl: While BAs are directly liable for HIPAA Security Rule violations, the CE retains the primary duty to report to HHS for breaches of their patient data unless the BAA states the BA will handle all notifications. CPC Exam Tip: Distinguish between the BA's duty to report to the CE and the CE's duty to report to HHS/Patients.

Without unreasonable delay and no later than 60 days following the discovery of the breach. For breaches involving 500 or more individuals, the media must also be notified in the affected jurisdiction. Key Thresholds: - Fewer than 500: Log breaches and report to HHS annually (within 60 days of the end of the calendar year). - 500 or more: Report within 60 days to HHS, affected individuals, and prominent media outlets. CPC Exam Strategy: 500 is the magic number for immediate HHS notification and media involvement.

Required specifications must be implemented as written. Addressable specifications allow the entity to: 1. Implement the standard as written, 2. Implement an equivalent alternative, OR 3. Not implement it if it is not reasonable/appropriate (must document why and how the risk is otherwise mitigated). Crucial Point: Addressable does NOT mean Optional. You cannot simply ignore an addressable specification; you must perform a risk assessment and document the decision. CPC Exam Tip: AAPC often tests the misconception that addressable means you can skip the rule if it costs too much.

No. This falls under the TPO exception (Treatment, Payment, and Healthcare Operations). Providers can share PHI for treatment purposes without a specific patient authorization. TPO Definitions: - Treatment: Provision, coordination, or management of care. - Payment: Activities to obtain premiums or reimbursement (e.g., billing, eligibility checks). - Operations: Quality assessment, case management, and business planning. CPC Exam Tip: Most daily coding and clinical tasks fall under TPO and do not require separate patient consent. However, Marketing and Psychotherapy notes usually require specific authorization.

Technical Safeguards. This category includes Access Control, Audit Controls, Integrity, Person/Entity Authentication, and Transmission Security. Audit Controls (Required): Implementation of hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. CPC Exam Strategy: If the question involves software logs, tracking logins, monitoring system activity, or who accessed what and when, the answer is Technical Safeguards > Audit Controls. Don't confuse this with Administrative risk analysis.