CPC Regulations Flashcards: 50 Practice Questions & Answers

The HIPAA Privacy Rule covers PHI in all forms (oral, paper, and electronic). The HIPAA Security Rule is a subset that applies specifically to ePHI (electronic Protected Health Information). CPC Tip: AAPC often tests the distinction between the broad scope of Privacy (rights/use) and the technical scope of Security (electronic protection). Remember: Privacy = Who and What (access rights/usage standards), Security = How (specific electronic safeguards).

The Minimum Necessary Standard. It requires covered entities to take reasonable steps to limit the use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose. EXCEPTIONS: Disclosures to a healthcare provider for treatment, disclosures to the patient, or disclosures required by law (e.g., a court order). CPC Exam Strategy: Look for scenarios where a payer or lawyer asks for a full chart; if the request isn't for treatment, only the specific requested/relevant parts should be sent. Sending the entire record when only one date of service was requested is a Privacy Rule violation.

30 days. Under the Privacy Rule, a covered entity must act on a request for access within 30 days. A one-time 30-day extension is permitted if the patient is provided with a written statement of the reasons for the delay. Note: State laws may be stricter (e.g., 15 days). If state law is more stringent, it supersedes HIPAA. CPC Exam Tip: AAPC frequently asks about the 30-day window and the single extension allowance. Also, remember that providers cannot deny access because the patient has an outstanding balance on their bill.

No. The Security Rule is technology neutral. While encryption is an Addressable implementation specification, the rule does not mandate a specific brand or type of software. The entity must implement a mechanism to encrypt and decrypt ePHI if it is a reasonable and appropriate safeguard. CPC Exam Strategy: Beware of distractors suggesting HIPAA mandates specific software like Microsoft BitLocker or AES-256. It only mandates the standard of protection, not the brand. If encryption isn't used, the entity must document why and implement an equivalent alternative.

Physical Safeguards. These are physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion. Three Security Safeguard Categories: 1. Administrative (Policies, Training, Risk Analysis) 2. Physical (Locks, Screen placement, Facility Access) 3. Technical (Passwords, Encryption, Audit Logs) CPC Exam Tip: Screen positioning, badge access, and workstation security are classic examples of Physical Safeguards.