Home
MedFlashCard
Sign InUnlock Full Access

CPC: 1041 Online Flashcards

1041 Flashcards14 Categories

CPC (Certified Professional Coder) exam prep: 1041 question-and-answer flashcards covering procedures, coding guidelines, pathology. Try 30 free below — no sign-up required.

Browse Categories

Try 30 free CPC cards

Sample cards from across the deck — judge the quality before you pay anything.

Saved on this device

30

Total Cards

0

Studied

0

Due Now

0

Need Review

0

Mastered (21+ days)

1
📚 regulationsmedium

Which HIPAA rule applies to Protected Health Information (PHI) in all forms (oral, paper, and electronic), and which specifically governs electronic Protected Health Information (ePHI)?

#regulations#hipaa
Tap to see answer
Card #1
Answer
The HIPAA Privacy Rule covers PHI in all forms (oral, paper, and electronic). The HIPAA Security Rule is a subset that applies specifically to ePHI (electronic Protected Health Information). CPC Tip: AAPC often tests the distinction between the broad scope of Privacy (rights/use) and the technical scope of Security (electronic protection). Remember: Privacy = Who and What (access rights/usage standards), Security = How (specific electronic safeguards).
Tap to see question
Card #1
2
📚 regulationsmedium

Under the Privacy Rule, a coder is reviewing a chart for a worker's compensation claim. What standard dictates that only the information relevant to the claim should be disclosed?

#regulations#hipaa
Tap to see answer
Card #2
Answer
The Minimum Necessary Standard. It requires covered entities to take reasonable steps to limit the use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose. EXCEPTIONS: Disclosures to a healthcare provider for treatment, disclosures to the patient, or disclosures required by law (e.g., a court order). CPC Exam Strategy: Look for scenarios where a payer or lawyer asks for a full chart; if the request isn't for treatment, only the specific requested/relevant parts should be sent. Sending the entire record when only one date of service was requested is a Privacy Rule violation.
Tap to see question
Card #2
3
📚 regulationsmedium

A patient requests a copy of their medical records. Under the HIPAA Privacy Rule, what is the maximum timeframe a covered entity has to provide this access?

#regulations#hipaa
Tap to see answer
Card #3
Answer
30 days. Under the Privacy Rule, a covered entity must act on a request for access within 30 days. A one-time 30-day extension is permitted if the patient is provided with a written statement of the reasons for the delay. Note: State laws may be stricter (e.g., 15 days). If state law is more stringent, it supersedes HIPAA. CPC Exam Tip: AAPC frequently asks about the 30-day window and the single extension allowance. Also, remember that providers cannot deny access because the patient has an outstanding balance on their bill.
Tap to see question
Card #3
4
📚 regulationsmedium

Does the HIPAA Security Rule require a specific type of encryption technology for all ePHI stored on a coder's laptop?

#regulations#hipaa
Tap to see answer
Card #4
Answer
No. The Security Rule is technology neutral. While encryption is an Addressable implementation specification, the rule does not mandate a specific brand or type of software. The entity must implement a mechanism to encrypt and decrypt ePHI if it is a reasonable and appropriate safeguard. CPC Exam Strategy: Beware of distractors suggesting HIPAA mandates specific software like Microsoft BitLocker or AES-256. It only mandates the standard of protection, not the brand. If encryption isn't used, the entity must document why and implement an equivalent alternative.
Tap to see question
Card #4
5
📚 regulationsmedium

A clinic implements a policy requiring all computer monitors to be positioned away from public view. This is an example of which type of safeguard under the Security Rule?

#regulations#hipaa
Tap to see answer
Card #5
Answer
Physical Safeguards. These are physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion. Three Security Safeguard Categories: 1. Administrative (Policies, Training, Risk Analysis) 2. Physical (Locks, Screen placement, Facility Access) 3. Technical (Passwords, Encryption, Audit Logs) CPC Exam Tip: Screen positioning, badge access, and workstation security are classic examples of Physical Safeguards.
Tap to see question
Card #5
6
📚 regulationshard

A coding consultant (Business Associate) accidentally sends ePHI to the wrong client. Under current HIPAA standards, who is primarily responsible for notifying the Department of Health and Human Services (HHS)?

#regulations#hipaa
Tap to see answer
Card #6
Answer
The Covered Entity (CE) is ultimately responsible for the notification to HHS and the patients. However, the Business Associate (BA) is required to notify the CE of the breach without unreasonable delay and no later than 60 days after discovery. Clinical Pearl: While BAs are directly liable for HIPAA Security Rule violations, the CE retains the primary duty to report to HHS for breaches of their patient data unless the BAA states the BA will handle all notifications. CPC Exam Tip: Distinguish between the BA's duty to report to the CE and the CE's duty to report to HHS/Patients.
Tap to see question
Card #6
7
📚 regulationshard

A covered entity discovers a breach affecting 501 individuals. According to the Breach Notification Rule, what is the deadline for notifying the Secretary of HHS and the media?

#regulations#hipaa
Tap to see answer
Card #7
Answer
Without unreasonable delay and no later than 60 days following the discovery of the breach. For breaches involving 500 or more individuals, the media must also be notified in the affected jurisdiction. Key Thresholds: - Fewer than 500: Log breaches and report to HHS annually (within 60 days of the end of the calendar year). - 500 or more: Report within 60 days to HHS, affected individuals, and prominent media outlets. CPC Exam Strategy: 500 is the magic number for immediate HHS notification and media involvement.
Tap to see question
Card #7
8
📚 regulationshard

In the context of the HIPAA Security Rule, differentiate between \Required\ and \Addressable\ implementation specifications.

#regulations#hipaa
Tap to see answer
Card #8
Answer
Required specifications must be implemented as written. Addressable specifications allow the entity to: 1. Implement the standard as written, 2. Implement an equivalent alternative, OR 3. Not implement it if it is not reasonable/appropriate (must document why and how the risk is otherwise mitigated). Crucial Point: Addressable does NOT mean Optional. You cannot simply ignore an addressable specification; you must perform a risk assessment and document the decision. CPC Exam Tip: AAPC often tests the misconception that addressable means you can skip the rule if it costs too much.
Tap to see question
Card #8
9
📚 regulationshard

A provider discusses a patient's diagnosis with a specialist for a referral without a specific signed authorization. Does this violate the HIPAA Privacy Rule?

#regulations#hipaa
Tap to see answer
Card #9
Answer
No. This falls under the TPO exception (Treatment, Payment, and Healthcare Operations). Providers can share PHI for treatment purposes without a specific patient authorization. TPO Definitions: - Treatment: Provision, coordination, or management of care. - Payment: Activities to obtain premiums or reimbursement (e.g., billing, eligibility checks). - Operations: Quality assessment, case management, and business planning. CPC Exam Tip: Most daily coding and clinical tasks fall under TPO and do not require separate patient consent. However, Marketing and Psychotherapy notes usually require specific authorization.
Tap to see question
Card #9
10
📚 regulationshard

An IT contractor performs a vulnerability scan on a hospital's server. Which specific safeguard category of the Security Rule requires the implementation of \Audit Controls\?

#regulations#hipaa
Tap to see answer
Card #10
Answer
Technical Safeguards. This category includes Access Control, Audit Controls, Integrity, Person/Entity Authentication, and Transmission Security. Audit Controls (Required): Implementation of hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. CPC Exam Strategy: If the question involves software logs, tracking logins, monitoring system activity, or who accessed what and when, the answer is Technical Safeguards > Audit Controls. Don't confuse this with Administrative risk analysis.
Tap to see question
Card #10
11
📚 regulationsmedium

A medical coder is reviewing a chart for an encounter and accesses the patient's entire history, including unrelated psychiatric notes, to ensure complete coding. Does this violate HIPAA?

#hipaa#phi#compliance
Tap to see answer
Card #11
Answer
Yes. Under the Minimum Necessary standard, covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose. While providers have broader access for treatment, administrative functions like coding and billing must be limited to the specific data needed for the task. AAPC Exam Tip: The Minimum Necessary rule does NOT apply to disclosures for treatment purposes, but it DOES apply to payment and healthcare operations (like coding). Avoid accessing psychotherapy notes unless specifically required for the encounter being coded.
Tap to see question
Card #11
12
📚 regulationsmedium

Under the HIPAA Privacy Rule, which of the following scenarios allows for the disclosure of PHI WITHOUT a patient's written authorization?

A)Marketing a new drug
B)Research purposes
C)Treatment, Payment, and Healthcare Operations (TPO)
D)Employer requests for life insurance.
#hipaa#tpo#phi
Tap to see answer
Card #12
Answer
C) Treatment, Payment, and Healthcare Operations (TPO). HIPAA allows the use and disclosure of PHI for TPO without specific patient authorization. Treatment includes coordination of care; Payment includes billing and eligibility; Operations include quality improvement and legal services. Exam Strategy: Distinguish between Authorization (required for non-routine uses like marketing) and Consent (which many facilities obtain for TPO, though not strictly required by federal law).
Tap to see question
Card #12
13
📚 regulationsmedium

To de-identify a patient record under the HIPAA Safe Harbor method, how many specific identifiers must be removed?

#hipaa#de-identification
Tap to see answer
Card #13
Answer
18. To meet the Safe Harbor method of de-identification, 18 specific identifiers must be removed, including names, all geographic subdivisions smaller than a state (with some zip code exceptions), all elements of dates (except year) directly related to an individual, phone numbers, and SSNs. Clinical Pearl: Once data is de-identified, it is no longer considered PHI and is not subject to HIPAA Privacy Rule protections. AAPC often tests the distinction between PHI and de-identified data.
Tap to see question
Card #13
14
📚 regulationsmedium

A third-party company is hired by a clinic to provide medical coding and auditing services. Under HIPAA, what must be in place before they can access PHI?

#hipaa#baa#compliance
Tap to see answer
Card #14
Answer
A Business Associate Agreement (BAA). A Business Associate (BA) is a person or entity that performs functions on behalf of a covered entity involving the use or disclosure of PHI. The BAA is a contract that requires the BA to appropriately safeguard the PHI. Note: Employees of a covered entity are NOT business associates; they are part of the workforce. Coder Tip: Always verify if a vendor has a BAA on file before transmitting patient data for external audits.
Tap to see question
Card #14
15
📚 regulationsmedium

A patient requests to see their medical record but the provider believes certain notes might be harmful to the patient's mental health. Can the provider deny access?

#hipaa#patient-rights
Tap to see answer
Card #15
Answer
Yes, but only under limited circumstances. The Privacy Rule allows a provider to deny access if a licensed healthcare professional determines that access is reasonably likely to endanger the life or physical safety of the individual or another person. Clinical Pearl: Note that a reviewable denial allows the patient to have the decision reviewed by another licensed professional. AAPC focuses on patient rights; remember that patients generally have the right to inspect and obtain a copy of their PHI within 30 days.
Tap to see question
Card #15
16
📚 regulationshard

A clinic discovers a breach of unsecured PHI affecting 550 patients. According to the HITECH Act, what is the maximum timeframe for notifying the Department of Health and Human Services (HHS)?

#hitech#breach#compliance
Tap to see answer
Card #16
Answer
No later than 60 days after the discovery of the breach. For breaches involving 500 or more individuals, the covered entity must notify the Secretary of HHS, the affected individuals, and prominent media outlets. If the breach affects fewer than 500 individuals, the entity may maintain a log and notify HHS annually. Exam Strategy: 60 days is the absolute deadline for large breaches; without unreasonable delay is the general standard for all notifications.
Tap to see question
Card #16
17
📚 regulationshard

A coder accidentally leaves a printed claim form containing PHI on a shared printer for 10 minutes. Another employee sees it but does not read it. Is this a HIPAA violation?

#hipaa#incidental-disclosure
Tap to see answer
Card #17
Answer
This is likely considered an Incidental Disclosure. The Privacy Rule is not violated if the covered entity has implemented reasonable safeguards and the Minimum Necessary standard, and the disclosure is a byproduct of an otherwise permitted use. However, if the coder frequently leaves PHI in public areas, it becomes a failure to implement Reasonable Safeguards. Exam Tip: Distinguish between Incidental (unintentional/accidental despite safeguards) and Non-compliant (systemic failure to protect data).
Tap to see question
Card #17
18
📚 regulationshard

The 21st Century Cures Act introduced regulations regarding Information Blocking. How does this affect a coder's handling of PHI requests?

#cures-act#information-blocking
Tap to see answer
Card #18
Answer
Information blocking is a practice likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI). Coders must ensure that HIPAA privacy protections are not used as a pretext to improperly withhold information that a patient or another provider is legally entitled to receive. Exam Highlight: While HIPAA protects privacy, the Cures Act mandates interoperability. Coders must balance Minimum Necessary with the requirement to not block legal access to EHI.
Tap to see question
Card #18
19
📚 regulationshard

A medical office receives a subpoena for a patient's records signed by an attorney. No court order or patient authorization is attached. What is the correct HIPAA-compliant response?

#hipaa#legal#phi
Tap to see answer
Card #19
Answer
The office cannot release the records immediately. Under HIPAA, a subpoena signed by an attorney (not a judge) requires the covered entity to receive satisfactory assurance that the requesting party made a good faith attempt to notify the patient or sought a qualified protective order. Clinical Pearl: A court order signed by a judge must be complied with immediately; an attorney's subpoena requires additional procedural steps to protect patient privacy before release.
Tap to see question
Card #19
20
📚 regulationshard

A pharmaceutical company offers a clinic a per-transfer fee to provide a list of patients with asthma for a new inhaler marketing campaign. Is this permitted?

#hipaa#marketing#compliance
Tap to see answer
Card #20
Answer
No, not without specific patient authorization. HIPAA requires a covered entity to obtain a valid authorization for any use or disclosure of PHI for marketing that involves financial remuneration from a third party. Marketing is defined as a communication about a product or service that encourages recipients to purchase or use it. Exam Tip: If the provider is paid to send the communication, it almost always requires a signed patient authorization, regardless of the clinical relevance.
Tap to see question
Card #20
21
📚 regulationsmedium

Under the False Claims Act (FCA), which level of intent is required for a provider to be held liable for submitting incorrect claims to Medicare?

#regulations#fca
Tap to see answer
Card #21
Answer
The FCA does not require specific intent to defraud. Liability is triggered if a person acts knowingly, which includes: 1) Actual knowledge, 2) Deliberate ignorance of the truth/falsity, or 3) Reckless disregard of the truth/falsity. Simple negligence or honest mistakes are generally excluded. Exam Tip: AAPC often tests the reckless disregard standard, such as a provider failing to check NCCI edits despite being aware they exist.
Tap to see question
Card #21
22
📚 regulationsmedium

A medical coder files a lawsuit on behalf of the federal government regarding a systemic upcoding scheme at a hospital. What is the legal term for this type of whistleblower provision?

#regulations#fca
Tap to see answer
Card #22
Answer
The provision is called Qui Tam (Latin for he who as much for the king as for himself). The person bringing the suit is known as the Relator. If the government recovers funds, the Relator typically receives between 15% and 30% of the recovery. Exam Tip: Be prepared to identify Relator as the specific term for the whistleblower in an FCA context.
Tap to see question
Card #22
23
📚 regulationsmedium

A practice identifies a Medicare overpayment of $50,000. Under the 60-day rule, what happens if they fail to return the funds within 60 days of identification?

#regulations#fca
Tap to see answer
Card #23
Answer
Failure to report and return an overpayment within 60 days of identification creates liability under the Reverse False Claims provision of the FCA. The 60-day clock begins when the provider has, or should have through reasonable diligence, identified the overpayment. Exam Tip: This is a high-yield topic; the retention of money the government is owed is just as actionable as the initial false claim.
Tap to see question
Card #23
24
📚 regulationsmedium

What are the primary financial penalties mandated for a violation of the False Claims Act, excluding the per-claim civil monetary penalty?

#regulations#fca
Tap to see answer
Card #24
Answer
The FCA mandates treble damages, which is three times (3x) the amount of the government's loss. In addition to treble damages, there are mandatory per-claim civil penalties that are adjusted annually for inflation (exceeding $13,000-$27,000 per claim by 2024-2026). Exam Tip: AAPC focuses on Treble as the multiplier for damages sustained by the government.
Tap to see question
Card #24
25
📚 regulationsmedium

A billing company knowingly submits claims for Incident To services that do not meet physician supervision requirements. Who can be held liable under the FCA?

#regulations#fca
Tap to see answer
Card #25
Answer
Both the billing company and the provider/entity can be held liable. The FCA applies to any person who knowingly presents, or causes to be presented a false claim. If a billing company ignores clear evidence of non-compliance, they cause the false claim to be presented. Exam Tip: Liability is broad and extends to anyone in the revenue cycle chain who acts with reckless disregard.
Tap to see question
Card #25
26
📚 regulationshard

How does a violation of the Anti-Kickback Statute (AKS) impact a provider's liability under the False Claims Act (FCA)?

#regulations#fca#aks
Tap to see answer
Card #26
Answer
A claim that includes items or services resulting from a violation of the Anti-Kickback Statute (AKS) constitutes a false or fraudulent claim for purposes of the FCA. This is true even if the service provided was medically necessary and coded correctly. Exam Tip: Look for scenarios where a kickback or referral fee exists; this automatically taints the claim, making it an FCA violation when submitted to Medicare/Medicaid.
Tap to see question
Card #26
27
📚 regulationshard

In the context of the FCA, what does the Materiality standard (as clarified by the Supreme Court in the Escobar case) require for a claim to be fraudulent?

#regulations#fca
Tap to see answer
Card #27
Answer
Materiality means the misrepresentation must have a natural tendency to influence, or be capable of influencing, the payment of money by the government. If the government consistently pays a claim despite knowing a specific requirement was violated, that requirement might not be considered material to the payment decision. Exam Tip: Not every minor regulatory breach is an FCA violation; the lie must be significant enough to affect the government's decision to pay.
Tap to see question
Card #27
28
📚 regulationshard

A coder is terminated after reporting fraudulent Medicare billing to the OIG. Under FCA Section 3730(h), what specific financial remedy is provided for back pay?

#regulations#fca
Tap to see answer
Card #28
Answer
The whistleblower (Relator) is entitled to two times the amount of back pay plus interest. Other remedies include reinstatement at the same seniority level and compensation for special damages, including litigation costs and reasonable attorneys' fees. Exam Tip: Distinguish between the Treble Damages for the government's loss and Double Back Pay for the whistleblower's retaliation protection.
Tap to see question
Card #28
29
📚 regulationshard

A physician group is audited and told their E/M leveling is consistently too high. They ignore the audit and continue the same patterns. Which FCA knowledge standard is most likely met?

#regulations#fca
Tap to see answer
Card #29
Answer
Reckless Disregard. By ignoring internal or external audit findings that identify specific errors, the group has demonstrated a reckless disregard for the truth or falsity of their claims. This is sufficient for FCA liability even if they did not have a specific plan to steal from Medicare. Exam Tip: Reckless disregard is the middle ground between negligence (accident) and actual knowledge (intent).
Tap to see question
Card #29
30
📚 regulationshard

Which of the following scenarios best illustrates a Reverse False Claim under the LATEST FCA guidelines?

#regulations#fca
Tap to see answer
Card #30
Answer
A provider performs an internal audit, identifies a $10,000 overpayment due to unbundling, but decides to keep the money to offset other underpaid claims. By intentionally failing to return the identified overpayment within 60 days, the provider has violated the Reverse False Claims provision. Exam Tip: AAPC tests this to ensure coders understand that keeping money you aren't entitled to is legally equivalent to taking it via a false claim.
Tap to see question
Card #30

Liked the free cards?

Get all 1,041 CPC flashcards

Try free first. Pay once only if it helps you study.

Free — what you have now

  • 30 CPC sample cards
  • Spaced-repetition reviews — On the free cards
  • Study by topic (14 categories) — Topics visible, locked
  • Study offline — Free cards you've opened
  • Progress saved — On this device
  • Due, need-review and mastered counts — On the free cards
  • Review, focus and grid modes, shuffle, bookmarks, keyboard shortcuts
  • Lifetime access + free content updates
$7 once

Full deck

  • All 1,041 CPC flashcards
  • Spaced-repetition reviews — Every card comes back right before you would forget it
  • Study by topic (14 categories) — Every topic unlocked
  • Study offline — The whole deck, after opening it once online
  • Progress saved — Synced to your account on every device
  • Due, need-review and mastered counts — Across the whole deck
  • Review, focus and grid modes, shuffle, bookmarks, keyboard shortcuts
  • Lifetime access + free content updates — One payment, no subscription
Unlock all 1,041 cards — $7

One-time payment · less than 1¢ per card · 30-day money-back guarantee

  1. 1

    Create a free account

    Email or Google — about 30 seconds.

  2. 2

    Pay $7 once

    PayPal, or any debit/credit card through PayPal.

  3. 3

    Start studying instantly

    The full deck unlocks the moment payment completes.

Is this a subscription?

No. It is one payment of $7 for lifetime access to this deck. Nothing renews.

What if it does not help me?

You are covered by a 30-day money-back guarantee — email care@drcertifications.com and you get a full refund, no questions asked.

Do I need a PayPal account?

No. PayPal checkout also accepts debit and credit cards without an account.

Why do I need an account?

So your purchase and your progress belong to you and follow you to any device.

Secure PayPal checkout 30-day refund No subscription

About This Collection

In my years mentoring healthcare professionals through certification exams, I have found that the difference between passing and failing often comes down to the systematic depth of preparation. The CPC exam is rigorous, requiring not just memorization but a fundamental shift in how you process clinical data. I have compiled this comprehensive collection of 1,041 flashcards to guide you through that transition with the thoroughness this credential demands. When I look at the scope of materials we need to cover, from complex regulations and RBRVS to specific coding guidelines, it becomes clear that surface-level review is insufficient. I designed this full collection to ensure no topic is left to chance. We go deep into the nuances of evaluation and management levels, data management, and the specific rules that govern accurate reimbursement. I have seen too many capable colleagues struggle because they underestimated the specificity required in the regulatory sections or missed the subtle distinctions in modifier usage. As professionals, we have a strong foundation in anatomy, pathology, and pharmacology, but the CPC requires us to view these subjects through a different lens. In this study set, I focus on translating your existing clinical knowledge into the precise language of medical coding. We cover the essential terminology and diagnostic criteria that directly impact code selection. I emphasize the connection between clinical documentation and the resulting code, which is often the stumbling block for those with clinical backgrounds who are new to the administrative side. Success requires a disciplined, evidence-based approach. I always tell my students that consistency beats intensity. By working through these 1,041 cards systematically, you are engaging in active recall, which is the most effective way to solidify these complex rules in your long-term memory. I have structured the categories to allow you to isolate your weak points—whether that is anesthesia, radiology, or the musculoskeletal system—and turn them into strengths before exam day. Earning your CPC is a significant investment in your professional future, opening doors to auditing, compliance, and revenue cycle management. This collection represents the complete roadmap I recommend for achieving mastery. It is time to commit to the work, trust the process, and secure the knowledge you need to pass with confidence.