I85PREP
⌘ K
ABA HALM study materials
ABA HALM study resources

ABA HALM practice questions

One question at a time. Build your ABA HALM understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Health Law Fundamentals and Regulatory Environment

Which federal statute is the primary law governing the privacy and security of protected health information held by most health care providers?

  1. The Emergency Medical Treatment and Labor Act
  2. The Health Insurance Portability and Accountability Act Correct answer.
  3. The Federal Food, Drug, and Cosmetic Act
  4. The Clinical Laboratory Improvement Amendments

Explanation

HIPAA, through its Privacy and Security Rules, sets national standards for protecting individually identifiable health information held by covered entities and their business associates. The other statutes address different subjects such as emergency care access, laboratory testing standards, and drug and device regulation.

Question 2Health Law Fundamentals and Regulatory Environment

Under HIPAA, which entity is a "covered entity"?

  1. A public library that stores community health pamphlets
  2. A software vendor that sells word-processing licenses to a clinic
  3. A patient advocacy nonprofit funded by donations
  4. A health plan that transmits health information electronically in connection with standard transactions Correct answer.

Explanation

Covered entities include health plans, health care clearinghouses, and health care providers that transmit health information electronically for transactions covered by HIPAA. The other organizations do not meet those statutory categories.

Question 3Health Law Fundamentals and Regulatory Environment

A hospital's billing contractor handles claims containing patient identifiers on the hospital's behalf. What is the contractor's most likely status under HIPAA?

  1. A covered entity
  2. A public health authority
  3. A research sponsor
  4. A business associate Correct answer.

Explanation

A business associate is a person or entity that performs functions or activities involving protected health information on behalf of a covered entity. Billing and claims processing are classic business associate functions requiring a written agreement.

Question 4Health Law Fundamentals and Regulatory Environment

Which term describes the minimum amount of information necessary to accomplish the intended purpose of a use or disclosure of protected health information?

  1. Minimum necessary Correct answer.
  2. De-identification
  3. Breach notification
  4. Accounting of disclosures

Explanation

The minimum necessary standard requires covered entities to make reasonable efforts to limit protected health information to the least amount needed for the purpose. De-identification, breach notification, and accounting of disclosures are separate HIPAA concepts.

Question 5Health Law Fundamentals and Regulatory Environment

Which federal law requires most hospitals with emergency departments to provide a medical screening examination and stabilizing treatment regardless of the patient's insurance status?

  1. HIPAA
  2. CLIA
  3. The Controlled Substances Act
  4. EMTALA Correct answer.

Explanation

The Emergency Medical Treatment and Labor Act obligates participating hospitals to screen and stabilize emergency medical conditions without regard to ability to pay. The other laws address privacy, laboratory quality, and controlled substance regulation.

Question 6Health Law Fundamentals and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following is generally required before a covered entity may use protected health information for marketing purposes?

  1. Publication in a local newspaper
  2. Written authorization from the individual Correct answer.
  3. A verbal acknowledgment from a family member
  4. Approval by the state medical board

Explanation

Uses and disclosures of protected health information for marketing generally require the individual's written authorization. Treatment, payment, and health care operations do not require authorization, but marketing falls outside those categories absent an exception.

Question 7Health Law Fundamentals and Regulatory Environment

Which of the following is a recognized individual right under the HIPAA Privacy Rule?

  1. The right to require a provider to alter a diagnosis in the medical record
  2. The right to request restrictions on certain uses and disclosures Correct answer.
  3. The right to demand deletion of all records held by any insurer
  4. The right to receive free genetic testing

Explanation

The Privacy Rule grants individuals rights including requesting restrictions, accessing their records, requesting amendments, and receiving an accounting of disclosures. Individuals cannot compel deletion of records or force changes to clinical findings.

Question 8Health Law Fundamentals and Regulatory Environment

A state enacts a law requiring stricter confidentiality protections for HIV status than HIPAA provides. How does this law generally interact with HIPAA?

  1. Both laws apply only to federal agencies
  2. The state law applies only to uninsured patients
  3. The state law is void because HIPAA preempts all state health privacy laws
  4. The stricter state law controls because HIPAA sets a floor, not a ceiling Correct answer.

Explanation

HIPAA generally preempts contrary state law unless the state law is more stringent or falls within an exception. Because HIPAA establishes minimum protections, more protective state provisions typically continue to apply.

Question 9Health Law Fundamentals and Regulatory Environment

A covered entity discovers that an unencrypted laptop containing protected health information was stolen and poses a significant risk of harm to affected individuals. What is the entity's obligation under the HIPAA Breach Notification Rule?

  1. Notify affected individuals without unreasonable delay and no later than 60 days after discovery Correct answer.
  2. Publish the incident solely on the entity's website
  3. Wait until the next annual report to disclose the incident
  4. Notify only the local police department

Explanation

The Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and within 60 days of discovery of a breach. Notification to regulators and possibly the media may also be required depending on the circumstances.

Question 10Health Law Fundamentals and Regulatory Environment

Which of the following best describes the HIPAA Security Rule's scope?

  1. It applies only to federal health care facilities
  2. It applies to all paper records and requires a single safeguard
  3. It applies to electronic protected health information and requires administrative, physical, and technical safeguards Correct answer.
  4. It applies only to information disclosed to researchers

Explanation

The Security Rule governs electronic protected health information and requires administrative, physical, and technical safeguards. The Privacy Rule covers protected health information in all forms, including paper and oral communications.

Question 11Health Law Fundamentals and Regulatory Environment

A clinician wants to disclose protected health information to a public health department to report a communicable disease. Which Privacy Rule provision most directly permits this?

  1. The public health activities permission Correct answer.
  2. The marketing authorization exception
  3. The psychotherapy notes authorization rule
  4. The minimum necessary prohibition

Explanation

The Privacy Rule expressly permits disclosures to public health authorities for activities such as disease reporting and surveillance. This permission operates without individual authorization.

Question 12Health Law Fundamentals and Regulatory Environment

Under CLIA, which statement best describes the regulatory framework?

  1. It governs the licensure of physicians
  2. It sets reimbursement rates for hospital outpatient visits
  3. It establishes quality standards and certification requirements for laboratories performing testing on human specimens Correct answer.
  4. It regulates the marketing of prescription drugs

Explanation

CLIA creates federal quality standards and certification requirements for laboratories that test human specimens for health assessment or diagnosis. It does not address reimbursement, physician licensure, or drug marketing.

Question 13Health Law Fundamentals and Regulatory Environment

A pharmaceutical manufacturer seeks to market a new prescription drug in the United States. Which federal agency's approval process generally applies?

  1. The Centers for Medicare & Medicaid Services
  2. The Drug Enforcement Administration
  3. The Food and Drug Administration Correct answer.
  4. The Occupational Safety and Health Administration

Explanation

The FDA administers the approval process for new drugs under the Food, Drug, and Cosmetic Act, including investigational and marketing application requirements. The other agencies address payment, controlled substances enforcement, and workplace safety.

Question 14Health Law Fundamentals and Regulatory Environment

A physician wants to prescribe a controlled substance. Which requirement is most directly imposed by the Controlled Substances Act?

  1. Accreditation by the Joint Commission
  2. Registration with the DEA Correct answer.
  3. Enrollment in a state immunization registry
  4. Certification by CLIA

Explanation

The Controlled Substances Act requires practitioners who dispense or prescribe controlled substances to register with the DEA. CLIA certification, Joint Commission accreditation, and registry enrollment serve unrelated purposes.

Question 15Health Law Fundamentals and Regulatory Environment

Which law requires employers and certain other entities to protect the confidentiality of substance use disorder treatment records and generally requires patient consent for disclosure?

  1. The Stark Law
  2. The False Claims Act
  3. The Anti-Kickback Statute
  4. 42 C.F.R. Part 2 regulations Correct answer.

Explanation

The federal confidentiality regulations at 42 C.F.R. Part 2 impose heightened protections on records of substance use disorder treatment and generally require patient consent for disclosure. The other laws address physician self-referral, remuneration for referrals, and fraud against federal programs.

Question 16Health Law Fundamentals and Regulatory Environment

A hospital employee accesses a celebrity patient's record out of curiosity without a treatment, payment, or operations purpose. This conduct most clearly violates which principle?

  1. The minimum necessary and permissible use requirements of the HIPAA Privacy Rule Correct answer.
  2. The EMTALA screening obligation
  3. The CLIA quality control standard
  4. The FDA advertising rule

Explanation

Accessing protected health information without a legitimate treatment, payment, or operations purpose exceeds permissible use and violates the minimum necessary and privacy protections. Curiosity access is a common example of an impermissible use.

Question 17Health Law Fundamentals and Regulatory Environment

Which of the following is the best example of protected health information?

  1. A billing statement that links a patient's name to a diagnosis code Correct answer.
  2. A published journal article reporting aggregate statistics
  3. An unmarked poster describing influenza symptoms generally
  4. A public health advisory with no individual identifiers

Explanation

Protected health information is individually identifiable health information transmitted or maintained in any form, such as a billing record linking a name to a diagnosis. General educational material and de-identified aggregate data are not protected health information.

Question 18Health Law Fundamentals and Regulatory Environment

A covered entity wants to use de-identified data for research. Which approach is consistent with the HIPAA de-identification standard?

  1. Removing only the patient's name
  2. Replacing names with initials only
  3. Removing the specified identifiers and obtaining a determination that re-identification risk is very small Correct answer.
  4. Encrypting the data while retaining all identifiers

Explanation

De-identification under HIPAA requires either removal of the enumerated identifiers with no actual knowledge of re-identifiability, or a statistical expert determination that the risk of re-identification is very small. Partial removal or encryption alone does not meet the standard.

Question 19Health Law Fundamentals and Regulatory Environment

A state requires physicians to report gunshot wounds to law enforcement. A physician treats a patient with a gunshot wound and is uncertain about disclosure under HIPAA. Which analysis is most accurate?

  1. HIPAA applies only to hospitals, so the physician has no obligations
  2. HIPAA forbids all disclosures to law enforcement without patient authorization
  3. HIPAA permits disclosures required by law, including mandatory reports to law enforcement Correct answer.
  4. HIPAA requires the physician to obtain a court order in every case

Explanation

The Privacy Rule permits uses and disclosures required by law, including mandatory reporting statutes such as certain wound reporting laws. Disclosures to law enforcement are also permitted in specified circumstances without authorization.

Question 20Health Law Fundamentals and Regulatory Environment

A health system uses a cloud vendor to store electronic protected health information. Which arrangement best reflects HIPAA compliance expectations?

  1. The health system is relieved of all Security Rule duties
  2. The vendor becomes a covered entity automatically
  3. A written business associate agreement with the vendor plus vendor safeguards consistent with the Security Rule Correct answer.
  4. No agreement is needed because the vendor never views the data

Explanation

A cloud vendor handling electronic protected health information on behalf of a covered entity is a business associate, requiring a written agreement and appropriate safeguards. The covered entity retains responsibility for compliance.

Question 21Health Law Fundamentals and Regulatory Environment

A covered entity experiences a breach involving more than 500 residents of a single state. Which additional notification is generally required?

  1. Notification to the entity's malpractice insurer only
  2. Notification to the state legislature only
  3. Notification to prominent media outlets serving that state without unreasonable delay and within 60 days Correct answer.
  4. Notification to every licensed physician in the country

Explanation

When a breach affects more than 500 residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving that area within 60 days of discovery. Notification to the Secretary of HHS is also required.

Question 22Health Law Fundamentals and Regulatory Environment

A researcher requests protected health information with a waiver of authorization. Which condition must generally be satisfied for an institutional review board or privacy board to grant the waiver?

  1. The information must be limited to billing records
  2. The research must be funded by the federal government
  3. The researcher must be employed by the covered entity
  4. The research could not practicably be conducted without the information and the waiver poses minimal privacy risk Correct answer.

Explanation

A waiver of authorization requires findings that the use or disclosure involves no more than minimal privacy risk, that the research could not practicably be conducted without the waiver, and that it could not practicably be conducted without the information. Funding source and employment are not conditions.

Question 23Health Law Fundamentals and Regulatory Environment

An individual asks a covered entity to restrict disclosure of protected health information to a health plan for a service paid out of pocket in full. How does the Privacy Rule generally treat this request?

  1. The covered entity must agree to the restriction when the disclosure is for payment or operations and the service was paid in full out of pocket Correct answer.
  2. The request is automatically void because individuals lack restriction rights
  3. The covered entity may always refuse any restriction request without exception
  4. The covered entity must obtain a court order to honor the request

Explanation

The Privacy Rule requires a covered entity to agree to a restriction request when the disclosure is to a health plan for payment or health care operations and the individual has paid in full out of pocket for the item or service. Other restriction requests are generally discretionary.

Question 24Health Law Fundamentals and Regulatory Environment

A laboratory performs testing on human specimens and wants to begin offering moderate-complexity tests. Which regulatory step is most relevant?

  1. Registering with the DEA
  2. Obtaining CLIA certification appropriate for the testing complexity Correct answer.
  3. Securing FDA approval of each test result report
  4. Obtaining a HIPAA marketing authorization

Explanation

CLIA requires laboratories to obtain a certificate consistent with the complexity of testing performed, with moderate- and high-complexity testing subject to additional requirements. DEA registration, FDA approval of reports, and marketing authorizations are unrelated.

Question 25Health Law Fundamentals and Regulatory Environment

A covered entity receives a subpoena for a patient's records in litigation but no court order or satisfactory assurances. Which response is generally most consistent with the Privacy Rule?

  1. Disclose the full record immediately because a subpoena always overrides HIPAA
  2. Disclose only to the patient's employer
  3. Refuse permanently and ignore the subpoena
  4. Seek satisfactory assurances that the requesting party has notified the patient or obtained a protective order before disclosing Correct answer.

Explanation

For judicial and administrative proceedings, the Privacy Rule permits disclosure in response to a subpoena only with satisfactory assurances that the individual has been notified or a qualified protective order exists, unless a court order is present. Disregarding the subpoena or disclosing without assurances is inappropriate.

Question 26Health Law Fundamentals and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following is an example of a permitted disclosure without patient authorization for treatment purposes?

  1. A hospital shares a patient's lab results with a consulting physician involved in the patient's care. Correct answer.
  2. A hospital uses patient information for a purpose unrelated to treatment, payment, or operations without authorization.
  3. A hospital sells patient information to a marketing firm without consent.
  4. A hospital discloses patient records to a reporter without permission.

Explanation

The HIPAA Privacy Rule permits covered entities to use or disclose protected health information for treatment, payment, and health care operations without patient authorization. Sharing lab results with a consulting physician directly involved in the patient's care falls under the treatment exception.

Question 27Health Law Fundamentals and Regulatory Environment

Which of the following is a key requirement of the HIPAA Security Rule for electronic protected health information (ePHI)?

  1. Prohibiting the use of cloud service providers for ePHI storage.
  2. Requiring patient consent for every use or disclosure of ePHI.
  3. Ensuring the confidentiality, integrity, and availability of ePHI. Correct answer.
  4. Mandating the use of blockchain technology for all ePHI storage.

Explanation

The HIPAA Security Rule specifically requires covered entities to ensure the confidentiality, integrity, and availability of ePHI. It does not mandate specific technologies like blockchain or prohibit cloud storage, nor does it require patient consent for every use or disclosure.

Question 28Health Law Fundamentals and Regulatory Environment

Under the HIPAA Breach Notification Rule, within what time frame must a covered entity notify affected individuals of a breach of unsecured protected health information?

  1. Within 24 hours of discovery of the breach.
  2. Within 30 days of discovery of the breach.
  3. Within 90 days of discovery of the breach.
  4. Within 60 days of discovery of the breach. Correct answer.

Explanation

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. Notification to the Secretary of HHS is also required, with different timelines depending on the size of the breach.

Question 29Health Law Fundamentals and Regulatory Environment

Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules?

  1. The Food and Drug Administration (FDA).
  2. The Centers for Medicare & Medicaid Services (CMS).
  3. The Federal Trade Commission (FTC).
  4. The Office for Civil Rights (OCR) within the Department of Health and Human Services. Correct answer.

Explanation

The Office for Civil Rights (OCR) within the Department of Health and Human Services is the primary federal agency responsible for enforcing the HIPAA Privacy, Security, and Breach Notification Rules. Other agencies like CMS and FDA have different regulatory roles.

Question 30Health Law Fundamentals and Regulatory Environment

A patient requests an amendment to their protected health information (PHI) because they believe it is incorrect. Under the HIPAA Privacy Rule, how must the covered entity respond?

  1. The covered entity must immediately grant the amendment without any review.
  2. The covered entity must act on the request within 60 days, with a possible 30-day extension, and may deny the request under certain circumstances. Correct answer.
  3. The covered entity may ignore the request if it is made in writing.
  4. The covered entity must forward the request to the Office for Civil Rights (OCR) for approval.

Explanation

The HIPAA Privacy Rule gives individuals the right to request an amendment of PHI. The covered entity must respond within 60 days (with a possible 30-day extension) and may deny the request if the PHI was not created by the entity, is not part of the designated record set, or is accurate and complete, among other reasons.

Question 31Health Law Fundamentals and Regulatory Environment

A covered entity uses a business associate to perform billing services. Which of the following is required under HIPAA?

  1. The covered entity must report all business associate breaches to the media.
  2. The business associate must obtain patient authorization for each disclosure.
  3. A written business associate agreement (BAA) that ensures the business associate will appropriately safeguard PHI. Correct answer.
  4. The business associate must be a licensed healthcare provider.

Explanation

HIPAA requires covered entities to have a written business associate agreement (BAA) with business associates that outlines the permitted uses and disclosures of PHI and requires appropriate safeguards. The BAA is a key compliance requirement.

Question 32Health Law Fundamentals and Regulatory Environment

A patient asks a covered entity to restrict disclosures of PHI to a health plan for a service that the patient paid for out of pocket in full. How must the covered entity respond under the HIPAA Privacy Rule?

  1. The covered entity may deny the request because restrictions are never mandatory.
  2. The covered entity must agree to the restriction if the disclosure is to a health plan for payment or operations and the PHI pertains solely to a service paid in full. Correct answer.
  3. The covered entity must report the request to the health plan before agreeing.
  4. The covered entity must obtain a court order to enforce the restriction.

Explanation

The HIPAA Privacy Rule requires covered entities to agree to a patient's request to restrict disclosure of PHI to a health plan if the disclosure is for payment or health care operations and the PHI pertains solely to a health care item or service for which the patient (or someone other than the health plan) has paid in full.

Question 33Health Law Fundamentals and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following best describes the minimum necessary standard?

  1. Covered entities must obtain patient authorization for every use or disclosure of PHI.
  2. Covered entities must disclose all PHI requested by another provider for treatment.
  3. Covered entities must encrypt all PHI when sending it via email.
  4. Covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose. Correct answer.

Explanation

The minimum necessary standard requires covered entities to make reasonable efforts to limit the use, disclosure, and request of PHI to the minimum amount necessary to accomplish the intended purpose. It applies to most uses and disclosures, with exceptions such as treatment disclosures.

Question 34Health Law Fundamentals and Regulatory Environment

A covered entity wants to contact a patient to remind them of an appointment. Under the HIPAA Privacy Rule, what is required?

  1. The covered entity must obtain written authorization from the patient before making the reminder call.
  2. The covered entity must offer the patient the opportunity to opt out of all future communications.
  3. The covered entity may contact the patient without authorization, provided it uses only limited PHI such as appointment time and location. Correct answer.
  4. The covered entity must encrypt all appointment reminder communications.

Explanation

The HIPAA Privacy Rule permits covered entities to contact patients for appointment reminders and other health-related benefits without authorization, as long as only limited PHI is used (e.g., appointment time and location). The patient must be given the opportunity to request that communications be made in a specific manner or at a specific location.

Question 35Health Law Fundamentals and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following is considered a permitted disclosure for public health activities?

  1. Posting patient information on a social media platform.
  2. Sharing PHI with a pharmaceutical company for marketing purposes.
  3. Disclosing PHI to a patient's employer without authorization.
  4. Reporting a communicable disease to a public health authority. Correct answer.

Explanation

The HIPAA Privacy Rule permits disclosures of PHI to public health authorities for public health activities, such as reporting communicable diseases, without patient authorization. Other disclosures generally require authorization or are not permitted.

Question 36Health Law Fundamentals and Regulatory Environment

A covered entity is required by state law to report certain wounds to law enforcement. How does the HIPAA Privacy Rule interact with this requirement?

  1. HIPAA preempts state law, so the covered entity cannot report without patient authorization.
  2. HIPAA permits disclosures required by law, so the covered entity may report as required by state law. Correct answer.
  3. HIPAA prohibits all disclosures to law enforcement without patient consent.
  4. HIPAA requires the covered entity to obtain a court order before reporting.

Explanation

The HIPAA Privacy Rule permits disclosures of PHI when required by law, including state laws that mandate reporting of wounds or injuries to law enforcement. HIPAA generally does not preempt more stringent state laws, but it allows disclosures that are legally required.

Question 37Health Law Fundamentals and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following is an example of a valid authorization for the use or disclosure of PHI?

  1. A verbal consent obtained over the phone.
  2. A written document signed by the patient that includes a description of the PHI to be used, the purpose, and an expiration date. Correct answer.
  3. A consent form that does not specify the purpose of the disclosure.
  4. A general consent form signed at registration that covers all future uses.

Explanation

A valid HIPAA authorization must be in writing, signed by the patient (or personal representative), and contain specific core elements, including a description of the PHI, the purpose of the use or disclosure, and an expiration date or event. Verbal consent and general consents are not sufficient for authorization.

Question 38Health Law Fundamentals and Regulatory Environment

A covered entity is planning to use PHI for research. Under the HIPAA Privacy Rule, which of the following is generally required?

  1. Notification to the patient's health plan.
  2. Authorization from the research participant or a waiver of authorization from an Institutional Review Board (IRB) or Privacy Board. Correct answer.
  3. Approval from the FDA.
  4. A court order.

Explanation

The HIPAA Privacy Rule requires authorization for research uses and disclosures of PHI, or a waiver of authorization approved by an IRB or Privacy Board. This ensures that research use is properly reviewed and authorized.

Question 39Health Law Fundamentals and Regulatory Environment

Under the HIPAA Privacy Rule, which of the following best describes the accounting of disclosures requirement?

  1. Covered entities must include disclosures made to the individual themselves in the accounting.
  2. Individuals have the right to receive a list of certain disclosures of their PHI made by a covered entity in the six years prior to the request. Correct answer.
  3. Covered entities must provide an accounting of disclosures within 10 days of a request.
  4. Covered entities must account for all disclosures of PHI, including those for treatment, payment, and operations.

Explanation

The HIPAA Privacy Rule gives individuals the right to an accounting of certain disclosures of their PHI made by a covered entity in the six years prior to the request. Disclosures for treatment, payment, and operations are generally excluded from the accounting.

Question 40Health Law Fundamentals and Regulatory Environment

A covered entity receives a request from a patient to access their PHI. The covered entity uses an electronic health record (EHR) system. Under the HIPAA Privacy Rule and the HITECH Act, what is the maximum time allowed to provide the patient with an electronic copy of their PHI?

  1. 30 days, with a possible 30-day extension. Correct answer.
  2. 60 days, with a possible 30-day extension.
  3. 10 days, with no extension.
  4. 90 days, with no extension.

Explanation

Under the HITECH Act and the HIPAA Privacy Rule, when a patient requests an electronic copy of their PHI, the covered entity must provide it within 30 days, with a possible 30-day extension if certain conditions are met. This is shorter than the general 30-day timeframe for access (which also allows a 30-day extension).

Question 41Compliance, Privacy, and Fraud and Abuse

Under the federal False Claims Act, a person who knowingly submits a false claim to a government healthcare program may be liable for which combination of penalties?

  1. Administrative sanctions limited to program exclusion
  2. Repayment of the claim amount without additional penalties
  3. Civil monetary penalties per claim plus treble damages Correct answer.
  4. Criminal fines only, with no civil exposure

Explanation

The False Claims Act imposes civil liability consisting of a per-claim monetary penalty plus three times the amount of the government's damages. Criminal exposure can exist separately under other statutes, but the FCA itself is a civil remedy. Simple repayment does not satisfy FCA exposure.

Question 42Compliance, Privacy, and Fraud and Abuse

The Anti-Kickback Statute prohibits remuneration offered or paid in exchange for which of the following?

  1. Referring patients for items or services payable by a federal healthcare program Correct answer.
  2. Charging patients a discounted self-pay rate
  3. Paying a supplier's standard invoice within terms
  4. Advertising a practice to the general public

Explanation

The Anti-Kickback Statute criminalizes knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce referrals or purchases of items or services reimbursable by a federal healthcare program. Ordinary advertising, lawful discounts disclosed appropriately, and standard commercial payments are not prohibited. The statute targets the link between payment and federal program business.

Question 43Compliance, Privacy, and Fraud and Abuse

Which statute is the primary federal law governing the privacy and security of individually identifiable health information held by covered entities?

  1. The Health Insurance Portability and Accountability Act Correct answer.
  2. The Sherman Antitrust Act
  3. The Employee Retirement Income Security Act
  4. The Fair Credit Reporting Act

Explanation

HIPAA, through its Privacy and Security Rules, governs the use and disclosure of protected health information by covered entities and their business associates. The other statutes address consumer credit, competition, and pension/benefit plan regulation respectively and do not set health privacy standards.

Question 44Compliance, Privacy, and Fraud and Abuse

A medical practice's compliance program should generally include all of the following elements EXCEPT which one?

  1. Guaranteeing that no compliance violations will ever occur Correct answer.
  2. Ongoing employee training and education
  3. Written policies and procedures addressing risk areas
  4. Designation of a compliance officer or contact

Explanation

Compliance programs are structured to prevent, detect, and correct violations; no program can guarantee that violations will never occur. The recognized elements include written policies, an assigned compliance officer, training, monitoring, and enforcement. A promise of zero violations is neither feasible nor a recognized program element.

Question 45Compliance, Privacy, and Fraud and Abuse

The Physician Self-Referral Law is commonly known by which name?

  1. The HITECH Act
  2. The Robinson-Patman Act
  3. The Sarbanes-Oxley Act
  4. The Stark Law Correct answer.

Explanation

The Physician Self-Referral Law is the Stark Law, which restricts physician referrals of designated health services to entities with which the physician has a financial relationship, absent an exception. HITECH amended HIPAA, Sarbanes-Oxley concerns corporate accountability, and Robinson-Patman concerns price discrimination.

Question 46Compliance, Privacy, and Fraud and Abuse

Under HIPAA, which of the following best describes a covered entity's obligation regarding a patient's request to access their own protected health information?

  1. The entity must obtain the patient's insurer approval before releasing records
  2. The entity may refuse all access requests without explanation
  3. The entity must generally provide access within a defined timeframe and may charge a reasonable cost-based fee Correct answer.
  4. The entity may charge whatever fee the market will bear

Explanation

HIPAA grants individuals a right of access to their protected health information, requiring timely response and permitting only reasonable, cost-based fees. Blanket refusal is not permitted, insurer approval is not required for the patient's own access, and fees cannot be arbitrary.

Question 47Compliance, Privacy, and Fraud and Abuse

A hospital learns that a workforce member emailed a spreadsheet containing patient names and diagnoses to the wrong external address. Which action is most consistent with HIPAA breach notification rules?

  1. Conduct a risk assessment to determine whether notification is required Correct answer.
  2. Automatically assume no notification is needed because the recipient is unknown
  3. Destroy all internal copies of the spreadsheet and take no further action
  4. Notify the media immediately regardless of the risk assessment

Explanation

HIPAA presumes an impermissible use or disclosure is a breach unless a risk assessment demonstrates a low probability that the information was compromised. Notification obligations flow from that assessment. Automatic assumptions, premature media notice, and document destruction do not follow the required framework.

Question 48Compliance, Privacy, and Fraud and Abuse

A laboratory pays a referring physician's office a per-patient fee each time the office sends a specimen to the lab. The fee is not tied to any specific service the office performs. This arrangement is most likely to raise concerns under which authority?

  1. The Emergency Medical Treatment and Labor Act
  2. The Health Care Quality Improvement Act
  3. The Anti-Kickback Statute Correct answer.
  4. The Clinical Laboratory Improvement Amendments

Explanation

Per-patient payments to a referral source for federal program business implicate the Anti-Kickback Statute because they can be viewed as remuneration to induce referrals. EMTALA governs emergency screening and transfer, CLIA governs laboratory testing standards, and HCQIA addresses peer review protections.

Question 49Compliance, Privacy, and Fraud and Abuse

Which of the following best describes the role of a business associate under HIPAA?

  1. A government agency that licenses healthcare facilities
  2. A person or entity that performs functions involving protected health information on behalf of a covered entity Correct answer.
  3. Any employee of a covered entity who handles patient scheduling
  4. A patient's family member acting as a caregiver

Explanation

A business associate is a separate person or entity that creates, receives, maintains, or transmits protected health information to perform functions or services for a covered entity. Employees of the covered entity are part of its workforce, not business associates, and licensing agencies and family caregivers do not fit the definition.

Question 50Compliance, Privacy, and Fraud and Abuse

A physician has a financial relationship with an imaging center and refers patients there for MRI scans that are designated health services. To avoid violating the Stark Law, the arrangement must satisfy which requirement?

  1. It must fit within a regulatory exception Correct answer.
  2. It must involve no more than five referrals per year
  3. It must be approved by the patients in writing
  4. It must be disclosed only to the physician's insurer

Explanation

The Stark Law is a strict liability statute: if a financial relationship exists and the physician refers designated health services to that entity, an exception must apply. Patient consent, insurer disclosure, and referral caps do not create an exception. Compliance depends on meeting the specific terms of a regulatory exception.