AMCA MAAC cheat sheet

HIPAA Privacy Rule governs use and disclosure of protected health information (PHI); the Security Rule governs electronic PHI (ePHI).

Minimum necessary standard: only the least amount of PHI needed for a purpose may be used, disclosed, or requested; treatment disclosures are exempt.

The 18 HIPAA identifiers include name, dates (except year) tied to an individual, SSN, MRN, phone, fax, email, and full-face photos.

De-identified health information must remove all 18 identifiers or be certified by a qualified statistician; de-identified data is not PHI.

Breach notification: covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovery.

Patients have the right to access their records; a covered entity must act on an access request within 30 days, with one 30-day extension.

TPO - treatment, payment, and health care operations - are the core permitted uses and disclosures without patient authorization.

Business associates must sign a Business Associate Agreement (BAA) before handling PHI on behalf of a covered entity.

Patients may request restrictions, confidential communications, amendments, and an accounting of disclosures of their PHI.

Establish a scheduling matrix: define appointment types and standard durations (e.g., new patient 30-45 min, established 15 min, follow-up 10 min).

Wave scheduling books several patients at the top of the hour; modified wave staggers arrivals to smooth provider flow.

Open-access (advanced access) scheduling reserves same-day slots so patients are seen on the day they call.

Buffer or catch-up slots are reserved for urgent and overbook needs; typical target is 1-2 per half-day session.

No-show protocol: document attempts to contact, apply the practice's cancellation policy, and flag the chart for follow-up.

Recall/reminder systems use phone, text, or mail at set intervals (e.g., 24-48 hours before the visit) to reduce no-shows.

When a provider is out, reschedule by priority: urgent/acute first, then chronic follow-ups, then routine and preventive visits.

Confirm patient identity and reason for visit when scheduling; verify insurance eligibility at the time of booking when possible.

The medical record is a legal document owned by the practice; patients have a right to access and copy its contents.

SOAP note format: Subjective (patient report), Objective (exam/findings), Assessment (diagnosis), Plan (treatment).

Corrections must be made with a single line, date, initials, and reason; never obliterate or use correction fluid on a paper chart.

Retention periods vary by state and payer; adult records are commonly kept 7-10 years, and minor records until the age of majority plus the state period.

Release of information requires a signed, dated authorization with patient name, records to release, recipient, purpose, and expiration.

Chain of custody and audit trails document who accessed or amended a record; EHRs log every view and edit.

Records must be legible, contemporaneous, signed with credentials, and free of unapproved abbreviations to support billing and legal defensibility.

Protected health information may be released without authorization for treatment, payment, operations, and as required by law (e.g., subpoena with proper process).

Front-office workflow order: registration, insurance verification, copay collection, encounter, coding, claim submission, and payment posting.

Patient registration captures demographics, insurance, guarantor, and consent signatures; errors here cause claim denials downstream.

Aging report buckets receivables (0-30, 31-60, 61-90, 91-120, 120+ days) to prioritize collection follow-up.

Practice management software (PMS) handles scheduling, registration, billing, and reporting; the EHR holds the clinical record.

OSHA requires a written exposure control plan, annual training, and offering hepatitis B vaccination to at-risk staff.

Patient rights include privacy, informed consent, access to records, and grievance procedures; post the Notice of Privacy Practices.

Incident reports document errors or near-misses for quality improvement and are generally not part of the medical record.

Telephone and written communication should be documented in the chart with date, time, who was contacted, and the outcome.

Common plan types: HMO (requires PCP and referrals, in-network focus), PPO (no referral, higher out-of-network cost), POS, and EPO.

Key terms: premium (monthly cost), deductible (amount paid before coverage), copay (fixed amount), coinsurance (percentage of cost), out-of-pocket maximum.

Coordination of benefits: the primary plan pays first; the secondary plan may cover remaining costs per its rules.

Medicare Part A covers inpatient hospital; Part B covers outpatient and physician services; Part D covers prescription drugs.

Medicaid is a joint federal-state program with income-based eligibility and state-specific coverage rules.

Verify eligibility and benefits before the visit: confirm active coverage, effective date, network status, and referral/authorization needs.

Prior authorization is payer approval required before certain services; missing auth is a common cause of denial.

EOB (Explanation of Benefits) is sent to the patient; the remittance advice (RA/835) is sent to the provider with payment details.

CPT codes (Category I, 5 digits) describe procedures and services; ICD-10-CM codes describe diagnoses and justify medical necessity.

ICD-10-CM codes are 3-7 characters: first character is a letter, second is a number, and later characters may be letters or numbers.

HCPCS Level II codes (5 characters, letter-prefixed) cover supplies, drugs, and equipment not in CPT.

Modifier 25 indicates a significant, separately identifiable E/M service on the same day as a procedure.

Modifier 59 indicates a distinct procedural service; modifier 26 is the professional component and TC the technical component.

CMS-1500 is the paper claim form for professional services; the UB-04 is used for institutional claims.

The claim lifecycle: charge entry, code assignment, claim scrub, submission, payer adjudication, payment posting, and denial/appeal.

Common denial reasons include eligibility issues, missing authorization, coding errors, and non-covered services; appeal within the payer's deadline.

E/M level selection is based on medical decision making or time; documentation must support the level billed.

Prefixes alter meaning: brady- (slow), tachy- (fast), hyper- (above), hypo- (below), dys- (difficult/painful), a-/an- (without).

Suffixes: -itis (inflammation), -ectomy (removal), -otomy (incision), -ostomy (opening), -algia (pain), -emia (blood condition).

Roots: cardi- (heart), hepat- (liver), nephr- (kidney), oste- (bone), neur- (nerve), derm- (skin), pulmon- (lung).

Directional terms: anterior/ventral (front), posterior/dorsal (back), superior (above), inferior (below), proximal (near), distal (far).

Body planes: sagittal divides left/right, coronal/frontal divides front/back, transverse divides upper/lower.

Abdominopelvic quadrants: RUQ (liver, gallbladder), LUQ (stomach, spleen), RLQ (appendix), LLQ (descending colon).

Vital sign norms for adults: temperature ~98.6 F (37 C), pulse 60-100 bpm, respirations 12-20/min, BP <120/80, SpO2 95-100%.

Anatomy order of the digestive tract: mouth, esophagus, stomach, small intestine, large intestine, rectum, anus.

Common abbreviations: BP, HR, RR, NPO (nothing by mouth), PRN (as needed), BID (twice daily), TID (three times daily), q.i.d. (four times daily).

Chain of survival: early recognition and call for help, early CPR, early defibrillation, advanced care, and post-arrest care.

Adult CPR: compressions at 100-120 per minute, depth 2-2.4 inches, full recoil, 30:2 compression-to-ventilation ratio for one or two rescuers.

AED use: turn on, attach pads, clear the patient, deliver shock if advised, then immediately resume compressions.

Choking adult: encourage coughing; if ineffective, give abdominal thrusts (Heimlich); for an unresponsive adult, start CPR.

Anaphylaxis: administer epinephrine auto-injector into the outer thigh, call 911, and monitor breathing.

Stroke signs (FAST): Face drooping, Arm weakness, Speech difficulty, Time to call 911.

Heart attack signs: chest pressure/pain, pain radiating to arm, jaw, or back, shortness of breath, nausea, and sweating.

Seizure first aid: protect the patient from injury, do not restrain or place objects in the mouth, time the seizure, and call 911 if it lasts over 5 minutes.

Emergency action plan: know exits, location of AED and first-aid kit, emergency numbers, and staff roles during a crisis.

HIPAA Privacy Rule governs use and disclosure of protected health information (PHI); the Security Rule governs electronic PHI (ePHI).

Minimum necessary standard: only the least amount of PHI needed for a purpose may be used, disclosed, or requested; treatment disclosures are exempt.

The 18 HIPAA identifiers include name, dates (except year) tied to an individual, SSN, MRN, phone, fax, email, and full-face photos.

De-identified health information must remove all 18 identifiers or be certified by a qualified statistician; de-identified data is not PHI.

Breach notification: covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovery.

Patients have the right to access their records; a covered entity must act on an access request within 30 days, with one 30-day extension.

TPO - treatment, payment, and health care operations - are the core permitted uses and disclosures without patient authorization.

Business associates must sign a Business Associate Agreement (BAA) before handling PHI on behalf of a covered entity.

Patients may request restrictions, confidential communications, amendments, and an accounting of disclosures of their PHI.

Establish a scheduling matrix: define appointment types and standard durations (e.g., new patient 30-45 min, established 15 min, follow-up 10 min).

Wave scheduling books several patients at the top of the hour; modified wave staggers arrivals to smooth provider flow.

Open-access (advanced access) scheduling reserves same-day slots so patients are seen on the day they call.

Buffer or catch-up slots are reserved for urgent and overbook needs; typical target is 1-2 per half-day session.

No-show protocol: document attempts to contact, apply the practice's cancellation policy, and flag the chart for follow-up.

Recall/reminder systems use phone, text, or mail at set intervals (e.g., 24-48 hours before the visit) to reduce no-shows.

When a provider is out, reschedule by priority: urgent/acute first, then chronic follow-ups, then routine and preventive visits.

Confirm patient identity and reason for visit when scheduling; verify insurance eligibility at the time of booking when possible.

The medical record is a legal document owned by the practice; patients have a right to access and copy its contents.

SOAP note format: Subjective (patient report), Objective (exam/findings), Assessment (diagnosis), Plan (treatment).

Corrections must be made with a single line, date, initials, and reason; never obliterate or use correction fluid on a paper chart.

Retention periods vary by state and payer; adult records are commonly kept 7-10 years, and minor records until the age of majority plus the state period.

Release of information requires a signed, dated authorization with patient name, records to release, recipient, purpose, and expiration.

Chain of custody and audit trails document who accessed or amended a record; EHRs log every view and edit.

Records must be legible, contemporaneous, signed with credentials, and free of unapproved abbreviations to support billing and legal defensibility.

Protected health information may be released without authorization for treatment, payment, operations, and as required by law (e.g., subpoena with proper process).

Front-office workflow order: registration, insurance verification, copay collection, encounter, coding, claim submission, and payment posting.

Patient registration captures demographics, insurance, guarantor, and consent signatures; errors here cause claim denials downstream.

Aging report buckets receivables (0-30, 31-60, 61-90, 91-120, 120+ days) to prioritize collection follow-up.

Practice management software (PMS) handles scheduling, registration, billing, and reporting; the EHR holds the clinical record.

OSHA requires a written exposure control plan, annual training, and offering hepatitis B vaccination to at-risk staff.

Patient rights include privacy, informed consent, access to records, and grievance procedures; post the Notice of Privacy Practices.

Incident reports document errors or near-misses for quality improvement and are generally not part of the medical record.

Telephone and written communication should be documented in the chart with date, time, who was contacted, and the outcome.

Common plan types: HMO (requires PCP and referrals, in-network focus), PPO (no referral, higher out-of-network cost), POS, and EPO.

Key terms: premium (monthly cost), deductible (amount paid before coverage), copay (fixed amount), coinsurance (percentage of cost), out-of-pocket maximum.

Coordination of benefits: the primary plan pays first; the secondary plan may cover remaining costs per its rules.

Medicare Part A covers inpatient hospital; Part B covers outpatient and physician services; Part D covers prescription drugs.

Medicaid is a joint federal-state program with income-based eligibility and state-specific coverage rules.

Verify eligibility and benefits before the visit: confirm active coverage, effective date, network status, and referral/authorization needs.

Prior authorization is payer approval required before certain services; missing auth is a common cause of denial.

EOB (Explanation of Benefits) is sent to the patient; the remittance advice (RA/835) is sent to the provider with payment details.

CPT codes (Category I, 5 digits) describe procedures and services; ICD-10-CM codes describe diagnoses and justify medical necessity.

ICD-10-CM codes are 3-7 characters: first character is a letter, second is a number, and later characters may be letters or numbers.

HCPCS Level II codes (5 characters, letter-prefixed) cover supplies, drugs, and equipment not in CPT.

Modifier 25 indicates a significant, separately identifiable E/M service on the same day as a procedure.

Modifier 59 indicates a distinct procedural service; modifier 26 is the professional component and TC the technical component.

CMS-1500 is the paper claim form for professional services; the UB-04 is used for institutional claims.

The claim lifecycle: charge entry, code assignment, claim scrub, submission, payer adjudication, payment posting, and denial/appeal.

Common denial reasons include eligibility issues, missing authorization, coding errors, and non-covered services; appeal within the payer's deadline.

E/M level selection is based on medical decision making or time; documentation must support the level billed.

Prefixes alter meaning: brady- (slow), tachy- (fast), hyper- (above), hypo- (below), dys- (difficult/painful), a-/an- (without).

Suffixes: -itis (inflammation), -ectomy (removal), -otomy (incision), -ostomy (opening), -algia (pain), -emia (blood condition).

Roots: cardi- (heart), hepat- (liver), nephr- (kidney), oste- (bone), neur- (nerve), derm- (skin), pulmon- (lung).

Directional terms: anterior/ventral (front), posterior/dorsal (back), superior (above), inferior (below), proximal (near), distal (far).

Body planes: sagittal divides left/right, coronal/frontal divides front/back, transverse divides upper/lower.

Abdominopelvic quadrants: RUQ (liver, gallbladder), LUQ (stomach, spleen), RLQ (appendix), LLQ (descending colon).

Vital sign norms for adults: temperature ~98.6 F (37 C), pulse 60-100 bpm, respirations 12-20/min, BP <120/80, SpO2 95-100%.

Anatomy order of the digestive tract: mouth, esophagus, stomach, small intestine, large intestine, rectum, anus.

Common abbreviations: BP, HR, RR, NPO (nothing by mouth), PRN (as needed), BID (twice daily), TID (three times daily), q.i.d. (four times daily).

Chain of survival: early recognition and call for help, early CPR, early defibrillation, advanced care, and post-arrest care.

Adult CPR: compressions at 100-120 per minute, depth 2-2.4 inches, full recoil, 30:2 compression-to-ventilation ratio for one or two rescuers.

AED use: turn on, attach pads, clear the patient, deliver shock if advised, then immediately resume compressions.

Choking adult: encourage coughing; if ineffective, give abdominal thrusts (Heimlich); for an unresponsive adult, start CPR.

Anaphylaxis: administer epinephrine auto-injector into the outer thigh, call 911, and monitor breathing.

Stroke signs (FAST): Face drooping, Arm weakness, Speech difficulty, Time to call 911.

Heart attack signs: chest pressure/pain, pain radiating to arm, jaw, or back, shortness of breath, nausea, and sweating.

Seizure first aid: protect the patient from injury, do not restrain or place objects in the mouth, time the seizure, and call 911 if it lasts over 5 minutes.

Emergency action plan: know exits, location of AED and first-aid kit, emergency numbers, and staff roles during a crisis.