I85PREP
⌘ K
AMCA MAAC study materials
AMCA MAAC study resources

AMCA MAAC practice questions

One question at a time. Build your AMCA MAAC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1HIPAA and Compliance

Under HIPAA, which entity is responsible for enforcing the Privacy and Security Rules against covered entities?

  1. The Office for Civil Rights within HHS Correct answer.
  2. The Department of Justice Antitrust Division
  3. The Federal Trade Commission
  4. The Centers for Medicare & Medicaid Services

Explanation

The HIPAA Privacy and Security Rules are enforced by the Office for Civil Rights (OCR) within the Department of Health and Human Services. CMS administers other HIPAA administrative simplification provisions, but OCR handles privacy and security enforcement.

Question 2HIPAA and Compliance

Which of the following best describes a covered entity under HIPAA?

  1. A vendor that sells software to hospitals
  2. Any business that stores data electronically
  3. Any employer that offers wellness benefits to staff
  4. A health plan, health care clearinghouse, or health care provider that transmits certain transactions electronically Correct answer.

Explanation

A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits any health information in electronic form in connection with a covered transaction. Selling software to hospitals does not by itself make an organization a covered entity.

Question 3HIPAA and Compliance

A hospital's billing contractor handles protected health information on the hospital's behalf. What is the contractor's HIPAA status?

  1. A public health authority
  2. A subcontractor exempt from HIPAA
  3. A covered entity
  4. A business associate Correct answer.

Explanation

A business associate is a person or entity that performs functions or services involving PHI on behalf of a covered entity. Billing services are a classic example requiring a business associate agreement.

Question 4HIPAA and Compliance

Which of the following is one of the three safeguards categories required by the HIPAA Security Rule?

  1. Licensing safeguards
  2. Administrative safeguards Correct answer.
  3. Marketing safeguards
  4. Financial safeguards

Explanation

The Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Administrative safeguards cover policies, workforce training, and access management.

Question 5HIPAA and Compliance

What is the minimum necessary standard designed to limit?

  1. The number of staff a facility may hire
  2. The length of time records must be kept
  3. The amount of PHI used, disclosed, or requested to what is needed for the purpose Correct answer.
  4. The number of business associates a covered entity may use

Explanation

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI to the minimum needed to accomplish the intended purpose. It applies to most uses and disclosures but has defined exceptions, such as treatment disclosures.

Question 6HIPAA and Compliance

Under the HIPAA Breach Notification Rule, affected individuals generally must be notified of a breach of unsecured PHI within what timeframe after discovery?

  1. 30 days
  2. 90 days
  3. 60 days Correct answer.
  4. 24 hours

Explanation

Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. Media notice and HHS notice follow separate timing rules depending on breach size.

Question 7HIPAA and Compliance

What is the primary purpose of the HIPAA Privacy Rule?

  1. To regulate pharmaceutical advertising
  2. To set national standards for protecting individuals' medical information Correct answer.
  3. To license health care providers
  4. To establish Medicare reimbursement rates

Explanation

The Privacy Rule establishes national standards for the protection of individually identifiable health information. It governs how PHI may be used and disclosed and grants individuals rights over their information.

Question 8HIPAA and Compliance

Which individual right is granted by the HIPAA Privacy Rule?

  1. The right to demand deletion of all records immediately
  2. The right to review other patients' records
  3. The right to request an accounting of certain disclosures Correct answer.
  4. The right to set their own retention schedule

Explanation

Individuals have the right to request an accounting of disclosures of their PHI, along with rights to access, amend, and request restrictions. These rights are subject to defined exceptions and procedures.

Question 9HIPAA and Compliance

A patient asks a covered entity for a copy of her medical record. Under the Privacy Rule, how must the entity generally respond?

  1. Require a court order before releasing any copy
  2. Provide access within a reasonable time and in the form and format requested if readily producible Correct answer.
  3. Deny the request because records belong to the provider
  4. Charge a fee equal to the full cost of the entire facility's operations

Explanation

The Privacy Rule grants individuals a right of access to their PHI. The entity must act within a reasonable timeframe (generally 30 days, with one possible extension) and provide the record in the requested form and format if readily producible.

Question 10HIPAA and Compliance

Which situation most clearly requires a business associate agreement before PHI is shared?

  1. A hospital sends a patient's record to another provider for treatment
  2. A provider discloses PHI as required by state law
  3. A patient gives written authorization for a disclosure
  4. A covered entity hires a cloud vendor to store PHI Correct answer.

Explanation

A vendor storing PHI on behalf of a covered entity is a business associate, and a written business associate agreement is required. Treatment disclosures and legally required disclosures fall outside that requirement.

Question 11HIPAA and Compliance

A covered entity discovers a breach affecting 650 individuals in one state. What additional notice is required beyond individual notice?

  1. No additional notice is required
  2. Notice to prominent media outlets serving the state Correct answer.
  3. Notice to the media only
  4. Notice to the state bar association

Explanation

When a breach affects more than 500 residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving that area without unreasonable delay and no later than 60 days after discovery.

Question 12HIPAA and Compliance

Which of the following best describes the Security Rule's requirement for encryption of electronic PHI?

  1. Encryption is addressable, meaning entities must implement it or document why it is not reasonable and appropriate Correct answer.
  2. Encryption applies only to paper records
  3. Encryption is always mandatory with no exceptions
  4. Encryption is prohibited unless approved by HHS

Explanation

Encryption is an addressable implementation specification under the Security Rule. Entities must assess whether it is reasonable and appropriate and, if not, document the equivalent alternative measure.

Question 13HIPAA and Compliance

A researcher wants to use PHI for a study. Which approach can permit the use without individual authorization?

  1. Obtaining approval from the covered entity's marketing department
  2. Publishing the data on a public website first
  3. Using a properly constituted IRB or privacy board waiver of authorization Correct answer.
  4. Relying on a verbal promise of confidentiality from the researcher

Explanation

The Privacy Rule permits use or disclosure of PHI for research without authorization when an IRB or privacy board grants a waiver or alteration of authorization, or when the data is de-identified.

Question 14HIPAA and Compliance

What does de-identification of PHI accomplish under the Privacy Rule?

  1. It removes the information from HIPAA privacy restrictions because it is no longer individually identifiable Correct answer.
  2. It converts the data into a business associate agreement
  3. It requires patient authorization for every future use
  4. It extends the retention period for records

Explanation

De-identified information is not individually identifiable health information and therefore falls outside the Privacy Rule's use and disclosure restrictions. De-identification may be done by expert determination or by removing specified identifiers.

Question 15HIPAA and Compliance

A clinician accesses the record of a celebrity patient out of curiosity, without a treatment, payment, or operations purpose. This is best characterized as:

  1. A permitted disclosure
  2. A required disclosure by law
  3. An impermissible use of PHI Correct answer.
  4. A de-identification event

Explanation

Accessing PHI without a legitimate purpose is an impermissible use under the Privacy Rule. Curiosity is not a treatment, payment, or health care operations purpose.

Question 16HIPAA and Compliance

Which of the following is an example of a permitted disclosure without authorization for health care operations?

  1. Selling patient lists to a data broker
  2. Disclosing PHI to a patient's employer without request
  3. Sharing PHI with a marketing firm for a paid ad campaign
  4. Conducting quality assessment and improvement activities Correct answer.

Explanation

Quality assessment and improvement activities are health care operations for which PHI may be used or disclosed without authorization. Marketing and sale of PHI generally require authorization.

Question 17HIPAA and Compliance

What is the role of a covered entity's designated privacy official?

  1. To serve as the entity's legal counsel in litigation
  2. To conduct external audits of other covered entities
  3. To oversee the entity's privacy policies and compliance with the Privacy Rule Correct answer.
  4. To approve all Medicare claims

Explanation

The Privacy Rule requires designation of a privacy official responsible for developing and implementing privacy policies and procedures and ensuring compliance. This is an internal compliance role.

Question 18HIPAA and Compliance

A covered entity wants to send PHI by email to a patient who has requested it. What is the most accurate statement?

  1. Email is always prohibited for PHI
  2. Email may be used only with a court order
  3. Email is permitted only if the message contains no PHI at all
  4. Unencrypted email may be used if the patient has been advised of the risks and still requests it Correct answer.

Explanation

The Privacy Rule permits email communication when reasonable safeguards are applied. If a patient is informed of the risks of unencrypted email and still requests it, the entity may generally honor that request.

Question 19HIPAA and Compliance

Under the HIPAA Security Rule, which is an example of a technical safeguard?

  1. Locking server room doors
  2. Adopting a written sanction policy
  3. Implementing access controls that restrict system entry Correct answer.
  4. Conducting workforce security training

Explanation

Technical safeguards use technology to protect electronic PHI and control access, such as unique user identification and access control mechanisms. Door locks are physical safeguards, and training and sanctions are administrative safeguards.

Question 20HIPAA and Compliance

A covered entity receives a subpoena for a patient's PHI in a legal proceeding. What must the entity generally ensure before disclosing?

  1. That the requesting attorney is board certified
  2. That the records are at least five years old
  3. That the patient's consent is implied by the subpoena
  4. That satisfactory assurances exist that the requesting party has met legal notice requirements Correct answer.

Explanation

Disclosures for judicial and administrative proceedings require satisfactory assurances that the individual has been given notice or that a protective order or other lawful conditions are met. A subpoena alone does not automatically authorize disclosure.

Question 21HIPAA and Compliance

Which statement best captures the relationship between state law and HIPAA?

  1. Stricter state laws may continue to apply alongside HIPAA Correct answer.
  2. HIPAA always preempts stricter state privacy laws
  3. HIPAA applies only when state law is silent
  4. State law is entirely irrelevant once HIPAA applies

Explanation

HIPAA sets a federal floor, and more stringent state laws generally are not preempted. Covered entities must comply with both HIPAA and any stricter applicable state requirements.

Question 22HIPAA and Compliance

A business associate experiences a breach of PHI it maintains for a covered entity. What is the business associate's obligation?

  1. Notify the covered entity without unreasonable delay and no later than 60 days after discovery Correct answer.
  2. Notify only the media
  3. Notify affected patients directly and never inform the covered entity
  4. Wait for the covered entity to discover the breach independently

Explanation

Business associates must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery. The covered entity then handles individual notification obligations.

Question 23HIPAA and Compliance

A covered entity plans to use PHI for a purpose that requires authorization. Which element must a valid HIPAA authorization contain?

  1. A notarized signature in all cases
  2. The patient's social security number as an identifier
  3. A statement waiving all future access rights
  4. A description of the information to be used or disclosed and the purpose Correct answer.

Explanation

A valid authorization must include core elements such as a description of the PHI, the persons authorized to disclose and receive it, the purpose, an expiration date, and the individual's signature. It must also include required statements about revocation and redisclosure.

Question 24HIPAA and Compliance

An entity wants to use the expert determination method to de-identify data. Which statement is most accurate?

  1. The method requires publishing the data publicly for review
  2. Any employee may self-certify de-identification without analysis
  3. A person with appropriate knowledge and experience must determine that the risk of re-identification is very small Correct answer.
  4. The entity must destroy all original records immediately

Explanation

Under expert determination, a person with appropriate knowledge and experience in statistical and scientific principles determines that the risk of identifying individuals is very small. The entity must document the methods and results.

Question 25HIPAA and Compliance

A covered entity wants to disclose PHI to a family member involved in a patient's care. Which approach best complies with the Privacy Rule?

  1. Disclose the patient's entire record regardless of relevance
  2. Refuse all disclosures to family members under any circumstance
  3. Use professional judgment to disclose information directly relevant to the person's involvement, consistent with the patient's wishes Correct answer.
  4. Disclose only if the patient has signed a formal authorization in every instance

Explanation

The Privacy Rule permits certain disclosures to family and friends involved in care when the patient does not object, using professional judgment and limiting information to what is directly relevant. Formal authorization is not always required.

Question 26HIPAA and Compliance

Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules against most covered entities?

  1. The Centers for Medicare & Medicaid Services
  2. The Food and Drug Administration
  3. The Office for Civil Rights within the Department of Health and Human Services Correct answer.
  4. The Federal Trade Commission

Explanation

The HHS Office for Civil Rights (OCR) is the agency charged with enforcing the HIPAA Privacy, Security, and Breach Notification Rules for most covered entities. Other agencies have narrower or different roles and do not generally enforce these rules.

Question 27HIPAA and Compliance

Under the HIPAA Privacy Rule, which of the following best describes the minimum necessary standard?

  1. Covered entities must obtain written authorization for every internal use of PHI
  2. Covered entities should limit PHI used or disclosed to the least amount reasonably needed for the purpose Correct answer.
  3. Covered entities must share PHI only with government agencies
  4. Covered entities must delete all PHI after each patient encounter

Explanation

The minimum necessary standard requires reasonable efforts to limit PHI to the minimum needed to accomplish the intended purpose, with certain exceptions such as treatment disclosures. It applies to uses and disclosures, not to mandatory deletion or universal authorization.

Question 28HIPAA and Compliance

A covered entity's workforce member receives an email from a colleague asking for a patient's lab results for a treatment consult. Which action best reflects the Privacy Rule?

  1. Post the results in a shared public folder for the care team
  2. Refuse to share any information without a signed authorization
  3. Forward the patient's entire chart to the colleague to be safe
  4. Share only the specific results needed for the consult with the treating colleague Correct answer.

Explanation

Disclosures for treatment to another health care provider generally do not require authorization, but the minimum necessary standard favors sharing only what is needed. Sharing the whole chart or posting publicly exceeds what the consult requires.

Question 29HIPAA and Compliance

Which of the following is an administrative safeguard under the HIPAA Security Rule?

  1. Encryption of data at rest
  2. A firewall filtering inbound traffic
  3. A locked server room door
  4. A documented security management process that includes risk analysis Correct answer.

Explanation

Administrative safeguards are policies and procedures governing workforce conduct and security management, such as risk analysis and sanction policies. Encryption, physical locks, and firewalls fall under technical or physical safeguards.

Question 30HIPAA and Compliance

A patient requests an accounting of disclosures of her PHI. For which type of disclosure must the covered entity generally provide an accounting?

  1. A disclosure for the patient's own treatment
  2. A disclosure made to the patient herself
  3. A disclosure authorized by the patient in writing
  4. A disclosure to a public health authority as required by law Correct answer.

Explanation

The accounting of disclosures covers certain disclosures, including those required by law such as to public health authorities, while excluding treatment, payment, and operations disclosures and disclosures to the individual. Authorized disclosures are generally excluded.

Question 31HIPAA and Compliance

A covered entity wants to use PHI for marketing that involves financial remuneration from a third party. What is generally required?

  1. A verbal agreement from the patient
  2. A valid patient authorization that discloses the remuneration Correct answer.
  3. Only an internal privacy office approval
  4. Nothing beyond routine operations rules

Explanation

Marketing communications that involve financial remuneration from a third party generally require a valid written authorization that clearly discloses the remuneration. Internal approvals or verbal consent do not satisfy the authorization requirement.

Question 32HIPAA and Compliance

Which of the following best describes the HIPAA Security Rule's scope?

  1. It applies only to federal government health programs
  2. It applies to all PHI regardless of format, including paper records
  3. It applies to electronic PHI held or transmitted by covered entities and their business associates Correct answer.
  4. It applies only to hospitals with more than 100 beds

Explanation

The Security Rule specifically addresses electronic protected health information, while the Privacy Rule covers PHI in all formats. It applies broadly to covered entities and business associates, not just large hospitals or federal programs.

Question 33HIPAA and Compliance

A covered entity discovers that a laptop containing unsecured PHI was stolen but the data was encrypted to current standards. How does this generally affect breach notification obligations?

  1. The encryption may support a conclusion that no reportable breach occurred Correct answer.
  2. Only the FBI must be notified
  3. The entity must notify the media regardless of encryption
  4. Notification is still required because a device was stolen

Explanation

PHI that is encrypted to recognized standards is generally considered secured, so a breach of unsecured PHI may not have occurred. The entity should still document its risk assessment and the encryption in place.

Question 34HIPAA and Compliance

Under the Privacy Rule, when may a covered entity disclose PHI to law enforcement without patient authorization?

  1. When the disclosure responds to a valid legal process or a limited set of permitted circumstances Correct answer.
  2. Whenever any officer verbally requests it
  3. Only after the patient's employer consents
  4. Only with a court order in every situation

Explanation

The Privacy Rule permits disclosures to law enforcement in specified circumstances, such as in response to a court order, warrant, or subpoena meeting requirements, or to identify or locate a suspect under limited conditions. A verbal request alone is generally insufficient.

Question 35HIPAA and Compliance

Which statement best describes the HIPAA Privacy Rule's treatment of psychotherapy notes?

  1. They are excluded from PHI entirely
  2. They generally require specific authorization for disclosure, separate from the rest of the record Correct answer.
  3. They may be disclosed to employers without authorization
  4. They may be freely shared for any health care operations purpose

Explanation

Psychotherapy notes receive heightened protection and generally require a specific authorization for disclosure, even in many circumstances where other PHI could be shared. They remain PHI but are subject to stricter rules.

Question 36HIPAA and Compliance

What is the main purpose of the HIPAA Breach Notification Rule?

  1. To require covered entities to notify affected individuals and HHS after certain breaches of unsecured PHI Correct answer.
  2. To set reimbursement rates for telehealth services
  3. To require encryption of all paper records
  4. To establish clinical documentation standards

Explanation

The Breach Notification Rule establishes obligations to notify affected individuals, HHS, and in some cases the media when a breach of unsecured PHI occurs. It does not set reimbursement, require paper encryption, or prescribe clinical documentation.

Question 37HIPAA and Compliance

A covered entity wants to contact a patient about a treatment alternative. Which statement is most accurate under the Privacy Rule?

  1. Only a business associate may send treatment communications
  2. Treatment communications are generally permitted without authorization Correct answer.
  3. Treatment communications are prohibited unless the patient opts in
  4. Any communication about treatment requires written authorization

Explanation

Communications about treatment alternatives or health-related benefits are generally part of treatment or health care operations and do not require authorization, though marketing rules may apply if remuneration is involved. The other options overstate restrictions.

Question 38HIPAA and Compliance

A business associate subcontracts part of its work involving PHI to another company. What is generally required?

  1. A written agreement flowing down the applicable safeguards to the subcontractor Correct answer.
  2. Approval by the affected patients before subcontracting
  3. No agreement, because the subcontractor is not a covered entity
  4. Only a verbal assurance of confidentiality

Explanation

Business associates must ensure that subcontractors that create, receive, maintain, or transmit PHI on their behalf agree in writing to appropriate safeguards, effectively flowing down the obligations. Patient-by-patient approval is not required.

Question 39Scheduling

A project manager is developing the project schedule and needs to determine the sequence of activities. Which technique is used to identify the logical relationships between project activities?

  1. Critical path method
  2. Resource leveling
  3. Precedence diagramming method Correct answer.
  4. Schedule compression

Explanation

The precedence diagramming method (PDM) is a technique used to create a project schedule network diagram that shows activities and their dependencies. It uses boxes and arrows to represent activities and their sequence. The critical path method is used to estimate duration and determine schedule flexibility, not to sequence activities.

Question 40Scheduling

Which of the following is an example of a mandatory dependency?

  1. A best practice to perform testing after coding
  2. A preferred sequence based on team experience
  3. A discretionary dependency based on historical data
  4. A contractual requirement to complete design before construction Correct answer.

Explanation

Mandatory dependencies are those that are legally or contractually required or inherent in the nature of the work. A contractual requirement to complete design before construction is a classic example. Discretionary dependencies are based on best practices or preferences and are not mandatory.

Question 41Scheduling

A project manager is estimating the duration of activities and wants to incorporate uncertainty. Which technique uses three-point estimates to calculate an expected duration?

  1. Program evaluation and review technique (PERT) Correct answer.
  2. Parametric estimating
  3. Bottom-up estimating
  4. Analogous estimating

Explanation

PERT uses three-point estimates (optimistic, pessimistic, and most likely) to calculate a weighted average expected duration, incorporating uncertainty. Analogous and parametric estimating are not based on three-point estimates. Bottom-up estimating aggregates individual estimates but does not inherently use three points.

Question 42Scheduling

Which of the following is a key benefit of developing a project schedule network diagram?

  1. It defines the project scope.
  2. It identifies the critical path and shows activity sequences. Correct answer.
  3. It determines the project budget.
  4. It assigns resources to activities.

Explanation

A project schedule network diagram visually shows the sequence of activities and their dependencies, which helps identify the critical path and understand the project flow. It does not determine the budget, assign resources, or define scope; those are separate processes.

Question 43Scheduling

A project manager is reviewing the schedule and notices that two activities are scheduled to occur at the same time but require the same specialized equipment. What is the best technique to resolve this overallocation?

  1. Crashing
  2. Fast tracking
  3. Resource leveling Correct answer.
  4. Schedule compression

Explanation

Resource leveling is used to adjust the schedule to resolve resource overallocation, often by delaying activities or adjusting their start and finish dates. Crashing and fast tracking are schedule compression techniques that may exacerbate resource issues. Schedule compression is a general term that includes crashing and fast tracking.

Question 44Scheduling

In a project schedule, the critical path is best described as:

  1. The longest path through the network diagram, determining the shortest project duration. Correct answer.
  2. The path with the most activities.
  3. The path with the most resources.
  4. The path with the highest risk.

Explanation

The critical path is the longest path through the project network diagram and determines the shortest possible project duration. It has zero total float. Paths with the most activities or resources are not necessarily critical.

Question 45Scheduling

A project manager is using a schedule network diagram and wants to determine the early start and early finish dates for activities. Which technique should be used?

  1. Forward pass Correct answer.
  2. Schedule baseline
  3. Critical path method
  4. Backward pass

Explanation

A forward pass calculates the early start and early finish dates for each activity by working from the start of the project to the end. A backward pass calculates late start and late finish dates. The critical path method uses both passes to determine float.

Question 46Scheduling

Which of the following is an example of a discretionary dependency?

  1. A preference to complete all documentation before testing Correct answer.
  2. A legal requirement to obtain a permit before construction
  3. A contractual milestone requiring approval before proceeding
  4. A mandatory safety inspection before operation

Explanation

Discretionary dependencies are established based on best practices or project preferences, such as completing documentation before testing. Mandatory dependencies are legally or contractually required, such as safety inspections, contractual milestones, and permits.

Question 47Scheduling

A project manager is estimating activity durations and uses a formula that is based on the quantity of work multiplied by a productivity rate. Which estimating technique is being used?

  1. Reserve analysis
  2. Parametric estimating Correct answer.
  3. Three-point estimating
  4. Analogous estimating

Explanation

Parametric estimating uses a statistical relationship between historical data and other variables (e.g., quantity of work multiplied by productivity rate) to calculate duration estimates. Analogous estimating uses expert judgment and historical data from similar projects. Three-point estimating uses optimistic, pessimistic, and most likely estimates. Reserve analysis is used to determine contingency reserves.

Question 48Scheduling

A project manager is developing the schedule and needs to compress the project duration without reducing scope. Which technique involves adding resources to critical path activities?

  1. Crashing Correct answer.
  2. Fast tracking
  3. Schedule baseline
  4. Resource leveling

Explanation

Crashing is a schedule compression technique that involves adding resources to critical path activities to shorten the project duration, often at increased cost. Fast tracking involves overlapping activities, which may increase risk. Resource leveling adjusts the schedule to resolve resource overallocation. Schedule baseline is the approved schedule.

Question 49Scheduling

A project manager is calculating the total float for an activity. The early start is day 5, early finish is day 10, late start is day 7, and late finish is day 12. What is the total float?

  1. 7 days
  2. 5 days
  3. 10 days
  4. 2 days Correct answer.

Explanation

Total float is calculated as late start minus early start or late finish minus early finish. Here, 7 - 5 = 2 days or 12 - 10 = 2 days. Therefore, the total float is 2 days.

Question 50Scheduling

Which of the following best describes the purpose of a schedule baseline?

  1. To document the original project scope.
  2. To track actual performance against the planned schedule. Correct answer.
  3. To define the project budget.
  4. To assign resources to activities.

Explanation

The schedule baseline is the approved version of the project schedule, used to compare actual performance against the plan and to measure schedule variance. It does not document scope, assign resources, or define the budget.