CCA (CNCF) common mistakes
CCA · Understand the traps and how to avoid them.
Assigning an ICD-10-PCS root operation based on the procedure's clinical name rather than verifying what the surgeon actually did (e.g., coding 'excision' when the documentation shows the entire lesion was cut out with a margin and the intent was removal of the whole body part, which is 'resection').
Candidates memorize procedure names as they appear in operative reports and skip the root-operation decision tree. PCS is built on the intent and the object of the procedure, and the same clinical label can map to different root operations depending on depth and intent.
What to do instead
Before selecting a PCS code, write down the objective (what the surgeon did to the body part), then walk the root-operation definitions: is the whole body part removed (resection) or only part (excision)? Is the site only inspected (inspection) or also treated? Check the index entry and confirm the character definitions in the table rather than trusting the index alone.
Stopping at the first plausible code in the ICD-10-CM alphabetic index without verifying the tabular list, missing Excludes1 notes, laterality, 7th-character episode of care, or combination-code rules.
The index is fast and gives a code, so candidates treat it as the final answer. Excludes1, code-first, and 7th-character requirements live in the tabular list, which is where the actual coding decision is finalized.
What to do instead
Adopt a fixed two-step habit: index for a candidate, tabular list for validation. At the tabular entry, explicitly check for Excludes1/Excludes2, code-first or use-additional-code instructions, laterality, and whether a 7th character is required. Treat any index entry with a dash or 'see' as incomplete until verified.
Applying the wrong sequencing rule for the principal diagnosis - choosing the condition that prompted admission versus the condition chiefly responsible for the encounter - especially when a combination code or an etiology/manifestation pair is involved.
Candidates conflate 'reason for admission' with 'principal diagnosis' and forget that the underlying condition is sequenced before the manifestation. Inpatient and outpatient guidelines also differ, and candidates apply one set of rules to both settings.
What to do instead
State the setting first (inpatient vs. outpatient), then apply that guideline set. For etiology/manifestation pairs, code the underlying cause first and the manifestation second. For combination codes, use the single code that captures both and resist adding a redundant secondary code.
Selecting a data element or value set based on its display name without checking the definition, allowable values, and version, and without confirming the measure or registry specification actually requires that element.
Data element names look self-explanatory, and candidates assume a familiar label means the same thing across systems. Value sets change between releases and a display name can hide different inclusion criteria.
What to do instead
For every data element, read the definition, data type, and value set OID/version before using it. Cross-check against the specification's required-element list and note the version date. If the definition and the display name conflict, the definition governs.
Mixing up terminology standards with classification standards and message-format standards - for example, using SNOMED CT where a classification (ICD-10-CM) is required, or confusing HL7 FHIR with a terminology system.
Candidates learn acronyms in isolation and treat all 'standards' as interchangeable. The exam tests whether you know which standard serves which purpose: classification for reporting, terminology for clinical granularity, and interchange formats for transport.
What to do instead
Build a three-column mental table: classification (ICD-10-CM/PCS, used for morbidity/mortality and reimbursement), clinical terminology (SNOMED CT, LOINC, RxNorm, used for meaning and interoperability), and interchange (HL7 v2, FHIR, used for messaging). When a question asks for a standard, first identify the purpose, then pick from the matching column.
Ignoring the difference between a data dictionary, a data model, and a data quality dimension when answering structure questions, and answering with a generic 'data governance' response.
These concepts overlap in practice, so candidates default to the broadest term. The exam distinguishes metadata artifacts (dictionary), structural design (model), and measurement of fitness (quality dimensions such as completeness, accuracy, timeliness).
What to do instead
Map the question to the artifact it describes. If it asks where a definition and allowable values live, that is the data dictionary. If it asks how entities relate, that is the data model. If it asks whether the data are fit for use, name the specific quality dimension rather than saying 'good data quality'.
Treating information governance as an IT function and answering with technical controls instead of governance structures - assigning accountability, stewardship, policy, and decision rights.
Candidates equate governance with security or infrastructure because those are visible. Governance questions test who owns the data, who is accountable for quality, and how decisions are made and documented.
What to do instead
For governance items, ask 'who decides and who is accountable?' rather than 'what system enforces it?' Expect answers involving data owners, data stewards, a governance council, policy and standards approval, and documented decision rights. Distinguish stewardship (operational responsibility) from ownership (accountability).
Overlooking the minimum necessary standard and role-based access when answering privacy and security questions, and defaulting to 'restrict all access' as the safe answer.
Candidates think the most restrictive answer is always correct. In practice, minimum necessary permits the access needed for the task, and role-based access is the mechanism that operationalizes it; blanket denial is neither required nor workable.
What to do instead
Frame each privacy item around purpose: does this role need this data for this task? The correct answer usually authorizes role-appropriate access while limiting scope, and requires documented policies, audit trails, and workforce training. Reserve outright denial for cases where no treatment, payment, or operations purpose exists.
Confusing the components of the revenue cycle - charge capture, coding, claim scrub, denial management, and remittance posting - and attributing a failure to the wrong stage when diagnosing a claim problem.
Candidates know the stages by name but not by output. A denial caused by a missing modifier originates in coding/charge capture, not in the billing office, and candidates misplace the root cause and therefore the corrective action.
What to do instead
Learn the cycle as a chain of handoffs with a defined output at each step: documentation to code, code to charge, charge to claim, claim to payer, remittance to posting. When given a symptom, trace backward to the first stage where the defect could have entered, and target the fix there.
Answering compliance questions by naming a law (e.g., 'that violates HIPAA') without identifying the specific requirement, the covered entity's obligation, or the required corrective action such as an audit, disclosure accounting, or breach notification.
Candidates recognize a regulation's name and stop there. Compliance items usually test the operational obligation - what must be done, documented, and reported - not just which statute applies.
What to do instead
Answer in three parts: the requirement (what the rule mandates), the entity's duty (policy, training, monitoring, documentation), and the response (corrective action, notification timeline, or reporting). If a question asks what to do next, choose the action that both remediates and documents the issue.