CMAA NHA Certified Medical Administrative Assistant - Set 3 - Part 1

Correct Answer: Negligence with four elements

Negligence requires the plaintiff to show duty, dereliction or breach, damages, and direct cause, often called the four Ds, and malpractice is negligence by a professional measured against the relevant specialty standard. Option a is incorrect because battery is unwanted intentional touching, which would apply to a procedure performed without consent rather than to a failure to follow the standard of care that this scenario actually describes. Option b is incorrect because false imprisonment involves restricting a patient's freedom to leave without legal grounds, which is a different tort from the standard-of-care breach the patient is alleging in this complaint. Option d is incorrect because breach of insurance contract concerns disputes between insurer and insured rather than the patient's claim that a clinician's care fell below the standard expected of a reasonable practitioner here.

Correct Answer: Patient abandonment

Patient abandonment occurs when a clinician unilaterally and without notice ends the patient relationship while care is still needed, and the patient suffers harm because of the interruption in treatment. Option b is incorrect because an express written contract would be an explicit document with stated terms; the issue here is the unilateral termination of an existing relationship rather than the wording of a written agreement. Option c is incorrect because implied informed consent applies in emergencies for unconscious patients; it does not describe the practice ending care while the patient still needs treatment and suffering harm as a result. Option d is incorrect because the statute of limitations sets a time window for filing a lawsuit, which is unrelated to whether the practice's conduct itself counts as abandonment under tort principles in this scenario.

Correct Answer: Written notice; emergency window; record offer

Accepted practice includes written notice often by certified mail, a reasonable emergency window such as thirty days, an offer to assist in finding a new provider, and an offer to transfer records on authorization. Option a is incorrect because verbal notice alone does not document the closure, leaves the patient without written information, and falls short of the formal steps that protect both the patient and the practice from abandonment claims. Option b is incorrect because an immediate cutoff with no transfer assistance fails the duty to provide a reasonable bridge for emergencies and to support continuity, which is the conduct most likely to be judged abandonment. Option c is incorrect because backdating closure to a prior visit creates a false record, which is itself a serious legal and ethical violation; documentation must reflect the actual sequence and timing of the termination process.

Correct Answer: Forward to manager or compliance officer

An attorney-signed subpoena requires careful processing under HIPAA, often needing patient authorization or a qualified protective order, so the CMAA forwards it to the manager, compliance officer, or attorney for review. Option a is incorrect because releasing records immediately can violate HIPAA when the subpoena lacks the required notice or protective order, exposing the practice to civil and regulatory penalties for an improper disclosure of protected information. Option c is incorrect because throwing the subpoena away avoids the legal process, which can lead to contempt findings and additional liability for the practice; the document must be handled rather than discarded by the staff member. Option d is incorrect because calling the patient and refusing delivery does not address the legal request and can complicate the process; the document still requires routing to the people with the authority to evaluate it.

Correct Answer: Defamation through verbal statements

Defamation involves communicating false statements that damage another's reputation; spoken defamation is slander while written is libel, and both can apply in medical settings if statements are inaccurate and harmful. Option a is incorrect because false imprisonment involves restricting a patient's freedom to leave without legal grounds, which is a different concept from spreading false statements that damage someone's reputation in a public space. Option b is incorrect because battery is unwanted intentional touching, which would apply to a procedure or contact performed without consent rather than to false statements made about a patient by a staff member. Option d is incorrect because invasion of privacy through photographs requires releasing or capturing images without authorization, which is distinct from the verbal spreading of inaccurate information that this scenario describes overall.

Correct Answer: Patient's Bill of Rights

The Patient's Bill of Rights articulates rights such as high-quality care, information, informed consent, refusal, privacy, confidentiality, access to records, and the right to file complaints without retaliation against the patient. Option b is incorrect because the OSHA Bloodborne Pathogens Standard protects workers from exposure to infectious materials, which is a workplace safety regulation rather than a statement of patient rights at registration. Option c is incorrect because the Joint Commission Universal Protocol covers pre-procedure verification, site marking, and time-out for invasive procedures rather than the patient rights framework being summarized for the new patient today. Option d is incorrect because the ICD-10-CM Coding Guidelines describe how to assign diagnosis codes, which is a coding reference rather than a statement of patient rights extended at registration to inform new patients.

Correct Answer: Affordable Care Act

The Affordable Care Act prohibits coverage denial for pre-existing conditions, ends lifetime and annual limits on essential benefits, requires plain-language summaries, and extends multiple consumer protections to insured patients across markets. Option a is incorrect because the OSHA Hazard Communication Standard governs labels, safety data sheets, and chemical training in workplaces, which is unrelated to the insurance protections the patient is asking the CMAA to describe. Option b is incorrect because the False Claims Act prohibits knowingly submitting false claims to the government, which addresses billing fraud rather than the patient insurance protections that the ACA puts in place under federal rules. Option c is incorrect because the Anti-Kickback Statute prohibits payments for referrals of federal-program services and concerns provider-payer relationships rather than the consumer protections the patient is asking the CMAA to describe.

Correct Answer: Direct to patient advocate or manager

Practices direct complaints to the appropriate channel, often a patient advocate or manager, and the framework protects the patient from retaliation while supporting investigation, response, and any needed corrective action. Option a is incorrect because telling the patient that complaints are not allowed contradicts the rights framework the practice has adopted and discourages legitimate feedback that protects both patients and the clinic over time. Option b is incorrect because discouraging the filing to keep peace ignores the patient's right and prevents the practice from learning about real concerns that may signal larger issues with care or staff conduct. Option d is incorrect because promising the staff will be fired commits to an outcome before the matter has been investigated, which exceeds the CMAA's authority and risks both unfair process and additional legal exposure.

Correct Answer: Right to examine bills

The right to examine bills supports informed engagement with charges, which lets the patient verify accuracy, identify errors, and pursue the financial-counseling and dispute paths available through the practice's rights framework. Option b is incorrect because the right to refuse therapy concerns clinical decisions about treatment rather than billing transparency, so it is not the principle that explains the itemized statement the patient is requesting today. Option c is incorrect because the right to formulate advance directives supports decisions about future care during incapacity, which is unrelated to the request to receive an itemized explanation of charges from a recent visit. Option d is incorrect because the right to refuse research participation protects patient autonomy in research enrollment, which is not the principle behind providing an itemized billing statement after a routine clinical visit at the practice.

Correct Answer: Rights pair with shared responsibilities

Many practices pair patient rights with shared responsibilities, such as providing accurate information, following plans of care, being considerate, paying obligations, and reporting changes, balancing autonomy with cooperation across the relationship. Option a is incorrect because rights apply to patients in this framework rather than to staff, so the principle that rights apply only to staff misrepresents the structure of the rights and responsibilities document at the practice. Option b is incorrect because responsibilities do not replace rights; they accompany them, since the framework retains the patient's protections while also asking for cooperation that supports safe and effective care for everyone. Option c is incorrect because rights do not expire after one visit, since the framework is built into the ongoing relationship and continues to apply as long as the patient receives care from the practice over time.

Correct Answer: Notice of Privacy Practices

HIPAA requires every covered entity to provide a Notice of Privacy Practices at first encounter, post it visibly, and obtain acknowledgment of receipt, describing uses, disclosures, patient rights, and complaint paths for the patient. Option a is incorrect because the Advance Beneficiary Notice informs Medicare patients that a service may not be covered, which is a different document tied to medical-necessity decisions and Medicare billing rather than HIPAA's privacy notice. Option b is incorrect because the Assignment of Benefits authorizes the insurer to pay the practice directly rather than the patient, which is a billing form rather than the HIPAA privacy notice the patient mentions. Option d is incorrect because the Authorization for Treatment supports the general clinical care plan but is not the HIPAA privacy notice; the privacy notice describes uses and disclosures of protected information rather than treatment consent.

Correct Answer: Business Associate Agreement

A Business Associate Agreement is a written contract that imposes specific HIPAA obligations on a vendor handling protected health information on behalf of a covered entity, with direct liability for the vendor under HIPAA rules. Option a is incorrect because an open enrollment notice describes insurance enrollment windows for plans, which is unrelated to the HIPAA-required vendor contract that imposes specific privacy and security obligations on the billing service in this scenario. Option c is incorrect because an ABN with modifier GA documents Medicare medical-necessity decisions for a specific service rather than the vendor relationship described, so it is not the agreement the compliance officer requires. Option d is incorrect because a letter of medical necessity supports clinical justification for a specific service, which is unrelated to the HIPAA-required vendor agreement the compliance officer is asking the practice to put in place.

Correct Answer: Within thirty days; one extension allowed

HIPAA gives the patient a right to inspect and obtain a copy of the designated record set generally within thirty days, with one fee-based extension permitted, plus reasonable cost-based fees per applicable limits. Option b is incorrect because five business days is shorter than HIPAA's standard time frame and does not match the federal access timeline, which gives covered entities thirty days to fulfill the request with one allowed extension. Option c is incorrect because a twenty-four-hour requirement is not HIPAA's access rule; that rule sets a thirty-day standard with an allowed extension, with state laws sometimes setting tighter time frames in particular jurisdictions. Option d is incorrect because a one-year time frame is far longer than HIPAA's access rule allows and would frustrate the patient's right to records, which is built around a thirty-day standard with one possible extension.

Correct Answer: TPO does not require authorization

Treatment, payment, and operations, called TPO, describe the routine uses of protected health information that generally do not require specific patient authorization, while uses outside TPO and outside listed public-purpose disclosures require authorization. Option a is incorrect because requiring authorization for all disclosures would halt routine treatment and billing across health care, which is precisely why the privacy rule built the TPO framework to support continuous operations under federal law. Option b is incorrect because billing falls within the payment portion of TPO and does not require specific authorization for routine claim submission; specific authorization is required for uses outside TPO and outside listed public-purpose disclosures. Option d is incorrect because huddles to coordinate care fall within treatment and operations and do not require specific authorization, since the practice's care team relies on routine information sharing to deliver safe coordin

Correct Answer: Minimum necessary standard

The minimum necessary standard limits use, disclosure, and request of protected information to the smallest amount needed for the purpose, with exceptions for disclosures to the patient and to providers for treatment under federal rules. Option a is incorrect because maximum disclosure is not the rule; the privacy rule was built around a minimum-necessary standard precisely to prevent unnecessary sharing of protected information beyond what the purpose actually requires. Option b is incorrect because open access to everyone runs counter to the privacy rule's protections and to role-based access controls that limit who can see what within the chart for compliant operations. Option c is incorrect because the audit log requirement applies to recording every access in the system rather than the volume of information shared in a particular disclosure to an outside consultant for the patient.

Correct Answer: Tier 3 willful neglect corrected

Tier 3 of the HIPAA civil penalty structure applies when the entity knew or should have known and acted with conscious disregard but corrected the violation within thirty days, with adjusted penalties published annually. Option b is incorrect because Tier 1 applies when the entity did not know and could not have known of the violation, which does not match a finding that the entity knew or should have known of the issue. Option c is incorrect because Tier 2 applies when there was reasonable cause but no willful neglect, which does not match the conscious disregard finding the compliance officer documented in this particular case. Option d is incorrect because Tier 4 applies to willful neglect that is not corrected, which differs from this case where the violation was corrected within the thirty-day window after the entity recognized the issue.

Correct Answer: Termination plus possible federal action

Knowingly obtaining or disclosing protected information for personal use can result in employment termination and federal criminal action, with penalties scaling up when the access is for personal gain or malicious intent. Option a is incorrect because no consequences would conflict with both the practice's sanction policy and federal criminal penalties for knowingly accessing or disclosing protected information without proper authorization at the entity. Option b is incorrect because promotion for digital skills makes no sense in the context of a deliberate privacy breach, since the conduct violates federal law and basic professional standards rather than demonstrating positive performance. Option d is incorrect because a quiet bonus would compound the violation by attempting to conceal it, which is itself a problem under both employment law and HIPAA enforcement and would not reduce the underlying liability.

Correct Answer: Individuals; HHS; prominent media outlet

Breaches affecting five hundred or more individuals in a single state require notice to the affected individuals, notice to HHS, and notification to a prominent media outlet under the federal breach notification rule. Option a is incorrect because individuals must be notified, but federal notice and media notice are also required for breaches above the five-hundred threshold in a single jurisdiction; individual notice alone falls short of the rule. Option c is incorrect because HHS must be notified, but individuals and a prominent media outlet must also receive notice when the breach affects more than five hundred people in a single state under the federal rule. Option d is incorrect because notifying family members and the insurer is not the structure required by the breach notification rule, which sets specific notice obligations to the affected individuals, to HHS, and to the public.

Correct Answer: Harm; history; finance; cooperation

OCR considers the nature and extent of harm, the entity's history of compliance, financial condition, and cooperation in the investigation when determining penalties, alongside the specific facts of the alleged violation under review. Option a is incorrect because marketing volume and vacation policy are unrelated to OCR enforcement criteria, which focus on the nature of the violation and the entity's compliance posture rather than operational marketing details. Option b is incorrect because color scheme, logo, and signage have no role in enforcement weighting under OCR criteria, which focuses on harm, history, finances, and cooperation rather than visual branding details for the practice. Option c is incorrect because lunch hours and parking lot size are operational facts unrelated to OCR's enforcement considerations, which focus on the violation itself and the entity's compliance record rather than physical workplace logistics.

Correct Answer: HIPAA grants no private action

HIPAA itself does not create a private right of action for individuals; complaints go to the entity and to OCR, while state laws and common-law theories may sometimes provide separate avenues for individual recovery. Option b is incorrect because HIPAA does not grant a private right of action; the rule channels enforcement through OCR and through state attorneys general under HITECH rather than through individual lawsuits brought directly under the act. Option c is incorrect because individual patients do not always recover full damages, since HIPAA has no private right of action and state-law claims depend on cause of action and proof of harm. Option d is incorrect because HIPAA does not bar state-law claims; in fact, state laws often provide separate avenues for harmed individuals to pursue remedies for privacy breaches that may parallel HIPAA's federal enforcement model.