Certified Professional Coder (CPC) Quiz: Fraud And Compliance Rules
20 questions · exam conditions
0:00
Fraud And Compliance RulesQuestion 1 of 20

A medical coder, new to a specialty, notices that the physician routinely bills for a comprehensive metabolic panel for every patient, regardless of their presenting problem. When asked, the physician states it's "just easier" than selecting individual tests. This practice results in unnecessary costs to the Medicare program. This is an example of:

Fraud
Abuse
A HIPAA violation
An appropriate use of panel codes
← Back to quizzes

Certified Professional Coder (CPC) Quiz

Certified Professional Coder (CPC) Quiz: Fraud And Compliance Rules

Practice Fraud And Compliance Rules in Certified Professional Coder (CPC) with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Fraud And Compliance Rules, giving you a quick way to practice the rules, question types, and explanations that matter most for Certified Professional Coder (CPC).

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A medical coder, new to a specialty, notices that the physician routinely bills for a comprehensive metabolic panel for every patient, regardless of their presenting problem. When asked, the physician states it's "just easier" than selecting individual tests. This practice results in unnecessary costs to the Medicare program. This is an example of:

  1. Fraud
  2. Abuse (correct answer)
  3. A HIPAA violation
  4. An appropriate use of panel codes
Explanation: This is an example of abuse. Abuse involves actions that are inconsistent with sound medical, fiscal, or business practices, and result in an unnecessary cost or reimbursement for services that are not medically necessary. While not intentionally deceptive, the physician's disregard for medical necessity and proper coding constitutes abuse.

Question 2

A patient's friend calls the physician's office to ask about the patient's test results. The office receptionist checks the patient's file, which does not contain an authorization to release information to this individual. How should the receptionist respond?

  1. Provide the results since the caller is a friend and seems concerned.
  2. State that due to privacy rules, they cannot provide any information without the patient's explicit consent. (correct answer)
  3. Inform the friend that the results are normal but provide no further details.
  4. Ask the friend to verify the patient's date of birth and then provide the results.
Explanation: Under the HIPAA Privacy Rule, a covered entity cannot disclose Protected Health Information (PHI) to anyone other than the patient or the patient's authorized representative without explicit consent. The correct response is to decline the request, citing privacy regulations.

Question 3

The billing department of a hospital needs to access patient records to submit claims. According to the HIPAA Privacy Rule's "minimum necessary" standard, what information are they permitted to access?

  1. The entire medical record for every patient to ensure complete accuracy.
  2. Only the specific demographic and clinical information needed to complete the claim form for the services rendered. (correct answer)
  3. Any information in the record except for psychotherapy notes.
  4. Only the patient's name and insurance information.
Explanation: The minimum necessary standard requires covered entities to limit the use and disclosure of Protected Health Information (PHI) to the minimum amount necessary to accomplish the intended purpose. For billing, this includes demographics, insurance information, dates of service, procedures, and diagnoses, but not the entire detailed clinical record.

Question 4

A coder at a surgery center bills separately for a surgical approach, the main surgical procedure, and the surgical closure. These are all considered integral parts of the main surgical procedure according to standard coding guidelines. This practice is an example of:

  1. Upcoding
  2. Unbundling (correct answer)
  3. A reasonable coding practice
  4. Double billing
Explanation: Unbundling is the practice of billing individual components of a service as separate procedures when a single, comprehensive code exists that includes all of those components. The surgical approach and standard closure are almost always included in the global surgical package for the main procedure.

Question 5

A physician provides a service to a Medicare patient that the physician believes may not be considered medically necessary by Medicare. A properly executed Advance Beneficiary Notice (ABN) was signed by the patient before the service was provided. Which modifier should be appended to the CPT code on the claim?

  1. GA (correct answer)
  2. GX
  3. GY
  4. GZ
Explanation: Modifier GA (Waiver of liability statement issued as required by payer policy) is used to indicate that a required ABN is on file because a service is expected to be denied as not reasonable and necessary. This transfers potential financial liability to the patient if Medicare denies the claim.

Question 6

A physician reports a CPT code with a Medically Unlikely Edit (MUE) value of 2. The claim is submitted with 3 units of service for a single date of service. What is the most likely outcome for this claim line?

  1. All 3 units will be paid without issue.
  2. The first 2 units will be paid, and the 3rd unit will be automatically denied. (correct answer)
  3. The entire line will be denied because it exceeds the MUE value.
  4. The payer will request medical records before paying for any of the units.
Explanation: Medically Unlikely Edits (MUEs) set the maximum number of units of service a provider would report for a single beneficiary on a single date of service. For a claim line exceeding the MUE value, Medicare Administrative Contractors (MACs) will typically pay for the units up to the MUE value and deny the excess units.

Question 7

A physician who has an ownership interest in a local imaging center refers his Medicare patients to that center for all their MRI needs. This arrangement may violate which of the following regulations?

  1. The HIPAA Privacy Rule
  2. The Anti-Kickback Statute
  3. The Physician Self-Referral Law (Stark Law) (correct answer)
  4. The National Correct Coding Initiative (NCCI)
Explanation: The Physician Self-Referral Law, commonly known as the Stark Law, prohibits physicians from referring Medicare or Medicaid patients for designated health services (DHS), such as imaging, to an entity with which the physician or an immediate family member has a financial relationship, unless a specific exception applies.

Question 8

A medical assistant at a large clinic loses an unencrypted personal laptop containing the names, social security numbers, and diagnoses of over 600 patients. What is the clinic's primary responsibility under the HIPAA Breach Notification Rule?

  1. Notify each affected individual, the Secretary of HHS, and prominent media outlets. (correct answer)
  2. Terminate the medical assistant immediately.
  3. Notify only the local police department about the lost laptop.
  4. Offer free credit monitoring to the affected patients, as no formal notification is required.
Explanation: For a breach of unsecured Protected Health Information (PHI) affecting 500 or more individuals, the HIPAA Breach Notification Rule requires the covered entity to provide notice to each affected individual, to the Secretary of Health and Human Services (HHS), and to prominent media outlets serving the relevant state or jurisdiction.

Question 9

An office is scheduling a Medicare patient for a diagnostic test. Which of the following situations would be a "triggering event" that necessitates providing the patient with an Advance Beneficiary Notice (ABN)?

  1. The patient is being scheduled for their annual wellness visit.
  2. The patient's diagnosis code does not support medical necessity for the test according to a Local Coverage Determination (LCD). (correct answer)
  3. The patient requests a copy of their medical records.
  4. The test is being performed pre-operatively for a covered surgical procedure.
Explanation: A triggering event for an ABN occurs when a provider has reason to believe a service, which is otherwise covered, may be denied by Medicare because it is not considered reasonable and necessary. An LCD that indicates non-coverage for a specific diagnosis is a common example of such a reason, triggering the need to inform the patient of potential financial liability.

Question 10

A patient has a lesion removed from their right arm and a completely separate, unrelated lesion removed from their left leg during the same encounter. The NCCI edit bundles the two excision codes. Which modifier would be most appropriate to indicate the two procedures were performed on separate anatomic sites?

  1. Modifier 51
  2. Modifier 59
  3. Modifier XS (correct answer)
  4. Modifier 25
Explanation: Modifier XS (Separate Structure) is one of the more specific X-modifiers used in place of modifier 59. It correctly identifies that the service is distinct because it was performed on a separate organ or structure (in this case, the right arm versus the left leg). This is the most precise modifier for this scenario.

Question 11

A physician's office hires a third-party company to handle its billing. This company will have access to patient demographic, insurance, and diagnosis information. Under HIPAA, what is required to permit this relationship?

  1. Nothing is required, as the company is not a healthcare provider.
  2. The office must have the company sign a Business Associate Agreement (BAA). (correct answer)
  3. The office must get specific authorization from every patient before sending their information to the billing company.
  4. The billing company must become a fully HIPAA-covered entity.
Explanation: A third-party company that performs a function on behalf of a covered entity and has access to PHI is a Business Associate. HIPAA requires a signed Business Associate Agreement (BAA) between the covered entity and the business associate. This BAA contractually requires the business associate to protect the PHI it handles.

Question 12

A billing office discovers a single instance where a coder mistakenly used a higher-level E/M code for a patient visit, resulting in an overpayment of $40. The error was unintentional, the overpayment was returned, and the coder was retrained. This event would most likely be classified as:

  1. Fraud
  2. Waste
  3. Abuse
  4. An error (correct answer)
Explanation: This scenario represents an error - a single, unintentional mistake that was promptly identified, corrected, and addressed through training. Fraud requires intent to deceive, abuse involves a pattern of practices inconsistent with accepted medical practice, and waste typically refers to overutilization of services. The corrective actions taken demonstrate this was an isolated error.

Question 13

A physician is on vacation for a week. The office staff continues to bill for daily hospital visits for several of the physician's inpatients, even though the physician is out of the country and no covering physician saw the patients. This is an example of:

  1. A HIPAA security incident
  2. Billing for services not rendered (correct answer)
  3. A violation of the Stark Law
  4. An acceptable "incident-to" billing practice
Explanation: This is a clear example of fraud, specifically billing for services not rendered or provided. This is one of the most serious types of healthcare fraud and involves submitting claims for services that were never performed.

Question 14

A durable medical equipment (DME) company offers a physician a cash payment for every patient they refer for a specialized wheelchair. Both parties knowingly and willfully enter into this agreement. This is a potential violation of the:

  1. Stark Law
  2. Anti-Kickback Statute (correct answer)
  3. Emergency Medical Treatment and Labor Act (EMTALA)
  4. Health Insurance Portability and Accountability Act (HIPAA)
Explanation: The Anti-Kickback Statute (AKS) is a criminal law that prohibits the knowing and willful payment of remuneration (such as cash) to induce or reward patient referrals for items or services payable by a Federal health care program. This scenario is a classic example of an illegal kickback.

Question 15

The office staff at a neurology practice obtains a signed ABN from a Medicare patient for a service that may be denied for medical necessity. However, they forget to give the patient a copy of the signed form. Is the ABN considered valid?

  1. Yes, as long as the office has the original signed copy on file.
  2. Yes, because the patient was notified verbally of their potential liability.
  3. No, the ABN is not considered valid unless the patient receives a copy. (correct answer)
  4. No, because ABNs are not used in a neurology practice.
Explanation: For an Advance Beneficiary Notice (ABN) to be considered valid, several criteria must be met. These include that the notice must be properly completed, signed by the beneficiary or their representative, and a copy must be given to the beneficiary before the service is provided. Failure to provide a copy invalidates the notice.

Question 16

A physician practice consistently bills Evaluation and Management (E/M) services at a higher level than what is supported by the medical record documentation. An internal audit reveals a pattern of this behavior, which the physician knowingly instructed the coder to perform to increase revenue. What does this practice represent?

  1. Fraud (correct answer)
  2. Abuse
  3. An acceptable billing practice
  4. A violation of the Stark Law
Explanation: This scenario describes fraud. Fraud is the intentional deception or misrepresentation that an individual knows to be false and that could result in some unauthorized benefit. The keywords "knowingly instructed" indicate intent, which is the key element that distinguishes fraud from abuse. Upcoding is a classic example of healthcare fraud.

Question 17

A provider performs a procedure they know is not medically necessary for a Medicare patient. The provider fails to obtain an Advance Beneficiary Notice (ABN) from the patient prior to the service. How should this service be reported on the claim form?

  1. Do not bill Medicare for the service and bill the patient directly.
  2. Bill Medicare with modifier GZ appended to the procedure code. (correct answer)
  3. Bill Medicare with modifier GA, even though an ABN was not signed.
  4. Bill Medicare without any modifiers and appeal the denial when it is received.
Explanation: Modifier GZ (Item or service expected to be denied as not reasonable and necessary) is used when the provider expects a denial for lack of medical necessity but did not obtain an ABN. Appending modifier GZ automatically assigns financial liability to the provider, meaning they cannot bill the patient for the service.

Question 18

A Medicare patient is scheduled for a cosmetic blepharoplasty, a procedure that is statutorily excluded from Medicare coverage. The practice wants to ensure the patient understands they will be financially responsible for the service. What is the most appropriate action?

  1. Obtain a signed Advance Beneficiary Notice (ABN) and append modifier GA to the procedure code.
  2. Have the patient sign an office-specific financial waiver informing them of their responsibility, as an ABN is not mandatory for statutorily non-covered services. (correct answer)
  3. Perform the service and submit the claim with modifier GZ because an ABN is not on file.
  4. Inform the patient verbally that the service is not covered and document this in the chart.
Explanation: An ABN is typically required for services that are normally covered by Medicare but may be denied in a specific case due to lack of medical necessity. For services that are statutorily non-covered (i.e., never covered, like most cosmetic procedures), an ABN is not required. The best practice is to have the patient sign a notice or waiver acknowledging their financial responsibility.

Question 19

A surgeon performs an exploratory laparotomy (49000) and during the procedure, also performs an appendectomy (44950). According to NCCI edits, the appendectomy is a Column 2 code bundled into the exploratory laparotomy (Column 1). Under which circumstance could both procedures be reported with a modifier?

  1. The appendectomy was performed for a separate and distinct medical reason, such as a ruptured appendix found during the exploration, and is documented as such. (correct answer)
  2. Both procedures were performed through the same incision.
  3. The appendectomy took a significant amount of extra time to complete.
  4. These two procedures can never be reported together.
Explanation: A National Correct Coding Initiative (NCCI) edit can be bypassed with an appropriate modifier (like 59 or an X-modifier) only if the procedures are truly separate and distinct. An incidental appendectomy is included in the exploratory laparotomy. However, if the appendectomy was performed for a distinct, medically necessary reason (like acute appendicitis), it can be reported separately with a modifier.

Question 20

A physician practice consistently bills Evaluation and Management (E/M) services at a higher level than what is supported by the medical record documentation. An internal audit reveals a pattern of this behavior, which the physician knowingly instructed the coder to perform to increase revenue. What does this practice represent?

  1. Fraud (correct answer)
  2. Abuse
  3. An acceptable billing practice
  4. A violation of the Stark Law
Explanation: This scenario describes fraud. Fraud is the intentional deception or misrepresentation that an individual knows to be false and that could result in some unauthorized benefit. The keywords "knowingly instructed" indicate intent, which is the key element that distinguishes fraud from abuse. Upcoding is a classic example of healthcare fraud.