CHC Practice EXAM PREPARATION
CHC PRACTICE EXAM PREPARATION FOR 2025/2026 WITH
COMPLETE QUESTIONS AND CORRECT DETAILED ANSWERS
(VERIFIED ANSWERS) |BRAND NEW VERSION!!
If during the course of an internal investigation, the compliance officer believes
the integrity of the investigation might be compromised by the continued
presence of work force members who are the subject of the investigation. In the
best interest of the attorney-client privilege, which action would you take?
a. Conduct employee background checks
b. Counsel obtains employee's depositions
c. Destroy documents and other evidence
d. Re-assign employees to other responsibilities until the investigation is
completed
e. All of the above
d. Re-assign employees to other responsibilities until the investigation is
completed.
Explanation: he/she should recommend that such individuals be temporarily
removed from their current responsibilities until the investigation is completed.
Ref. Healthcare Compliance Professional's Manual
The privacy officer for a hospital has updated the Notice of Privacy Practices/NPP
to reflect a material change because the previous notice did not have a
description that individuals have the right to amend their PHI. The 3rd party
review team identified that the NPP did not have the required information to let
individuals know of their right to amend PHI. What's the BEST course of action to
correct deficiency?
A. Make arrangements to mail the new NPP mailed to all patients seen within the
last year at the hospital
B. Make arrangements to have the new NPP distributed to new patients that come
to the hospital
1|Page
, CHC Practice EXAM PREPARATION
C. Post a copy of the new NPP on the hospital's internal intranet so that all
employees can see the updated version of the notice
D. Meet with legal to discuss how to best self-disclose to OCR that the hospital
was in violation of the NPP requirements and has since corrected the deficiency
B. Make arrangements to have the new NPP distributed to new patients that come
to the hospital
The NPP must describe the following individual rights:
https://www.law.cornell.edu/cfr/text/45/164.520
• The right to request restrictions on uses or disclosures of PHI for treatment,
payment or healthcare operations; for use in a facility directory (if applicable); or
to family members and others involved in the patient's care; however, the
provider is not required to agree to the restriction except in the case of a
disclosure to a health insurer if the individual has paid for the care as required by
§164.522(a)(1)(vi). This is a change necessitated by the Omnibus Rule.
• The right to receive confidential communications by alternative means or at
alternative locations per §164.522(b).
• The right to inspect and copy PHI per § 164.524. The provider may want to
include a statement that the provider may charge a reasonable cost-based fee for
copies.
• The right to amend PHI per § 164.526.
• The right to receive an accounting of disclosures of PHI as provided by §
164.528.
• The right to receive a paper copy of the NPP upon request.
• A brief description of how the individual may exercise the foregoing rights, e.g.,
by submitting a written request to the provider's privacy officer.
The billing manager was conducting a contemporaneous review and found what
could be a significant error. The billing manager contacts you and you then
subsequently contact your in-house legal counsel. Which of the following
statements are False?
a. Because of the False Claims Act, your in-house counsel advises you that the
2|Page
, CHC Practice EXAM PREPARATION
retrospective audit will need to cover a minimum of 6 years to a maximum of 10
years.
b. If you do not refund the Medicare overpayments, you could be charged with a
federal felony under the Social Security Act.
c. A contemporaneous review that was done by the billing manager would be
covered under the attorney-client privilege.
d. You are asked to perform a statistical sample of the population. You need to
know that a larger sample size will be required if the variation in the errors is
larger.
c. A contemporaneous review that was done by the billing manager would be
covered under the attorney-client privilege.
Explanation: A significant limitation of the definition of protected
communications relates to documents that are prepared by the client prior to
the time when the attorney began preparations to give advice.
Ref. Healthcare Compliance Professional's Manual
You are the new compliance officer at an institution with an already established
compliance committee. Which committee members' professional background
would be MOST valuable in performing audit activities?
a. Legal Counsel
b. Business Management
c. Chief Financial Officer
d. Bio-Medical Engineer
b. Business Management
Explanation: It may be appropriate to designate a vendor oversight function for
third party relationships to monitor elements of the supply chain, provide a
central point for enterprise vendor issues, and set standards for training, tools,
and monitoring.
Ref: HCPG Auditing and Monitoring 3460.30.40.60
3|Page
, CHC Practice EXAM PREPARATION
A covered entity must obtain the patient's written authorization for any use or
disclosure of protected health information (PHI) in which circumstances?
a. Marketing activities
b. Research
c. PHI sales and licensing
d. Information sharing needed for treatment
e. A and C only
f. All of the above
e. A and C only
Ref. Permitted Uses and Disclosures section - https://www.hhs.gov/hipaa/for-
professionals/privacy/laws-regulations/index.html
Protected health information (PHI) is considered de-identified by HIPAA Privacy
Rule standards by:
a. absence of actual knowledge by the covered entity that the remaining
information could be used alone or in combination with other information to
identify the individual
b. removal of only patient name and date of birth
c. a formal determination by a qualified expert
d. the removal of 18 specified individual identifiers
e. A, C and D
f. All of the answers
e. A, C and D
The Privacy Rule provides two de-identification methods: 1) a formal
determination by a qualified expert; or 2) the removal of specified individual
identifiers as well as absence of actual knowledge by the covered entity that the
remaining information could be used alone or in combination with other
information to identify the individual.
Ref. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-
identification/index.html#preparation
4|Page
CHC PRACTICE EXAM PREPARATION FOR 2025/2026 WITH
COMPLETE QUESTIONS AND CORRECT DETAILED ANSWERS
(VERIFIED ANSWERS) |BRAND NEW VERSION!!
If during the course of an internal investigation, the compliance officer believes
the integrity of the investigation might be compromised by the continued
presence of work force members who are the subject of the investigation. In the
best interest of the attorney-client privilege, which action would you take?
a. Conduct employee background checks
b. Counsel obtains employee's depositions
c. Destroy documents and other evidence
d. Re-assign employees to other responsibilities until the investigation is
completed
e. All of the above
d. Re-assign employees to other responsibilities until the investigation is
completed.
Explanation: he/she should recommend that such individuals be temporarily
removed from their current responsibilities until the investigation is completed.
Ref. Healthcare Compliance Professional's Manual
The privacy officer for a hospital has updated the Notice of Privacy Practices/NPP
to reflect a material change because the previous notice did not have a
description that individuals have the right to amend their PHI. The 3rd party
review team identified that the NPP did not have the required information to let
individuals know of their right to amend PHI. What's the BEST course of action to
correct deficiency?
A. Make arrangements to mail the new NPP mailed to all patients seen within the
last year at the hospital
B. Make arrangements to have the new NPP distributed to new patients that come
to the hospital
1|Page
, CHC Practice EXAM PREPARATION
C. Post a copy of the new NPP on the hospital's internal intranet so that all
employees can see the updated version of the notice
D. Meet with legal to discuss how to best self-disclose to OCR that the hospital
was in violation of the NPP requirements and has since corrected the deficiency
B. Make arrangements to have the new NPP distributed to new patients that come
to the hospital
The NPP must describe the following individual rights:
https://www.law.cornell.edu/cfr/text/45/164.520
• The right to request restrictions on uses or disclosures of PHI for treatment,
payment or healthcare operations; for use in a facility directory (if applicable); or
to family members and others involved in the patient's care; however, the
provider is not required to agree to the restriction except in the case of a
disclosure to a health insurer if the individual has paid for the care as required by
§164.522(a)(1)(vi). This is a change necessitated by the Omnibus Rule.
• The right to receive confidential communications by alternative means or at
alternative locations per §164.522(b).
• The right to inspect and copy PHI per § 164.524. The provider may want to
include a statement that the provider may charge a reasonable cost-based fee for
copies.
• The right to amend PHI per § 164.526.
• The right to receive an accounting of disclosures of PHI as provided by §
164.528.
• The right to receive a paper copy of the NPP upon request.
• A brief description of how the individual may exercise the foregoing rights, e.g.,
by submitting a written request to the provider's privacy officer.
The billing manager was conducting a contemporaneous review and found what
could be a significant error. The billing manager contacts you and you then
subsequently contact your in-house legal counsel. Which of the following
statements are False?
a. Because of the False Claims Act, your in-house counsel advises you that the
2|Page
, CHC Practice EXAM PREPARATION
retrospective audit will need to cover a minimum of 6 years to a maximum of 10
years.
b. If you do not refund the Medicare overpayments, you could be charged with a
federal felony under the Social Security Act.
c. A contemporaneous review that was done by the billing manager would be
covered under the attorney-client privilege.
d. You are asked to perform a statistical sample of the population. You need to
know that a larger sample size will be required if the variation in the errors is
larger.
c. A contemporaneous review that was done by the billing manager would be
covered under the attorney-client privilege.
Explanation: A significant limitation of the definition of protected
communications relates to documents that are prepared by the client prior to
the time when the attorney began preparations to give advice.
Ref. Healthcare Compliance Professional's Manual
You are the new compliance officer at an institution with an already established
compliance committee. Which committee members' professional background
would be MOST valuable in performing audit activities?
a. Legal Counsel
b. Business Management
c. Chief Financial Officer
d. Bio-Medical Engineer
b. Business Management
Explanation: It may be appropriate to designate a vendor oversight function for
third party relationships to monitor elements of the supply chain, provide a
central point for enterprise vendor issues, and set standards for training, tools,
and monitoring.
Ref: HCPG Auditing and Monitoring 3460.30.40.60
3|Page
, CHC Practice EXAM PREPARATION
A covered entity must obtain the patient's written authorization for any use or
disclosure of protected health information (PHI) in which circumstances?
a. Marketing activities
b. Research
c. PHI sales and licensing
d. Information sharing needed for treatment
e. A and C only
f. All of the above
e. A and C only
Ref. Permitted Uses and Disclosures section - https://www.hhs.gov/hipaa/for-
professionals/privacy/laws-regulations/index.html
Protected health information (PHI) is considered de-identified by HIPAA Privacy
Rule standards by:
a. absence of actual knowledge by the covered entity that the remaining
information could be used alone or in combination with other information to
identify the individual
b. removal of only patient name and date of birth
c. a formal determination by a qualified expert
d. the removal of 18 specified individual identifiers
e. A, C and D
f. All of the answers
e. A, C and D
The Privacy Rule provides two de-identification methods: 1) a formal
determination by a qualified expert; or 2) the removal of specified individual
identifiers as well as absence of actual knowledge by the covered entity that the
remaining information could be used alone or in combination with other
information to identify the individual.
Ref. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-
identification/index.html#preparation
4|Page
