1|Page
AAPC CPB FINAL EXAM LATEST 2026 ACTUAL EXAM
WITH COMPLETE QUESTIONS AND CORRECT
DETAILED ANSWERS ||VERIFIED EXAM!!!(100%
VERIFIED ANSWERS) |ALREADY GRADED A+|
||PROFESSOR VERIFIED|| ||NEWEST EXAM!!!!!!||
A private practice hires a consultant to come in and audit
some medical
records. Under the Privacy Rule, what is this consultant
considered?
A. A business associate
B. An employee
C. A covered entity
D. A clearinghouse - Answer-A. A business associate
Business associates perform certain functions or activities,
which involve the use or disclosure of individually
identifiable health information, on behalf of another person
or organization. These services include claims processing
or administration, data analysis, utilization review, billing,
benefit management, and re-pricing. Because the
consultant will be auditing medical records, PHI will need
to be shared from the practice. The practice would be the
covered entity
,2|Page
A practice agrees to pay $250,000 to settle a lawsuit
alleging that the practice used X-rays of one patient to
justify services on multiple other patients' claims. The
manager of the office brought the civil suit. What type of
case is this?
A. HIPAA
B. Qui Tam
C. Anti-Kickback
D. Stark case - Answer-B. Qui Tam
A Qui Tam case is also known as a whistleblower case. If
an individual knows of a violation of the FCA, he or she
may bring a civil action on behalf of him or herself and on
behalf of the U.S. government (such an individual is called
a relator)
A patient is seen in your clinic. Her husband calls later in
the day to ask for information about the visit. The practice
pulls the patient's privacy authorization to see if they can
speak to the husband. What act does this action fall
under?
A. Health Information Act
,3|Page
B. Social Security Act
C. HIPAA
D. ADA - Answer-C. HIPAA
The Privacy Act is under HIPAA and protects the health
information of the patient. According to HIPAA, for the
practice to release information to the husband, the patient
would have to have signed an authorization.
Which of the following situations allows the release of PHI
without authorization from the patient?
A. Request for life insurance
B. Request from family member
C. Physician's office to release to a family member
D. Workers' compensation - Answer-D. Workers'
compensation
Workers' compensation is listed as one of the exceptions
permitted by the Privacy rule for use and disclosure of
information.
, 4|Page
Billing for a lower level of care than is supported in
documentation, making false statements to obtain
undeserved benefits or payment from a federal healthcare
program, or billing for services that were not performed is
defined as what by CMS?
A. an Anti-kickback
B. abuse
C. a Stark violation
D. fraud - Answer-D. fraud
All of these actions are considered Fraud by CMS. CMS
defines fraud as making false statements or
misrepresenting facts to obtain an undeserved benefit or
payment from a federal healthcare program. CMS defines
abuse as an action that results in unnecessary costs to a
federal healthcare program, either directly or indirectly
Medicare overpayments should be returned within what
time frame after the overpayment has been identified?
A. 60 days
B. 1 year
C. 120 days
D. 30 days - Answer-A. 60 days
AAPC CPB FINAL EXAM LATEST 2026 ACTUAL EXAM
WITH COMPLETE QUESTIONS AND CORRECT
DETAILED ANSWERS ||VERIFIED EXAM!!!(100%
VERIFIED ANSWERS) |ALREADY GRADED A+|
||PROFESSOR VERIFIED|| ||NEWEST EXAM!!!!!!||
A private practice hires a consultant to come in and audit
some medical
records. Under the Privacy Rule, what is this consultant
considered?
A. A business associate
B. An employee
C. A covered entity
D. A clearinghouse - Answer-A. A business associate
Business associates perform certain functions or activities,
which involve the use or disclosure of individually
identifiable health information, on behalf of another person
or organization. These services include claims processing
or administration, data analysis, utilization review, billing,
benefit management, and re-pricing. Because the
consultant will be auditing medical records, PHI will need
to be shared from the practice. The practice would be the
covered entity
,2|Page
A practice agrees to pay $250,000 to settle a lawsuit
alleging that the practice used X-rays of one patient to
justify services on multiple other patients' claims. The
manager of the office brought the civil suit. What type of
case is this?
A. HIPAA
B. Qui Tam
C. Anti-Kickback
D. Stark case - Answer-B. Qui Tam
A Qui Tam case is also known as a whistleblower case. If
an individual knows of a violation of the FCA, he or she
may bring a civil action on behalf of him or herself and on
behalf of the U.S. government (such an individual is called
a relator)
A patient is seen in your clinic. Her husband calls later in
the day to ask for information about the visit. The practice
pulls the patient's privacy authorization to see if they can
speak to the husband. What act does this action fall
under?
A. Health Information Act
,3|Page
B. Social Security Act
C. HIPAA
D. ADA - Answer-C. HIPAA
The Privacy Act is under HIPAA and protects the health
information of the patient. According to HIPAA, for the
practice to release information to the husband, the patient
would have to have signed an authorization.
Which of the following situations allows the release of PHI
without authorization from the patient?
A. Request for life insurance
B. Request from family member
C. Physician's office to release to a family member
D. Workers' compensation - Answer-D. Workers'
compensation
Workers' compensation is listed as one of the exceptions
permitted by the Privacy rule for use and disclosure of
information.
, 4|Page
Billing for a lower level of care than is supported in
documentation, making false statements to obtain
undeserved benefits or payment from a federal healthcare
program, or billing for services that were not performed is
defined as what by CMS?
A. an Anti-kickback
B. abuse
C. a Stark violation
D. fraud - Answer-D. fraud
All of these actions are considered Fraud by CMS. CMS
defines fraud as making false statements or
misrepresenting facts to obtain an undeserved benefit or
payment from a federal healthcare program. CMS defines
abuse as an action that results in unnecessary costs to a
federal healthcare program, either directly or indirectly
Medicare overpayments should be returned within what
time frame after the overpayment has been identified?
A. 60 days
B. 1 year
C. 120 days
D. 30 days - Answer-A. 60 days
