20 Administrative & Front Office Practice Questions & Answers

1. 1. A patient submits a written request for a copy of her medical record. The office cannot assemble and produce the records within the standard timeframe. Under the HIPAA Privacy Rule right of access, what may the practice do?

   • A.Add a search-and-retrieval fee to cover the extra staff time
   • B.Take one 30-day extension after giving the patient written notice of the reason for the delay and the new expected date✓ Answer
   • C.Take as much time as needed, as long as the patient is told verbally
   • D.Deny the request because the records are not readily available

   The right of access requires a covered entity to act on a request within 30 calendar days, and it may take only one 30-day extension, which must be accompanied by written notice stating the reason and the new date. The rule also permits only a reasonable, cost-based fee for copying, postage and preparing a summary — search and retrieval time may never be charged, which is why the fee option is wrong.

   Source: 45 CFR 164.524(b)(2) and (c)(4) — HIPAA Privacy Rule, individual right of accessReport a problem with this question

2. 2. An unencrypted office laptop containing the protected health information of 40 patients is stolen from a staff member's car. Under the HITECH breach notification requirements, the affected individuals must be notified:

   • A.Only if the Office for Civil Rights orders notification after investigating
   • B.At the same time as the annual log is submitted, because fewer than 500 people are affected
   • C.Without unreasonable delay and no later than 60 calendar days after discovery of the breach✓ Answer
   • D.Within 10 business days of discovering the theft

   Individual notice is always due without unreasonable delay and never later than 60 calendar days from discovery, regardless of how many people are involved. The under-500 rule affects only when the U.S. Department of Health and Human Services is notified — those breaches may be logged and reported annually — so it does not delay the letters owed to the patients themselves.

   Source: 45 CFR 164.404(b) (individual notice) and 164.408(c) (annual HHS reporting for breaches under 500) — HITECH Breach Notification RuleReport a problem with this question

3. 3. A patient is referred to a cardiologist. The cardiologist's office calls the practice and asks for the patient's recent ECG tracing and progress notes so the specialist can prepare for the consultation. What does HIPAA require before the records are sent?

   • A.Nothing beyond verifying that the request is legitimate — disclosures for treatment are permitted without authorization✓ Answer
   • B.The patient's verbal consent, witnessed and documented by two staff members
   • C.A subpoena duces tecum from the specialist's attorney
   • D.A signed, dated authorization from the patient naming the cardiologist

   HIPAA permits a covered entity to use and disclose protected health information for treatment, payment and health care operations (TPO) without a patient authorization, and sharing records with another provider who is treating the patient is a classic treatment disclosure. The minimum necessary standard does not even apply to disclosures made for treatment, because the treating provider needs the full clinical picture; authorizations are reserved for non-TPO uses such as marketing or release to an employer or attorney.

   Source: 45 CFR 164.506(c) (TPO disclosures) and 164.502(b)(2)(i) (minimum necessary does not apply to treatment disclosures)Report a problem with this question

4. 4. To win a negligence claim against a provider, the plaintiff must prove four elements often taught as the "four D's." Which list states them correctly?

   • A.Duty, discovery, deposition, damages
   • B.Duty, dereliction, direct cause, damages✓ Answer
   • C.Duty, dereliction, defense, disclosure
   • D.Diagnosis, documentation, disclosure, damages

   Negligence requires a duty of care owed to the patient, a dereliction (breach) of that duty measured against the standard of care, proof that the breach was the direct cause of the injury, and actual damages. All four must be present — a breach that causes no measurable harm, or harm with no causal link to the breach, will not sustain the claim, which is why discovery and deposition (procedural steps, not elements) are distractors.

   Source: Elements of negligence ("four D's"); AAMA CMA (AAMA) Content Outline II.E, Legal and Ethical IssuesReport a problem with this question

5. 5. A patient states clearly that he does not want a vaccination today. The medical assistant replies, "Hold still, it will only take a second," and administers the injection anyway. Which tort has most likely been committed?

   • A.Invasion of privacy
   • B.Assault
   • C.Slander
   • D.Battery✓ Answer

   Battery is the intentional touching of a person without consent, and giving an injection over a competent patient's refusal is exactly that — the touching completes the tort. Assault is the threat or act that creates a reasonable fear of imminent unwanted contact with no contact occurring, so the words alone would have been assault; because the needle actually went in, the correct answer is battery.

   Source: Intentional torts — assault and battery; AAMA CMA (AAMA) Content Outline II.E, Legal and Ethical IssuesReport a problem with this question

6. 6. A 6-year-old is seen for injuries the provider reasonably suspects are the result of physical abuse. The parent tells the staff that they do not consent to any report being made to anyone. What is the correct action?

   • A.Document the findings only and wait for a second visit to establish a pattern
   • B.Honor the objection, because HIPAA requires a signed authorization before any disclosure
   • C.Ask the parent to sign a release first and report only if they agree
   • D.Make the report to the designated state agency; the report is legally mandated and is a HIPAA-permitted disclosure✓ Answer

   Suspected child abuse is a mandatory report in every state, and the duty is triggered by reasonable suspicion, not by proof or by anyone's permission — waiting for a "pattern" leaves the child at risk and can itself be a violation. HIPAA specifically permits disclosures required by law and reports of abuse or neglect to the authorized agency, so the privacy rule is not a barrier and no authorization is needed.

   Source: 45 CFR 164.512(a) and 164.512(b)(1)(ii) — disclosures required by law and reports of child abuse; state mandatory reporting statutesReport a problem with this question

7. 7. An incapacitated patient has a valid medical durable power of attorney naming her neighbor as her health care agent. Her adult son arrives and demands a different treatment decision than the agent has made. Whose decision governs?

   • A.The son's, because next of kin always outranks a non-relative
   • B.The neighbor's, because a valid advance directive naming a health care agent takes precedence over other family members' wishes✓ Answer
   • C.Whatever a majority of the family members agree on
   • D.The practice's ethics committee decides automatically in any family disagreement

   A medical durable power of attorney is the patient's own legally executed choice of decision-maker, so the named agent speaks with the patient's voice and displaces the default next-of-kin hierarchy that applies only when no directive exists. The Patient Self-Determination Act requires facilities to ask about and document advance directives precisely so the patient's expressed wishes, not family consensus, control care.

   Source: Patient Self-Determination Act of 1990 (OBRA 1990); AAMA CMA (AAMA) Content Outline II.E, advance directivesReport a problem with this question

8. 8. A patient who is visibly frightened about an upcoming biopsy snaps at the medical assistant, "You're the one who's nervous — you can't even look at me." Which defense mechanism is the patient displaying?

   • A.Regression
   • B.Displacement
   • C.Rationalization
   • D.Projection✓ Answer

   Projection is attributing one's own unacceptable feelings to another person, which is exactly what happens when the patient's own fear is relabeled as the assistant's nervousness. Displacement would mean redirecting the emotion onto a safer target while still owning it, rationalization would mean inventing a logical-sounding excuse, and regression would mean reverting to childlike behavior — none of which describe reassigning the feeling itself.

   Source: Defense mechanisms; AAMA CMA (AAMA) Content Outline II.F, CommunicationReport a problem with this question

9. 9. A patient with limited English proficiency arrives for a visit and brings her 12-year-old son to translate for her. What is the medical assistant's best action?

   • A.Reschedule the visit for a day the patient can bring an English-speaking adult relative
   • B.Speak more loudly and use simple English words with gestures
   • C.Arrange a qualified medical interpreter and speak directly to the patient, not to the interpreter✓ Answer
   • D.Allow the child to interpret, since the patient chose him herself

   Minor children and family members are not qualified interpreters: they lack clinical vocabulary, may filter or soften sensitive information, and using them raises confidentiality and consent problems, so facilities receiving federal funds must offer competent language assistance at no cost. Addressing the patient directly, in the second person, keeps her at the center of the encounter and preserves the therapeutic relationship; raising your voice does nothing for a person who simply does not speak the language.

   Source: Title VI of the Civil Rights Act of 1964 (language access for LEP patients); HHS National CLAS Standards 5–7; AAMA Content Outline II.FReport a problem with this question

10. 10. A patient telephones the office asking for her biopsy results. The pathology report is in the chart, but the provider has not yet reviewed it or authorized its release. What should the medical assistant do?

    • A.Refer her to the pathology laboratory to obtain the results directly
    • B.Tell her the provider will review the report and contact her, then document the call and route it to the provider✓ Answer
    • C.Tell her the report looks normal to you so she does not have to worry over the weekend
    • D.Read the pathology report aloud verbatim, since the patient has a right to her own health information

    Releasing or characterizing test results is outside the medical assistant's scope of practice, because interpreting a result and deciding what it means for the patient is a clinical judgment reserved to the provider; saying it "looks normal" is both an interpretation and a potential source of false reassurance. The patient's HIPAA right of access is satisfied through the formal records-request process, not an unauthorized phone read-out, and every clinically relevant call must be documented in the record.

    Source: Medical assistant scope of practice (no interpretation of results); AAMA Content Outline II.E and II.F, telephone techniquesReport a problem with this question

11. 11. During an office visit a patient is supplied with a walker and a nebulizer from the practice's durable medical equipment stock. Which code set is used to report these items on the insurance claim?

    • A.CPT Category II
    • B.HCPCS Level II✓ Answer
    • C.ICD-10-PCS
    • D.ICD-10-CM

    HCPCS Level II is the alphanumeric code set maintained by CMS for products, supplies and services that CPT does not cover — durable medical equipment, prosthetics, orthotics, injectable drugs and ambulance transport. ICD-10-CM reports diagnoses, ICD-10-PCS is used only for inpatient hospital procedures, and CPT Category II codes are optional performance-measurement tracking codes, so none of them can report the equipment itself.

    Source: HCPCS Level II, HIPAA-adopted code set (CMS); AAMA Content Outline III.G.1, coding applicationsReport a problem with this question

12. 12. A patient comes in for a scheduled minor procedure. At the same visit the provider also evaluates and documents a separate, new complaint of chest tightness. Which CPT modifier is appended to the evaluation and management code?

    • A.Modifier 51 — multiple procedures
    • B.Modifier 26 — professional component
    • C.Modifier 59 — distinct procedural service
    • D.Modifier 25 — a significant, separately identifiable E/M service by the same provider on the same day as a procedure✓ Answer

    Minor procedures already include a small amount of evaluation work in their global package, so a payer will bundle the E/M into the procedure unless modifier 25 signals that the visit addressed a significant, separately identifiable problem supported by its own documentation. Modifier 59 marks distinct procedures rather than an E/M service, modifier 51 addresses multiple procedures in one session, and modifier 26 splits out the professional reading of a test.

    Source: AMA CPT Appendix A, modifier 25; AAMA Content Outline III.G.1, coding applicationsReport a problem with this question

13. 13. A patient with well-controlled hypertension and type 2 diabetes presents today because of acute low back pain that began after lifting a heavy box. Which diagnosis should be listed first on the CMS-1500 claim?

    • A.The chronic condition the patient has carried the longest
    • B.Diabetes, because it is the most clinically serious condition
    • C.Whichever diagnosis code comes first alphanumerically
    • D.Acute low back pain, because it is the condition chiefly responsible for today's encounter✓ Answer

    The ICD-10-CM guidelines require the first-listed diagnosis to be the condition chiefly responsible for the services provided at that encounter, not the most serious or longest-standing problem; the coexisting chronic conditions are reported as additional codes only if they affect the visit. Correct sequencing matters because the claim's medical necessity rests on linking each procedure line to the diagnosis that justifies it in block 24E of the CMS-1500.

    Source: ICD-10-CM Official Guidelines for Coding and Reporting, Section IV.G (first-listed condition); CMS-1500 block 24E diagnosis pointerReport a problem with this question

14. 14. After a claim is adjudicated, which document is sent to the PATIENT to explain the allowed amount, what the plan paid, and the patient's remaining responsibility?

    • A.The explanation of benefits (EOB)✓ Answer
    • B.The remittance advice (RA/ERA)
    • C.The encounter form (superbill)
    • D.The day sheet

    The explanation of benefits goes to the insured patient and is informational — it is not a bill — while the remittance advice, electronic or paper, goes to the provider and accompanies the actual payment for one or more claims. Confusing the two is a common error; the practical difference is the recipient and the fact that the RA is what the biller posts payments and contractual adjustments from.

    Source: AAMA Content Outline III.G.4 — explanation of benefits versus remittance adviceReport a problem with this question

15. 15. A claim is returned by the clearinghouse and was never entered into the payer's processing system because the member identification number contains a typographical error. How should this be classified and handled?

    • A.A rejection; bill the patient the full charge instead
    • B.A denial; file a formal appeal with supporting medical records
    • C.A rejection; correct the error and resubmit the claim✓ Answer
    • D.A denial; write the balance off as uncollectible

    A rejection is a front-end failure — the claim never reached adjudication because it did not pass format or eligibility edits — so the fix is to correct the data element and resubmit within the timely filing limit, and no appeal exists because nothing was decided. A denial, by contrast, is a claim the payer did adjudicate and refused to pay, and that is what triggers the appeal process; shifting the charge to the patient over a clerical typo would be improper.

    Source: Claim rejection versus denial and the appeal process; AAMA Content Outline III.G.5Report a problem with this question

16. 16. A provider believes Medicare will not pay for a test a patient wants because it exceeds the covered frequency. The patient has Original (fee-for-service) Medicare. What must the office do to be able to bill the patient if Medicare denies?

    • A.Perform the test first and, if Medicare denies, issue the ABN afterward and then bill the patient
    • B.Give the patient an Advance Beneficiary Notice of Noncoverage (Form CMS-R-131) before the service, with enough time to make an informed choice✓ Answer
    • C.Nothing — ABNs apply only to Medicare Advantage enrollees
    • D.Nothing — a Medicare beneficiary is automatically liable for any service Medicare denies

    The ABN exists to transfer financial liability to the beneficiary, and it only works if it is delivered in advance, is specific about the service and the expected reason for denial, and gives the patient a real chance to accept or decline; a blanket, routine, or after-the-fact notice is invalid. Without a properly executed ABN the provider must absorb the cost and may not bill the beneficiary, and the form applies to Original Medicare rather than Medicare Advantage plans, which use their own coverage notices.

    Source: CMS Advance Beneficiary Notice of Noncoverage, Form CMS-R-131; Medicare Claims Processing Manual, Chapter 30Report a problem with this question

17. 17. A participating provider charges $450 for a service. The payer's allowed amount is $300, the patient has already met the annual deductible, and the plan pays 80 percent of the allowed amount. How much may the practice collect from the patient?

    • A.$150
    • B.$60✓ Answer
    • C.$210
    • D.$90

    Coinsurance is calculated on the allowed amount, not the provider's charge: the plan pays 80 percent of $300 ($240) and the patient owes the remaining 20 percent, which is $60. The $150 difference between the $450 charge and the $300 allowed amount is a contractual write-off that a participating provider agreed to accept and may never balance-bill to the patient.

    Source: AAMA Content Outline III.G.6–III.G.9 — allowed amount, contractual adjustment/write-off, coinsurance; prohibition on balance billing by participating providersReport a problem with this question

18. 18. A practice is setting up next quarter's appointment schedule in a new system. What must be done BEFORE any patient appointments are entered?

    • A.Convert the practice to open-access scheduling so no blocking is needed
    • B.Double-book the first hour of each day to absorb anticipated no-shows
    • C.Import the patient recall list so overdue patients are booked first
    • D.Establish the matrix by blocking out times the providers are unavailable — holidays, hospital rounds, meetings, lunch and catch-up buffers✓ Answer

    The matrix defines the times that are genuinely available before anyone is booked into them, so it must be created first; without it, patients get scheduled into hospital rounds, meetings, or holidays and the day collapses. Recall lists, double-booking and open-access are scheduling choices that operate inside an established matrix, not substitutes for building one.

    Source: AAMA Content Outline III.H.1 — appointment scheduling, establishing the matrixReport a problem with this question

19. 19. An office books three patients at the top of each hour and then single appointments at 20 and 40 minutes past the hour. Which scheduling method is this?

    • A.Stream (time-specified) scheduling
    • B.Open hours scheduling
    • C.Modified wave scheduling✓ Answer
    • D.Clustering (categorization) scheduling

    Modified wave places a small group at the top of the hour and then staggers individual appointments through the rest of it, which smooths out the wait that pure wave scheduling creates while still absorbing late arrivals and no-shows. Stream gives each patient a single distinct slot, open hours has no appointed times at all, and clustering groups similar visit types together into blocks.

    Source: AAMA Content Outline III.H.1 — scheduling methods (stream, wave, modified wave, double booking, clustering, open hours)Report a problem with this question

20. 20. A medical assistant realizes she recorded a set of vital signs on the wrong page of a paper chart. What is the correct way to fix the entry?

    • A.Draw a single line through the entry so it remains legible, write the correction, label it "error," and add the date and her initials✓ Answer
    • B.Erase the entry completely and rewrite the page so the chart stays neat
    • C.Remove the page from the chart and replace it with a rewritten one
    • D.Cover the entry with correction fluid and write the correct information over it

    The medical record is a legal document, so a correction must show what was originally written, what it was changed to, and who changed it and when — the single line preserves the original entry and the initials and date create accountability. Obliterating, erasing or replacing pages destroys evidence and can make the whole record look altered, which severely undermines the practice's defense if the chart is ever reviewed in a legal proceeding.

    Source: AAMA Content Outline III.H.2–III.H.3 — health information management, documentation and correction of the medical recordReport a problem with this question

Practice questions based on the AAMA (CMA) and AMT (RMA) certification content outlines and standard medical-assisting curriculum. Not affiliated with or endorsed by AAMA, AMT, or any certifying body. Study the official candidate handbook and confirm current exam content before testing. About the CMA exam →