CMAA Medical Administrative Assistant practice questions with answers

Answer: A) Stored on remote servers

• ACorrect. It is hosted online and accessed over the internet.
• BIncorrect. It is electronic.
• CIncorrect. That is local storage.
• DIncorrect. Cloud systems are typically backed up.

Answer: A) Use secure, approved email

• ACorrect. PHI must only be sent through secure, approved systems.
• BIncorrect. This violates privacy rules.
• CIncorrect. This reads as shouting.
• DIncorrect. Clear subjects help.

Answer: A) Regression

• ACorrect. It's a return to earlier behavior under stress.
• BIncorrect. That channels feelings into useful activity.
• CIncorrect. That attributes one's feelings to others.
• DIncorrect. That's unconsciously blocking memories.

Answer: C) Tell them to call 911 now

• AIncorrect. This is an emergency.
• BIncorrect. This is an emergency.
• CCorrect. These are signs of a stroke.
• DIncorrect. This is an emergency.

Answer: D) Treatment, payment, operations

• AIncorrect. This is not permitted.
• BIncorrect. Marketing generally needs authorization.
• CIncorrect. This needs authorization.
• DCorrect. TPO uses are permitted without authorization.

Answer: A) Keep a written exposure control plan, reviewed and updated at least annually

OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) requires a written Exposure Control Plan that is reviewed and updated at least annually. The employer must also offer hepatitis B vaccination within 10 working days at no cost, keep training records for 3 years, and provide PPE at no cost.

• ACorrect. The standard requires a written Exposure Control Plan. It must be reviewed and updated at least once a year, and also whenever new or changed tasks or procedures affect exposure.
• BIncorrect. The vaccine must be made available within 10 working days of initial assignment, at no cost to the employee.
• CIncorrect. Training records must be kept for 3 years from the date of the training.
• DIncorrect. The employer must provide appropriate PPE at no cost, and it must be readily accessible at the worksite or issued to employees. It can't depend on a written request.

Answer: A) The admitting diagnosis, the provider's admission orders, and the patient's insurance information

To schedule a direct admission, the hospital needs the admitting diagnosis, the provider's admission orders and the patient's insurance information, which it uses to verify coverage and get any required precertification.

• ACorrect. The hospital needs the diagnosis to place the patient and the provider's orders to admit the patient formally. Medicare inpatient status requires an admission order from a physician or qualified practitioner. Insurance information is needed to verify coverage and get any required precertification.
• BIncorrect. Immunization records may be part of the chart, but they aren't what the hospital needs to arrange an admission. The hospital needs the diagnosis, orders and insurance details.
• CIncorrect. A direct admission skips the emergency department, so there is no ED triage level to report.
• DIncorrect. The office's privacy notice acknowledgment is an internal document of the practice. The hospital gives its own notice and doesn't need this to schedule the admission.

Answer: A) To plan preventive checkups at recommended ages, where growth, screenings, and immunizations are addressed

A well-child schedule tells staff when to book routine preventive visits by age. Visits are frequent in infancy and annual from about age 3, and they cover growth checks, screenings and vaccines.

• ACorrect. Well-child visits are routine preventive visits at set ages. They include growth and development checks, screening tests, immunizations and guidance for parents.
• BIncorrect. Same-day slots for acute symptoms are sick visits, not well-child visits. Parents are told to call whenever a child seems ill, separate from the well-child schedule.
• CIncorrect. Catch-up vaccination is one possible part of care, but well-child visits are planned ahead at set ages whether or not a dose was missed.
• DIncorrect. Infants and toddlers need much more frequent visits, such as at 1, 2, 4, 6, 9, 12, 15 and 18 months. Visits become annual from about age 3.

Answer: C) Payment to the provider

• AIncorrect. That is an advance directive.
• BIncorrect. That is a records release.
• CCorrect. The insurer pays the provider directly.
• DIncorrect. That is a surgical consent.

Answer: D) Front and back

• AIncorrect. A copy is needed.
• BIncorrect. The back has key details.
• CIncorrect. The front has member data.
• DCorrect. The back often lists claims addresses and phone numbers.

Answer: B) A court order, if one exists

• AIncorrect. Court orders come first.
• BCorrect. Otherwise specific custody rules apply.
• CIncorrect. A court order or custody rules decide.
• DIncorrect. A court order or custody rules decide.

Answer: D) An appeal asking for reconsideration, with supporting documentation

When a payer denies a correctly coded, well-documented claim, the office files an appeal with supporting documentation. Corrected claims and reopenings are for actual errors, and diagnosis codes must never be changed just to get paid.

• AIncorrect. Codes must reflect the documentation. Changing a diagnosis just to get payment is improper and may be fraud.
• BIncorrect. An unchanged resubmission does not challenge the medical-necessity decision and is likely to be denied as a duplicate.
• CIncorrect. Reopenings are for minor errors or omissions. In this case the claim has no error; the office disagrees with the payer's decision.
• DCorrect. An appeal (for Medicare, the first level is a redetermination) formally disputes the payer's decision. Including the supporting records shows that the service was medically necessary.

Answer: D) When there are more than four installments or a finance charge

• AIncorrect. It depends on the plan terms.
• BIncorrect. Disclosure is for installment plans.
• CIncorrect. Disclosure may be required.
• DCorrect. It explains the terms.

Answer: B) A password, then a one-time code from a phone app

Two-factor authentication needs proof from two different categories: something you know, something you have, or something you are. A password plus a one-time code from a device qualifies. Two knowledge items do not.

• AIncorrect. A password and a security question are both 'something you know.' Two proofs from the same category are not two factors.
• BCorrect. This combines something you know (the password) with something you have (the device that generates the one-time code), so the two factors come from different categories.
• CIncorrect. Entering the same knowledge factor twice is still one factor. It adds no second type of proof.
• DIncorrect. A locked room is a physical safeguard, not an authentication factor. The login itself still uses only one factor.

Answer: C) Auto attendant

An auto attendant answers calls automatically and routes callers through a keypad or voice menu. Voicemail, answering services and call forwarding do different jobs.

• AIncorrect. Voicemail records a message when no one answers. It does not present a menu that routes callers to departments.
• BIncorrect. An answering service uses live outside operators who take messages, often after hours. It is not an automated menu.
• CCorrect. An auto attendant greets callers automatically and routes them through a keypad or voice menu to the right extension or department. A good setup also gives callers a quick path to a live person for urgent needs.
• DIncorrect. Call forwarding sends calls from one number to another, for example to an on-call phone. It does not offer callers a menu of choices.