Work through the groups in order: foundations first, then scheduling, registration, verification, collections, denials, privacy, and improvement. Each concept pairs a rule with a worked decision and a common error, so read the explanation, resolve the example in your head before reading its outcome, and note the mistake line for later review. The examples are hypothetical learning cases, and references below list the texts supporting each rule. Use this guide alongside official program materials rather than as a replacement for them.
Patient Access Foundations and the Access Role
1. Where the revenue cycle begins and ends
The revenue cycle starts when a patient calls to schedule, not when billing submits a claim, and it ends only when the account balance is fully resolved through payer payments, contractual adjustments, write-offs, or patient payments. Access staff control the earliest, highest-leverage steps.
Example: A scheduler skips insurance questions on a call; the claim later denies for ineligible coverage. The failure occurred at scheduling, before any clinical service, so correction targets the access step.
Mistake to avoid: Treating denials as a billing-department problem when the root cause was captured at scheduling or check-in.
Reference: AAPC CPPM study guide sample
2. Efficiency versus effectiveness
Efficiency reaches a result with fewer staff and less time; effectiveness delivers an outcome the patient is satisfied with. A process can be efficient yet ineffective, or effective yet unaffordable. Skilled access managers test every workflow change against both questions rather than optimizing only speed.
Example: Cutting check-in steps to move patients faster drops copay capture and raises denials; the manager restores card scanning and balance collection because effectiveness was lost.
Mistake to avoid: Measuring only wait times or volume and assuming patient satisfaction and clean claims follow automatically.
Reference: AAPC CPPM study guide sample
3. Front office versus back office duties
Front office work covers patient-facing intake: scheduling, registration, verification, and time-of-service collection. Back office work covers claims processing, appeals, and accounts receivable follow-up. Deciding where a task belongs matters because errors migrate downstream: a front office omission becomes a back office denial.
Example: A missing group number at registration surfaces weeks later as a rejected claim; the practice assigns group-number confirmation to front office checklists.
Mistake to avoid: Assigning eligibility correction to billing staff instead of fixing the registration capture point.
Reference: AAPC CPPM study guide sample
4. Manager versus leader orientation
Managers focus on day-to-day tasks, direct work, and ensure completion with a tactical, controlling approach; leaders set direction, inspire, and think long-term. Access departments need both: a manager may run the schedule template while leading staff through an EMR transition.
Example: During a new check-in system rollout, the supervisor sets deadlines (managing) and also holds listening sessions to build buy-in (leading).
Mistake to avoid: Assuming a title grants leadership; directive task control alone does not motivate staff through change.
Reference: AAPC CPPM study guide sample
5. Accountability through measurable goals
Accountability is built by assigning measurable, objective goals, not by vague expectations. Positive, negative, or combined incentives frame it. Staff who understand what, why, and how performance is defined help prevent poor performance and support continuous improvement across the access team.
Example: Instead of demanding accuracy, the manager sets a target of complete insurance fields on every registration and audits a sample weekly.
Mistake to avoid: Evaluating registration quality by impression or seniority rather than sampled, objective audit results.
Reference: AAPC CPPM study guide sample
6. Access-to-care policy for patients unable to pay
Practices need a written policy for patients who cannot pay at check-in. The decision flow distinguishes established patients, who may see the manager or senior receptionist, from new patients, who may be rescheduled; uninsured patients may be referred to a free clinic or the emergency department.
Example: An established patient forgot his wallet; per policy he sees the senior receptionist and signs a balance agreement rather than being turned away.
Mistake to avoid: Letting each receptionist improvise payment exceptions, creating inconsistent and potentially discriminatory access.
Reference: AAPC CPPM study guide sample
Providers, Payers, and Care Settings
7. MD and DO credentials
Both MDs and DOs are fully licensed physicians who may use all accepted treatments, including drugs and surgery. DOs are osteopathic physicians, many emphasizing the musculoskeletal system, prevention, and holistic care. Access staff should not route or restrict services based on the degree type.
Example: A patient requests a different doctor because her provider is a DO; staff explain both degree types hold equivalent prescribing and surgical authority.
Mistake to avoid: Treating osteopathic physicians as lesser or alternative practitioners when verifying credentials or scheduling.
Reference: AAPC CPPM study guide sample
8. NPP direct billing versus incident-to billing
Non-physician practitioners such as NPs, PAs, clinical nurse specialists, and certified nurse midwives may bill payers under their own identifier, generally at a percentage below physician payment, or bill incident-to under the supervising physician's identifier. The choice changes whose number appears on the claim.
Example: An NP follows up on a physician-monitored hypertension patient with the physician in the suite; the visit is billed incident-to under the physician's identifier.
Mistake to avoid: Billing an NPP service under a physician identifier when the incident-to conditions were never met.
Reference: AAPC CPPM study guide sample
9. Incident-to supervision and course-of-treatment rules
Incident-to services must be part of the patient's normal course of treatment, with the physician having personally performed an initial service and remaining actively involved. The NPP's work must be integral to the physician's own care. Direct supervision means presence in the office suite, not the treatment room.
Example: A physician leaves the building while a PA sees a patient's first visit; this fails incident-to because no physician-performed initial service and supervision exist.
Mistake to avoid: Assuming a physician's name on the chart satisfies incident-to without in-suite supervision and prior involvement.
Reference: AAPC CPPM study guide sample
10. Prescription authority distinctions
Physicians, nurse practitioners, and physician assistants can write prescriptions; a registered nurse cannot. When scheduling or routing medication refill requests, access staff direct them to prescribers, not to nursing staff, regardless of how routine the request seems to the caller.
Example: A patient calls for a refill and offers to have the RN sign it; staff route the request to the NP because RNs lack prescribing authority.
Mistake to avoid: Routing refill authorization to whoever answers the phone instead of a licensed prescriber.
Reference: AAPC CPPM study guide sample
11. Payment models: fee-for-service versus ACO fixed payment
Under fee-for-service, each service is billed separately; an Accountable Care Organization receives a fixed dollar amount to care for a patient and must allocate treatment resources efficiently, often with risk-adjusted methodology. Access staff see the difference in authorization and referral expectations before visits.
Example: A clinic joins an ACO; scheduling now confirms care-coordination referrals before specialist visits because resource use affects the fixed payment.
Mistake to avoid: Assuming every payer reimburses per visit identically regardless of the practice's payment model contracts.
Reference: AAPC CPPM study guide sample
12. Specialty routing using reason-for-visit
Specialty scope drives correct routing: podiatrists treat foot and ankle conditions, rheumatologists treat joints and autoimmune disease, urologists cover urinary tract and male reproductive organs. Capturing the reason for visit at scheduling lets staff match patients to the right specialist the first time.
Example: A caller describes ankle pain from a weekend game; the scheduler offers sports medicine rather than general surgery based on the injury description.
Mistake to avoid: Booking patients into whatever slot is open without matching the complaint to specialty scope.
Reference: AAPC CPPM study guide sample
Scheduling and Appointment Management
13. Insurance capture at scheduling
Insurance information must be collected when the appointment is made so coverage can be verified before arrival. Missing this step risks denied claims and forces the provider to collect from the patient or write off the balance, depending on the contract with the payer.
Example: A scheduler records the plan name but no member ID; verification stalls, so the office calls the patient back before the visit to complete it.
Mistake to avoid: Waiting until check-in to discover the plan requires authorization the visit cannot obtain in time.
Reference: AAPC CPPM study guide sample
14. Accident and work-related screening
Asking whether the visit relates to an accident or work-related condition identifies the responsible payer, such as workers' compensation or auto coverage, before the claim goes out. This single screening question prevents misdirected primary claims and later rebilling.
Example: A patient mentions a fall at work; the scheduler flags workers' compensation as payer and collects employer details instead of health plan information.
Mistake to avoid: Billing the patient's health plan for a work injury and reworking the claim after payer rejection.
Reference: AAPC CPPM study guide sample
15. Disclosing non-participation before the visit
If the patient's carrier is one the provider does not participate with or is not a preferred provider for, the patient should be told before traveling to the office. Communicating financial obligations up front, including copay and coinsurance, protects full payment for services.
Example: A new patient holds an out-of-network plan; the scheduler explains higher patient responsibility at booking, and the patient still confirms the appointment.
Mistake to avoid: Surprising patients with non-network costs at check-in, prompting cancellations and uncollected balances.
Reference: AAPC CPPM study guide sample
16. Prior authorization triggered at scheduling
When a patient's plan requires prior authorization for a service, the call to the payer should happen before the patient arrives. Without it, the payer may deny the claim, leaving the provider to collect from the patient or write off the balance depending on the contract.
Example: Imaging is scheduled for Thursday; staff submit the authorization request on Monday so payer approval is documented before the appointment.
Mistake to avoid: Treating authorization as billing's job after the service instead of an access task before arrival.
Reference: AAPC CPPM study guide sample
17. Schedule templates and reminders
Organizing patients into an effective schedule using templates that specify appointment types by time of day maximizes revenue and patient flow. Providing reminders reduces the risk of patients not showing up, protecting both access capacity and the provider's productivity.
Example: A clinic reserves morning slots for new-patient physicals needing extra time and sends text reminders, cutting same-day cancellations noticeably.
Mistake to avoid: Filling every slot identically regardless of visit type, causing backups and rushed encounters.
Reference: AAPC CPPM study guide sample
18. Reason-for-service capture
Identifying the reason for services at scheduling is critical to organizing the schedule for efficiency and patient flow. Vague entries like follow-up prevent proper slot typing, authorization checks, and specialty routing, so staff record the specific purpose of each visit.
Example: The scheduler types post-op staple removal rather than follow-up, allowing a short slot and correct supply setup.
Mistake to avoid: Accepting checkup or follow-up as a complete reason, hiding authorization and duration needs.
Reference: AAPC CPPM study guide sample
Registration and Data Accuracy
19. Registration accuracy drives clean claims
Inaccurate registration information leads to claim denials, difficulty in collection efforts, and a less effective, more costly revenue cycle. Data gathered at registration is paramount for clean claims, authorizations, and future collection; errors delay cash flow and add resubmission costs.
Example: A transposed policy digit causes rejection; the practice corrects the record and adds a read-back step at check-in.
Mistake to avoid: Viewing typos as trivial clerical issues rather than direct causes of denials and delayed cash.
Reference: AAPC CPPM study guide sample
20. Registration accuracy audits
An effective audit samples ten to fifteen records per registration staff member, reviewing registration paperwork and remittance advices for registration-related denials. Key measurements include demographics, insurance verification, group number, copay collected, card copy, consent, and emergency contact, followed by a training plan.
Example: An audit shows one scheduler never records group numbers; the manager schedules targeted retraining and re-audits the next month.
Mistake to avoid: Running audits without follow-up training and re-measurement, so the same errors keep recurring.
Reference: AAPC CPPM study guide sample
21. Open-ended questions at check-in
Asking how the patient will pay the copay today works better than asking whether there is a copay, and offering to scan the card beats asking whether insurance changed. Open-ended phrasing assumes the action and invites specifics, reducing missed payments and stale data.
Example: Asked how she will pay today, a patient reveals a new plan and produces the card for scanning on the spot.
Mistake to avoid: Using yes/no questions that let patients answer no and bypass collection or updates.
Reference: AAPC CPPM study guide sample
22. Insurance card scanning at every visit
Scanning or copying the insurance card at each visit captures current policy and group numbers and provides documentation for eligibility disputes. Asking to scan the card, rather than asking whether insurance changed, avoids relying on patient memory of plan details.
Example: A patient insists nothing changed, but the scan shows a new group number effective that month; the claim is filed correctly.
Mistake to avoid: Skipping the scan for established patients and filing against outdated plan details.
Reference: AAPC CPPM study guide sample
23. Required registration data elements
Beyond demographics, registration should capture employer, emergency contact, consent to treat, and acknowledgements such as the notice of privacy practices signature. These fields support collections, clinical safety, and compliance, and their absence shows up as deductions on registration audits.
Example: An audit flags missing consent-to-treat forms; the office adds a checkpoint so no patient reaches the clinical area unsigned.
Mistake to avoid: Treating consent and acknowledgement forms as optional paperwork when they are audited elements.
Reference: AAPC CPPM study guide sample
24. Productivity and skill at the front desk
Because money is collected and critical information gathered at registration, productive, skilled staff at this position are vital. Strong training plus follow-up performance audits maintain quality, and reports can identify staff who are not collecting copays as required.
Example: Monthly collection reports show one receptionist consistently missing copays; coaching and side-by-side observation correct the pattern.
Mistake to avoid: Staffing the front desk with whoever is available instead of trained, audited personnel.
Reference: AAPC CPPM study guide sample
Insurance Verification and Authorization
25. Verify before the appointment date
Insurance should be verified once the appointment is scheduled and information entered, before the visit date. Early verification provides the opportunity to correct policy number typos, missing group numbers, or terminated coverage, which otherwise delay reimbursement for the practice.
Example: Verification on Tuesday reveals coverage ended last month; the patient is contacted Wednesday and secures active coverage before Friday's visit.
Mistake to avoid: Verifying eligibility at check-in when no time remains to fix coverage problems.
Reference: AAPC CPPM study guide sample
26. Eligibility versus benefit depth
Verification means confirming the plan is active and that it covers the services to be performed, plus the patient's out-of-pocket amounts such as copays, deductibles, and coinsurance. Active coverage alone does not confirm the specific scheduled service is a covered benefit.
Example: Eligibility shows active coverage, but the planned procedure is non-covered; staff inform the patient of self-pay responsibility before the visit.
Mistake to avoid: Reading active eligibility as proof that the scheduled service itself is covered.
Reference: AAPC CPPM study guide sample
27. Consequences of skipped authorization
Without prior authorization, the payer may deny the claim, and the provider must either collect from the patient or write off the balance depending on the contract. Authorization is therefore a revenue-protection step, not an administrative courtesy performed for convenience.
Example: A plan denies an unauthorized procedure as non-covered; under contract the practice cannot bill the patient and absorbs the loss.
Mistake to avoid: Assuming the payer will retroactively authorize services that were performed in good faith.
Reference: AAPC CPPM study guide sample
28. Referrals as a distinct requirement
No authorization or referral appears as its own denial category, separate from eligibility. Some plans require a primary care referral before specialist visits even when the service itself is covered; access staff must confirm both requirements independently for each scheduled encounter.
Example: An HMO patient books cardiology without a referral; the scheduler obtains one from the primary care office before the visit date.
Mistake to avoid: Confusing an approved referral with an authorization and skipping the other requirement.
Reference: AAPC CPPM study guide sample
29. Provider enrollment with the plan
Provider not enrolled or not certified is a common denial cause. If the provider is not enrolled with a health plan, staff should either avoid scheduling those patients with that provider or schedule with a different enrolled provider, and track pending enrollment applications.
Example: Denials cluster around one plan; review shows the physician's enrollment application is still pending, so new patients are booked elsewhere.
Mistake to avoid: Continuing to schedule patients with providers known to be unenrolled with their plans.
Reference: AAPC CPPM study guide sample
30. Check-in insurance decision flow
At check-in, staff confirm whether the patient has insurance, verify coverage, and copy the card; if the patient lacks coverage, the flow branches to payment ability, referral to the office manager, or community resources rather than automatic refusal of the encounter.
Example: An uninsured walk-in with cash pays a deposit and sees the provider; one without funds is referred per the access policy.
Mistake to avoid: Turning away uninsured patients before applying the practice's written access-to-care policy.
Reference: AAPC CPPM study guide sample
Point-of-Service Collections and Financial Communication
31. Time-of-service collection scope
Any patient-responsible payment should be collected at the front desk during registration before service: copays, deductibles, current account balances, and non-covered services. Clear, specific collection policies standardize the process and reduce back-end rework for the billing team.
Example: A patient owes a copay and a prior balance; both are collected at check-in under the posted policy.
Mistake to avoid: Deferring copays and balances to mailed statements after the visit, which adds collection cost and lets enforcement vary by receptionist instead of following the posted policy.
Reference: AAPC CPPM study guide sample
32. The added cost of late collection
Collecting payment after the initial visit carries added costs, such as mailing statements to patients. Time-of-service collection avoids these expenses and improves cash flow, which is why practices define collection policies for the front desk rather than relying on statements afterward.
Example: A practice calculates the mailing cost per statement and shifts routine copay collection to check-in, cutting statement volume noticeably.
Mistake to avoid: Deferring small balances to statements and spending more on mailing than the balance is worth.
Reference: AAPC CPPM study guide sample
33. Balance reminders for established patients
When scheduling an established patient, staff should check for outstanding balances, including guarantor balances, and remind the patient to bring payment for the current visit. This turns the appointment call into a collection opportunity before the visit occurs.
Example: The scheduler notes a guarantor balance and asks the patient to bring payment; the balance is settled at check-in.
Mistake to avoid: Scheduling established patients without checking balances, losing the pre-visit collection opportunity.
Reference: AAPC CPPM study guide sample
34. Patients who cannot pay at check-in
The decision flow sends patients unable to pay to the office manager or senior receptionist under the policy for patients who cannot pay, rather than leaving receptionists to decide. Established patients may keep their visits; new patients may be offered rescheduling instead.
Example: A new patient forgot all payment methods; per policy she is offered a reschedule rather than an improvised exception.
Mistake to avoid: Allowing front-line staff to create ad hoc payment exceptions without manager authority.
Reference: AAPC CPPM study guide sample
35. Deposit collection when funds exist
When a patient has cash, check, or card available, the flow collects a deposit for the current visit copay and any back balance due before the patient sees the provider. This secures revenue before service rather than chasing it afterward through statements.
Example: A patient with a card pays the copay plus last month's balance at the window and proceeds to the exam room.
Mistake to avoid: Letting patients proceed to care with a promise to pay on the way out.
Reference: AAPC CPPM study guide sample
36. Monitoring collection performance
Reports should identify instances where staff are not collecting copays, followed by additional training on why time-of-service collection matters. Measurement makes the policy enforceable and reveals whether misses are systemic or tied to one individual.
Example: A copay-capture report shows one desk below peers; after coaching, that desk's rate matches the others.
Mistake to avoid: Publishing a collection policy without any report verifying staff actually follow it.
Reference: AAPC CPPM study guide sample
Revenue Cycle and Denial Prevention
37. Tracking denials by type
Practices should chart denial percentages by type over time, such as non-covered, not eligible, missing information, invalid codes, no authorization, and untimely filing. The pattern identifies where to intervene; a persistent category signals a systemic process failure, not random error.
Example: Non-covered denials dominate the report every month; the manager investigates scheduling and check-in procedures rather than individual claims.
Mistake to avoid: Working denials one by one without categorizing root causes across the report.
Reference: AAPC CPPM study guide sample
38. The 80/20 rule in denial reduction
As a rule of thumb, most issues stem from a minority of problems. Denial reduction starts by reviewing the denial report, identifying the top reasons, determining corrective actions, updating policy, educating staff, and using practice management software rules where available.
Example: Two denial causes account for most of the volume; the practice fixes eligibility checking and enrollment tracking before anything else.
Mistake to avoid: Spreading effort evenly across all denial types instead of attacking the dominant few.
Reference: AAPC CPPM study guide sample
39. Non-covered service spikes
A consistently high percentage of non-covered denials should prompt the manager to look for systemic errors by monitoring scheduling and check-in staff procedures. The question is whether staff are verifying benefits for the specific service, not just confirming active coverage.
Example: Non-covered denials rise after a new scheduler starts; observation shows she skips benefit-depth checks, so training is assigned.
Mistake to avoid: Writing off non-covered denials as payer behavior without auditing the front-end process.
Reference: AAPC CPPM study guide sample
40. Charge capture and coding responsibility
Each service performed must be matched to procedure and diagnosis codes based on what the provider documented in the record. Code selection may be done by the provider or by trained staff such as certified coders, but the provider remains responsible for accuracy.
Example: A coder selects codes from the documented note; the physician reviews and signs off, retaining responsibility for accuracy.
Mistake to avoid: Assuming the coder owns accuracy and the provider need not review selected codes.
Reference: AAPC CPPM study guide sample
41. A/R aging and the over-90 measure
Accounts receivable should be aged in buckets such as current, 31-60, 61-90, and beyond, with the percentage over 90 days tracked monthly. A rising over-90 figure means collections are lagging and follow-up workflows need escalation before balances age further.
Example: The over-90 percentage climbs for three straight months; the manager assigns dedicated follow-up staff to the oldest self-pay balances.
Mistake to avoid: Watching total A/R dollars only and missing deterioration hidden in the aging mix.
Reference: AAPC CPPM study guide sample
42. Denial improvement as a cycle
An effective effort reviews the denial report, identifies reasons, educates staff on fixes, and modifies processes, such as adopting a better enrollment tracking tool or escalating pending plan enrollments. Verification that correct applications reached every plan closes the loop.
Example: After enrollment-related denials, the practice adopts a tracking tool and verifies applications per plan before booking those patients.
Mistake to avoid: Stopping at staff education without changing the process that produced the denials.
Reference: AAPC CPPM study guide sample
HIPAA Privacy in Access Operations
43. Who is a covered entity
The Privacy Rule applies to health plans, clearinghouses, and providers who transmit health information electronically in connection with standard transactions such as claims or eligibility inquiries. A provider emailing patients is not covered by that fact alone; the transmission must relate to a standard transaction.
Example: A small practice submits electronic eligibility checks through its vendor; it is covered even though staff also mail paper claims.
Mistake to avoid: Assuming paper-only filing exempts a practice whose billing service transmits electronically for it.
Reference: HHS Summary of the HIPAA Privacy Rule
44. PHI across all media
Protected health information is individually identifiable information about health, care, or payment held by a covered entity in any form: electronic, paper, or oral. Access staff create PHI verbally at the front desk, so privacy discipline applies to conversations, not just records.
Example: A receptionist discusses a patient's outstanding balance loudly at the window; that oral disclosure is regulated PHI handling.
Mistake to avoid: Limiting privacy practices to the EMR while ignoring spoken and printed information.
Reference: HHS Summary of the HIPAA Privacy Rule
45. Business associates and agreements
A business associate is a non-workforce person or organization performing functions for a covered entity involving PHI, such as claims processing, billing, or data analysis. Written agreements must impose safeguards, and a covered entity cannot authorize any use the Rule itself would prohibit.
Example: The practice hires a billing service that touches claim data; a signed business associate agreement with required safeguards precedes data sharing.
Mistake to avoid: Exchanging PHI with a billing vendor for years without a current written agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
46. Minimum necessary in access work
Covered entities must make reasonable efforts to use, disclose, and request only the minimum PHI needed for the purpose, supported by role-based access policies. The whole record cannot be sent unless specifically justified. Requests from providers for treatment are exempt from this limit.
Example: An eligibility inquiry includes member ID and service type only, not the full chart, because the payer needs limited fields.
Mistake to avoid: Sending entire records for routine eligibility or payment questions without specific justification.
Reference: HHS Summary of the HIPAA Privacy Rule
47. Incidental disclosures and safeguards
The Rule does not require eliminating every risk of incidental disclosure. A disclosure incident to an otherwise permitted one is allowed if the covered entity has adopted reasonable safeguards and the information being shared was limited to the minimum necessary.
Example: Another patient overhears a name called at the window; with lowered voices and spacing, this incidental exposure is permitted.
Mistake to avoid: Claiming any overheard detail is acceptable because safeguards exist somewhere in the office.
Reference: HHS Summary of the HIPAA Privacy Rule
48. De-identified data versus limited data sets
De-identified information, created by removing specified identifiers or by formal statistical determination, carries no use restrictions. A limited data set removes direct identifiers but retains some information and may be used only for research, public health, or operations under a data use agreement.
Example: A vendor wants claims data for a utilization study; the practice supplies a limited data set with a signed data use agreement, not full identifiers.
Mistake to avoid: Releasing a limited data set without a data use agreement as if it were de-identified.
Reference: HHS Summary of the HIPAA Privacy Rule
Patient Rights and Disclosure Decisions
49. Notice of privacy practices at first encounter
Direct treatment providers must deliver the notice no later than the first service encounter, post it prominently at each delivery site, and make good-faith efforts to obtain written acknowledgement, documenting any failure. In emergencies, notice is furnished as soon as practicable.
Example: A new patient receives the notice at check-in and signs the acknowledgement; the scanned form is stored with the registration record.
Mistake to avoid: Handing out the notice only when a patient requests it and never documenting acknowledgement efforts.
Reference: HHS Summary of the HIPAA Privacy Rule
50. Treatment, payment, and operations uses
A covered entity may use and disclose PHI without authorization for its own treatment, payment, and health care operations, and for the treatment activities of any provider. Payment includes obtaining premiums and reimbursement; operations include quality assessment, credentialing, audits, and fraud detection.
Example: The practice sends claim details to the payer for reimbursement; no patient authorization is needed because this is payment.
Mistake to avoid: Demanding patient signatures for routine claims submission that the Rule already permits.
Reference: HHS Summary of the HIPAA Privacy Rule
51. When authorization is required
Written authorization is required for uses outside treatment, payment, and operations, such as disclosures to a life insurer for coverage, employer pre-employment physical results, or a drug firm's marketing. Authorizations must be plain language, specify information and recipients, and state revocation rights.
Example: A life insurer requests examination results; the practice releases them only after the patient signs a compliant written authorization.
Mistake to avoid: Releasing examination results to an employer or insurer without a valid written authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
52. Personal representatives and minors
A personal representative, someone legally authorized to act for the individual or the estate, must be treated as the individual. Parents generally represent minor children, but exceptions exist, and where law is silent a licensed professional may decide access in professional judgment.
Example: A divorced father requests his daughter's records; staff confirm custody documentation before treating him as personal representative.
Mistake to avoid: Releasing a minor's records to any relative who asks without verifying representative status.
Reference: HHS Summary of the HIPAA Privacy Rule
53. Facility directory and involvement disclosures
Providers may list a patient's name, general condition, and location in a facility directory using informal permission, disclosing to people who ask by name. Similar informal agreement permits sharing information directly relevant to a person involved in the individual's care or payment.
Example: A hospital tells a caller asking for the patient by name that she is in stable condition; no written authorization is needed.
Mistake to avoid: Confirming a patient's presence to callers who never identify the patient by name.
Reference: HHS Summary of the HIPAA Privacy Rule
54. Right of access and the designated record set
Individuals may review and obtain copies of PHI in the designated record set, meaning records used to make decisions about them, such as medical and billing records. Psychotherapy notes and certain other categories are excepted, and reasonable cost-based copying fees may apply.
Example: A patient requests her billing records; the practice provides copies within the record set and charges a cost-based fee.
Mistake to avoid: Denying record access because the patient carries an outstanding account balance.
Reference: HHS Summary of the HIPAA Privacy Rule
Quality, Technology, and Change Management
55. Plan-Do-Check-Act for access metrics
Quality improvement follows a cycle: plan a change, do it on a small scale, check the measured result, and act by adopting or adjusting. Applied to access, a registration fix is piloted at one desk, measured, then spread only if the metrics actually improve.
Example: One receptionist pilots a read-back script for policy numbers; audit scores rise, so the practice adopts it at every desk.
Mistake to avoid: Rolling out a process change practice-wide before measuring a pilot result.
Reference: AAPC CPPM study guide sample
56. Zero tolerance for preventable denials
Creating a culture of zero tolerance for preventable denials means treating avoidable front-end errors as unacceptable, pairing the stance with education and process fixes. The cultural expectation is what sustains improvements after the initial project formally ends.
Example: After eligibility denials drop, the manager keeps monthly denial reviews on the agenda so gains are not abandoned.
Mistake to avoid: Declaring victory after one improvement cycle and then discontinuing all measurement.
Reference: AAPC CPPM study guide sample
57. EMR cost-benefit analysis before purchase
An EMR decision should rest on a table identifying all costs and benefits over several years: hardware, hosting, training, interfacing, and incentives against savings such as reduced paper supplies, storage, pharmacy calls, and improved collections. Accurate financial planning eases the transition.
Example: A practice compares five-year totals for two systems; higher hosting fees are offset by paper and storage savings, justifying the choice.
Mistake to avoid: Comparing only upfront software prices and ignoring multi-year operating costs and savings.
Reference: AAPC CPPM study guide sample
58. Hosted ASP model economics
A hosted application service provider model can require roughly half the up-front cost of a local installation while returning about twice the benefit in the referenced analysis, because the vendor hosts the system and the practice pays recurring fees instead of heavy infrastructure.
Example: A two-provider office chooses vendor hosting over buying a server, trading a large capital outlay for predictable monthly fees.
Mistake to avoid: Forgetting recurring hosting and maintenance fees when totaling the hosted model's cost.
Reference: AAPC CPPM study guide sample
59. Certified EHR technology and interoperability
The Quality Payment Program requires certified EHR technology, and the 2015 Edition criteria span categories including clinical processes, care coordination, privacy and security, patient engagement, and electronic exchange. Using certified technology supports electronic exchange of clinical documents for coordination.
Example: Before relying on its record system for quality reporting, a practice confirms the vendor holds current certification under the program.
Mistake to avoid: Assuming any electronic record system qualifies for programs requiring certified technology.
Reference: AAPC CPPM study guide sample
60. Managing physician resistance to change
When a physician erupts over a new system, effective responses acknowledge the difficulty, apologize sincerely, agree where possible, and offer to show benefits, while ineffective ones argue or cite rules. Giving the physician a sense of control moves the conversation toward resolution.
Example: Facing complaints about a new EMR, the manager says the change is hard and offers a walkthrough; the physician agrees to try.
Mistake to avoid: Answering physician frustration with because that is the policy, which escalates resistance.
Reference: AAPC CPPM study guide sample
References and further reading
Source links checked on Oct 2, 2026.