Administrative Assisting, Medical Law and Ethics
12.7% of the exam
This guide covers two domains that the NHA scores separately but that share one spine: Administrative Assisting (12 scored items) and Medical Law and Ethics (7 scored items). That is 19 of the 150 scored items, about 12.7% of the exam — roughly one item in eight. With the cutline near 78% correct, these 19 items are not decoration. The spine running through both is scope of practice: almost every wrong answer in this domain is the one where the medical assistant decides something a provider or a payer decides. Work the checks out loud before you open the answers. Reading this page twice is worth far less than answering each prompt once from memory.
Scheduling systems and prioritizing by clinical urgency
Administrative Assisting is 12 scored items, and scheduling is where many of them live. Know the systems. Stream: one patient per fixed slot. Wave: several booked at the top of the hour, seen in order. Modified wave: two or three at the top, then singles. Double booking: two patients in one slot. Clustering: like visits grouped, all physicals Tuesday morning. Open hours: first come, first served. Visit type drives slot length — a new patient needs more time than an established follow-up, because history, consents and insurance must be built from zero. Urgency is screened against a written office protocol, never your own clinical judgment. Chest pain, trouble breathing, uncontrolled bleeding or stroke signs are not "next available." Document every no-show, cancellation and callback attempt in the record.
Insurance verification and the cost-sharing math
Verify coverage before the visit, not at checkout: active dates, plan type, in- or out-of-network status, whether a referral or prior authorization is required, and the patient's cost share. Three terms. Copay: a fixed dollar amount for a covered service, collected at the time of service. HealthCare.gov defines it as paid after the deductible, but many plans apply office-visit copays before the deductible is met — read the plan. Deductible: the amount the patient pays each year before the plan starts paying. Coinsurance: a percentage of the allowed amount, owed after the deductible is met. Worked example — allowed amount $200, deductible not yet met: the patient owes $200 and the remaining deductible drops by $200. Same visit once the deductible is met, with 20% coinsurance: the patient owes $40 and the plan pays $160. The Explanation of Benefits is a statement of how the claim processed, not a bill.
ICD-10-CM versus CPT, medical necessity, referral versus prior authorization
Two code sets, two jobs. ICD-10-CM answers why: the diagnosis. Three to seven characters, first character alpha, second numeric, characters three through seven alphanumeric, decimal placed after the third character. The annual code set takes effect every October 1, and CMS with CDC/NCHS also issue a mid-year update effective April 1. CPT answers what was done: five characters, maintained by the AMA, annual code set effective every January 1. Category I codes are five numeric digits, organized in six sections — Evaluation and Management, Anesthesia, Surgery, Radiology, Pathology and Laboratory, Medicine. Category II quality-measure codes are four digits plus the letter F. Category III emerging-technology codes are four digits plus the letter T. HCPCS Level II (CMS) is one letter plus four digits: supplies, DME, drugs, ambulance. Medical necessity means the diagnosis code must justify the procedure code; a mismatch is a leading denial reason. Scope note: the provider documents and determines the diagnosis. You confirm that codes match what the provider documented — you never assign a diagnosis the provider did not record. A referral comes from a provider and sends the patient to another provider. A prior authorization comes from the payer and approves the service in advance — obtain it before scheduling.
The claim: superbill, clearinghouse, rejection versus denial
The encounter form, or superbill, captures the diagnosis and procedure codes for one visit and feeds the claim. Professional (non-institutional) claims use the 1500 Health Insurance Claim Form, version 02/12, maintained by the National Uniform Claim Committee; institutional claims use the UB-04 (CMS-1450). Most claims travel electronically through a clearinghouse that scrubs them before the payer adjudicates. Learn the split. A REJECTED claim never entered the payer's adjudication system — a data error such as a transposed member ID. Correct the data and resubmit; there is nothing to appeal. A DENIED claim was processed and payment was refused — correct what is correctable and appeal within the payer's filing deadline. The payer sends an Explanation of Benefits to the patient and a remittance advice to the practice. Accounts receivable is tracked on an aging report, conventionally in 30-day buckets. A write-off or adjustment is posted, not collected. Scope and integrity line: changing a code so a claim will pay is fraud, not problem-solving.
The record: documentation, correcting an error, and inventory
The chart is a legal document. Paper correction: draw one line through the error so the original stays readable, write the correction, add the reason, then date and initial. Never erase, white out, black out or obliterate. The Medicare Program Integrity Manual (Pub. 100-08, ch. 3, section 3.3.2.5) sets the standard for paper and electronic records alike: every amendment, correction or delayed entry must be clearly and permanently identified as such, must clearly indicate the date and author, and must clearly identify all original content, without deletion. In an EHR that means a correction is an addendum and the audit trail preserves the original entry. A late entry is labeled as a late entry and dated the day it is actually written. Chart what you did, never in advance, never for someone else. On the supply side: maintain par levels, rotate stock oldest first, check expiration dates, and keep maintenance, temperature and equipment-inspection logs current.
HIPAA: minimum necessary, authorizations, and the patient's clocks
Minimum necessary means: use, disclose and request the least protected health information needed for the task. 45 CFR 164.502(b)(2) lists six situations where it does not apply — disclosures to or requests by a health care provider for treatment, uses or disclosures made to the individual, uses or disclosures made under the patient's authorization, disclosures to the Secretary of HHS for enforcement, uses or disclosures required by law, and uses or disclosures required for compliance with HIPAA. Treatment, payment and health care operations (TPO) need no separate authorization; nearly everything else does — an employer, an attorney, a life insurer, a family member the patient has not approved. Patient rights run on clocks: access within 30 days with one 30-day extension; amendment within 60 days with one 30-day extension; accounting of disclosures reaching back six years, acted on within 60 days with one 30-day extension, and TPO is excluded from the accounting.
Consent, advance directives, mandatory reporting, and negligence
Implied consent: the patient's action shows agreement — rolling up a sleeve for an injection. Expressed consent: stated aloud or in writing. Informed consent: the provider explains diagnosis, procedure, risks, benefits, alternatives, and the consequence of refusing. The medical assistant may witness the signature and confirm the form is complete, signed and dated — never explain the procedure, never answer "should I do this?". Advance directives (Patient Self-Determination Act, 1990): a living will states treatment wishes; a durable power of attorney for health care names who decides. DNR/DNI and POLST/MOLST are medical orders signed by an authorized health care professional that staff act on immediately; form names and requirements vary by state. Mandatory reporting: report reasonable suspicion of abuse in good faith — you never investigate and never wait for proof. Negligence requires all four elements: duty, dereliction, direct cause, damages.
Where people lose points
✗ "ICD-10-CM and CPT are basically interchangeable code sets."
✓ ICD-10-CM = the diagnosis, the WHY the patient was seen. 3–7 characters, annual set effective October 1. CPT = the procedure or service, the WHAT was done. 5 characters, annual set effective January 1. A clean claim pairs them: the ICD-10-CM code must support medical necessity for the CPT code billed.
✗ "Copay, coinsurance and deductible all just mean the patient's share."
✓ Copay = flat dollar amount for a covered service, collected at the time of service. Deductible = annual amount the patient pays before the plan pays. Coinsurance = a percentage of the allowed amount, owed after the deductible is met. Order of operations on any exam math: deductible first, then coinsurance.
✗ "A referral and a prior authorization are the same paperwork."
✓ A referral comes from a PROVIDER and sends the patient to another provider. A prior authorization (or precertification) comes from the PAYER and approves the service in advance. A patient can hold a valid referral and still be denied payment for lack of prior authorization — they are two separate gates.
✗ "A rejected claim and a denied claim are the same thing."
✓ A REJECTION never entered adjudication — it failed a format or data edit (wrong member ID, missing field). Fix the data and resubmit; there is no appeal because there was no decision. A DENIAL was adjudicated and payment was refused. That one gets an appeal, filed within the payer's deadline and supported by the provider's documentation.
✗ "The medical assistant obtains the patient's informed consent."
✓ The PROVIDER obtains informed consent, because informed consent is the disclosure conversation — diagnosis, procedure, risks, benefits, alternatives, consequences of refusal — not the signature. The MA may witness the signature and verify the form is complete, signed and dated. Any clinical question from the patient goes back to the provider.
✗ "Fix a charting error by deleting it or covering it so the chart looks clean."
✓ Never. Paper: one line through the error so the original stays readable, then correction, reason, date, initials. EHR: an addendum. The Medicare Program Integrity Manual requires every amendment, correction or delayed entry to be clearly and permanently identified as such, to show the date and author, and to leave all original content identifiable without deletion. A record that hides its own history reads as concealment in a legal review.
✗ "A living will, a health care proxy and a DNR are the same document."
✓ A living will says WHAT treatment the patient wants. A durable power of attorney for health care / health care proxy says WHO decides when the patient cannot. DNR/DNI and POLST/MOLST are medical ORDERS signed by an authorized health care professional and acted on immediately. Directives express wishes; orders direct action.
✗ "Minimum necessary applies to everything, so send the referred specialist as little as possible."
✓ 45 CFR 164.502(b)(2) exempts treatment disclosures from minimum necessary — send the specialist what treatment requires. It also does not apply to uses or disclosures to the individual, those made under the patient's authorization, those required by law, those required for HIPAA compliance, or disclosures to the Secretary of HHS for enforcement. It DOES apply to routine internal use, payment and operations.
✗ "A bad outcome proves negligence."
✓ All four elements must be present: duty (a care relationship existed), dereliction (the standard of care was breached), direct cause (that breach caused the harm), damages (actual harm occurred). Miss any one and there is no negligence. A poor outcome from care delivered to the standard is not negligence.
✗ "Don't report suspected abuse until you are sure — you could ruin someone's life."
✓ Mandatory reporting is triggered by REASONABLE SUSPICION, not proof. CAPTA (42 U.S.C. 5106a) conditions state grant funding on state laws that give immunity from civil or criminal liability to people who report in good faith. Investigating on your own, confronting the suspected abuser, or waiting for certainty are all failures. Report to the designated agency, follow office protocol, document objectively.
✗ "The lab result is normal, so telling the patient is just being helpful."
✓ Releasing results is the provider's decision. An MA may relay a result the provider has already released and documented, using the provider's words. Saying what it means, calling it "normal," or answering "is that bad?" is interpretation — that is diagnosis, and it is outside the CCMA scope of practice.
✗ "Have every Medicare patient sign an ABN at check-in, just in case."
✓ The Advance Beneficiary Notice of Noncoverage (Form CMS-R-131) is for Original Medicare fee-for-service — not Medicare Advantage (Part C) or Part D — and must be specific: this item or service, this reason Medicare may deny it, this estimated cost, delivered before the service so the patient can choose. CMS prohibits routine and blanket ABNs and prohibits collecting signatures on blank forms. An invalid ABN does not transfer financial liability to the patient.
Numbers to memorize
| Exam weight of this guide | Administrative Assisting 12 scored items + Medical Law and Ethics 7 = 19 of 150 (12.7%) |
| HIPAA right of access (45 CFR 164.524) | Act no later than 30 days after receipt; one 30-day extension with written notice of the reason — 60 days maximum |
| HIPAA right to amend (45 CFR 164.526) | Act no later than 60 days; one 30-day extension. Patient may file a statement of disagreement if denied |
| Accounting of disclosures (45 CFR 164.528) | Six years back; act within 60 days with one 30-day extension. Excluded: treatment, payment and operations; disclosures to the individual; disclosures made under the patient's authorization; and other listed categories |
| Notice of Privacy Practices (45 CFR 164.520(c)(2)) | Direct treatment provider: give no later than the date of first service delivery (in an emergency, as soon as reasonably practicable); make a good faith effort to obtain written acknowledgment of receipt |
| Breach notice to individuals (45 CFR 164.404) | Without unreasonable delay, and in no case later than 60 calendar days after discovery of the breach |
| Breach notice to HHS (45 CFR 164.408) | 500 or more individuals: contemporaneously with the notice to individuals. Fewer than 500: log them and report annually, no later than 60 days after the end of the calendar year |
| Minimum necessary — does NOT apply to (45 CFR 164.502(b)(2)) | Six exceptions: disclosures to or requests by a provider for treatment; uses/disclosures to the individual; uses/disclosures under the patient's authorization; disclosures to the Secretary of HHS for enforcement; uses/disclosures required by law; uses/disclosures required for HIPAA compliance |
| De-identification, Safe Harbor method (45 CFR 164.514(b)(2)) | Remove 18 identifiers; all ages over 89 and date elements indicating such age may be aggregated into a single category of "age 90 or older" |
| ICD-10-CM format | 3 to 7 characters; 1st alpha, 2nd numeric, 3rd–7th alphanumeric; decimal after the 3rd character; a 3-character code is used only if not further subdivided |
| ICD-10-CM update schedule | Annual code set effective October 1; CMS and CDC/NCHS also issue a mid-year update effective April 1 |
| CPT format and categories (AMA) | 5 characters. Category I = five numeric digits, in six sections (E/M, Anesthesia, Surgery, Radiology, Pathology and Laboratory, Medicine); Category II = 4 digits + F (performance measurement); Category III = 4 digits + T (emerging technology) |
| CPT annual update | Annual code set effective January 1 |
| HCPCS Level II (CMS) | One alphabetical letter + 4 numeric digits; covers supplies, DME/DMEPOS, certain drugs, ambulance |
| Claim forms | Professional/non-institutional: 1500 Health Insurance Claim Form, version 02/12, maintained by the National Uniform Claim Committee (NUCC). Institutional: UB-04 (CMS-1450) |
| Rejection versus denial | Rejection = never adjudicated (format/data error) — correct and resubmit, no appeal. Denial = adjudicated and payment refused — appeal within the payer's filing deadline |
| Advance Beneficiary Notice of Noncoverage | Form CMS-R-131; Original Medicare fee-for-service only (not Medicare Advantage or Part D); delivered before the item or service; routine, blanket and pre-signed blank ABNs are invalid |
| Cost-sharing order of operations | Copay is a flat amount for a covered service; the deductible is satisfied first; coinsurance is a percentage of the allowed amount applied after the deductible |
| Four elements of negligence | Duty, dereliction (breach of the standard of care), direct cause, damages — all four required |
| Patient Self-Determination Act | 1990; facilities receiving Medicare/Medicaid must inform patients of their rights and ask whether they have an advance directive |
| Information blocking (21st Century Cures Act) | 45 CFR part 171: 10 exceptions — 6 for not fulfilling a request (subpart B, including Protecting Care Access), 3 for the procedures used to fulfill it (subpart C), 1 TEFCA manner exception (subpart D). Under the infeasibility exception the actor must respond to the requestor in writing within 10 business days |
| CMS record correction standard | Medicare Program Integrity Manual (Pub. 100-08) ch. 3, sec. 3.3.2.5: every amendment, correction or delayed entry must be clearly and permanently identified as such, must clearly indicate the date and author, and must clearly identify all original content, without deletion |
Test yourself
No answers here on purpose — retrieving them is the practice. Drill this domain if any of these stall you.
- Name the six scheduling systems and state, in one phrase each, how patients are slotted.
- A patient calls with a sudden severe headache, slurred speech and a drooping face. What are your two required actions and the two decisions you are not permitted to make?
- A service has an allowed amount of $600. The patient has $450 of deductible remaining and 30% coinsurance. Show the math for what the patient owes and what the plan pays.
- Write out the ICD-10-CM character rules: how many characters, what type is each position, and where does the decimal go?
- Which code set has its annual update on October 1 and which on January 1, who maintains each, and what extra ICD-10-CM update date exists?
- Give the format of a CPT Category I, Category II and Category III code, and of a HCPCS Level II code.
- Distinguish a referral, a prior authorization and an ABN by who issues each and what each accomplishes.
- Distinguish a rejected claim from a denied claim, say what you do about each, and name the form and the committee behind professional paper claims.
- Describe, step by step, the correct way to fix an error in a paper chart, then the correct way to fix one in the EHR, and state the three things CMS requires of any amendment.
- List the six situations in which HIPAA's minimum necessary standard does not apply.
- State the deadline for each: right of access, right to amend, accounting of disclosures, breach notice to individuals, breach notice to HHS for 500 or more, and breach notice to HHS for fewer than 500.
- Give an example of implied consent, an example of expressed consent, and state exactly who obtains informed consent and what the medical assistant may and may not do.
- Contrast a living will, a durable power of attorney for health care, and a POLST/MOLST — which one is a medical order?
- What standard of certainty triggers mandatory reporting, and name three things a mandated reporter must not do instead of reporting.
- Name the four elements of negligence and explain why a poor outcome alone does not satisfy them.
- A patient asks you to explain her cholesterol panel, her surgical risks, and whether her rash looks infected. Answer each request in one sentence that stays inside the CCMA scope of practice.