Study guide
PHI Identifiers and Minimum Necessary
NHA Certified Billing and Coding Specialist CBCS
Track your progress as you read
Finished sections get a check mark.
1 Introduction and 2026 CBCS Exam Facts
Official 2026 CBCS Exam Facts How to Use This Guide Scoring, Time, and Question Strategy Current Manual Policy and Official Resources
2 Revenue Cycle Foundations
Revenue Cycle Map Patient Access to Charge Capture Claim to Payment Workflow Error Prevention and Rework Loops
3 Regulatory Compliance for Billing and Coding
HIPAA Privacy, Security, and Breach Recognition HITECH, FCA, Stark Law, and Anti-Kickback Basics OIG, Compliance Plans, and Audits Fraud, Abuse, and Documentation Risk
4 Confidentiality, Consent, and Professional Communication
PHI Identifiers and Minimum Necessary Consent, Authorization, and Release of Information Communicating with Patients, Providers, and Payers Ethical Escalation and Documentation Habits
5 Insurance Products and Payer Types
Commercial Plan Types Medicare, Medicaid, and TRICARE Secondary Payers, COB, and the Birthday Rule Workers' Compensation, Auto, and Other Third-Party Payers
6 Eligibility, Benefits, and Authorization
Intake Documents and Insurance Cards Eligibility, Benefits, Copay, Deductible, and Coinsurance Referrals, Preauthorization, and Predetermination ABN, Medical Necessity, and Self-Pay Workflows
7 Clinical Documentation and Abstraction
Anatomy, Terminology, and Acronyms Locating Relevant Documentation Abstracting Diagnoses, Procedures, and Services Provider Queries and Documentation Clarity
8 ICD-10-CM Guidelines and Sequencing
ICD-10-CM Structure, Conventions, and Notes Specificity, Laterality, and Episode of Care Sequencing, Code First, Use Additional Code, and Excludes Notes Medical Necessity and Diagnosis Support
9 CPT, E/M, and Procedure Coding
CPT Structure, Sections, and Symbols E/M Leveling, MDM, and Time Procedure Coding and Global Periods Specialty and Telehealth Coding Considerations
10 HCPCS, Modifiers, and Code Edits
HCPCS Level II and Medicare Codes High-Yield Modifiers NCCI, MUE, Bundling, and Unbundling Place of Service, Units, and Payer-Specific Rules
11 Claim Forms and Required Fields
CMS-1500 Professional Claims UB-04 Institutional Claims Diagnosis Pointers, Charges, Units, and NPIs Clean Claim Checklists
12 Electronic Claims, EDI, and Clearinghouses
EDI Transaction Map: 837, 835, 270, 271, 277CA, and 999 Clearinghouse Scrubbing and Front-End Rejections Payer-Specific Submission Rules Resubmission, Correction, and Timely Filing
13 Adjudication, Remittance, and Payment Posting
Adjudication Outcomes, Allowed Amounts, and Contractuals EOB, ERA, RA, CARC, and RARC Reading Patient, Payer Responsibility, and Secondary Billing Payment Posting, Adjustments, Writeoffs, and Credit Balances
14 Denials, Appeals, and Accounts Receivable Follow-Up
Rejections Versus Denials Denial Root Cause Analysis and Corrections Reconsiderations, Appeals, and Medicare Appeal Levels Aging Reports, Prioritization, and Follow-Up Notes
15 Patient Financial Responsibility
Estimates, Copays, Deductibles, and Coinsurance Assignment of Benefits and Financial Policies Statements, Payment Plans, and Hardship Workflows Collections Communication and FDCPA Awareness
16 Reporting, Reconciliation, and Revenue Cycle Improvement
Daily Balancing, Batches, and Deposits Productivity, Quality, and Denial Metrics Payer Trends, Contract Review, and Process Improvement Audit Trails, Documentation, and Compliance Reporting
17 Integrated CBCS Case Labs
New Patient Office Visit Case Diagnostic Test Authorization Case Surgical Global Period and Modifier Case Denial to Appeal Case
18 High-Yield CBCS Exam Traps
Sequencing Versus Bundling Traps Eligibility Versus Authorization Traps Privacy Versus Release of Information Traps Rejection, Denial, Write-Off, and Appeal Traps
19 Study Plan and Domain Remediation
Six-Week Study Plan Two-Week Final Review Plan Using Score Reports and Practice Data Building a Missed-Question Log
20 Exam-Day Readiness and Next Steps
Scheduling Deadlines and Test Delivery Pacing, Flagging, and Answer Changing After the Exam: Results, Retakes, and Renewal Career Next Steps After CBCS
PHI Identifiers and Minimum Necessary
Key Takeaways Explain This Topic AI
PHI is health information tied to identifiers that can reasonably connect the information to a specific person.
Names, geographic details, dates, contact information, account numbers, record numbers, images, and similar identifiers can make data identifiable.
Minimum necessary means using, requesting, or disclosing only the PHI needed for the job task, except where the rule does not apply such as patient access or treatment disclosure.
De-identification removes or limits identifiers so information can be used with greatly reduced privacy risk.
CBCS exam answers should favor role-based access, secure systems, identity verification, and restraint when sharing patient information.
Last updated: April 2026
Protected health information is not limited to dramatic clinical facts. In billing and coding, PHI can be ordinary data: a patient name on a superbill, a diagnosis on a claim, an account number in a work queue, a date of service in an appeal packet, or an explanation of benefits mailed to a home address. Information becomes PHI when it is individually identifiable health information held or transmitted by a covered entity or business associate. The exam often tests whether candidates notice that billing information is health information, not just financial data.
Key Concepts
Identifiers are clues that information can be tied to a person. Common identifiers include name, street address or smaller geographic detail, dates directly related to the person, telephone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, vehicle identifiers, device identifiers, web addresses, IP addresses, biometric identifiers, full-face photos or comparable images, and any other unique identifying characteristic.
A spreadsheet of unpaid balances with names and diagnoses is PHI. A list of procedure volumes with no patient identifiers may be de-identified or aggregated, depending on how it is prepared.
CBCS candidates should be able to apply this concept to daily workflow. A claim form contains PHI. A denial letter contains PHI. A payment posting report may contain PHI if it includes patient names, account numbers, services, or dates. A sticky note with a patient's name and procedure left in a public area is a privacy problem. A phone conversation about a patient's bill in a crowded waiting room can disclose PHI. Screens visible to visitors, printed schedules left at a front desk, and email sent to the wrong recipient are common exam-style risks.
Minimum necessary is a practical limitation on PHI use and disclosure. A billing specialist should access the account needed for the assigned task, not browse other encounters. When sending records for a payer appeal, include the documentation needed to support the denied service, not unrelated records. When calling a patient about a balance, confirm identity before discussing details and avoid announcing sensitive information to anyone who answers the phone.
Workflow and Documentation
When leaving a voicemail, follow organizational policy; many organizations keep messages limited to callback information unless the patient has requested otherwise.
The minimum necessary standard does not apply in every situation. It generally does not restrict disclosures to a provider for treatment, disclosures to the patient who is the subject of the information, uses or disclosures made under a valid authorization, certain required disclosures to the government, or uses and disclosures required by law. Even then, staff should use secure channels and follow policy. The exam may include an answer choice that says "release the entire chart because HIPAA never applies to payment." That is wrong.
Payment is permitted, but the amount disclosed should still be appropriate to the payment purpose.
Role-based access supports minimum necessary. A scheduler, coder, biller, payment poster, collector, and compliance auditor may all need PHI, but not necessarily the same PHI. A coder may need provider documentation. A payment poster may need remittance advice and account information. A front desk worker may need demographics and insurance cards. Access should be tied to work responsibilities. If an employee changes jobs, access should change. If an employee leaves, access should be disabled.
Exam Application
De-identification reduces privacy risk by removing identifiers or using an expert determination method. For exam purposes, de-identified data is often used for training, quality review, or reporting when individual patient identity is not needed. However, staff should not casually "de-identify" by deleting only the name while leaving medical record number, exact dates, rare diagnosis, and small-town address. If the remaining details can reasonably identify the person, privacy risk remains.
The safest habit is to pause before viewing, printing, speaking, faxing, emailing, or uploading PHI. Ask: Do I have a work reason? Is this the correct patient? Is this the correct recipient? Is this the least information needed? Is this an approved channel? If the answer is uncertain, use policy or ask a supervisor, privacy officer, or compliance contact. CBCS questions reward this disciplined approach. The right answer is rarely the fastest answer; it is the one that completes the revenue cycle task while protecting confidentiality.
High-Yield Checkpoints
PHI is health information tied to identifiers that can reasonably connect the information to a specific person.
Names, geographic details, dates, contact information, account numbers, record numbers, images, and similar identifiers can make data identifiable.
Minimum necessary means using, requesting, or disclosing only the PHI needed for the job task, except where the rule does not apply such as patient access or treatment disclosure.
De-identification removes or limits identifiers so information can be used with greatly reduced privacy risk.
CBCS exam answers should favor role-based access, secure systems, identity verification, and restraint when sharing patient information.