CMAC Practice Questions (2026) — Free Sample Questions with Answers

Answer: D

Nothing beyond an internal log, because fewer than 500 patients were involved: The 500 threshold affects media and HHS timing, not whether patients must be notified.

Notify local media within 10 days, because a laptop was stolen: Media notice is required only when a breach affects more than 500 residents of a state or jurisdiction.

Notify patients only if one of them reports identity theft or misuse: Notification is triggered by the breach itself, not by later evidence of harm.

Notify each affected patient without unreasonable delay, within 60 days: Correct. Affected individuals must be notified within 60 days of discovery; breaches under 500 are also reported to HHS within 60 days after the end of the calendar year.

Unsecured (unencrypted) PHI breach: notify individuals within 60 days of discovery; 500+ also requires media and prompt HHS notice; under 500, report to HHS annually. Encryption is the best safeguard.

Answer: D

As an established patient, since she already has a chart: Having an old chart does not make a patient established once the three-year window has passed.

As an established patient, since she saw this same physician: Seeing the same physician counts only if the visit was within the past three years.

As a consult, since she has been away from the practice: Consultations require a request from another provider for an opinion; this is a routine visit.

As a new patient, since her last visit was over three years ago: Correct. Under CPT, a patient is new if no professional services were received from the physician or same-specialty group physician within the past three years.

Three-year rule: no face-to-face professional service from the provider or same-specialty group member within three years = new patient (longer appointment slot).

Answer: A

Brown, Ann; Brown, Ann M.; Browne, Al; Brown-Smith, Lee: Correct. 'Brown' (nothing after it) comes before 'Browne'; 'BrownSmith' as one unit compares E before S, so Browne precedes Brown-Smith; Ann precedes Ann M.

Brown, Ann M.; Brown, Ann; Brown-Smith, Lee; Browne, Al: 'Ann' alone files before 'Ann M.' (nothing before something), and Browne files before BrownSmith.

Brown, Ann; Brown, Ann M.; Brown-Smith, Lee; Browne, Al: This treats the hyphen as a break; as one unit, BrownSmith comes after Browne (E before S).

Browne, Al; Brown, Ann; Brown, Ann M.; Brown-Smith, Lee: 'Brown' is shorter than 'Browne', so under nothing-before-something it files first.

Alphabetic filing: surname, then given name, then middle initial; compare letter by letter; shorter unit first when identical so far; hyphenated names are one unit.

Answer: C

$13,550: This subtracts payments but forgets to subtract the $350 in adjustments.

$13,900: This adds the adjustments instead of subtracting them.

$13,200: Correct. $12,400 + $3,250 − $2,100 − $350 = $13,200.

$9,950: This leaves out today's charges, which increase accounts receivable.

Ending A/R = beginning A/R + charges − payments − adjustments. Reconcile the day sheet with deposits and receipts before closing.

Answer: A

The employer group health plan, then Medicare: Correct. Under Medicare Secondary Payer rules, for a working beneficiary 65 or older whose employer has 20 or more employees, the group plan is primary.

Medicare, then the employer group health plan: Medicare is primary only if the employer has fewer than 20 employees or the patient is retired.

Whichever plan has the lower deductible this year: Filing order follows coordination-of-benefits and MSP rules, not cost.

Both payers at the same time, split evenly: Claims are filed in order: primary first, then secondary with the primary's EOB/remittance.

MSP: working aged (65+) with an employer plan from a 20+ employee employer → group plan primary; retired → Medicare primary; Medicaid is always the payer of last resort.

Answer: B

Sit him upright and offer water while waiting for him to recover: An unresponsive person with gasping breathing may be in cardiac arrest; giving fluids is dangerous and delays CPR.

Shout for help, have 911 called and an AED brought, and start CPR: Correct. Gasping is not normal breathing; activate the emergency response, get the AED and begin chest compressions per BLS.

Check his pulse for a full minute before deciding what to do: BLS limits pulse checks to no more than 10 seconds to avoid delaying compressions.

Wait for the provider to finish with a patient and assess him: Every minute without CPR lowers survival; trained staff should act immediately.

Unresponsive + not breathing normally (gasping) = call for help/911, get the AED, start compressions right away.