Are flashcards effective for the CCA exam?

Yes. Flashcards use active recall — retrieving an answer from memory — which research shows is one of the most effective study methods, especially in short, spaced sessions. They're ideal for the CCA's heavy terminology: ICD-10-CM conventions, ICD-10-PCS root operations, MS-DRG and APC rules, and HIPAA.

What topics do the CCA flashcards cover?

All six AHIMA competency areas: clinical classification systems (ICD-10-CM, ICD-10-PCS, CPT, HCPCS), reimbursement methodologies (MS-DRG, APC, the chargemaster), health records & data content (UHDDS, the MPI), compliance (fraud/abuse, NCCI, the False Claims Act), information technologies (EHR, CAC), and confidentiality & privacy (HIPAA, PHI).

How should I study with these CCA flashcards?

Lead with clinical classification — the code sets and conventions that are about a third of the exam — then drill reimbursement (MS-DRG vs APC) and the HIPAA privacy rules. Mix the modes: flip to learn, type to test recall, match for speed, and quiz to check yourself before a full practice test.

Are the CCA flashcards free?

Yes — 100% free, all four study modes, no paywall and no sign-up.

Do these flashcards match the current CCA exam?

Yes. The cards are organized to AHIMA's current CCA competency areas and the 105-question, 2-hour format, including current ICD-10-CM/PCS conventions, the 2021+ office E/M rules, and current reimbursement and HIPAA standards.

The U.S. diagnosis code set (Clinical Modification), maintained by NCHS; used to report diagnoses in all care settings. Codes are 3–7 characters.

The procedure code set for inpatient hospital procedures, maintained by CMS. Every code is exactly 7 characters.

Current Procedural Terminology — the AMA code set (HCPCS Level I) for physician and outpatient procedures and services; 5-digit codes.

An alphanumeric CMS code set (one letter + four digits) for drugs, supplies, DME, and ambulance — items not in CPT.

The condition established after study to be chiefly responsible for occasioning the patient's admission to the hospital (UHDDS definition).

First-listed diagnosis

The outpatient counterpart to the principal diagnosis — the main reason, established at that encounter, for the visit or service.

What does 'after study' mean in the principal diagnosis definition?

The diagnosis is selected based on the complete workup during the stay, not the admitting impression — so it may differ from the admitting diagnosis.

An ICD-10-CM note meaning 'not coded here' — the two conditions are mutually exclusive and can never be reported together.

An ICD-10-CM note meaning 'not included here' — the conditions are separate, so both may be coded when each is documented.

A single ICD-10-CM code that classifies two diagnoses, or a diagnosis with an associated manifestation or complication.

Etiology / manifestation convention

Code the underlying condition (etiology) first, then the manifestation. A manifestation code can never be sequenced first.

An ICD-10-CM instruction to sequence the underlying condition (etiology) before the current code.

'Use additional code' note

An ICD-10-CM instruction to assign an additional code, usually sequenced after the underlying condition, to fully describe it.

'In diseases classified elsewhere'

Signals a manifestation code that is never sequenced first; the underlying etiology must be coded and sequenced before it.

7th character A (injury)

Initial encounter — the patient is receiving active treatment for the injury.

7th character D (injury)

Subsequent encounter — routine care during the healing or recovery phase.

7th character S (injury)

Sequela — a residual late effect of an injury or its treatment.

Placeholder X (ICD-10-CM)

Holds an empty character position so a required 7th character lands in the correct slot.

Not elsewhere classifiable — the condition is specified but the classification lacks a more precise code.

Not otherwise specified — equivalent to 'unspecified' in the Tabular List.

Index then Tabular rule

Find the term in the Alphabetic Index, then verify the code in the Tabular List — never code from the Index alone.

Cooperating parties (ICD-10-CM guidelines)

CMS, NCHS, AHA, and AHIMA — the four parties that develop and approve the Official Guidelines.

Conventions vs guidelines precedence

The Tabular List and Alphabetic Index instructions (conventions) take precedence over the general coding guidelines.

Outpatient uncertain diagnosis rule

Never code a 'probable,' 'suspected,' or 'rule out' condition as confirmed — code the signs, symptoms, or reason for the visit.

Inpatient uncertain diagnosis rule

A diagnosis documented as 'suspected' but not ruled out at discharge may be coded as if it existed.

Signs and symptoms integral to a diagnosis

Not coded separately when they are routinely associated with the established underlying condition.

'See' cross-reference

A mandatory instruction in the Alphabetic Index to refer to the alternative term indicated.

Section IV (ICD-10-CM guidelines)

Diagnostic coding and reporting guidelines for outpatient services, including first-listed diagnosis selection.

ICD-10-PCS character 1

Section — e.g., 0 = Medical and Surgical.

ICD-10-PCS character 2

Body System — the general body system.

ICD-10-PCS character 3

Root Operation — the objective of the procedure; the most-tested PCS character.

ICD-10-PCS character 4

Body Part — the specific anatomical site.

ICD-10-PCS character 5

Approach — the technique used to reach the site (open, percutaneous, etc.).

ICD-10-PCS character 6

Device — any device left in place at the end of the procedure.

ICD-10-PCS character 7

Qualifier — additional distinguishing detail about the procedure.

Root operation Excision

Cutting out or off, without replacement, a PORTION of a body part.

Root operation Resection

Cutting out or off, without replacement, ALL of a body part.

Excision vs Resection

Excision removes part of a body part; Resection removes all of a defined body part (e.g., a whole lung lobe).

Letters O and I in ICD-10-PCS

Never used — to avoid confusion with the digits 0 and 1.

The grids from which each of the 7 characters of an ICD-10-PCS code is selected and built.

CPT is the AMA code set for physician/outpatient procedures; HCPCS Level II covers what CPT does not.

Office/outpatient E/M leveling (2021+)

Leveled by Medical Decision Making (MDM) OR total time on the encounter date; history and exam no longer set the level.

MDM elements (need 2 of 3)

Problems addressed, amount/complexity of data reviewed, and risk of complications.

E/M new patient definition

A patient not seen by the provider — or same-specialty provider in the group — within the prior 3 years.

E/M established patient

A patient seen by the provider or same-specialty group within the prior 3 years.

Your FREE CCA Flashcards 2026 – 200+ Cards

Realistic, CCA exam-style flashcards on ICD-10-CM/PCS, CPT, reimbursement, compliance and HIPAA — flip, match, type, and quiz yourself.

Master cards to boost your scoreMaster cards to raise your exam readiness score

How well do you know them?

CCA Flashcards

ICD-10-CM: The U.S. diagnosis code set (Clinical Modification), maintained by NCHS; used to report diagnoses in all care settings. Codes are 3–7 characters.
ICD-10-PCS: The procedure code set for inpatient hospital procedures, maintained by CMS. Every code is exactly 7 characters.
CPT: Current Procedural Terminology — the AMA code set (HCPCS Level I) for physician and outpatient procedures and services; 5-digit codes.
HCPCS Level II: An alphanumeric CMS code set (one letter + four digits) for drugs, supplies, DME, and ambulance — items not in CPT.
Principal diagnosis: The condition established after study to be chiefly responsible for occasioning the patient's admission to the hospital (UHDDS definition).
First-listed diagnosis: The outpatient counterpart to the principal diagnosis — the main reason, established at that encounter, for the visit or service.
What does 'after study' mean in the principal diagnosis definition?: The diagnosis is selected based on the complete workup during the stay, not the admitting impression — so it may differ from the admitting diagnosis.
Excludes1: An ICD-10-CM note meaning 'not coded here' — the two conditions are mutually exclusive and can never be reported together.
Excludes2: An ICD-10-CM note meaning 'not included here' — the conditions are separate, so both may be coded when each is documented.
Combination code: A single ICD-10-CM code that classifies two diagnoses, or a diagnosis with an associated manifestation or complication.
Etiology / manifestation convention: Code the underlying condition (etiology) first, then the manifestation. A manifestation code can never be sequenced first.
'Code first' note: An ICD-10-CM instruction to sequence the underlying condition (etiology) before the current code.
'Use additional code' note: An ICD-10-CM instruction to assign an additional code, usually sequenced after the underlying condition, to fully describe it.
'In diseases classified elsewhere': Signals a manifestation code that is never sequenced first; the underlying etiology must be coded and sequenced before it.
7th character A (injury): Initial encounter — the patient is receiving active treatment for the injury.
7th character D (injury): Subsequent encounter — routine care during the healing or recovery phase.
7th character S (injury): Sequela — a residual late effect of an injury or its treatment.
Placeholder X (ICD-10-CM): Holds an empty character position so a required 7th character lands in the correct slot.
NEC: Not elsewhere classifiable — the condition is specified but the classification lacks a more precise code.
NOS: Not otherwise specified — equivalent to 'unspecified' in the Tabular List.
Index then Tabular rule: Find the term in the Alphabetic Index, then verify the code in the Tabular List — never code from the Index alone.
Cooperating parties (ICD-10-CM guidelines): CMS, NCHS, AHA, and AHIMA — the four parties that develop and approve the Official Guidelines.
Conventions vs guidelines precedence: The Tabular List and Alphabetic Index instructions (conventions) take precedence over the general coding guidelines.
Outpatient uncertain diagnosis rule: Never code a 'probable,' 'suspected,' or 'rule out' condition as confirmed — code the signs, symptoms, or reason for the visit.
Inpatient uncertain diagnosis rule: A diagnosis documented as 'suspected' but not ruled out at discharge may be coded as if it existed.
Signs and symptoms integral to a diagnosis: Not coded separately when they are routinely associated with the established underlying condition.
'See' cross-reference: A mandatory instruction in the Alphabetic Index to refer to the alternative term indicated.
Section IV (ICD-10-CM guidelines): Diagnostic coding and reporting guidelines for outpatient services, including first-listed diagnosis selection.
ICD-10-PCS character 1: Section — e.g., 0 = Medical and Surgical.
ICD-10-PCS character 2: Body System — the general body system.
ICD-10-PCS character 3: Root Operation — the objective of the procedure; the most-tested PCS character.
ICD-10-PCS character 4: Body Part — the specific anatomical site.
ICD-10-PCS character 5: Approach — the technique used to reach the site (open, percutaneous, etc.).
ICD-10-PCS character 6: Device — any device left in place at the end of the procedure.
ICD-10-PCS character 7: Qualifier — additional distinguishing detail about the procedure.
Root operation Excision: Cutting out or off, without replacement, a PORTION of a body part.
Root operation Resection: Cutting out or off, without replacement, ALL of a body part.
Excision vs Resection: Excision removes part of a body part; Resection removes all of a defined body part (e.g., a whole lung lobe).
Letters O and I in ICD-10-PCS: Never used — to avoid confusion with the digits 0 and 1.
PCS Tables: The grids from which each of the 7 characters of an ICD-10-PCS code is selected and built.
CPT = HCPCS Level I: CPT is the AMA code set for physician/outpatient procedures; HCPCS Level II covers what CPT does not.
Office/outpatient E/M leveling (2021+): Leveled by Medical Decision Making (MDM) OR total time on the encounter date; history and exam no longer set the level.
MDM elements (need 2 of 3): Problems addressed, amount/complexity of data reviewed, and risk of complications.
E/M new patient definition: A patient not seen by the provider — or same-specialty provider in the group — within the prior 3 years.
E/M established patient: A patient seen by the provider or same-specialty group within the prior 3 years.
Office/outpatient E/M code range: 99202–99215 (99202–99205 new, 99211–99215 established).
Modifier 25: A significant, separately identifiable E/M service by the same provider on the same day as a procedure.
Modifier 59: Distinct procedural service — flags a procedure not normally reported together that is appropriate here.
Modifier 50: Bilateral procedure — performed on both the left and right sides in one operative session.
Modifier 26: Professional component — the physician's interpretation and report only.
Modifier TC: Technical component — the equipment, supplies, and technician only.
Modifier 91: Repeat clinical diagnostic laboratory test performed the same day to obtain a new result.
HCPCS J codes: Report injectable and infusion drugs by dosage amount.
HCPCS E codes: Report durable medical equipment (DME), such as a wheelchair.
HCPCS A codes: Report ambulance/transportation and medical & surgical supplies.
HCPCS Level II code format: One alphabetic letter followed by four numeric digits.
Sequela coding sequence: Code the resulting condition first, then the sequela code with 7th character S.
Two conditions equally meeting principal diagnosis: When no guideline directs otherwise, either condition may be sequenced as principal.
Prospective payment system (PPS): Reimburses a provider a predetermined, fixed amount tied to the case or service, rather than the provider's actual charges.
PPS incentive: Because payment is fixed regardless of actual cost, facilities are incentivized to manage resources efficiently.
MS-DRG: Medicare Severity Diagnosis-Related Group — the inpatient payment group based on clinically and resource-similar cases, refined by severity.
What drives MS-DRG assignment?: The principal and secondary diagnoses, procedures, sex, and discharge status.
CC (complication or comorbidity): A secondary diagnosis that can raise a case to a higher-weighted MS-DRG.
MCC (major complication or comorbidity): A more severe secondary diagnosis that can raise a case to an even higher-weighted MS-DRG.
MS-DRG relative weight: Represents the relative resource intensity of cases in that group compared with the average case.
Inpatient base payment formula: MS-DRG relative weight multiplied by the hospital's base payment rate.
Case-mix index (CMI): The average of a facility's MS-DRG relative weights; a higher CMI means a more complex, resource-intensive patient mix.
Why secondary-diagnosis coding affects the CMI: Captured CCs/MCCs raise MS-DRG weights, which raises the average (the CMI).
IPPS: The Medicare inpatient prospective payment system — pays a fixed amount per inpatient discharge using MS-DRGs.
APC: Ambulatory Payment Classification — the outpatient prospective payment grouping under OPPS, paying per service or procedure.
OPPS: The Medicare hospital outpatient prospective payment system — pays per outpatient service using APCs.
MS-DRG vs APC: MS-DRGs pay per inpatient discharge (IPPS); APCs pay per outpatient service/procedure (OPPS).
Comprehensive APC: Pays a single all-inclusive amount for a primary service plus its associated adjunctive services.
OPPS status indicator: Tells how a service is paid — e.g., packaged into another service's payment rather than paid separately.
Outlier payment: An additional PPS payment for an unusually costly case far exceeding the typical cost of its group.
Major diagnostic category (MDC): A broad clinical category under which DRGs are organized, generally by body system or etiology.
Chargemaster (CDM): A facility's master list of billable items and services, each with a charge code, description, amount, and CPT/HCPCS code.
CDM line-item elements: A charge code, item description, charge amount, and associated CPT or HCPCS code.
Why review the CDM regularly?: To keep CPT/HCPCS codes current and prevent claim denials or incorrect payment; ideally at least annually.
Hard-coded vs soft-coded charges: Hard-coded services flow through the CDM automatically; soft-coded services are assigned by a coder reviewing documentation.
NCCI edits: CMS edits that prevent improper payment: procedure-to-procedure (PTP) edits and Medically Unlikely Edits (MUEs).
PTP edit: A procedure-to-procedure edit that stops unbundling of code pairs that should be reported together.
MUE (Medically Unlikely Edit): Caps the maximum units of a HCPCS/CPT code reportable for one patient on one day.
NCCI modifier indicator 0: No modifier can override the edit — the codes cannot be unbundled.
NCCI modifier indicator 1: A modifier (such as 59) may bypass the edit when clinically justified and documented.
Why principal diagnosis selection has financial weight: It helps determine the MS-DRG, which drives the inpatient payment amount.
RBRVS: The Resource-Based Relative Value Scale underlying the Medicare Physician Fee Schedule (work + practice-expense + malpractice RVUs).
UB-04 claim form: The institutional/facility claim form used to bill for hospital and facility services (CMS-1450).
CMS-1500 claim form: The claim form used to bill for physician and other professional (non-institutional) services.
Revenue cycle: The set of administrative and clinical functions that capture, manage, and collect patient-service revenue, from registration to final payment.
Effect of a deleted code in an outdated CDM: Claims using the deleted code may be denied or rejected.
Why two same-principal-diagnosis cases differ in DRG: One had a documented complication or comorbidity that shifted it to a higher-severity group.
Master patient index (MPI): The permanent database that links a unique identifier to each patient and all of their encounters — the backbone of the HIS.
Purpose of searching the MPI before registration: To prevent creating a duplicate entry for a patient who already exists in the system.
Duplicate medical record: Two or more records created for the same patient — fragments care and creates billing and patient-safety risk.
Good patient identifier for the MPI: Unique to one patient and stable across all encounters.
UHDDS: Uniform Hospital Discharge Data Set — standard data elements reported for hospital inpatients; source of the principal-diagnosis definition.
UHDDS significant procedure: A procedure that carries a procedural or anesthetic risk, requires special training, or is surgical in nature.
UACDS: Uniform Ambulatory Care Data Set — standardizes data collection for outpatient/ambulatory care visits.
Why standardized data sets matter: Every facility reports the same defined elements the same way, making the data comparable across facilities.
Data vs information: Data are raw, unprocessed facts; information is data organized and interpreted to be meaningful and useful.
Authentication of a record entry: Verification by the author who is responsible for the entry — e.g., a signature; one author cannot sign for another.
Late entry in a record: Must clearly state it is a late entry and reflect when the information was actually documented.
Correcting a signed electronic entry: Enter an addendum or amendment that links to the original while preserving (never obscuring) the original content.
Why records must never be altered to obscure content: Obscuring original content destroys the record's integrity and its value as legal and clinical evidence.
History and physical (H&P): Documents the chief complaint and establishes the patient's baseline condition.
Operative report contents: The preoperative and postoperative diagnoses, the procedure performed, and the surgeon's findings.
Discharge summary contents: The reason for admission, significant findings, procedures/treatment, condition at discharge, and follow-up.
Legal health record: The defined set of documents an organization would produce as its official record for legal purposes.
Disease index: Organizes patient records by the diagnosis codes assigned during their care.
Registry vs index: A registry collects more detailed clinical data on a specific population or condition than an index does.
AHIMA data-quality model: Defines characteristics such as accuracy, completeness, consistency, and timeliness for health data.
Data accuracy: The data-quality characteristic that data are correct and free of error.
Single-source data capture: Capture each data element once at its source and reuse it to reduce duplicate, inconsistent entry.
Electronic signature requirement: Must uniquely identify the author and be applied under that author's control.
Required element on every entry: The date the entry was made (plus authentication by its author).
MPI as the foundation of the HIS: Nearly every other system relies on it to correctly identify and link a patient's information.
Discharge disposition standardization: Using standard categories lets disposition data be compared reliably across facilities.
Fraud (health care): Knowing and intentional deception or misrepresentation to obtain an unauthorized benefit, such as billing for services not rendered.
Abuse (health care): Practices inconsistent with sound fiscal or medical practice that cause unnecessary cost, without the same proven intent.
Fraud vs abuse — the dividing line: Intent. Fraud requires knowing, intentional deception; abuse does not.
Upcoding: Assigning a code that reflects a more severe diagnosis or more expensive service than the documentation supports.
Unbundling: Billing component codes separately when a single comprehensive code should be reported, to obtain higher payment.
Example of upcoding: Routinely selecting the highest-level E/M code on every chart regardless of documentation.
False Claims Act: A federal law imposing liability on anyone who knowingly submits, or causes to be submitted, false claims to Medicare.
'Knowingly' under the False Claims Act: Includes actual knowledge, deliberate ignorance, and reckless disregard of the truth — not just intent to defraud.
Qui tam action: A whistleblower lawsuit allowing a private individual to sue on the government's behalf and share in any recovery.
Handling a discovered Medicare overpayment: Report and return it within the required timeframe to avoid False Claims Act liability.
Anti-Kickback Statute: Prohibits knowingly offering, paying, soliciting, or receiving remuneration to induce referrals of covered items or services.
Stark Law (physician self-referral): Generally restricts a physician from referring Medicare patients to an entity with which they have a financial relationship, unless an exception applies.
OIG Work Plan: Identifies the areas the HHS Office of Inspector General intends to review or audit — signals compliance-risk focus.
OIG compliance program core elements: A designated compliance officer/committee, training, auditing/monitoring, and a confidential reporting hotline, among others.
Confidential reporting hotline: Lets employees report concerns and protects good-faith reporters from retaliation.
LEIE: The OIG List of Excluded Individuals and Entities — check it before employing or contracting with anyone.
Effect of OIG exclusion: The excluded party's claims are no longer paid by Medicare/Medicaid, and others may face penalties for using them.
Recovery Audit Contractor (RAC): Reviews Medicare claims to identify and correct improper payments — both overpayments and underpayments.
AHIMA Standards of Ethical Coding: Direct coders to assign codes based on provider documentation in the record and applicable coding guidelines.
Physician query: A compliant, non-leading request to a provider to clarify conflicting, incomplete, or ambiguous documentation before coding.
When to query the provider: When documentation is conflicting, incomplete, ambiguous, or imprecise and the missing detail affects code assignment.
Diagnosis only in a nursing note: Generally requires provider documentation — query the provider before coding it.
Coder pressured to assign an unsupported code: Refuse to assign it and report the concern through the established compliance channel.
Why upcoding is serious even if believed harmless: It produces payment not supported by documentation, which can constitute fraud.
Inappropriate-access discovery: Report a colleague viewing records they have no business reason to access through the facility's privacy/compliance process.
Computer-assisted coding (CAC): Software that scans clinical documentation and suggests candidate codes for a coder to review and validate.
Technology underlying CAC: Natural language processing (NLP), which extracts clinical concepts from free-text documentation.
Coder's role with CAC suggestions: Validate each suggested code against the documentation and edit or delete as needed — suggestions are not final.
CAC confirmation vs auto-finalize: A confirmation workflow is safer because NLP suggestions still require coder review before finalizing.
Monitoring CAC accuracy: Audit a sample of CAC-assisted charts against documentation for accuracy.
Encoder software: Helps a coder select and validate diagnosis and procedure codes during the coding process.
Logic-based (knowledge-based) encoder: Prompts the coder with sequencing edits and questions that mirror the coding guidelines.
Grouper software: Assigns coded data to a payment group, such as an MS-DRG, based on the codes entered.
Encoder vs grouper: An encoder helps select/validate codes; a grouper assigns the case to a payment group.
Lower-than-expected MS-DRG from a grouper: Verify that all relevant secondary diagnoses and their POA status were coded.
Audit trail (audit log): Records who accessed or modified a patient record, and when.
Role-based access control: Limits each user's access to the record functions appropriate to that person's job role.
EHR keyword search: Helps a coder quickly locate terms across the record, reducing search time.
Confirming a definitive diagnosis in the EHR: Look to provider documentation such as the operative report and the discharge summary.
Conflicting EHR documentation: Initiate a physician query to resolve the conflict before coding.
Structured data in the EHR: Standardized data elements and code sets that ease retrieval and improve data quality.
Present on admission (POA) indicator: Shows whether a diagnosis was present at the time of inpatient admission; it affects MS-DRG payment and is grouper input.
HIPAA: The Health Insurance Portability and Accountability Act — its Privacy and Security Rules protect protected health information.
Protected health information (PHI): Individually identifiable health information held or transmitted by a covered entity in any form — electronic, paper, or oral.
Minimum necessary standard: Limit the use, disclosure, and request of PHI to the least amount needed to accomplish the intended purpose.
Minimum necessary exceptions: Does not apply to disclosures for treatment, or to disclosures made under the patient's authorization.
Incidental disclosure: A permitted secondary exposure of PHI when reasonable safeguards and the minimum necessary standard are followed.
Psychotherapy notes: Kept separate from the rest of the record; generally require a specific authorization to disclose, even for routine purposes.
Personal representative (HIPAA): A person with legal authority to make health care decisions for the patient, such as a health-care proxy.
PHI protection after death: Continues for 50 years after the date of death under the HIPAA Privacy Rule.
Right of access: A patient's right to obtain a copy of their own record, generally within 30 days (with one possible 30-day extension).
Right to amend: A patient's right to request a correction to PHI in the designated record set.
Right to confidential communications: A patient's right to be contacted by a chosen method or at a chosen location.
Accounting of disclosures: A list of certain PHI disclosures; it generally excludes treatment, payment, and health care operations disclosures.
Revoking an authorization: Must be done in writing; after revocation, further disclosures under it are not permitted.
Verifying a requester before release: Confirm the identity and authority of the requester before disclosing any PHI.
Attorney-only subpoena: Requires satisfactory assurances (patient notice or a protective order) before PHI is disclosed.
Reasonable cost-based fee for record copies: A patient may be charged a reasonable, cost-based fee limited to copying, supplies, and labor for the copy.
Sanctions for a HIPAA violation: Penalties applied against workforce members who fail to comply with the entity's privacy policies.
Limited data set: A data set stripped of most direct identifiers, shareable for research under a data use agreement.
Data use agreement: An agreement committing a recipient of a limited data set to safeguard the information and limit its use.
Substance-use-disorder treatment records (42 CFR Part 2): Carry more stringent consent requirements and limits on redisclosure than general HIPAA PHI.
Public-health disclosure & minimum necessary: Disclose only the information reasonably needed for the public-health purpose.
Covered entity: A health plan, health care clearinghouse, or health care provider that transmits health information electronically — bound by HIPAA.
ICD-10-CM code length: Codes are 3 to 7 characters, with a decimal placed after the 3rd character.
First 3 characters of an ICD-10-CM code: The category — the broad disease or condition group.
Root operation Bypass: Altering the route of passage of the contents of a tubular body part.
Root operation Insertion: Putting in a nonbiological device that monitors, assists, performs, or prevents a physiological function.
Root operation Removal: Taking out or off a device from a body part.
Root operation Detachment: Cutting off all or part of an extremity (amputation).
Approach: Open: Cutting through the skin or mucous membrane to expose the procedure site.
Approach: Percutaneous: Entry by puncture or minor incision to reach the procedure site.
Approach: Percutaneous endoscopic: Entry by puncture/minor incision plus visualization with an endoscope.
Manifestation code: A code that describes a manifestation of an underlying disease and can never be sequenced first.
Default code (ICD-10-CM): The code listed next to a main term in the Index, representing the condition most commonly associated with that term.
'With' convention: Terms linked by 'with' in the Index or Tabular are assumed related unless documentation indicates otherwise.
Laterality (ICD-10-CM): Many codes specify right, left, or bilateral; assign the correct side from documentation.
CPT Category II codes: Optional performance-measure tracking codes that end in the letter F.
CPT Category III codes: Temporary codes for emerging technology, services, and procedures, ending in the letter T.
Time-based critical care: 99291 reports the first 30–74 minutes; +99292 each additional 30 minutes.
Z codes (ICD-10-CM): Report encounters for reasons other than disease/injury, such as exams, screenings, and aftercare.
External cause codes: Capture how an injury happened (cause, intent, place, activity); never sequenced as principal/first-listed.
Charge vs reimbursement: A charge is what a facility lists for a service; reimbursement is what the payer actually pays (often a set PPS amount).
Per diem payment: A fixed payment amount per day of care, regardless of the actual services delivered that day.
Capitation: A fixed payment per member per month to cover a defined set of services, regardless of utilization.
Fee-for-service: Payment for each individual service provided — the opposite of a bundled/prospective amount.
Remittance advice: The payer's explanation accompanying payment, detailing how each claim line was adjudicated.
Clean claim: A claim with no errors or missing information that can be processed without additional data.
Claim denial: A payer's refusal to pay a claim, often due to coding, coverage, or documentation issues.
Local Coverage Determination (LCD): A coverage decision made by a Medicare Administrative Contractor for its region.
National Coverage Determination (NCD): A nationwide Medicare coverage decision made by CMS.
Medical necessity: The principle that a service must be reasonable and necessary; the diagnosis must support the procedure billed.
Advance Beneficiary Notice (ABN): A notice to a Medicare patient before a likely-noncovered service, shifting financial responsibility to the patient.
Designated record set: The group of records a covered entity uses to make decisions about a patient; subject to access and amendment rights.
Demographic data: Patient identifying information such as name, address, date of birth, and sex.
Clinical data: Documentation of the patient's health condition, care, and treatment within the record.
Data completeness: The data-quality characteristic that all required data elements are present.
Data timeliness: The data-quality characteristic that data are recorded and available when needed.
Patient registry: A collection of detailed data on patients with a specific diagnosis or condition (e.g., a cancer registry).
Compliance program purpose: To prevent, detect, and correct violations of law and improper coding/billing within an organization.
Internal audit (coding): A periodic review of coded records against documentation to find and correct errors before claims go out.
Non-leading query: A query that asks the provider to clarify without suggesting a specific answer that would increase payment.
Sentinel effect: The improvement in behavior that results from knowing one's work is being monitored or audited.
HIPAA Security Rule scope: Protects electronic PHI (ePHI) through administrative, physical, and technical safeguards.
Natural language processing (NLP): Technology that interprets human (free-text) language so software can extract clinical concepts for coding.
Clinical documentation improvement (CDI): A program that works with providers to ensure documentation accurately reflects severity and supports coding.
Data integrity: The accuracy, completeness, and consistency of data over its entire lifecycle.
Interoperability: The ability of different health IT systems to exchange and use data with one another.
Business associate: A person/entity that performs functions involving PHI on behalf of a covered entity; bound by a BAA.
Business associate agreement (BAA): A contract requiring a business associate to safeguard PHI per HIPAA.
Breach (HIPAA): An impermissible use or disclosure of unsecured PHI that compromises its security or privacy.
De-identified information: Health data stripped of identifiers so it is no longer PHI and falls outside HIPAA restrictions.
Treatment, payment & operations (TPO): The core uses/disclosures of PHI permitted without separate authorization.

To find us again, just search “Career Employer CCA”

By Career EmployerUpdated Jun 19, 2026

200+ free CCA flashcards — 4 ways to study

CCA Flashcard of the DayNew daily

The classic card. Do you know this one?

Click Study Flashcards above to open the flashcard hub — hundreds of CCA cards you can flip, match, type, or quiz yourself on. Every card is drawn from AHIMA’s six competency areas of entry-level coding, so you study exactly what the exam tests.^[1] Pair them with our free practice test and study guide.

CCA Flashcard Study Modes

Most flashcard sites give you one thing: a card to flip. Ours has four modes so you can both learn the material and prove you know it — the difference between recognizing an answer and recalling it under exam pressure.

Flip (Study) — the classic card. Flip term ↔ definition, shuffle the deck, and mark each card “Got it” or “Still learning.”
Match (Game) — a timed game: pair each term to its definition as fast as you can. Great for cementing ICD-10-CM conventions, PCS root operations, and reimbursement terms.
Type (Recall) — read the definition and type the term. Typing forces true active recall instead of passive recognition.
Quiz (Test) — multiple-choice questions generated from the cards, so you self-test exactly like exam day.

Free CCA flashcards from Career Employer — active recall for the AHIMA Certified Coding Associate exam

Why Flashcards Work for the CCA

Flashcards aren’t busywork — they’re built on active recall: pulling an answer out of memory strengthens it far more than re-reading notes. Pair that with spacing — short sessions across several days rather than one cram — and you retain more in less time.

The CCA is dense with terminology — ICD-10-CM conventions, ICD-10-PCS root operations, MS-DRG and APC rules, compliance laws, and HIPAA.^[2] Spaced flashcards are the most efficient way to keep it all fresh. Used alongside our practice test and study guide, they turn review time into measurable progress.

CCA Flashcards by Topic

The cards are organized by AHIMA’s six competency areas. Drill the highest-yield one first — clinical classification, the code sets and conventions that make up about a third of the exam:^[1]

CCA flashcards by topic
Topic	What it covers
Clinical Classification Systems	ICD-10-CM conventions, ICD-10-PCS root operations, CPT/E&M, HCPCS
Reimbursement Methodologies	Prospective payment, MS-DRG vs APC, case-mix index, the chargemaster
Health Records & Data Content	UHDDS, the MPI, record content, data quality
Compliance	Fraud vs abuse, upcoding/unbundling, NCCI, the False Claims Act, queries
Information Technologies	EHR, computer-assisted coding, encoders & groupers
Confidentiality & Privacy	HIPAA Privacy & Security, PHI, minimum necessary, release of information

How to Get the Most Out of These Flashcards

Lead with the heavy topic. Clinical classification — the code sets and conventions — is about a third of the exam. Start there.
Use Type and Quiz, not just Flip. Recognizing the right answer is easy; recalling and choosing it is the real test.
Drill the inpatient/outpatient pairs. ICD-10-PCS vs CPT, MS-DRG vs APC, and the uncertain-diagnosis rules all flip by setting — the CCA loves to test the difference.
Then prove it. When the cards feel easy, confirm with a full practice test before exam day.

CCA Flashcards FAQ

Hundreds of free CCA flashcards, organized across the six AHIMA competency areas — clinical classification (ICD-10-CM/PCS, CPT, HCPCS), reimbursement methodologies, health records & data content, compliance, information technologies, and confidentiality & privacy. They're free with no account required.

References

1.AHIMA. “Certified Coding Associate (CCA) Certification.” ahima.org. ↑
2.CDC / National Center for Health Statistics. “ICD-10-CM Official Guidelines for Coding and Reporting.” cdc.gov. ↑
3.Centers for Medicare & Medicaid Services. “ICD-10-PCS Official Guidelines for Coding and Reporting.” cms.gov. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

All Posts

Career Employer’s Editorial Process

Here at Career Employer, we focus a lot on providing factually accurate information that is always up to date. We strive to provide correct information using strict editorial processes, article editing, and fact-checking for all of the information found on our website. We only utilize trustworthy and relevant resources. To find out more, make sure to read our full editorial process page here.