CCE BC-TMH Board Certified TeleMental Health Provider

Which document MUST a telemental health (TMH) provider have in place with their video platform vendor to maintain HIPAA compliance?

• ABusiness Associate Agreement (BAA)
• BMemorandum of Understanding (MOU)
• CEnd User License Agreement (EULA)
• DService Level Agreement (SLA)

A counselor licensed only in Ohio receives a session request from a long-term client who has just moved to Florida and is now physically located in Tampa. What is the MOST appropriate action?

• AProvide the session because the therapeutic relationship was established in Ohio
• BDecline to provide TMH services unless the counselor is licensed in Florida or covered by…
• CProvide the session and document Ohio as the client's location
• DRefer the client to the Ohio licensing board for guidance

PSYPACT primarily authorizes which professionals to deliver telehealth across state lines in member states?

• ALicensed Professional Counselors
• BLicensed Clinical Social Workers
• CLicensed Psychologists
• DLicensed Marriage and Family Therapists

Which element is REQUIRED in a TMH-specific informed consent that is NOT typically required in standard in-person informed consent?

• ARisks related to technology failure and breaches of electronic privacy
• BLimits of confidentiality regarding child abuse
• CThe provider's training and credentials
• DFees and payment policies

During the COVID-19 Public Health Emergency, HHS issued an enforcement discretion notice that allowed providers to use which of the following platforms temporarily?

• APublic-facing platforms such as Twitch and TikTok Live
• BNon-public-facing communication products such as FaceTime and Skype
• CAny platform regardless of public exposure
• DOnly platforms with signed BAAs

A client receiving substance use disorder treatment via TMH at a Part 2 program asks the counselor to share progress with their employer. Under 42 CFR Part 2, what is required for this disclosure?

• AVerbal consent documented in the chart
• BSpecific, written client consent that meets Part 2 requirements
• CA standard HIPAA authorization signed once a year
• DNo consent because employment is a treatment-related disclosure

Which of the following BEST describes the ethical responsibility of a TMH provider regarding client identity at the START of the therapeutic relationship?

• AAccept the name the client provides without verification
• BVerify identity with a government-issued photo ID and document the verification
• CVerify identity only if insurance is being billed
• DVerify identity only when prescribing medication

A TMH client discloses that their roommate, who is identifiable, will 'pay for what they did.' The client describes a plan and access to a weapon. The counselor's PRIMARY duty under Tarasoff jurisprudence is to:

• AMaintain confidentiality and continue treatment
• BTake reasonable steps to warn or protect the identifiable third party
• CEnd the session immediately and refer to inpatient care
• DNotify the client's family

A counselor records TMH sessions for supervision. Which step is MOST critical before recording?

• AInform the supervisor
• BObtain explicit, written client consent and document storage and retention policies
• CEncrypt the recording after it is uploaded
• DUse a personal hard drive for storage

A 14-year-old in California seeks TMH counseling without parental knowledge. The counselor should FIRST:

• ARefuse services until a parent is present
• BDetermine the state's age of consent for outpatient mental health services and the releva…
• CBill the parent's insurance and notify them
• DProvide unlimited sessions to build rapport before discussing consent

Which of the following is the MOST appropriate way to handle mandatory reporting of suspected child abuse identified during a TMH session?

• AMandatory reporting does not apply to TMH because the counselor cannot directly observe t…
• BReport to the appropriate child protective services agency in the jurisdiction where the…
• CWait until the next in-person opportunity to make the report
• DNotify the parent first and ask them to self-report

Documenting the client's physical location at the start of every TMH session is required PRIMARILY because:

• AInsurance reimbursement requires geographic codes
• BJurisdictional licensure and emergency response depend on the client's location
• CTime zones must be accounted for in scheduling
• DMost platforms require location for analytics

Which scope-of-practice consideration is UNIQUE to TMH?

• AMaintaining competence in chosen modalities
• BDemonstrating competence in the technology used to deliver care
• CAdhering to a code of ethics
• DPursuing continuing education

A client invites the counselor to connect on a personal social media account. The MOST ethical response is to:

• AAccept the invitation to strengthen the alliance
• BDecline and review the practice's social media policy with the client
• CAccept and create a separate professional persona
• DIgnore the request without addressing it

A psychologist licensed in a PSYPACT state wants to see a client who is traveling in another PSYPACT state. The psychologist should:

• AApply for a temporary license in the receiving state
• BHold an active E.Passport and Authority to Practice Interjurisdictional Telepsychology (A…
• CDecline because PSYPACT only covers permanent residents
• DUse only asynchronous communication

Which is the BEST documentation practice for a TMH session?

• ANote only clinical content and skip technical details
• BNote that TMH was used, the platform, the client's location, any disconnections, and clin…
• CNote only the platform used
• DDocument only if reimbursement requires it

Telehealth parity laws in many states require:

• AIdentical reimbursement for telehealth and in-person services in all cases
• BCoverage of telehealth services on terms comparable to in-person, with specifics varying…
• COnly Medicare-aged adults to receive telehealth
• DCounselors to discount telehealth services by 20%

Which CPT/HCPCS modifier is currently used to identify a synchronous telehealth service delivered via real-time interactive audio and video?

• AGT
• B95
• CGQ
• DFQ

A counselor is asked by a court to release TMH session recordings. The counselor should FIRST:

• AComply immediately to avoid contempt
• BVerify the legal basis (subpoena vs court order) and consult legal counsel and the client
• CRefuse all disclosure regardless of the order
• DEmail the recordings to the requesting attorney

Which is the MOST appropriate informed consent practice for a client with limited English proficiency receiving TMH?

• AUse the client's family member as the interpreter
• BProvide consent documents and discussion in the client's preferred language using a quali…
• CProvide English-only consent and ask the client to sign
• DSkip consent if the client appears to understand the platform

Which of the following BEST defines a HIPAA breach?

• AAny unauthorized acquisition, access, use, or disclosure of PHI that compromises its secu…
• BOnly loss of paper records
• COnly theft of a laptop
• DAny disclosure to a treating clinician

A counselor accidentally emails an unencrypted session note to the wrong client. Under HIPAA Breach Notification Rule, the counselor must:

• ATake no action because it was an accident
• BConduct a risk assessment and notify the affected individual and HHS as required
• CNotify only the wrong recipient
• DWait six months before deciding

Which of the following is an example of an asynchronous TMH service?

• ALive video psychotherapy
• BTelephone crisis call
• CSecure messaging where the counselor responds within 24 hours
• DGroup video therapy

A counselor offers TMH services to a client residing in a state that requires specific TMH-related continuing education. The counselor has not completed this CE. The MOST ethical action is to:

• AProvide services and complete CE within the year
• BDecline to provide services until CE requirements are met or alternative arrangements are…
• CProvide services and document that the client is aware of the CE gap
• DProvide services and consult the licensing board after the fact

Under HIPAA, the Minimum Necessary Standard means that providers should:

• ADisclose all available information to ensure thorough care
• BLimit disclosures to the minimum needed to accomplish the purpose, except for treatment p…
• CDisclose only when subpoenaed
• DDisclose only after the client signs an authorization for every interaction

A TMH client requests their full record under HIPAA's Right of Access. The provider must generally:

• ARefuse if the record contains psychotherapy notes
• BProvide access to the designated record set within 30 days, with limited exceptions for p…
• CCharge a per-page fee unrelated to actual cost
• DProvide only a summary unless the client gives a reason

Which is the MOST appropriate practice for managing dual relationships in a small community where TMH is delivered?

• AAvoid all incidental contact entirely
• BDiscuss boundaries proactively, document, and refer when conflicts of interest are unavoi…
• CPretend not to know the client when seen in public
• DEnd the therapeutic relationship at the first sign of overlap

A counselor's professional liability insurance lists in-person practice only. Before providing TMH, the counselor should:

• ABegin TMH and notify the carrier later
• BConfirm coverage explicitly includes TMH and any cross-state services
• CAssume coverage carries over automatically
• DCancel the policy

Which of the following BEST describes how informed consent for TMH should address recording by either party?

• ARecording is implicitly permitted in TMH
• BBoth client and clinician must explicitly consent to recordings; unauthorized recording i…
• COnly the clinician may record
• DOnly the client may record

A counselor practicing under the Counseling Compact's privilege to practice in a remote state must comply with:

• AOnly the home state's laws
• BThe remote state's practice laws and standards while serving clients located there
• COnly the federal HIPAA standard
• DOnly the home state's ethics code

Which platform feature BEST supports HIPAA compliance for TMH video sessions?

• APublic chat rooms
• BEnd-to-end or transport encryption with a signed BAA
• CFree consumer accounts
• DPublic link sharing

Multi-factor authentication (MFA) for TMH platforms PRIMARILY protects against:

• APower outages
• BCredential compromise and unauthorized account access
• CBandwidth limitations
• DCamera malfunctions

Which of the following is generally considered HIPAA-compliant when a BAA is in place?

• APersonal FaceTime
• BStandard consumer Skype
• CDoxy.me
• DPublic Facebook Messenger

End-to-end encryption (E2EE) means that:

• AData is encrypted only while at rest on the server
• BOnly the communicating endpoints can decrypt the data, and even the platform vendor canno…
• CThe platform vendor can read content for quality assurance
• DData is unencrypted in transit but encrypted on the device

A clinician uses a personal smartphone to text appointment reminders to clients without consent. This practice is:

• AAcceptable because text reminders are administrative
• BProblematic because SMS is generally not encrypted and consent has not been documented
• CAcceptable if the phone is password-protected
• DAcceptable if the clinic owns the phone

Recording a TMH session for clinical review should be stored:

• AOn a personal cloud drive without encryption
• BIn an encrypted, access-controlled location with documented retention and destruction pol…
• COn a flash drive kept in the clinician's home
• DOn the platform's free trial storage tier

Which is a BEST practice to mitigate risk when a TMH session is interrupted by a platform outage?

• AEnd the session and document later
• BSwitch immediately to a personal social media call
• CHave a pre-arranged backup plan (e.g., phone number) documented in informed consent
• DWait for the client to email

Which control BEST limits unauthorized access to a TMH waiting room or video session?

• APosting the session link publicly
• BUnique meeting links per session and provider admittance from a waiting room
• CReusing the same meeting link for all clients
• DDisabling all authentication

When evaluating a TMH platform vendor, which of the following BEST indicates the vendor has matured security practices?

• AMarketing claims of 'HIPAA-friendly'
• BA signed BAA, SOC 2 or HITRUST attestation, and documented incident response
• CA free pricing tier
• DThe presence of a clinician on the leadership team

A counselor wants to offer secure messaging between sessions. Which is MOST important to verify?

• AWhether the platform supports emoji
• BWhether the platform encrypts messages, retains them as part of the record, and is covere…
• CWhether messages can be exported to social media
• DWhether the platform has a free tier

An insurance company asks a counselor to use a non-BAA video portal to communicate about a client. The counselor should:

• AUse the portal to maintain payer relationships
• BDecline and propose a HIPAA-compliant channel for any PHI exchange
• CUse the portal but withhold names
• DForward the portal link to the client

Which is the MOST appropriate password practice for a TMH platform account?

• AReuse a password from another favorite site
• BUse a long, unique passphrase managed by a password manager and enable MFA
• CUse the clinic's name as the password
• DShare the password with all staff

A clinician's home Wi-Fi has the default router password and no encryption configured. Before continuing TMH from home, the clinician should:

• AContinue and address it later
• BChange the router admin password, enable WPA2/WPA3 encryption, and update firmware
• CUse only mobile data
• DDisable the Wi-Fi password to simplify access

Audit logging on a TMH platform PRIMARILY supports:

• AMarketing analytics
• BDetection of unauthorized access and HIPAA accountability
• CFaster client onboarding
• DReduced bandwidth usage

Which is the BEST way to verify that a chosen TMH platform's BAA is valid?

• ATrust the platform's marketing site
• BObtain a fully countersigned BAA and retain a copy in compliance records
• CTake a screenshot of the BAA page
• DAsk another clinician if they have one