ABA HALM cheat sheet

Medicare Conditions of Participation (42 CFR 482) are minimum health-and-safety requirements an organization must meet to receive Medicare payment.

The Stark Law (42 USC 1395nn) prohibits physician self-referral for designated health services payable by Medicare unless a specific exception applies.

Anti-Kickback Statute (42 USC 1320a-7b(b)) is a criminal statute requiring intent; it covers remuneration for referrals of items or services payable by federal health care programs.

HIPAA Privacy Rule governs use and disclosure of protected health information; the Security Rule covers electronic PHI; the Breach Notification Rule requires notice within 60 days of discovery.

EMTALA requires a Medicare-participating hospital with an emergency department to provide a medical screening examination and stabilizing treatment regardless of ability to pay.

The False Claims Act imposes liability for knowingly presenting false claims; the 1986 amendments created qui tam relator provisions.

Civil Monetary Penalties Law (42 USC 1320a-7a) authorizes administrative penalties and program exclusion for specified prohibited conduct.

The ACA physician payment sunshine provision (Open Payments) requires manufacturers to report transfers of value to physicians and teaching hospitals.

Seven elements of an effective compliance program: written policies, compliance officer/committee, training, open communication lines, internal monitoring/auditing, enforcement/discipline, and response/corrective action.

A compliance program should be risk-based: allocate auditing and monitoring resources according to likelihood and magnitude of legal or financial exposure.

Four HIPAA permitted disclosure categories: to the individual, for treatment/payment/operations, incidental to a permitted use, and pursuant to a valid authorization.

Minimum necessary standard applies to uses, disclosures, and requests for PHI except for treatment, disclosures to the individual, and certain authorized purposes.

Exclusion screening: check the OIG List of Excluded Individuals/Entities and the SAM.gov database before hiring and monthly thereafter; billing for services furnished by an excluded person is prohibited.

A Corporate Integrity Agreement is a negotiated settlement term with OIG imposing monitoring, reporting, and independent review obligations.

Breach risk assessment considers the nature and extent of PHI involved, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent of mitigation.

Safe harbor regulations (42 CFR 1001.952) describe payment practices that do not violate the Anti-Kickback Statute, such as certain employment and personal services arrangements.

Revenue cycle stages: preregistration, registration, charge capture, coding, claim submission, remittance posting, denial management, and collections.

Denial management metrics include denial rate (denied claims divided by total claims), days to resolve, and percentage of denials overturned on appeal.

Capacity management balances staffing, scheduling, and demand; queueing theory holds that wait times rise nonlinearly as utilization approaches 100 percent.

Process improvement frameworks: PDSA (Plan-Do-Study-Act) for rapid cycles; Lean targets waste; Six Sigma targets variation reduction.

A key performance indicator should be specific, measurable, attributable, and tied to an accountable owner and reporting cadence.

Staffing ratios and productivity benchmarks (for example, work relative value units per provider) are used to compare provider output to specialty norms.

Root cause analysis is a structured retrospective method for adverse events; failure mode and effects analysis is a prospective method for process risk.

Net revenue equals gross charges less contractual allowances and discounts; the contractual allowance is the difference between billed charges and the payer's allowed amount.

Accounts receivable days (days in AR) equals (total AR divided by total charges) multiplied by days in the period.

Payer mix is the proportion of revenue or volume attributable to each payer class; it drives margin sensitivity to rate changes.

Inpatient prospective payment uses DRG-based fixed payments; outpatient uses APC groups; physician services use the RBRVS formula with work, practice expense, and malpractice components.

Contribution margin equals revenue minus variable costs; fixed costs are excluded when evaluating incremental volume decisions.

A contract with a payer should specify rates, fee schedule basis, timely filing, appeal rights, medical necessity criteria, and termination provisions.

Value-based arrangements shift risk through shared savings, bundles, or capitation; capitation pays a fixed amount per member per period regardless of services used.

Under the Stark Law, compensation must be set in advance, at fair market value, and must not vary with the volume or value of referrals, absent an exception.

Board fiduciary duties include the duty of care (informed, deliberative oversight) and the duty of loyalty (putting the organization's interests first).

Conflict-of-interest policy: disclose, recuse from voting, and document the recusal in the minutes when a director or officer has a material interest.

Sarbanes-Oxley-derived practices for nonprofits include independent audit committees, whistleblower protections, and document retention policies.

Informed consent requires disclosure of the nature of the procedure, material risks and benefits, alternatives, and the patient's right to refuse.

Four principles of biomedical ethics: autonomy, beneficence, nonmaleficence, and justice.

A conflict of commitment differs from a conflict of interest: it concerns allocation of time and effort rather than personal financial gain.

Governance documents (articles of incorporation, bylaws, and committee charters) define authority; minutes are the official record of board action.

The risk management cycle: identify and assess risk, reduce or transfer risk, monitor, and revise.

Occurrence reporting systems capture adverse events and near misses; near-miss reporting is a leading indicator and should be nonpunitive.

Just culture distinguishes human error (console), at-risk behavior (coach), and reckless behavior (punish).

Claims-made professional liability coverage responds to claims reported during the policy period; occurrence coverage responds to incidents occurring during the period.

The IHI Model for Improvement uses three questions (aim, measures, changes) plus PDSA cycles; the Model for Improvement is a common quality framework.

Common quality measures include structure, process, and outcome categories; the Donabedian model organizes measurement this way.

Sentinel event: an unexpected occurrence involving death or serious physical or psychological injury; a root cause analysis is typically required within a defined timeframe.

Failure mode and effects analysis scores severity, occurrence, and detectability to prioritize process risks before harm occurs.

Credentialing verifies licensure, training, and experience; privileging authorizes specific services at a specific facility.

Peer review protections vary by state; common statutory elements include confidentiality of proceedings and immunity for participants acting in good faith.

Patient safety event taxonomy distinguishes adverse events, near misses, and hazardous conditions.

Root cause analysis output should be a corrective action plan with owners, deadlines, and measurable follow-up.

Risk financing options include self-insurance, commercial insurance, and captives; selection depends on loss frequency, severity, and capital tolerance.

Disclosure of unanticipated outcomes to patients and families is supported by ethical and accreditation expectations and should be documented.

Quality dashboards should link measures to accountable leaders and review cadence to drive improvement.

Medicare enrollment and revocation: providers may be barred from re-enrollment for specified periods following program termination.

The Health Care Quality Improvement Act provides peer review immunity when due process standards are met.

State licensure is the primary authority for scope of practice; federal conditions of participation set minimum facility standards.

The Emergency Medical Treatment and Labor Act applies to any hospital with an emergency department that participates in Medicare.

Business associate agreements are required before a covered entity may disclose PHI to a business associate for a function or activity.

Advance directives (living wills, health care powers of attorney) express patient preferences and should be documented and accessible.

Stark penalties include denial of payment, refund obligations, and civil monetary penalties per violation; the statute is strict liability.

Audit sampling should be statistically defensible; document the population, sample size, and selection method.

A coding audit compares documented services to coded claims and identifies over- or under-coding patterns.

The OIG Work Plan lists current audit and enforcement priorities and is a primary source for compliance risk assessment.

Compliance training should be role-based and documented with completion records retained per policy.

Hotline reports should be logged, triaged, investigated, and tracked to resolution with confidentiality protections.

Monitoring is ongoing and routine; auditing is periodic and independent; both are required elements of an effective program.

Corrective action plans should identify root cause, remediation steps, responsible parties, and verification of effectiveness.

Gross charges are list prices; allowed amounts are payer-determined; paid amounts are net of patient responsibility.

Bad debt versus charity care: charity care is provided to patients who cannot pay and is often reported separately from bad debt.

Cost-to-charge ratio converts charges to estimated costs for cost reporting and analysis.

Budget variance analysis compares actual to budgeted revenue and expense and decomposes variance into volume, rate, and mix components.

Capital budgeting evaluates projects using net present value, internal rate of return, and payback period.

Payer contract modeling estimates revenue impact of proposed rate changes before signing.

Days cash on hand equals unrestricted cash divided by average daily operating expenses.

Board committees commonly include audit, finance, quality, and compensation; each should have a written charter.

Executive compensation should be benchmarked to fair market value and approved by an independent body.

Whistleblower and non-retaliation policies protect good-faith reporters of suspected wrongdoing.

Confidentiality obligations of directors extend to board deliberations and protected information.

Mission, vision, and values statements guide strategic decisions and should align with resource allocation.

Ethical decision frameworks include consequences, duties, and virtues; document the reasoning and stakeholders considered.

Succession planning and board orientation reduce governance risk from turnover.

Incident reporting should capture date, time, persons involved, description, immediate actions, and notification.

Claims data analysis identifies high-frequency and high-severity loss drivers for targeted risk reduction.

Patient grievance processes require timely acknowledgment, investigation, and written response.

Infection prevention and control programs use surveillance, isolation precautions, and hand hygiene monitoring.

Medication reconciliation at transitions reduces adverse drug events.

Quality improvement projects should define a measurable aim, a family of measures, and a change theory.

Accreditation surveys (for example, Joint Commission) assess compliance with standards and drive corrective action plans.

Workforce planning aligns staffing to volume forecasts and skill mix requirements.

Scheduling optimization reduces overtime and improves access; measure by fill rate and overtime percentage.

Supply chain management uses par levels, reorder points, and vendor performance metrics.

Project management phases: initiation, planning, execution, monitoring, and closure.

Change management models (for example, Kotter's steps) structure adoption of new processes.

Benchmarking compares internal performance to external peers to identify improvement opportunities.

Documentation of processes supports training, audit, and continuity planning.

The OIG exclusion authority applies to convictions for program-related fraud and to other specified offenses.

The False Claims Act permits treble damages and civil penalties per false claim.

The Anti-Kickback Statute safe harbor for employment requires a bona fide employment relationship with compensation for services.

HIPAA accounting of disclosures requires tracking certain disclosures for six years.

The minimum necessary standard does not apply to disclosures required by law or to the individual.

Security Rule requires administrative, physical, and technical safeguards for electronic PHI.

Whistleblower protections under the False Claims Act prohibit retaliation against relators.

Contract terms should address rate methodology, payment timelines, claim edits, appeals, and termination.

Fee schedule analysis compares proposed rates to current and to Medicare benchmarks.

Risk-sharing arrangements require actuarial modeling of utilization and cost.

Underpayments should be tracked and appealed systematically.

Contract performance should be monitored with dashboards of volume, revenue, and denial metrics.

Legal review should confirm compliance with Stark, Anti-Kickback, and state law before execution.

Renewal terms should be calendared with sufficient lead time for renegotiation.

Professional codes (for example, ACHE, AHIMA, HCCA) set expectations for integrity, confidentiality, and competence.

Mandatory reporting obligations vary by state and may include suspected abuse, neglect, or impaired professionals.

Conflicts of interest should be disclosed in writing and managed through recusal or divestment.

Documentation should be accurate, timely, and contemporaneous.

Patient confidentiality extends beyond HIPAA to state law and professional ethics.

Continuing education maintains competence and licensure.

Whistleblower obligations may require internal reporting before external reporting depending on policy.

Structure measures assess resources; process measures assess actions; outcome measures assess results.

Risk adjustment accounts for patient factors that affect outcomes.

Statistical process control charts distinguish common-cause from special-cause variation.

Measure specifications define numerator, denominator, exclusions, and data source.

Benchmarking uses percentiles or targets to interpret performance.

Improvement requires reliable measurement and feedback loops.

Public reporting and pay-for-performance link measurement to accountability.