ABA HALM common mistakes
ABA HALM · Understand the traps and how to avoid them.
Treating the Stark Law and the Anti-Kickback Statute as interchangeable, so a question asking about a physician compensation arrangement gets answered with the wrong statute's elements or penalty structure.
Both regulate physician financial relationships and both appear in the same study material, so candidates memorize them as one blended concept instead of two statutes with different intent standards and different exceptions/safe harbors.
What to do instead
Build a two-column comparison card: for each, write the intent standard (strict liability vs. knowing and willful), who is covered, the key exceptions or safe harbors, and the penalty regime. Before answering, identify which statute the stem's facts trigger (referral-based prohibition vs. remuneration for referrals).
Applying a privacy rule to the wrong kind of record, e.g., invoking HIPAA authorization requirements for employment records held by an employer, or for de-identified data, or for substance use disorder records that fall under a separate confidentiality regime.
Candidates default to 'HIPAA covers everything' and skip the threshold question of whether the entity is a covered entity and whether the record is protected health information at all.
What to do instead
Answer in two steps: (1) Is the holder a covered entity or business associate? (2) Is this individually identifiable health information transmitted or maintained in the covered function? Only then apply authorization, minimum necessary, and disclosure rules. Flag 42 CFR Part 2 and state law as separate overlays.
Mixing up the four Medicare Advanced Beneficiary Notice and related notice types, or assuming a signed ABN always shifts liability to the beneficiary.
The notices look similar and are learned as a list of acronyms rather than as a decision tree based on the reason the service may be denied and whether the service is statutorily excluded.
What to do instead
Memorize the ABN decision logic: statutory exclusion means the ABN is voluntary and the beneficiary is always liable; a potentially non-covered service requires a mandatory ABN before the service, and liability shifts only if the notice is valid and properly executed. Practice with short scenarios classifying each.
Confusing the roles of the compliance officer, the compliance committee, and the governing body, or assigning operational compliance duties to the board.
Governance and compliance content overlaps, and candidates answer with whichever body sounds most authoritative rather than the body that actually owns the function under program guidance.
What to do instead
Map each function to its owner: board approves and oversees the program and receives reporting; the compliance committee provides oversight and coordination; the compliance officer runs day-to-day operations, investigations, and reporting lines. Answer by asking 'who does this task in practice?'
Confusing enterprise risk management with quality improvement, so a question about a proactive risk assessment (such as a failure mode and effects analysis) is answered with a retrospective improvement model.
Both domains use similar vocabulary around safety, data, and improvement, and candidates pattern-match on the word 'risk' without checking whether the tool is prospective or retrospective.
What to do instead
Sort the tools explicitly: prospective tools (FMEA, root cause analysis is retrospective, hazard analysis) versus improvement frameworks (PDSA, Lean, Six Sigma). Note whether the tool asks 'what could go wrong' or 'what did go wrong and how do we improve.'
Answering reimbursement questions using charge amounts or billed amounts when the question asks about payment, cost, or contractual allowance.
Candidates conflate charges, costs, and payments because the numbers in a scenario all look like money owed, and they skip identifying which figure the question is actually asking for.
What to do instead
Before calculating, label the quantity requested: charge (list price), cost (resource consumed), allowed amount (contractual), paid amount (after patient responsibility and adjustments), or contractual allowance (charge minus allowed). Then select the formula for that label only.
Missing the fraud-and-abuse implication in a fact pattern that describes a business arrangement, such as a lease below fair market value, free staff, or compensation tied to referral volume, and answering only the contract or operational question.
The stem is framed around operations or contracting, so candidates answer the surface question and do not scan for the compliance red flags embedded in the facts.
What to do instead
After reading any arrangement scenario, run a fixed red-flag checklist: below fair market value, volume- or value-based compensation, free or below-cost items or services, and referrals between parties. If any flag is present, address the fraud-and-abuse analysis in the answer.
Choosing an answer that describes what is ethical or clinically ideal when the question asks what is legally required, or the reverse.
Ethics and law are taught together, and candidates select the 'best practice' option because it feels safest, ignoring the qualifier in the stem.
What to do instead
Circle the operative qualifier in the stem (required, permitted, prohibited, recommended, best practice) before reading options. Eliminate options that answer a different qualifier than the one asked, even if the option is otherwise true.
Assuming a breach notification is required for every impermissible use or disclosure of protected health information, without applying the risk assessment or the exception categories.
The breach rule is learned as 'unauthorized access equals report it,' and candidates skip the presumption-of-breach analysis and the exceptions such as unintentional acquisition by workforce members acting in good faith.
What to do instead
Apply the sequence: was there an impermissible use or disclosure? Is there an exception? If not, presume breach unless a documented four-factor risk assessment shows low probability of compromise. Answer notification questions only after that sequence.
Ignoring the entity-type and tax-exempt status context in governance questions, such as applying for-profit shareholder duties to a nonprofit board or missing private inurement and excess benefit concerns.
Candidates study governance duties generically and do not adjust for whether the organization is a nonprofit, a public hospital, or a for-profit entity, even though the duties and prohibitions differ.
What to do instead
First line of every governance scenario: identify the entity type. For nonprofits, add duty of obedience to mission and the prohibition on private inurement and excess benefit transactions to the standard duty of care and loyalty analysis. Then evaluate the facts against that framework.