Compliance, Privacy, and Fraud and Abuse
Two regimes, one program
Compliance questions blend the HIPAA Privacy, Security, and Breach Notification Rules with the federal fraud and abuse laws: the False Claims Act (FCA), the Anti-Kickback Statute (AKS), the physician self-referral law (Stark), the Civil Monetary Penalties Law, and the Exclusion authorities. HIPAA governs use and disclosure of protected health information (PHI); fraud and abuse governs financial arrangements and billing integrity. A candidate must know that these regimes overlap - a breach investigation can expose billing problems, and a compliance program must address both.
Concepts to master
Know the minimum necessary standard, the treatment, payment, and operations permissions, and when authorization is required. Understand business associate relationships and the required contract terms. For fraud and abuse, know that the AKS is intent-based ("knowingly and willfully"), while Stark is strict liability for financial relationships without an exception - a classic contrast question. Know the safe harbors and exceptions are the only protection; there is no de minimis rule. Understand the 60-day overpayment rule and the value of a documented compliance program under the Federal Sentencing Guidelines and OIG guidance.
Traps
Stems that describe a discount, free software, or below-market lease are testing whether you can match facts to a specific safe harbor. Another trap: assuming a Stark exception protects an AKS problem - it does not. Also watch for questions that treat the Privacy Rule as prohibiting all disclosures; it permits many without authorization.
Rule of thumb
For any arrangement question, ask: Is there remuneration? Is it for referrals of federally reimbursable items? Does a safe harbor fit exactly? If not, treat it as prohibited.