Legal, Regulatory, and Compliance Requirements
Core concepts
Compliance is the ongoing process of meeting legal, regulatory, and contractual obligations. Know the layers: statute and regulation, licensure and scope of practice, payer rules, accreditation standards, and internal policy.
Core areas: privacy and security of health information (notice, minimum necessary, patient rights, breach notification), informed consent (capacity, disclosure, voluntariness, documentation), record retention, billing integrity (false claims, upcoding, medical necessity), and workplace safety. Understand HIPAA-style privacy principles generically: permitted uses, authorization, safeguards, and business associate agreements. Know anti-kickback and Stark-style self-referral concerns: arrangements must not exchange value for referrals.
Compliance program elements: written policies, a compliance officer, training, monitoring and auditing, a reporting mechanism, enforcement, and corrective action. Know the difference between internal audit (preventive) and investigation (responsive).
Traps
- Assuming consent is implied for all disclosures - treatment, payment, and operations have specific boundaries.
- Confusing a breach (impermissible use/disclosure) with a violation of internal policy.
- Ignoring documentation: compliance is proven by records, not intent.
- Treating accreditation standards as optional - they may be contractually binding.
Rule of thumb
When unsure whether a disclosure is permitted, apply the minimum necessary test and, if still unclear, obtain written authorization.
Worked example
A staff member emails a patient's record to the wrong address. Steps: contain, assess risk, document, notify per policy and law, and implement corrective action. The event is a potential breach regardless of intent.