CMRS (ACAC) cheat sheet

A complete medical record contains patient identification, consent, history, physical, progress notes, orders, test results, and discharge summary.

The SOAP note format organizes documentation into Subjective, Objective, Assessment, and Plan.

Documentation must be legible, dated, timed, and authenticated by the author with a signature or unique identifier.

Late entries are permitted if clearly labeled as late and dated with the actual date of entry.

The medical record is a legal document; alterations must be made via addendum, never by obliterating original text.

Reviewers must verify that each service billed has a corresponding order and documented result.

A problem list provides a longitudinal summary of the patient's active and resolved diagnoses.

Documentation standards require that the reason for each encounter be explicitly stated.

Electronic health records must maintain an audit trail showing who accessed or modified the record and when.

ICD-10-CM codes identify diagnoses; ICD-10-PCS codes identify inpatient procedures; CPT codes identify outpatient services and procedures.

E/M code selection depends on medical decision making or time, per the current CPT guidelines.

The physician query process is used when documentation is ambiguous, inconsistent, or incomplete for code assignment.

Principal diagnosis is the condition established after study to be chiefly responsible for the admission.

Present on admission (POA) indicators must be reported for all inpatient diagnoses.

Modifier 25 indicates a significant, separately identifiable E/M service on the same day as a procedure.

Bundling edits (NCCI) identify code pairs that should not be billed together without an appropriate modifier.

Medical necessity must support the code level selected; upcoding occurs when a higher level is billed without documentation support.

Clinical documentation integrity (CDI) programs seek to ensure documentation is complete, accurate, and reflective of the patient's clinical status.

Medical necessity is the determination that a service is reasonable and necessary for the diagnosis or treatment of illness or injury.

A query should be non-leading, include clinical indicators, and offer multiple-choice options when possible.

Documentation of clinical indicators (vital signs, lab results, imaging) supports the diagnosis and code assignment.

Hierarchy of diagnoses (principal, secondary, and comorbidity) must be supported by provider documentation.

CDI specialists review records concurrently or retrospectively to identify documentation gaps and query providers.

Medical necessity denials often arise from missing documentation of the reason for the encounter or the service performed.

Severity of illness and risk of mortality are reflected in the documented diagnoses and affect quality metrics.

The False Claims Act prohibits knowingly submitting false or fraudulent claims to government payers.

The Anti-Kickback Statute prohibits offering or receiving remuneration to induce referrals for federally reimbursed services.

The Stark Law restricts physician self-referrals for designated health services paid by Medicare.

HIPAA Privacy Rule governs the use and disclosure of protected health information (PHI).

The HITECH Act strengthened HIPAA enforcement and introduced breach notification requirements.

Recovery Audit Contractors (RACs) review claims for overpayments and underpayments.

Medicare Advantage plans are subject to risk adjustment coding rules and RADV audits.

The 60-day overpayment rule requires providers to report and return identified overpayments within 60 days.

Compliance programs should include written policies, training, monitoring, and a reporting mechanism.

A statistically valid random sample allows extrapolation of error rates to the population.

Sample size calculation considers confidence level, margin of error, and expected error rate.

The audit universe is the total set of claims or records from which a sample is drawn.

A stratified sample divides the population into subgroups to ensure representation of high-risk areas.

Data mining uses queries and analytics to identify outliers, patterns, and potential billing anomalies.

An audit finding must be supported by documentation evidence and a clear rationale.

Error rate = (number of claims with errors / total claims audited) × 100.

Root cause analysis identifies the underlying reason for a compliance deficiency.

Fraud is intentional deception or misrepresentation that the individual knows to be false.

Waste is the overutilization of services or other practices that result in unnecessary costs.

Abuse includes practices that are inconsistent with accepted medical or business practices and result in unnecessary cost.

Red flags for fraud include unbundling, upcoding, billing for services not rendered, and duplicate claims.

The OIG Work Plan outlines areas of focus for audits and investigations.

Whistleblower protections under the False Claims Act allow qui tam actions and provide anti-retaliation safeguards.

A compliance hotline is a confidential reporting mechanism for potential fraud, waste, or abuse.

Providers must screen employees and contractors against the OIG exclusion list.

An audit report should include scope, methodology, findings, and recommendations.

A corrective action plan (CAP) must specify the issue, corrective steps, responsible parties, and timeline.

Findings should be communicated to the audited entity in a timely manner to allow response and correction.

Follow-up audits verify that corrective actions have been implemented and are effective.

Reports should distinguish between errors that are isolated and those that are systemic.

Clear, objective language should be used in audit reports; avoid accusatory or speculative statements.

The CAP should include measurable outcomes to track improvement.

Communication of audit results must comply with confidentiality and legal privilege considerations.

The minimum necessary standard limits PHI access and disclosure to the amount needed to accomplish the purpose.

Reviewers must not access PHI of patients not related to their assigned work.

A conflict of interest exists when a reviewer has a personal or financial interest in the audit outcome.

Professional conduct requires objectivity, integrity, and adherence to applicable laws and standards.

Confidentiality agreements and HIPAA training are required for workforce members with PHI access.

Breach notification is required when unsecured PHI is impermissibly accessed or disclosed.

Ethical review practices prohibit altering documentation or influencing coding decisions without clinical support.

Auditors should maintain independence and avoid auditing their own work or areas where they have responsibility.