CHA Healthcare Auditor cheat sheet

False Claims Act (FCA) liability attaches to knowingly presenting false claims; penalties per claim plus treble damages; whistleblower (qui tam) relator share typically 15–30% of recovery.

Anti-Kickback Statute (AKS) prohibits remuneration for referrals of federally reimbursed items/services; safe harbors (e.g., employment, personal services) provide protection if all conditions are met.

Physician Self-Referral (Stark) Law: strict liability for designated health services referrals when a financial relationship exists, unless an exception applies; no intent required.

HIPAA Privacy Rule governs use/disclosure of PHI; Security Rule applies to ePHI and requires administrative, physical, and technical safeguards; Breach Notification Rule requires notice within 60 days of discovery.

OIG Compliance Program Guidance: seven elements-written policies, compliance officer/committee, training, communication lines, auditing/monitoring, discipline, and corrective action.

EMTALA requires screening and stabilization for emergency conditions regardless of ability to pay; violations can lead to termination from Medicare and civil monetary penalties.

Civil Monetary Penalties (CMP) inflation-adjusted annually; OIG publishes penalty amounts in 42 CFR Part 1003.

Medicare Conditions of Participation (CoPs) set minimum health and safety standards; survey/certification deficiencies can result in termination from Medicare.

IIA Global Internal Audit Standards (2024) and IPPF: five domains-Purpose, Ethics, Governance, Management, and Quality-and core principles.

Independence: internal auditors must not assume management responsibilities; impairment disclosure required; chief audit executive reports functionally to the board/audit committee.

Objectivity: avoid conflicts of interest; annual conflict-of-interest declarations; rotate staff on high-risk engagements.

Due professional care: apply the knowledge, skills, and experience expected of a reasonably prudent auditor; not infallibility.

Quality assurance and improvement program (QAIP): internal assessments (ongoing and periodic) and external assessment at least every five years.

Audit evidence sufficiency (quantity) and appropriateness (relevance and reliability); external evidence generally more reliable than internal.

Professional skepticism: question contradictions, verify assertions, and follow up on inconsistencies.

Documentation: working papers must support conclusions, be reviewable, and retained per organizational policy and legal requirements.

Risk assessment considers likelihood and impact; inherent risk adjusted for control effectiveness yields residual risk.

Materiality: set quantitative thresholds (e.g., % of revenue or expenses) and qualitative factors (fraud, regulatory, reputational).

Audit universe: inventory of auditable entities/processes; prioritize based on risk, materiality, and time since last audit.

Scope defines boundaries: period, locations, systems, and processes; exclusions must be documented and approved.

Engagement planning includes objectives, scope, criteria, resources, timeline, and communication with stakeholders.

Walkthroughs and process mapping identify key controls and gaps before testing.

Data analytics can be used to profile populations and target high-risk transactions for sampling.

Risk-based sampling focuses resources on areas with higher likelihood of material error or fraud.

Evidence types: inspection, observation, inquiry, confirmation, recalculation, re-performance, and analytical procedures.

Sampling risk: risk that sample conclusion differs from population; non-sampling risk: human error or inappropriate procedures.

Attribute sampling: estimates deviation rate for a control; variables sampling: estimates monetary misstatement.

Sample size increases with higher confidence, lower tolerable deviation rate, and higher expected deviation rate.

Statistical sampling allows projection to population; non-statistical sampling relies on auditor judgment.

Test of controls: evaluate operating effectiveness; substantive testing: detect material misstatements.

Analytical procedures: compare current data to expectations (trends, ratios, benchmarks) and investigate significant variances.

Document sampling methodology, population definition, selection method, and evaluation of results.

Revenue cycle stages: pre-registration, registration, charge capture, coding, billing, claims processing, denials management, and collections.

Coding compliance: assign ICD-10-CM/PCS, CPT, and HCPCS codes based on documentation; unbundling and upcoding are high-risk areas.

Evaluation and Management (E/M) coding: level selected by medical decision making or time (per current guidelines); documentation must support level.

Charge capture controls: charge master maintenance, reconciliation of services to charges, and late charge monitoring.

Claims editing: National Correct Coding Initiative (NCCI) edits and Medically Unlikely Edits (MUE) prevent improper payments.

Modifier use: e.g., modifier 25 for significant, separately identifiable E/M service; modifier 59 for distinct procedural services (use with caution).

Underpayment and overpayment analysis; refunds and credit balances must be processed timely.

Audit sampling of claims: verify code selection, documentation support, medical necessity, and billing accuracy.

Documentation must support medical necessity, coding, and quality measures; include history, exam, assessment, and plan (H&P).

Clinical documentation integrity (CDI) programs clarify ambiguous documentation through physician queries; queries must be non-leading.

Quality measures: e.g., HEDIS, CMS Star Ratings, and Core Measures; audits verify numerator/denominator accuracy.

Medical necessity: services must be reasonable and necessary for diagnosis/treatment; Local Coverage Determinations (LCDs) and National Coverage Determinations (NCDs) provide criteria.

Documentation of diagnoses must be specific (e.g., laterality, type, severity) to support coding and risk adjustment.

Audit of quality-of-care: compare care processes to evidence-based guidelines; identify deviations and adverse events.

Peer review and credentialing: verify licenses, certifications, and privileges.

Patient safety indicators (PSIs) and hospital-acquired conditions (HACs) are quality audit targets.

HIPAA Privacy Rule: minimum necessary standard for uses/disclosures; patient rights include access, amendment, accounting of disclosures, and restriction requests.

Security Rule: administrative, physical, and technical safeguards; risk analysis and risk management are required.

Breach notification: notify affected individuals without unreasonable delay and no later than 60 days; HHS notification if >500 individuals (media notice also).

Business Associate Agreements (BAAs) required when vendors handle PHI; BAAs must include required provisions.

HITECH Act strengthens HIPAA enforcement, increases penalties, and extends requirements to business associates.

Release of information: valid authorization must include patient signature, date, purpose, expiration, and right to revoke.

Health information management: retention schedules, legal health record definition, and release-of-information controls.

Audit logging and access monitoring: track PHI access, investigate anomalies, and enforce sanctions.

Audit report elements: objectives, scope, methodology, findings (criteria, condition, cause, effect), conclusions, and recommendations.

Findings should be actionable, risk-rated, and agreed upon with management; include management response and target date.

Communication: draft report to management for factual accuracy; final report distributed to appropriate stakeholders.

Follow-up: verify corrective actions are implemented within committed timelines; track open issues.

Report writing: clear, concise, objective, and free of jargon; avoid personal attacks.

Root cause analysis distinguishes symptom from underlying cause to prevent recurrence.

Quality review of reports: peer review for accuracy, completeness, and adherence to standards.

Escalation: significant risks or non-responses reported to audit committee/board.

Fraud: intentional deception for gain; waste: misuse of resources without intent; abuse: practices inconsistent with sound business/medical practices.

Red flags: unusual billing patterns, high-volume services, upcoding, duplicate claims, and services not rendered.

Investigative auditing: secure evidence chain of custody, conduct interviews, and coordinate with legal counsel.

Data analytics for fraud detection: outlier analysis, peer comparison, and trend analysis.

Whistleblower protections and non-retaliation policies; encourage reporting through hotlines.

Recovery and remediation: identify overpayments, report and return within 60 days (per 60-day rule), and implement controls.

Coordination with law enforcement and OIG; self-disclosure options (e.g., OIG Self-Disclosure Protocol).

Documentation of investigation: maintain confidentiality and privilege where applicable.