CHCO cheat sheet

The OIG seven elements: (1) written policies and procedures and standards of conduct; (2) designated compliance officer and compliance committee; (3) effective training and education; (4) effective lines of communication; (5) well-publicized disciplinary standards; (6) internal monitoring and auditing; (7) prompt response and corrective action.

Governance rule: the compliance officer should report to the CEO and have direct, unfettered access to the governing body; the board approves the program, receives regular reports, and ensures adequate resources.

Compliance committee is cross-functional: compliance, legal, medical staff, nursing, coding/billing, finance, human resources, privacy and security, and internal audit; minutes document attendance, risks reviewed, and decisions.

Written policies must be current, version-controlled, approved by the appropriate authority, accessible to all workforce members, and acknowledged at hire and at defined intervals thereafter.

Risk assessment formula: rank each risk by likelihood of occurrence multiplied by potential impact (financial, clinical, reputational), then refresh the ranking annually and whenever the OIG Work Plan, audit findings, or enforcement actions change.

Disciplinary standards apply uniformly across job titles, are published in advance, and are documented in the personnel file; deviation from the published standard is itself a program deficiency.

Program resources (budget, full-time equivalents, technology) should be proportional to the organization's size, complexity, and risk profile, and should be revisited in the annual program review.

Documentation retention: committee minutes, training rosters, audit workpapers, investigation files, and disclosure records are the evidence of an effective program and should follow the organization's legal hold and retention schedule.

False Claims Act elements: a claim for payment presented to the federal government, falsity in a material respect, knowledge (actual knowledge, deliberate ignorance, or reckless disregard), causation, and resulting payment; remedies are treble damages plus inflation-adjusted per-claim penalties.

FCA statute of limitations: the later of six years after the violation or three years after the government knew or should have known, but never more than ten years after the violation.

Qui tam shares under 31 U.S.C. § 3730(d): 15 to 25 percent of the recovery when the government intervenes and 25 to 30 percent when it declines; the relator must be an original source.

Anti-Kickback Statute: 42 U.S.C. § 1320a-7b(b) prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce referrals of items or services payable by a federal health care program; it is a felony with up to ten years' imprisonment and a $100,000 criminal fine per violation.

One-purpose test: AKS liability attaches if any one purpose of the remuneration is to induce referrals, even when legitimate purposes also exist; intent may be proved through circumstantial evidence such as the structure of the arrangement.

Safe harbors at 42 CFR 1001.952 immunize qualifying arrangements only if every condition is met; common examples are bona fide employment, personal services and management contracts, space rental, equipment rental, and fair market value arrangements with documented terms.

Stark Law (42 U.S.C. § 1395nn): a physician may not refer Medicare patients for designated health services to an entity with which the physician or an immediate family member has a financial relationship unless a statutory or regulatory exception applies; the prohibition is strict liability.

Designated health services include clinical laboratory, radiology and imaging, radiation therapy, physical and occupational therapy, durable medical equipment, home health, outpatient prescription drugs, inpatient and outpatient hospital services, prosthetics, parenteral and enteral nutrients, and outpatient speech-language pathology.

Civil Monetary Penalties Law (42 U.S.C. § 1320a-7a) authorizes the OIG to impose administrative penalties, assessments, and program exclusions for false claims, kickbacks, and other enumerated conduct; amounts are set in 45 CFR 102.3 and adjusted for inflation each year.

PHI is individually identifiable health information created or received by a covered entity or business associate that relates to health status, care, or payment, in any form or medium; the Privacy Rule applies to all forms, the Security Rule only to electronic PHI.

De-identification safe harbor: remove all 18 specified identifiers (names, geographic subdivisions smaller than a state, dates except year, phone and fax numbers, email, SSN, medical record and account numbers, device identifiers, URLs, IP addresses, biometric identifiers, photographs, and other unique codes) plus any actual knowledge of re-identifiability, or rely on a qualified expert determination.

Individual rights: access within 30 days with one 30-day extension; amendment response within 60 days; accounting of disclosures covering the six years before the request; confidential communications and restriction requests must be addressed under the rule's timelines.

Breach notification: notify affected individuals without unreasonable delay and no later than 60 days after discovery; breaches affecting 500 or more individuals in a state require notice to prominent media outlets and contemporaneous notice to HHS, while smaller breaches are logged and reported to HHS annually.

Breach risk assessment four factors: the nature and extent of the PHI involved, the unauthorized person who accessed or received it, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated.

Encryption meeting HHS guidance and destruction consistent with the rule are safe harbors: an impermissible use or disclosure of PHI that is rendered unusable, unreadable, or indecipherable is not a reportable breach.

Security Rule safeguards fall into administrative, physical, and technical categories plus organizational and documentation requirements; a documented, accurate, and thorough risk analysis and risk management plan are required and are the most frequently cited deficiencies.

A business associate agreement must be in place before PHI is shared with a business associate; under HITECH and the Omnibus Rule business associates are directly liable for specified Security Rule and Privacy Rule obligations.

Code sets in use: ICD-10-CM for diagnoses, ICD-10-PCS for inpatient procedures, CPT for physician and outpatient services, HCPCS Level II for supplies, drugs, and non-physician services, and revenue codes for facility billing.

Medical necessity is the overarching payment condition: the service must be reasonable and necessary for the diagnosis or treatment of illness or injury, and the medical record must support the code, the level of service, and the site of service billed.

NCCI procedure-to-procedure edits prohibit billing certain code pairs together; modifier indicator 0 means no override is permitted, indicator 1 means an appropriate modifier may bypass the edit if documentation supports it, and medically unlikely edits set per-code daily unit maximums.

Evaluation and management coding in the office setting follows the 2021 rules: select the level using medical decision making or total time on the date of the encounter, and apply the history and examination only as clinically appropriate.

The 60-day overpayment rule requires a provider or supplier that identifies an overpayment to report and return the full amount within 60 days, or by the date the corresponding cost report is due if that is later; an overpayment is identified when the entity has actual knowledge or acts in deliberate ignorance or reckless disregard.

High-risk billing patterns: upcoding to higher-paying codes, unbundling services that should be reported with a single comprehensive code, duplicate claims, billing for services not rendered or not documented, and billing for non-covered services without a valid Advance Beneficiary Notice.

The two-midnight rule: inpatient admission is generally appropriate when the admitting physician expects the beneficiary to require hospital care spanning at least two midnights, with the expectation and supporting facts documented at admission.

External audit programs to expect: Medicare Administrative Contractor reviews, Recovery Audit Contractors, Unified Program Integrity Contractors, Supplemental Medical Review Contractors, and Medicaid Integrity Contractors; each may extrapolate overpayments from a valid sample.

Incident-to billing requires that the service be furnished as an integral part of the physician's course of treatment, be of a type commonly furnished without charge, be under the physician's direct supervision, and be documented in the medical record.

Audit cycle: define scope and objective, identify the population or universe, select a defensible sample, test against written criteria, quantify findings, issue a report with root cause, agree on a corrective action plan with owners and dates, and re-audit to validate sustained correction.

Sampling decision rule: use a statistically valid random sample drawn with a tool such as OIG RAT-STATS when findings may be projected to a population; use a judgmental sample only for internal process improvement where projection is not intended.

Error rate formula: number of claims with at least one error divided by the number of claims reviewed; overpayment projection equals the sample mean overpayment multiplied by the population size, with a confidence interval reported.

Monitoring combines ongoing activities (pre-bill edits, charge capture reviews, denial trend analysis, exclusion screening, hotline data) with periodic audits; monitoring frequency is set by risk score, prior findings, and volume.

Investigation protocol: route the matter through counsel to protect privilege, issue a litigation hold before collecting documents, define scope and lead investigator, conduct interviews, preserve evidence with a documented chain of custody, and report findings factually.

Privilege protection: attorney-client privilege covers confidential communications made for the purpose of obtaining legal advice; the Upjohn warning tells employees that counsel represents the organization, not the individual, and that the discussion is privileged.

Self-disclosure decision factors: whether the conduct was knowing, whether an overpayment exists, whether there is a pattern, the size of the exposure, the strength of the internal controls failure, and whether the government already has knowledge; disclose through the OIG Self-Disclosure Protocol or the CMS voluntary self-referral disclosure protocol as appropriate.

Independence rule: auditors and investigators should not review processes they operate, and findings should be reported to the compliance officer and, for significant matters, to the board or audit committee.

Training plan design: base content and frequency on the annual risk assessment, assign modules by role (for example, coding staff on documentation, sales staff on anti-kickback and fair market value, all staff on privacy and the duty to report), and refresh when regulations or audit findings change.

Minimum cadence: general compliance and privacy training at onboarding and at least annually; high-risk roles receive additional targeted education tied to their specific exposure and to audit results.

Core content: standards of conduct, the duty to report and non-retaliation, AKS and Stark basics, HIPAA privacy and security, coding and billing integrity, documentation requirements, and the consequences of non-compliance.

Documentation of training: retain the curriculum version, the date, the instructor or platform, the attendee roster or learning management system completion report, and the post-test results for each participant.

Communication element: the program must provide effective lines of communication such as an anonymous hotline, a compliance email address, an open-door policy, and periodic compliance newsletters, with a documented process for logging, triaging, and resolving reports.

Hotline effectiveness indicators: call volume and category trends, percentage of anonymous reports, average time to close, substantiation rate, and evidence that reporters were not retaliated against.

Training effectiveness measurement: pre- and post-test score improvement, completion rates by department, audit error trends following education, hotline reporting patterns, and targeted re-education for staff who fail knowledge checks.

Board and executive education is separate from workforce training: governing body members should receive periodic education on their oversight duties, the organization's risk profile, and significant enforcement developments.

Government process documents: an OIG subpoena compels records; a Department of Justice Civil Investigative Demand compels documents, interrogatory answers, or testimony; a grand jury subpoena is issued through a court and is returnable on a fixed date; validate the request's scope and authority before producing.

Immediate response steps: notify counsel and the compliance officer, issue a litigation hold, suspend routine destruction, assign a single point of contact, calendar every deadline, collect and log documents, and brief any witnesses before testimony.

Disclosure of PHI in response to legal process is permitted under the HIPAA Privacy Rule when the request is valid and the disclosure is limited to the minimum necessary; verify authenticity of the process and document the production.

Corrective action plan elements: statement of the deficiency, root cause analysis, specific corrective actions, responsible owner, completion date, validation method, and ongoing monitoring to demonstrate sustained resolution.

A corporate integrity agreement is a negotiated settlement obligation, typically five years, that may require an independent review organization, compliance committee and board certifications, reportable events reporting, training, and annual OIG reporting.

Exclusion consequences: an excluded individual or entity may not bill federal health care programs and may not furnish items or services that are billed to them; employing an excluded person who performs covered services creates a separate false claims exposure.

Cooperation credit: voluntary disclosure, proactive remediation, and full cooperation with the government are recognized mitigating factors, and DOJ guidance directs investigators to focus on individual accountability as well as corporate resolution.

Reportable events under a CIA typically include a government investigation, a material violation of the agreement, and a change in the compliance officer or governing body composition, and each requires notice within the timeframe the agreement specifies.