CHCO common mistakes
CHCO · Understand the traps and how to avoid them.
When asked to list the OIG seven elements, the candidate substitutes 'risk assessment' or 'board oversight' for a real element and drops 'enforcement of standards through well-publicized disciplinary guidelines' or 'effective lines of communication.'
Study habits blur the seven elements together with DOJ/OIG program-effectiveness factors and guidance on corporate compliance programs, so candidates recall themes instead of the enumerated list and fill gaps with plausible-sounding items.
What to do instead
Memorize the seven elements as a fixed ordered list and attach one concrete artifact to each (disciplinary guidelines = a written sanction matrix cited in the handbook and applied in a documented case). Self-quiz backwards: name the element from the artifact, not the artifact from the element.
On a self-referral fact pattern, the candidate applies Stark to an arrangement with no physician involvement, or states that a Stark violation requires proof of intent, or labels an AKS problem as 'an exception issue' rather than a safe harbor issue.
Both statutes police remuneration and referrals and many exceptions share names, so under time pressure the two collapse into a single mental category called 'fraud and abuse.'
What to do instead
Before answering, run a four-row comparison: covered parties (Stark reaches only physicians and immediate family members), intent (Stark is strict liability; AKS requires knowing and willful conduct although actual knowledge of the statute is not required), safe harbor versus exception, and disclosure route (CMS SRDP versus OIG Self-Disclosure Protocol).
The candidate states FCA damages are doubled, treats per-claim civil penalties as discretionary, assumes a relator must be an employee with firsthand knowledge, or omits the obligation to return an identified overpayment within 60 days.
The False Claims Act is studied as a headline ('treble damages') rather than as a set of separate elements, and qui tam procedure is skimmed, so recalled fragments get recombined incorrectly.
What to do instead
Learn the FCA as a checklist: knowingly presenting or using a false claim; treble damages plus a per-claim civil penalty adjusted annually for inflation; materiality as construed in Escobar; reverse false claims; and the 60-day overpayment-return clock running from identification, not from when the refund is processed.
The candidate answers that Security Rule 'addressable' specifications are optional, so an entity may simply decline to implement encryption, access controls, or audit controls and note the decision.
The word 'addressable' sounds discretionary, and candidates skim the implementation-specification section without reading how the standard's flexibility requirement actually operates.
What to do instead
State the rule precisely: addressable means assess whether the specification is reasonable and appropriate, then either implement it or document why it is not and implement an equivalent alternative measure. Add that the risk analysis is a required standard, not addressable, and that encryption is a breach safe harbor only if actually deployed and the keys are not compromised.
The candidate starts the 60-day breach notification clock on the date of the incident or the date the investigation closed, and concludes an incident is 'not a breach' without walking through the four-factor risk assessment.
Incident-date and investigation-close-date are the dates most prominent in a fact pattern, and the low-probability-of-compromise analysis is remembered as a conclusion rather than a documented process.
What to do instead
Anchor on discovery: the clock begins when the incident is known or would have been known with reasonable diligence, including by a business associate acting as the covered entity's agent. For every 'not a breach' answer, state the four factors (nature and extent of PHI, unauthorized recipient, whether PHI was actually acquired or viewed, mitigation) and note that the determination must be documented.
Facing ambiguous documentation, the candidate selects the highest-reimbursed code the record could arguably support, or unbundles a service by appending modifier 25 to an E/M visit without a significant, separately identifiable service documented.
Exam items are written to reward the conservative, documentation-driven answer, but candidates default to the coding instinct that maximizes legitimate reimbursement and treats a modifier as a tool for getting paid rather than a claim about the record.
What to do instead
Apply a two-step test every time: is the service medically necessary and documented in the record, then is it correctly coded? For NCCI edits, state that a modifier may override an edit only when the documentation supports a distinct service, and be ready to say the compliant answer is to bill the lower-level code or query the physician rather than upcode.
The candidate designs an audit sample by pulling the largest or most suspicious claims and then extrapolates an error rate to the population, or describes a sample without stating how the population and selection method were defined.
Internal monitoring experience teaches targeted, judgmental review, and candidates do not separate monitoring (where judgmental selection is fine) from measurement (where extrapolation demands a probability sample).
What to do instead
Always state population, frame, sampling unit, selection method, and sample size before results. Use random or statistically valid selection (for example RAT-STATS) when an error rate will be projected; reserve non-statistical samples for internal monitoring and explicitly say no extrapolation is claimed.
The candidate has the compliance officer run witness interviews alone, assumes the resulting memos are privileged because compliance is 'confidential,' and never mentions giving employees an Upjohn-type warning about counsel's representation.
Compliance departments do handle investigations daily, and 'privilege' gets treated as a label attached to any sensitive document rather than a protection that depends on counsel direction and purpose.
What to do instead
Frame investigations as counsel-directed when legal exposure exists: engage counsel, conduct interviews at counsel's direction, mark and limit distribution of work product, give an Upjohn warning at the start of each interview, and remember that the underlying facts are generally not privileged even when the analysis is.
The candidate evaluates a training program by completion percentage and the existence of an annual slide deck, with no role-specific content, no documented attendance, and no assessment of comprehension or behavior change.
Completion dashboards are easy to produce and are what boards and auditors ask for, so candidates mistake a measurable output for evidence of an effective program.
What to do instead
Describe training as risk-based and role-differentiated (coders, billing staff, sales, clinicians, board), delivered at onboarding and periodically, documented with attendance and content version, reinforced by testing or teach-back, and evaluated through downstream metrics such as audit error rates. Give the board separate education on oversight duties.
The candidate closes a corrective action plan once policies are revised and training is delivered, and routes a Stark-only disclosure to the OIG Self-Disclosure Protocol rather than the CMS Self-Referral Disclosure Protocol.
A CAP is treated as a documentation deliverable rather than a monitored remediation cycle, and the two disclosure channels are remembered as 'self-disclosure' generically without their jurisdictional split.
What to do instead
Write each CAP element as a row: root cause, action, accountable owner, due date, evidence of completion, validation audit with defined sample and threshold, and reporting to the compliance committee until the metric holds. Route disclosures by issue type: Stark-only matters to the CMS SRDP, potential AKS or FCA exposure to the OIG SDP, and consider parallel obligations where both are implicated.