CHCO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

OIG seven elements

The OIG framework for effective compliance: written policies and standards, designated compliance leadership, training and education, communication lines, enforcement and discipline, monitoring and auditing, and prompt corrective action.

Compliance officer independence

The compliance officer should report to the governing body or chief executive, have direct access to the board, hold authority over the program budget, and not be subordinate to the functions being monitored.

Compliance committee function

A cross-functional committee that reviews risk assessments, audit results, policy approvals, and corrective actions, and documents its meetings, attendance, and decisions in formal minutes.

Standards of conduct

A written statement of the organization's ethical expectations and its coding, billing, privacy, and referral commitments that applies to all workforce members, including contractors, and is acknowledged periodically.

Board compliance oversight

Governing body duties include approving the compliance program, receiving regular risk and audit reports, ensuring adequate resources, and overseeing the response to significant compliance failures.

False Claims Act

31 U.S.C. sections 3729 through 3733 impose liability for knowingly presenting or causing false claims, with treble damages and inflation-adjusted per-claim penalties, and permit private qui tam suits.

Qui tam relator share

A private relator receives 15 to 25 percent of the recovery when the government intervenes and 25 to 30 percent when it declines, under 31 U.S.C. section 3730(d).

Anti-Kickback Statute

42 U.S.C. section 1320a-7b(b) makes it a felony to knowingly and willfully offer or pay remuneration to induce referrals of items or services payable by federal health care programs.

Stark Law

42 U.S.C. section 1395nn bars physicians from referring Medicare patients for designated health services to entities with which they or immediate family members have a financial relationship, absent an exception.

Civil Monetary Penalties Law

42 U.S.C. section 1320a-7a authorizes OIG administrative penalties, assessments, and program exclusions for false claims, kickbacks, and other listed conduct; amounts are inflation-adjusted annually.

Breach notification deadline

Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery; breaches affecting 500 or more individuals are reported to HHS at the same time.

HIPAA breach presumption

An impermissible use or disclosure of unsecured protected health information is presumed a breach unless the entity documents a four-factor risk assessment showing low probability that the information was compromised.

De-identification safe harbor

Protected health information is de-identified when a qualified expert determines re-identification risk is very small, or when all 18 specified identifiers and any actual knowledge of re-identifiability are removed.

Minimum necessary standard

Covered entities must limit uses, disclosures, and requests of protected health information to the least amount reasonably necessary for the purpose, with exceptions for treatment and authorized disclosures.

Security Rule risk analysis

45 CFR section 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.

NCCI procedure-to-procedure edits

Medicare bundling edits pairing codes that should not be billed together; modifier indicator 0 means no override is allowed, while indicator 1 permits an appropriate modifier.

60-day overpayment rule

42 U.S.C. section 1320a-7k(d) requires a provider that identifies an overpayment to report and return it within 60 days or by the applicable cost report due date.

Medical necessity documentation

The medical record must support the level of service billed through the history, examination, and medical decision making, or total time, consistent with the code's definition.

Modifier 25 use

Appended to an evaluation and management code when a significant, separately identifiable service is performed on the same day as a procedure by the same physician.

Two-midnight rule

Inpatient admission is generally appropriate when the physician expects the beneficiary to need hospital care spanning at least two midnights, with that expectation documented at admission.

RAT-STATS sampling

OIG's free statistical software used to draw random samples, calculate error rates, and project overpayments to a population, commonly in audits and self-disclosures.

Attorney-client privilege

Protects confidential communications between counsel and client made for legal advice; it can be waived by disclosure, so investigations should route through counsel with documented purpose.

Litigation hold

A written directive suspending routine destruction of documents and electronically stored information once litigation, investigation, or a subpoena is reasonably anticipated, with tracked compliance.

Baseline compliance audit

A review of past claims against documentation and rules to measure error rates and prioritize corrective work; results inform monitoring, education, and possible self-disclosure.

Compliance hotline requirements

An accessible, confidential channel allowing anonymous reporting of suspected misconduct, publicized to the workforce, with non-retaliation protections and documented tracking of every report received.

Role-based compliance training

Education tailored to the specific risks of a job family, such as coding staff on documentation or sales staff on anti-kickback limits, delivered at onboarding and periodically thereafter.

LEIE screening

Checking employees, contractors, and vendors against the OIG List of Excluded Individuals and Entities before hiring or contracting and monthly thereafter, documenting results and acting on matches.

Training effectiveness measurement

Evaluating whether education changed behavior using pre- and post-tests, completion rates, audit error trends, hotline volume, and targeted follow-up for staff who fail knowledge checks.

Corporate integrity agreement

A negotiated settlement term requiring OIG-specified compliance obligations, such as an independent review organization, periodic reports, certifications, and training, typically for five years.

Corrective action plan

A documented response to an identified deficiency stating root cause, specific corrective steps, responsible owners, deadlines, validation methods, and monitoring to confirm sustained resolution.

OIG Self-Disclosure Protocol

A formal channel for disclosing potential fraud to OIG before government knowledge; it requires a complete narrative and damages calculation and generally yields reduced penalties and exclusion protection.

CID subpoena response

On receiving a Civil Investigative Demand, notify counsel and compliance, suspend destruction, collect and log responsive documents, prepare witnesses, and avoid unilateral contact with the government.