CHCO key terms

The seven building blocks OIG expects: written policies and procedures, a designated compliance officer and committee, training and education, open communication lines, internal monitoring and auditing, consistent discipline, and prompt corrective action when problems are found.

The person responsible for running the compliance program day to day: setting priorities, overseeing auditing and training, handling reported concerns, and reporting program results to senior leadership and the governing body.

A cross-functional group of leaders from coding, billing, clinical operations, legal, and finance that meets regularly to review compliance risks, approve policies, and direct resources toward the highest-priority exposures.

The board's duty to understand the organization's compliance risk profile, approve the program's structure and budget, receive regular reporting, and hold management accountable for fixing identified problems.

A concise statement of the organization's ethical commitments and behavioral expectations that applies to everyone from the board to front-line staff and anchors more detailed policies.

A structured process for identifying and ranking compliance risks by likelihood and potential harm, so audit, training, and staffing resources go where exposure is greatest.

A federal statute imposing civil liability, including treble damages and per-claim penalties, on anyone who knowingly submits, or causes the submission of, a false claim to a government payer.

A lawsuit a private person files on the government's behalf alleging fraud; the relator may receive a share of any recovery, and the government may intervene or decline to take over the case.

A criminal statute barring knowingly offering, paying, soliciting, or receiving anything of value to induce referrals of items or services paid for by a federal healthcare program.

A regulation describing an arrangement the government will not prosecute under the Anti-Kickback Statute, but only if every condition of that safe harbor is fully satisfied.

A strict-liability civil statute barring physicians from referring Medicare patients for designated health services to entities with which they or an immediate family member have a financial relationship, unless an exception applies.

A statute letting the government impose money penalties and program exclusions administratively, without filing suit, for defined violations such as false claims, kickbacks, and improper beneficiary inducements.

A sanction removing a person or entity from federal healthcare program participation; billing for items or services furnished by an excluded individual can create substantial liability, even if the work was competent.

The price a willing buyer would pay a willing seller in an arm's-length transaction, with neither under pressure to deal; used to test whether physician compensation exceeds legitimate value.

Funds the organization receives or keeps but is not entitled to; identified overpayments generally must be reported and returned within 60 days or the retained claim can be treated as false.

Individually identifiable health information created or received by a covered entity or business associate, in any form, that relates to a person's health, care, or payment for care.

The HIPAA regulation governing how covered entities and business associates may use and disclose PHI, including notice, minimum necessary limits, patient access rights, and authorization requirements.

The HIPAA regulation requiring administrative, physical, and technical safeguards for electronic PHI, built around a documented risk analysis, risk management, and periodic evaluation of those safeguards.

The requirement to limit uses, disclosures, and requests for PHI to the smallest amount reasonably needed for the purpose, with defined exceptions such as disclosures for treatment.

Requires covered entities to notify affected individuals, the Department of Health and Human Services, and sometimes the media after discovering a breach of unsecured PHI, generally within 60 days.

A contract allowing a vendor to handle PHI for a covered entity and obligating it to safeguard the data, report breaches, and meet applicable HIPAA requirements.

Clinical records showing why a service was reasonable and necessary for the patient's condition; without such support a paid claim can be recouped even when the service was truly delivered.

Billing a code that reflects a higher level of service, complexity, or payment than the documentation supports; a frequent audit finding and a potential false claim.

Reporting separately for components of a service that should be billed under one comprehensive code, which inflates payment and violates payer billing rules.

Payer edits flagging code pairs that generally should not be billed together unless a documented modifier shows the services were distinct and separately reportable.

A notice given to a Medicare beneficiary before a service likely to be denied as not medically necessary, which can shift financial responsibility to the patient if denial occurs.

A planned, independent review of records, claims, and processes against legal and payer requirements, designed to catch errors before an external reviewer does.

Selecting a statistically valid subset of claims or records, measuring the error rate, and projecting that rate across a larger population to estimate overpayment or risk.

A structured, documented inquiry into a reported concern that establishes the facts, preserves evidence, defines the scope, and determines what corrective action is needed.

Legal protection keeping confidential communications between counsel and the organization from disclosure; structuring an investigation to preserve it requires early involvement of lawyers.

Baseline education every workforce member receives on the code of conduct, key laws, how to raise concerns, and non-retaliation, typically at hire and then annually.

Education tailored to the risks of a specific job family such as coders, billers, sales staff, or clinicians, covering the rules and failure patterns those people actually meet in daily work.

The signals senior leaders send through decisions and priorities about whether compliance matters more than revenue; staff follow what leaders reward and tolerate.

A confidential, often anonymous channel for reporting suspected wrongdoing, paired with a firm prohibition on punishing anyone who raises a concern in good faith.

A documented set of specific steps, owners, and deadlines for fixing a known deficiency, plus follow-up testing to confirm the fix actually worked.

A negotiated agreement with the OIG, usually lasting several years, imposing monitoring, reporting, training, and independent review duties as a condition of continued federal program participation.

Reporting misconduct to the government before it is discovered, which can reduce penalties and help avoid exclusion, but requires careful planning and usually legal counsel.

A written directive to preserve documents and electronic data relevant to anticipated litigation or an investigation, pausing routine deletion and destruction schedules.

A compulsory government request for documents, data, or testimony in a healthcare fraud investigation, with deadlines and scope that must be tracked and negotiated carefully.