CHCO study guide
CHCO · Work through your exam, one topic at a time.
The Certified Healthcare Compliance Officer (CHCO) is a professional credential for people who carry day-to-day responsibility for a healthcare organization's compliance and ethics program - compliance officers and analysts, billing and revenue-cycle managers, privacy and security staff, internal auditors, and clinicians moving into administrative oversight. It signals that the holder understands both the legal framework regulators enforce and the practical machinery of running a program: governance and board reporting, risk assessment, policy development, auditing and monitoring, education, and responding to a government inquiry when one arrives. The CHCO study guide has 7 sections and about 2,350 words.
01Compliance Program Structure, Governance, and the OIG Seven Elements
The OIG's seven elements are the backbone of any healthcare compliance program: (1) written standards of conduct, policies, and procedures; (2) designation of a compliance officer and compliance committee with direct access to the governing body; (3) effective training and education; (4) effective lines of communication, including a hotline and non-retaliation protection; (5) internal monitoring and auditing; (6) well-publicized disciplinary standards and enforcement; and (7) prompt response and corrective action, including investigation and remediation. Examiners rarely ask you to recite the list.
324 words, about 2 min02Healthcare Regulatory Framework: FCA, Anti-Kickback Statute, Stark Law, and Civil Monetary Penalties
False Claims Act (31 U.S.C. Liability for knowingly presenting or causing a false claim.
352 words, about 2 min03HIPAA Privacy, Security, and Breach Notification
Covers protected health information in any form. Treatment, payment, and healthcare operations (TPO) are permitted uses; other disclosures require a valid authorization unless a specific regulatory exception applies.
344 words, about 2 min04Coding, Billing, and Reimbursement Compliance
The classic billing risks are upcoding, unbundling, duplicate claims, services not rendered, services not medically necessary, diagnosis miscoding to justify payment, modifier misuse, place-of-service errors, and documentation that fails to support the code billed. Medical necessity is the linchpin: documentation must support both the level of service and the clinical rationale.
333 words, about 2 min05Auditing, Monitoring, and Internal Investigations
Monitoring is ongoing, often real-time and preventive: pre-bill edits, charge reconciliation, denial trending, exclusion screening. Auditing is periodic, retrospective, and independent validation against a defined standard.
318 words, about 2 min06Compliance Education, Training, and Communication
Training must be risk-based and role-specific: coders need coding integrity content, sales and physician liaison staff need AKS and Stark content, clinicians need documentation and HIPAA content, and leadership needs governance and oversight content. It must occur at onboarding, at least annually, and whenever regulations, systems, or job duties change.
348 words, about 2 min07Enforcement Response, Corrective Action Plans, and Government Investigations
Common instruments include subpoenas for documents or testimony, civil investigative demands, OCR inquiries, and OIG exclusion inquiries. Route the request to counsel, designate a single point of contact, log every deadline, issue a preservation notice, and produce documents in the requested format.
331 words, about 2 min