CHCO study plan

Map the seven OIG compliance program elements to concrete artifacts (policies, hotline logs, training records, audit workpapers) in a two-column table

Draft an organizational chart showing the compliance officer's reporting lines, board/audit-committee touchpoints, and independence safeguards

List the core duties of a compliance committee and write five example agenda items for a quarterly meeting

Explain in your own words how a compliance program scales across a small clinic versus a multi-hospital system

Complete the domain 1 work by writing a draft code of conduct summary and a conflicts-of-interest disclosure form outline

Describe exclusion screening obligations, including the OIG List of Excluded Individuals/Entities and the SAM.gov exclusions database, and set a monthly screening cadence

Define the False Claims Act's key concepts: knowingly, false claim, materiality, treble damages, and qui tam relator share

Distinguish the FCA's three knowledge standards (actual knowledge, deliberate ignorance, reckless disregard) using three original fact patterns

Compare the Anti-Kickback Statute and the Stark Law across intent standard, referral scope, exceptions or safe harbors, and penalties

Summarize at least eight AKS safe harbors (for example, employment, personal services, space rental, EHR donations) and state the core condition for each

Outline the main Stark exceptions, including in-office ancillary services and the fair market value requirement

Explain the Civil Monetary Penalties framework and how CMP, AKS, and FCA liability can stack on a single arrangement

Draft an arrangement-review checklist used before signing a physician contract

Reinforce domain 2 by analyzing two original scenarios and deciding which statute is implicated and why

Differentiate HIPAA privacy, security, and breach notification rules by scope, covered entity versus business associate duties, and required documentation

List the 18 HIPAA identifiers and explain the two permitted de-identification methods

Walk through the four-factor breach risk assessment and state when notification is required and to whom

Outline the minimum necessary standard and its main exceptions

Finish domain 3 by describing administrative, physical, and technical safeguard categories and writing three sample security controls for each

Explain how the HIPAA Security Rule and the HIPAA Privacy Rule interact with a business associate agreement

Trace a claim from documentation to code assignment to submission and identify three points where compliance risk enters

Describe the roles of ICD-10, CPT, and HCPCS in billing and explain how upcoding, unbundling, and modifier misuse create false claim exposure

Outline a physician documentation query process that stays within compliance boundaries

Build a baseline risk assessment that ranks at least 10 compliance risk areas by likelihood and impact

Draft an annual internal audit plan naming scope, sample size rationale, frequency, and reporting lines for three audit areas

Write an investigation protocol covering intake, conflict check, evidence preservation, interviewee rights, and documentation

Explain privilege, self-disclosure options, and overpayment identification and repayment obligations under the 60-day rule

Finish domain 5 by designing a monitoring dashboard with at least six metrics and defined thresholds

Design a role-based training curriculum with audience, content, cadence, delivery method, and completion tracking for four roles

Draft a communication plan covering hotline awareness, non-retaliation messaging, and anonymous reporting channels

Outline a corrective action plan structure: root cause, corrective steps, owners, timelines, and validation evidence

Describe how to respond to a government subpoena or Civil Investigative Demand, including counsel engagement and litigation hold steps

Re-rank all seven domains by your practice-test scores and spend the most time on the two weakest

Complete two timed practice sets of at least 40 questions each and review every missed item to root cause

Rewrite condensed one-page summaries for each of the five heaviest domains

Recite the elements, statutory thresholds, notification timelines, and audit steps from memory in a written brain dump