Compliance and Regulatory Guidelines
Scope
Compliance questions blend privacy law, fraud-and-abuse law, and accreditation. For HIPAA, know the Privacy Rule (uses and disclosures for treatment, payment, and health care operations; the minimum necessary standard; the elements of a valid authorization; patient rights to access and amend; accounting of disclosures), the Security Rule safeguards (administrative, physical, technical), and breach notification timelines. Know that state law is preempted only when it is less strict than HIPAA.
Fraud and abuse content includes the False Claims Act and its qui tam provisions, the Anti-Kickback Statute (knowing and willful remuneration for referrals), the physician self-referral (Stark) law, the OIG Work Plan and compliance program elements, RAC and other audit contractors, NCCI edits, and the Advance Beneficiary Notice. Also expect the Medicare Conditions of Participation, EMTALA, and the distinction between a statute, a regulation, and a guideline.
Traps
Minimum necessary does not apply to disclosures for treatment. Upcoding a diagnosis to raise payment is fraud, not “coding optimization,” and “everyone does it” is never a defense. Pay attention to whether a scenario describes a privacy violation (impermissible access or disclosure) versus a security violation (safeguard failure).
Rule of thumb
Before releasing information, ask three questions: is there a permissible purpose, is the amount the minimum necessary, and is the request properly documented and tracked?
Worked example
A supervisor asks a coder to change a CC-level diagnosis to an MCC to increase payment. The correct response is to refuse and report it - the change would misrepresent the record and could constitute a false claim.