Medical Compliance
Medical Compliance
Medical compliance involves adhering to laws, regulations, and guidelines that govern healthcare operations. Candidates must understand key regulations such as HIPAA (privacy and security), the False Claims Act, the Anti-Kickback Statute, the Stark Law, and the Office of Inspector General (OIG) Compliance Program Guidance. A compliance program typically includes written policies, a compliance officer, training, monitoring, and enforcement.
A major trap in exam questions is the difference between the Anti-Kickback Statute and the Stark Law: the Anti-Kickback Statute is a criminal law that prohibits remuneration for referrals of items or services reimbursed by federal healthcare programs, while the Stark Law is a civil law that prohibits physician self-referral for designated health services (DHS) paid by Medicare, regardless of intent. Another trap is HIPAA's Privacy Rule versus Security Rule: the Privacy Rule governs the use and disclosure of protected health information (PHI), while the Security Rule specifically addresses electronic PHI (ePHI).
Compliance also includes coding and billing integrity. Upcoding (billing for a higher level of service than provided) and unbundling (billing components separately that should be bundled) are examples of fraud. The OIG recommends seven elements of an effective compliance program, including high-level commitment, written policies, training, and auditing.
Worked example: A physician owns a laboratory and refers patients to it for testing. Medicare pays for the tests. This arrangement may violate the Stark Law because the physician has a financial relationship with the entity providing DHS. Rule of thumb: any financial relationship between a physician and a healthcare entity that provides DHS to Medicare patients must fit within a Stark exception or it is prohibited.