PMPC Designation cheat sheet

Seven elements of an effective compliance program: written policies/procedures, compliance officer and committee, training and education, communication lines, internal monitoring/auditing, enforcement/discipline, and corrective action.

The compliance officer reports to the governing body and has authority independent of billing or revenue-cycle management; the compliance committee meets at least quarterly and documents minutes.

Mandatory exclusion screening: OIG List of Excluded Individuals/Entities (LEIE) and SAM.gov exclusions checked at hire and monthly thereafter; results retained for at least 10 years.

Compliance program effectiveness is measured by auditing and monitoring plans: baseline audits, annual risk assessment, and corrective action plans with owners and deadlines.

The Patient Protection and Affordable Care Act (ACA) §6401 requires providers/suppliers enrolling in Medicare to establish a compliance program as a condition of enrollment.

The OIG Work Plan and Corporate Integrity Agreements (CIAs) define enforcement priorities; a CIA typically imposes independent review organization (IRO) audits and annual certifications.

Disclosure obligations: 60 days to report and return identified overpayments (ACA §6402); failure creates liability under the False Claims Act (FCA) and Civil Monetary Penalties Law.

Enforcement tools: FCA (treble damages plus per-claim penalties), Civil Monetary Penalties Law, Anti-Kickback Statute, Physician Self-Referral (Stark) Law, and exclusion from federal health programs.

The compliance committee charter should specify membership, quorum, reporting lines, and authority to investigate; board minutes should show receipt of compliance reports.

Medicare coverage requires the service be reasonable and necessary, documented in the medical record, and ordered/certified per benefit category rules.

Evaluation and Management (E/M) level selection follows the 2021+ office/outpatient guidelines: medical decision making (MDM) or total time on the date of the encounter; history and exam are no longer used to select level.

Modifier 25 is appended to a significant, separately identifiable E/M service on the same day as a procedure; documentation must support both services.

Incident-to billing requires the physician to have initiated the course of treatment, direct supervision by the physician, and the service be an integral part of the physician's plan; the auxiliary personnel must be employed by the physician or practice.

Advance Beneficiary Notice of Noncoverage (ABN) form CMS-R-131 must be issued before service when the provider believes Medicare will deny as not reasonable and necessary; the beneficiary selects an option and the form is retained.

Local Coverage Determinations (LCDs) and National Coverage Determinations (NCDs) define coverage; LCDs include covered and noncovered ICD-10-CM diagnosis lists and documentation requirements.

National Correct Coding Initiative (NCCI) Procedure-to-Procedure (PTP) edits and Medically Unlikely Edits (MUEs) prevent improper code pair billing; modifier 59 or X{EPSU} may bypass PTP edits only when clinically appropriate.

Medicare Physician Fee Schedule (MPFS) payment = (Work RVU × Work GPCI + PE RVU × PE GPCI + MP RVU × MP GPCI) × Conversion Factor; sequestration reduces Medicare payments by 2%.

Teaching physician documentation: the teaching physician must document his/her presence and participation in the key components of the service; a student note alone is not billable.

Risk assessment matrix: score each risk by likelihood and impact (1–5 each); prioritize risks with a score of 12 or higher for audit and monitoring.

Red flags requiring investigation: upcoding patterns, high modifier 25/59 use, duplicate claims, services without orders, unbundling, and same-day discharge/readmission patterns.

Corrective action plan (CAP) must include root cause, corrective steps, responsible person, target date, and validation audit; close only after re-audit shows sustained compliance.

Internal audit sampling: use statistically valid random samples; for a 95% confidence interval with 5% margin, sample size is approximately 385 for large populations, or use the OIG RAT-STATS tool.

Overpayment response: quantify, refund within 60 days, document root cause, and implement monitoring; repeated overpayments can trigger a CIA or exclusion.

Conflict-of-interest program: annual disclosure by board, executives, and medical staff; recusal from decisions affecting financial interests; gifts and meals tracked under Sunshine Act/Open Payments.

Non-retaliation policy must protect good-faith reporters; hotline reports are logged, triaged within 5 business days, investigated, and tracked to resolution.

Documentation integrity: medical record must support the code billed, the medical necessity, and the identity of the provider; late entries must be dated and labeled as addenda.

Breach notification: HIPAA requires notification to affected individuals within 60 days of discovery; breaches affecting 500+ individuals also require HHS and media notice.

Exclusion means no federal health care program payment for any item or service furnished by the excluded person, including items ordered or prescribed by the excluded person.

OIG exclusion authority: mandatory exclusion for convictions related to program fraud or patient abuse/neglect; permissive exclusion for other offenses, license revocation, or default on health education loans.

Effect of exclusion: claims submitted for services by an excluded individual are not payable; payment received must be repaid; the provider may face Civil Monetary Penalties (CMP) up to three times the amount claimed.

An excluded individual may not be employed in any capacity that involves federal health care program billing, ordering, prescribing, or direct patient care; administrative and non-federal roles may be permissible with legal review.

Screening requirement: check LEIE and SAM.gov before hire, at credentialing, and monthly; document results; a hit requires immediate removal from federal-program duties pending verification.

Self-disclosure: use the OIG Self-Disclosure Protocol (SDP) for potential fraud; use CMS Voluntary Self-Referral Disclosure Protocol (SRDP) for Stark violations; disclose before the government discovers the conduct.

Reinstatement: excluded individuals may apply for reinstatement after the minimum exclusion period (commonly 5 years for mandatory exclusions, 3 years for permissive) by submitting an application to OIG.

CMP exposure for employing an excluded person: penalties per item or service plus up to three times the amount claimed, and potential exclusion of the entity itself.