Compliance Risks, Actions, and Issues
Risk assessment
Effective compliance begins with a documented risk assessment ranking exposure by likelihood and impact. High-risk areas typically include billing, coding, referral arrangements, privacy, and vendor relationships. Exam questions reward identifying risk before an event and applying proportionate resources.
Investigative actions
When an issue surfaces, the sequence is consistent: contain the problem, preserve evidence, conduct a privileged and confidential investigation, determine root cause, remediate, and disclose or repay as required. The 60-day repayment rule under the Affordable Care Act requires returning identified overpayments within 60 days of identification, and the lookback period is generally six years. Self-disclosure options include the OIG Self-Disclosure Protocol and CMS self-referral disclosure. A trap is delaying repayment pending an internal review - the clock starts at identification.
Common issues
Recurring problem areas include exclusion screening failures, inadequate documentation, gifts to referral sources, and failure to monitor delegated functions. Know that an issue involving a potential excluded person must be escalated immediately and that continued billing for that person's services creates overpayment exposure.
Rule of thumb
Identify, contain, investigate, remediate, repay, and monitor. Skipping repayment or monitoring is the most commonly tested omission.
Worked example
An audit reveals $40,000 in overpayments identified on March 1. The organization must quantify and return the amount within 60 days, document the corrective action plan, and add the issue to ongoing monitoring. Waiting for a full-year review before repaying creates additional liability.