Compliance, Privacy, and Regulatory Requirements
Privacy and security
HIPAA has three parts to know. The Privacy Rule governs uses and disclosures, requires minimum necessary, permits treatment, payment, and operations without authorization, and grants patients rights to access, amend, and receive an accounting of disclosures. The Security Rule requires administrative, physical, and technical safeguards; encryption provides a safe harbor if a breach occurs. Breach notification to affected individuals is generally due within 60 days of discovery. Releases must contain the required elements, and psychotherapy notes need a separate authorization. A billing service or clearinghouse requires a Business Associate Agreement; without one, the disclosure is improper. State law and minor-consent rules can be stricter than HIPAA.
Fraud, waste, and abuse
The False Claims Act imposes treble damages for knowingly submitting false claims, and "knowingly" includes deliberate ignorance. Qui tam relators share in recoveries. The Anti-Kickback Statute is intent-based and prohibits remuneration for referrals of federally payable items. The Stark Law is a strict-liability physician self-referral prohibition covering designated health services, subject to specific exceptions. Screen employees and vendors against the OIG LEIE and SAM exclusion lists. Identified overpayments must be reported and returned within 60 days.
Compliance program
Seven elements: written standards, a compliance officer and committee, training and education, open communication lines, internal monitoring and auditing, enforcement and discipline, and prompt corrective action. RAC, MAC, and UPIC audits typically target medical necessity, coding, and documentation.
Traps
Confusing Stark (strict liability, financial relationship) with the Anti-Kickback Statute (intent). Treating a BAA as optional. Releasing records to a spouse without authorization.
Rule of thumb
When a billing error is found, quantify it, refund it within 60 days, and document the root cause.