CCS (Customs & Trade Compliance Certifications) cheat sheet

ICD-10-CM conventions: the Tabular List is the index's authority; an Excludes1 note means the two codes are never reported together, while Excludes2 means the second condition may be reported if present and documented.

Placeholder X is required only when a code is exactly six characters and a seventh character is needed; it is never used as a filler in the outpatient diagnosis code set.

ICD-10-PCS codes are built from seven characters (section, body system, root operation, body part, approach, device, qualifier); the root operation, not the procedure name, drives code selection.

CPT modifier 25 applies to a significant, separately identifiable E/M service on the same day as a procedure or other service; modifier 59/ X{EPSU} addresses distinct procedural services, not E/M.

Global surgical package: 0-day = minor procedure (only the day of service), 10-day = minor procedure with follow-up, 90-day = major procedure; E/M on the same day as a 0-day procedure is separately payable only if a modifier is appropriate.

HCPCS Level II codes (A-V, J, Q, etc.) are used for drugs, supplies, and services not represented in CPT; CPT Category III codes are temporary tracking codes for emerging technology.

E/M level selection under 2021+ office/outpatient guidelines uses medical decision making (problems, data, risk) or total time on the date of the encounter, not the 1995/1997 key components.

Coding queries must be non-leading and ask for a specific clinical clarification (e.g., "Is this acute or chronic?") without suggesting the diagnosis or code.

Data elements have five attributes: definition, allowable values, data type (numeric, alphanumeric, date, etc.), field length, and format; each must be specified to make a data dictionary useful.

HL7 v2.x messages are pipe-delimited with segment IDs (MSH, PID, PV1, OBX); HL7 FHIR uses RESTful resources (Patient, Encounter, Observation) and is the current interoperability standard for exchange.

SNOMED CT is a comprehensive clinical terminology for EHR documentation; LOINC identifies laboratory and clinical observations; RxNorm normalizes medications; ICD-10-CM classifies diagnoses for reporting.

Data quality dimensions: accuracy, completeness, consistency, timeliness, precision, and definition; data integrity failures are identified by comparing source documents to the database.

DICOM governs medical imaging storage and transmission; PACS archives images; the imaging report and the image set are distinct data assets.

HEDIS measures use administrative (claims) and hybrid (medical record) data; the measurement year and continuous enrollment criteria must be confirmed before reporting a rate.

A data dictionary should include the data element name, definition, source system, owner, and allowable values; a data model shows the relationships between entities.

Health data standards are maintained by SDOs: HL7 (messaging and FHIR), ANSI/ASC X12 (claims and eligibility transactions), NCPDP (pharmacy claims), and ISO/TC 215 (international health informatics).

Information governance is the accountability framework for how data is created, used, retained, and disposed; it is distinct from data management, which executes the controls.

The AHIMA information governance principles include accountability, transparency, integrity, protection, compliance, availability, retention, and disposition.

Legal health record is the record the organization designates as the official business record; the designated record set under HIPAA is what the patient has a right to access, amend, and receive an accounting of disclosures for.

Retention schedules must reflect federal and state requirements plus statutes of limitation; the longest applicable retention period controls, and litigation holds suspend routine destruction.

A record is the complete set of information about a patient encounter; a data element is the smallest unit of information; data stewardship assigns responsibility for a domain to a named individual.

Release of information requires a valid authorization with patient identifier, purpose, date, expiration, signature, and right to revoke; psychotherapy notes require a separate authorization.

Minimum necessary applies to uses and disclosures for payment and operations, but not to treatment, disclosures to the patient, or disclosures required by law.

A legal hold (litigation hold) overrides the retention schedule; destruction must be documented, and destruction of records under hold is a serious compliance breach.

Revenue cycle sequence: scheduling/registration, eligibility and benefits verification, coding and charge capture, claim submission, payer adjudication, remittance posting, denial management, and patient collections.

Charge capture must reconcile charges to the procedure and supply documentation; missed charges are identified by comparing the chargemaster to the clinical record.

Clean claim rate = claims accepted on first submission ÷ total claims submitted; first-pass denial rate = initial denials ÷ total claims; both are standard revenue cycle KPIs.

Denial management requires root-cause categories: registration/eligibility, coding, authorization, medical necessity, and timely filing; each category has a distinct corrective action.

Days in accounts receivable (A/R) = (total A/R ÷ total charges) × days in period; a lower value generally indicates faster cash collection.

The chargemaster must be reviewed at least annually; it links CPT/HCPCS, revenue codes, and charges and is a compliance-sensitive document.

Under the No Surprises Act and price transparency rules, hospitals must publish standard charges and provide good-faith estimates to uninsured or self-pay patients on request.

Coordination of benefits determines primary versus secondary payer; the birthday rule applies to dependent children of parents with separate plans, with exceptions for court orders.

The seven elements of an effective compliance program: written policies, compliance officer and committee, training and education, communication lines, auditing and monitoring, discipline, and corrective action.

The False Claims Act imposes liability for knowingly presenting false claims; qui tam (whistleblower) suits allow private parties to sue on the government's behalf and share in recoveries.

The Anti-Kickback Statute prohibits remuneration for referrals of federally payable items or services; the Stark Law prohibits physician self-referral for designated health services, with the exception that Stark is strict liability and does not require intent.

The OIG Work Plan and the OIG Compliance Program Guidance identify audit targets; the OIG's Self-Disclosure Protocol is a route for voluntary disclosure of potential fraud.

HIPAA Security Rule requires administrative, physical, and technical safeguards; the Privacy Rule governs uses and disclosures; the Breach Notification Rule requires notification within 60 days of discovery.

The minimum necessary standard, the accounting of disclosures, and the right to request restrictions and amendments are patient rights under HIPAA.

Coding audits should use a statistically valid sample and a defined error rate; documentation must support the code, and a query must be resolved before the claim is submitted.

The Civil Monetary Penalties Law and the Physician Payments Sunshine Act (Open Payments) are separate from the FCA; Sunshine requires reporting of transfers of value to physicians and teaching hospitals.

Descriptive analytics summarizes what happened (rates, counts); diagnostic explains why; predictive forecasts; prescriptive recommends action; the analytics maturity model moves through these stages.

Sensitivity = TP / (TP + FN); specificity = TN / (TN + FP); PPV = TP / (TP + FP); NPV = TN / (TN + FN); prevalence affects PPV and NPV but not sensitivity or specificity.

Incidence measures new cases over a period; prevalence measures all existing cases at a point or period; crude rates are unadjusted, and age/sex adjustment allows fair comparison across populations.

A control chart distinguishes common-cause variation from special-cause variation; a run of seven or more points on one side of the mean signals special cause.

Standardized mortality ratio (SMR) = observed deaths ÷ expected deaths; a value above 1 indicates more deaths than expected.

Risk adjustment (e.g., HCC models) uses diagnoses to predict cost and outcomes; documentation and coding completeness directly affect the risk score.

Data visualization should match the chart to the data: line charts for trends over time, bar charts for categorical comparison, scatter plots for correlation, and avoid pie charts for many categories.

A population health registry uses inclusion criteria, a denominator, and a numerator; measure specification must state the measurement period and exclusions.

Change management models: Lewin (unfreeze, change, refreeze), Kotter's eight steps, and the ADKAR model (awareness, desire, knowledge, ability, reinforcement).

SMART goals are specific, measurable, achievable, relevant, and time-bound; a project charter defines scope, sponsor, and success criteria.

A RACI matrix assigns responsibility: responsible (does the work), accountable (owns the outcome), consulted, and informed.

Budget variance = actual − budgeted; a favorable variance lowers cost or raises revenue relative to plan, and the sign convention must be stated explicitly.

FTE calculation: annual productive hours per FTE ÷ total hours needed = FTEs required; productive hours exclude paid time off and holidays.

Staffing benchmarks (e.g., coding productivity of charts per hour) must be adjusted for case mix, EHR, and coder experience before comparison.

A SWOT analysis identifies internal strengths and weaknesses and external opportunities and threats; it informs strategy but does not itself set priorities.

Key performance indicators should be few, tied to strategy, and reviewed on a defined cadence; dashboards should show trend and target, not a single point.

HIPAA Privacy Rule permits disclosure for treatment, payment, and health care operations without authorization; other uses require a valid authorization unless an exception applies.

The HIPAA Security Rule applies to electronic protected health information and requires risk analysis, access controls, audit controls, and encryption or equivalent safeguards.

The HITECH Act extended HIPAA to business associates and strengthened breach notification and enforcement penalties.

Informed consent requires capacity, disclosure of risks and alternatives, voluntariness, and the patient's decision; it is a process, not a signature.

The AHIMA Code of Ethics obliges HIM professionals to protect privacy and confidentiality, ensure data integrity, and avoid conflicts of interest.

EMTALA requires a medical screening examination and stabilization for anyone presenting to an emergency department, regardless of insurance or ability to pay.

The 42 CFR Part 2 rules for substance use disorder records are stricter than HIPAA; redisclosure requires specific patient consent.

Ethical decision-making frameworks (e.g., the four principles: autonomy, beneficence, nonmaleficence, justice) guide resolution of conflicts between patient rights and organizational duties.