CHC (CCB) cheat sheet

A standard is a mandatory requirement; a policy states the organization's position; a procedure describes the step-by-step method for meeting the policy.

Policies are approved by governance (board or compliance committee) and reviewed at least annually or when regulations change.

Written policies and procedures are a core element of the seven elements of an effective compliance program (OIG/DOJ guidance).

Version control elements: document owner, effective date, revision number, approval signature, and scheduled review date.

Policies must be distributed to all affected workforce members and acknowledged in writing, with acknowledgments retained.

A policy that is not enforced or monitored is a documentation gap; auditors test for evidence of implementation, not just existence.

Standards of conduct apply organization-wide and address coding/billing integrity, privacy, conflicts of interest, and non-retaliation.

Gap analysis compares current policies against applicable statutes, regulations, and payer contract requirements to identify missing controls.

Seven elements: written standards, compliance leadership (officer/committee), effective training, communication lines, monitoring/auditing, enforcement/discipline, and prompt corrective action.

The compliance officer should report to the governing body or CEO and have direct, independent access to the board.

The compliance committee typically includes clinical, legal, finance, coding, privacy, and operations representatives and meets on a defined schedule.

Board oversight includes receiving periodic compliance reports, approving the compliance plan, and ensuring adequate resources.

Independence is preserved when the compliance function is not subordinate to revenue-cycle or financial operations it monitors.

Charter documents define the committee's authority, membership, quorum, and reporting lines.

Resource allocation should be risk-based: staffing, budget, and audit hours directed to highest-risk areas.

Succession and cross-training plans reduce single-point-of-failure risk in compliance operations.

Training must be role-specific: coders on coding/billing rules, clinicians on documentation and Stark/AKS, leadership on oversight duties.

Required elements include general compliance, standards of conduct, privacy/HIPAA, fraud and abuse, and reporting/anti-retaliation.

New hires complete training within a defined onboarding window; all workforce members complete periodic refresher training.

Completion must be tracked with dated records (LMS reports, signed attestations) retained per retention policy.

Training content is updated when regulations, policies, or identified risk areas change.

Effectiveness is measured by knowledge assessments, post-training audits, and error-rate trends, not completion counts alone.

Governing body members and executives receive documented compliance education appropriate to their oversight role.

Training for contractors and vendors is delivered per contract terms and documented.

A reporting mechanism (hotline, web portal, direct line to compliance) must allow anonymous and confidential reporting where permitted by law.

Anti-retaliation policy prohibits adverse action against good-faith reporters; retaliation is itself a reportable compliance violation.

Reports are triaged by risk severity, logged with unique identifiers, and tracked to resolution with documented disposition.

Communication channels include hotline, email, intranet, newsletters, staff meetings, and direct access to the compliance officer.

Non-retaliation rights and reporting channels must be communicated during training and posted accessibly.

Confidentiality is maintained on a need-to-know basis; legal privilege may apply to investigation communications via counsel.

Metrics tracked include report volume by category, time to closure, substantiation rate, and repeat-issue rate.

Escalation pathways define when a report goes to the board, legal, law enforcement, or a payer as required.

Monitoring is ongoing (real-time edits, denials review, pre-bill checks); auditing is periodic, retrospective, and independent.

Audit sampling: random, targeted, or stratified; sample size should support a defensible error-rate estimate.

Error rate = (number of records with at least one error ÷ number of records reviewed) × 100.

Benchmarks and thresholds (e.g., a targeted error rate) trigger focused re-education and expanded review.

Work plans specify scope, objectives, sample methodology, timelines, and reporting to the compliance committee.

Audit findings require root-cause analysis, corrective action plans with owners and due dates, and follow-up validation.

Coding audits compare documentation to assigned codes against official coding guidelines and payer policies.

Work papers and audit results are retained per record-retention policy and support external audit or government inquiry.

Discipline is applied consistently and proportionately, from counseling to termination, based on severity and intent.

Investigations are documented: intake, scope, evidence collected, interviews, findings, and disposition.

Legal privilege is best preserved by directing investigation communications through counsel.

Overpayment identification triggers a duty to report and return within 60 days of identification under the 60-day rule (42 U.S.C. § 1320a-7k(d)).

Corrective action includes refunds, claims adjustments, policy revision, re-education, and self-disclosure where appropriate.

Self-disclosure options include the OIG Self-Disclosure Protocol and CMS Self-Referral Disclosure Protocol (SRDP).

Exclusion screening against OIG LEIE and SAM must occur at hire and monthly thereafter; excluded individuals cannot be billed for federal program items/services.

Documented discipline records support consistency and demonstrate enforcement element in audits.

Risk assessment identifies, scores, and prioritizes compliance risks by likelihood and impact.

Common method: risk score = likelihood × impact, ranked into high/medium/low tiers driving audit and training priorities.

Risk sources include OIG Work Plan, CIA/DPA requirements, payer audits, internal audit findings, hotline trends, and regulatory changes.

Risk register records risk description, owner, rating, mitigation plan, and review date.

Enterprise risk management integrates compliance risk with financial, operational, clinical, and reputational risks.

High-risk areas in coding/billing typically include E/M level selection, modifier use, medical necessity, and provider-based billing.

Risk tolerance thresholds determine when a risk escalates to the compliance committee or board.

Annual reassessment is performed; reassessment also occurs after significant events (mergers, new service lines, enforcement actions).

False Claims Act prohibits knowingly presenting false claims; includes qui tam provisions and treble damages plus per-claim penalties.

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) prohibits remuneration for referrals of federally reimbursable items/services; safe harbors provide protection.

Stark Law (42 U.S.C. § 1395nn) prohibits physician self-referral for designated health services unless an exception applies; strict liability standard.

Civil Monetary Penalties Law and Exclusion Statute (42 U.S.C. § 1320a-7) authorize penalties and program exclusion.

HIPAA Privacy and Security Rules govern PHI use/disclosure and require administrative, physical, and technical safeguards.

Coding/billing follows official guidelines (ICD-10-CM/PCS, CPT, HCPCS), NCCI edits, and payer medical-necessity policies.

The 60-day overpayment rule requires reporting and returning identified overpayments.

Compliance program guidance from OIG is voluntary but informs enforcement expectations and sentencing under the Federal Sentencing Guidelines.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Compliance program administration coordinates the seven elements across departments and business units.

Committee minutes document quorum, decisions, and action items and are retained as governance records.

Reporting cadence to the board is typically quarterly, with immediate escalation for material issues.

Charters define authority, membership, meeting frequency, and reporting obligations.

Compliance budget and staffing are risk-based and reviewed annually.

Delegation of compliance duties must be documented and monitored.

Independence from revenue operations preserves objectivity of monitoring and auditing.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Pre-bill edits and post-bill audits are complementary controls for coding accuracy.

NCCI edits identify code pairs that are not separately reportable absent an appropriate modifier.

Medical necessity must be supported by documentation in the medical record.

Modifier use (e.g., 25, 59, X{EPSU}) requires documented justification.

Charge capture reconciliation compares services performed to services billed.

Provider education is targeted to audit-identified error patterns.

Billing compliance metrics include denial rates, error rates, and refund volumes.

[needs_review] This domain entry is reserved; do not treat as authoritative.

HIPAA requires administrative, physical, and technical safeguards for PHI.

Minimum necessary standard limits PHI use/disclosure to what is needed.

Breach notification obligations include individuals, HHS, and media under defined thresholds.

Business associate agreements are required before sharing PHI with vendors.

Security risk analysis is a required element and must be documented.

Access controls and audit logs support detection of unauthorized PHI access.

Privacy incidents are tracked and investigated with documented disposition.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Screen against OIG LEIE and SAM at hire and monthly.

Document screening results and retain records.

Excluded individuals cannot provide federally reimbursable items/services.

Immediate removal from federally billable functions upon identification.

Vendor contracts require exclusion screening attestations.

Screening failures can result in CMP liability.

Screening logs are audit evidence.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Retention periods follow federal/state law and payer contract terms.

Compliance records include policies, training logs, audits, investigations, and hotline logs.

Litigation holds suspend routine destruction.

Records must be retrievable and legible.

Destruction is documented and secure.

Retention schedules are reviewed periodically.

Audit work papers are retained to support findings.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Corporate Integrity Agreements impose monitoring and reporting obligations.

Self-disclosure can mitigate penalties.

Cooperation credit is available under sentencing guidelines.

Resolution may include refunds, penalties, and exclusion.

Legal counsel directs responses to government inquiries.

Document preservation is required upon notice.

Corrective actions are documented and validated.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Contract terms define billing, audit, and recoupment rights.

Revenue integrity reconciles charges, coding, and payments.

Denial management identifies root causes.

Payer audits are coordinated with compliance.

Refund obligations follow contract and law.

Contract terms are reviewed for compliance risk.

Metrics track underpayments and overpayments.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Leadership tone sets compliance expectations.

Non-retaliation protects good-faith reporting.

Ethics training reinforces standards of conduct.

Speak-up channels are accessible and trusted.

Culture surveys measure perceptions of compliance.

Recognition reinforces ethical behavior.

Repeat issues signal culture gaps.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Due diligence precedes vendor engagement.

Contracts include compliance and audit clauses.

Vendors are screened for exclusion.

Business associate agreements govern PHI.

Vendor performance is monitored.

Termination rights exist for compliance failures.

Vendor risk is included in the risk register.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Audit responses are coordinated and timely.

Findings are validated before closure.

Corrective actions have owners and due dates.

Root-cause analysis drives remediation.

Follow-up audits confirm effectiveness.

Remediation is reported to governance.

Lessons learned update training and policies.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Metrics align to risk priorities.

Dashboards report trends to governance.

Hotline metrics include volume and closure time.

Audit metrics include error rates and remediation status.

Training metrics include completion and assessment scores.

Metrics are reviewed for reliability.

Trends inform resource allocation.

[needs_review] This domain entry is reserved; do not treat as authoritative.

Regulatory changes are tracked and assessed for impact.

Impacted policies are updated and communicated.

Training is refreshed for material changes.

Implementation is monitored for effectiveness.

Change log documents updates.

Owners are assigned for each change.

Changes are reported to governance.