CHC (AHE) cheat sheet

A compliance standard states the obligation; a policy states the organization's position; a procedure states the steps taken to satisfy both.

Policy hierarchy: code of conduct > board-approved policies > departmental policies > work instructions; lower documents may not conflict with higher ones.

Each policy should specify scope, responsible owner, effective date, review cycle, and the position accountable for exceptions.

Written standards must address the seven elements of an effective compliance program, including high-risk areas such as billing, coding, and marketing.

Version control requires a unique document ID, revision history, approval signature, and retention of superseded versions per record retention policy.

Distribution and attestation records establish that standards were communicated; attestation should be renewed at defined intervals and at onboarding.

Gaps between written policy and observed practice are a primary audit finding and should be remediated through corrective action plans.

Policies should be reviewed at least annually and whenever law, regulation, or a material change in operations occurs.

The compliance officer should report to the board or a board committee and have direct access to the CEO to preserve independence.

A compliance committee is typically cross-functional, including legal, finance, clinical, HR, and operations, and meets on a documented schedule.

Governance documents should define the compliance officer's charter, authority, reporting lines, and budget authority.

The seven elements of an effective compliance program: standards and procedures, oversight, due care in delegation, communication and training, monitoring and auditing, enforcement and discipline, and response and prevention.

Adequate resources are evidenced by staffing ratios, budget, and access to subject-matter expertise; resource shortfalls should be documented and escalated.

Compliance must be represented in strategic decisions such as mergers, new service lines, and new billing arrangements.

Board minutes should reflect receipt of compliance reports and actions taken in response to identified risks.

Training should be role-based: general compliance for all staff, specialized content for billing, coding, sales, and clinical staff.

Completion tracking should capture learner identity, date, content version, and passing score for auditing purposes.

New hires should complete general compliance training within a defined onboarding window; existing staff should receive recurring training.

Training content should be refreshed when regulations change, when an audit identifies a knowledge gap, or after a material enforcement event.

Effectiveness can be measured by pre/post knowledge scores, completion rates, and correlation with audit error rates.

Governing body and senior leadership should receive periodic compliance education distinct from workforce training.

Training records should be retained per the organization's record retention schedule to demonstrate program operation.

Monitoring is ongoing and process-based; auditing is periodic, independent, and sample-based.

Audit sampling should be risk-based; findings should be quantified by error rate and financial exposure.

An internal investigation should document scope, complaint source, evidence gathered, interviews, and conclusions.

Investigations should preserve privilege where appropriate, be conducted by independent parties when conflicts exist, and maintain confidentiality.

Findings should be tracked to closure with a corrective action plan, owner, and due date.

Work plans should define audit objectives, scope, sample size, and criteria before fieldwork begins.

Overpayments identified through audits should be evaluated for reporting and repayment obligations under applicable law.

Discipline should be applied consistently across job levels, including leadership, to demonstrate program commitment.

Corrective actions should address root cause, not just the individual instance, and should include monitoring for recurrence.

Sanctions should be documented in personnel files and tracked centrally to show consistency.

Exclusion screening should be performed at hire and periodically against OIG LEIE and SAM exclusion lists.

A corrective action plan should specify the problem, root cause, action, responsible party, timeline, and verification method.

Repeat or knowing violations should be escalated to a higher level of discipline than isolated or negligent errors.

Voluntary self-disclosure may be considered when violations are identified and not otherwise required to be reported.

Anti-Kickback Statute prohibits knowingly offering or receiving remuneration to induce referrals for items or services payable by federal health care programs.

Stark Law prohibits physician self-referral for designated health services unless a specific exception applies.

False Claims Act imposes liability for knowingly presenting false claims; the qui tam provision allows private relators to sue on the government's behalf.

HIPAA Privacy Rule governs use and disclosure of protected health information; the Security Rule governs electronic PHI safeguards.

Civil Monetary Penalties Law and the Beneficiary Inducement CMP prohibit inducements likely to influence beneficiary selection of provider.

The Physician Payments Sunshine Act requires reporting of transfers of value to physicians and teaching hospitals.

Compliance programs should map legal requirements to internal policies and controls, with assigned ownership for each requirement.

Risk assessment should evaluate likelihood and impact, then prioritize controls and monitoring resources accordingly.

Risk factors include high-dollar billing, new providers, new service lines, high denial rates, and outlier utilization patterns.

Detection mechanisms include hotlines, audits, data analytics, and exit interviews.

A hotline should permit anonymous reporting, be widely publicized, and have documented intake and triage procedures.

Non-retaliation protections must be communicated and enforced to encourage reporting.

Risk assessments should be refreshed at least annually and when significant changes occur in law, operations, or organizational structure.

Trend analysis of reports, audit findings, and claims data supports early identification of emerging risk.

Tone at the top is evidenced by leadership communications, resource allocation, and response to reported issues.

Compliance messaging should be recurring and integrated into operational communications, not limited to annual training.

A culture of compliance is supported by psychological safety, non-retaliation, and visible accountability.

Board oversight should include regular compliance reporting, review of risk assessments, and approval of the compliance plan.

Communication channels should include hotline, email, manager escalation, and direct access to the compliance officer.

Culture surveys and employee feedback can be used as leading indicators of program effectiveness.

Governance structures should define authority, reporting lines, and escalation paths for compliance issues.

Effectiveness is measured through metrics such as audit error rates, training completion, hotline volume and outcomes, and remediation timeliness.

The Plan-Do-Study-Act cycle can be applied to compliance program improvement.

Periodic program reviews should compare current practices against the seven elements and applicable guidance.

Benchmarking against industry peers and regulatory expectations informs gap analysis.

Findings from audits, investigations, and external reviews should feed into the next risk assessment cycle.

Documented evidence of program operation (minutes, training records, audit reports) supports effectiveness claims.

Continuous improvement should be documented through a formal plan with measurable objectives and timelines.