Standards, Policies, and Procedures
From Standards to Procedures
A compliance program is built in layers. Standards of conduct are the organization's broad ethical commitments (e.g., "we bill only for services actually provided"). Policies translate those commitments into rules for a topic area (e.g., a billing-integrity policy). Procedures are the step-by-step instructions that tell a specific role how to comply (e.g., the checklist a coder runs before submitting a claim). Questions test whether you can place a given item at the right layer.
What Good Documents Contain
Effective standards and policies are written in plain language, are role-relevant, are dated and version-controlled, and describe consequences for violations. Procedures should be executable by a new employee without guesswork. A common trap: confusing the document with the process. A policy that exists but is not followed, communicated, or updated is a compliance gap, not a control.
Maintenance and Approval
Policies need an owner, a review cycle (often annual or triggered by regulatory change), and documented approval by the appropriate governing body. Watch for questions that imply a policy can be created by anyone, or that a policy is "done" once written. The lifecycle is draft, approve, communicate, train, monitor, and revise.
Worked Example
A question describes a clinic whose coders each handle modifiers differently. The best answer is not "retrain the coders" alone but "publish a standard procedure for modifier use and train to it" - the inconsistency signals a missing procedure, not individual failure. Rule of thumb: if people are guessing, the procedure is missing or unclear.
Common Traps
- Assuming a stricter policy is always better; it must be achievable and consistent with law.
- Treating the code of conduct as sufficient on its own.
- Forgetting that policies must be accessible to the workforce they govern.