CHCSP cheat sheet

Seven elements of an effective compliance program: written policies and procedures; designation of a compliance officer and compliance committee; effective training and education; effective lines of communication; enforcement through publicized disciplinary guidelines; internal monitoring and auditing; prompt response and corrective action.

Governing authority duties: the board must be knowledgeable about the compliance program's content and operation, exercise reasonable oversight, and ensure the compliance officer has adequate authority, resources, and direct access to the board.

Compliance officer reporting line: the compliance officer should report to the CEO and the governing body, not solely to the general counsel or a revenue-generating operational executive, to preserve independence.

Compliance committee composition: cross-functional membership including clinical leadership, billing/revenue cycle, legal, human resources, information technology, and internal audit; the committee meets on a documented schedule and keeps minutes.

Three lines model: first line is operational management owning and managing risk; second line is compliance and risk functions monitoring and advising; third line is internal audit providing independent assurance.

Program risk assessment drives allocation: the annual compliance work plan, audit universe, and training curriculum are built from the compliance risk assessment, not from prior-year habit.

Written standards of conduct apply to all workforce members, contractors, and vendors; they define the organization's commitment to integrity and the consequences of violations.

Documentation standard: if a program element is not documented (charter, minutes, work plan, logs, training records), it is treated as not performed during an enforcement review.

Risk scoring formula: risk = likelihood x impact (often expanded to likelihood x impact x detectability or velocity); document the scale definitions so scores are reproducible across reviewers.

Risk assessment inputs: OIG Work Plan items, Corporate Integrity Agreement obligations, payer audit findings, prior internal audit results, whistleblower and hotline trends, regulatory change logs, and industry enforcement settlements.

Regulatory change management: each new or amended rule (for example annual CMS payment rules or OIG safe harbor updates) is logged with an owner, an impact analysis, and a due date, then verified as implemented.

Risk heat map placement: residual risk (after existing controls) determines priority; inherent risk minus control effectiveness yields residual risk, and only residual risk drives the work plan.

Applicability analysis: determine which regulations bind the entity by provider type, payer mix, and state licensure, since Medicare, Medicaid, commercial, and state law requirements differ and can stack.

Risk appetite and tolerance statements are approved by the governing body and set thresholds for when a risk escalates to the compliance committee or board.

Third-party risk: vendors with access to protected health information or who perform billing on the entity's behalf require pre-contract due diligence, contract compliance terms, and periodic reassessment.

Risk assessment refresh triggers: mergers and acquisitions, new service lines, new markets, major system implementations, and significant enforcement actions require an out-of-cycle reassessment.

Medical necessity is the overarching payment requirement: a service must be reasonable and necessary for diagnosis or treatment; accurate coding alone does not establish payable claims.

E/M documentation must support the level billed under the selected framework (medical decision making or total time); time-based billing requires documenting total time on the date of the encounter.

Incident-to billing requires that the physician established the plan of care, the physician is physically present in the office suite, the service is an integral part of the physician's service, and state law and payer rules permit it.

Teaching physician documentation: the teaching physician must document that he or she personally saw the patient and participated in the management, or reference the resident's note in a combined entry.

Modifier rules: modifier 25 is appended to an E/M service only when a significant, separately identifiable service is performed on the same day as a procedure; modifier 59 or the X{EPSU} modifiers indicate distinct services.

National Correct Coding Initiative edits: code pairs are bundled unless a modifier is permitted; modifier indicator 0 means no modifier can override the edit, and indicator 1 means an appropriate modifier may.

Advance Beneficiary Notice of Noncoverage (ABN) must be issued and documented when the provider believes Medicare will deny a service as not medically necessary; otherwise the beneficiary cannot be billed.

Charge capture integrity: charge description master and fee schedule changes require documented approval, version control, and reconciliation of charges to services rendered.

HIPAA Privacy Rule governs uses and disclosures of protected health information; the Security Rule governs electronic PHI and requires administrative, physical, and technical safeguards.

Minimum necessary standard applies to routine uses, disclosures, and requests of PHI; it does not apply to treatment disclosures or to disclosures to the individual or authorized by the individual.

Breach notification: notify affected individuals without unreasonable delay and no later than 60 days after discovery; notify HHS, and if 500 or more individuals in a state or jurisdiction, notify prominent media outlets within 60 days.

Breach risk assessment four factors: nature and extent of PHI involved, the unauthorized person who accessed or received it, whether PHI was actually acquired or viewed, and the extent of risk mitigation.

Encryption of data at rest and in transit, when performed according to HHS guidance, supports the safe harbor that rendering PHI unusable, unreadable, or indecipherable is not a breach.

Security Rule required implementation specifications must be implemented; addressable specifications require a documented risk-based decision to implement, or documented justification for an equivalent alternative.

HIPAA Security Risk Analysis is required and must be current, documented, and used to drive remediation; it is the most common finding in OCR enforcement.

Patient rights: access to records within 30 days (one 30-day extension permitted), amendment requests, accounting of disclosures, and restriction requests; fee-based access must be reasonable and cost-based.

Business associate agreements are required before PHI is shared with a business associate and must include the elements in 45 CFR 164.504(e), including breach reporting obligations.

False Claims Act liability: knowingly presenting, or causing to be presented, a false or fraudulent claim; knowledge includes actual knowledge, deliberate ignorance, and reckless disregard, not intent to defraud.

FCA damages are treble the government's damages plus a per-claim civil penalty that is inflation-adjusted annually; qui tam relators may receive 15 to 30 percent of the recovery.

Anti-Kickback Statute prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce referrals of items or services payable by a federal health care program; it is intent-based and covers one purpose.

Stark Law is a strict liability civil statute: a physician cannot refer designated health services to an entity with which the physician has a financial relationship unless an exception applies, and the entity cannot bill for those services.

Exclusion: an excluded individual cannot furnish items or services payable by federal health care programs; billing for services furnished by an excluded person creates liability, and OIG maintains the List of Excluded Individuals/Entities.

Civil Monetary Penalties Law and the Beneficiary Inducements CMP prohibit remuneration to beneficiaries likely to influence their selection of a provider, subject to exceptions such as permissible incentives.

Waste is unnecessary or excessive resource use and abuse is practice inconsistent with sound medical or business practice; both may be non-fraudulent but still require corrective action.

Compliance program guidance from OIG is voluntary but is used as a benchmark in enforcement; the presence of an effective program can reduce penalties under the Federal Sentencing Guidelines.

Audit sampling: define the population, sampling unit (claim, encounter, or line item), sampling method (random, stratified, or targeted), and confidence level before pulling records; document the rationale.

Sample size rule of thumb: for a 95 percent confidence level and 5 percent margin of error, a random sample near 60-80 units is often used for small populations, but a statistically valid plan should be calculated for the specific population.

Error rate calculation: error rate = number of claims with at least one error / number of claims audited; dollar error rate = net overpayment dollars / total audited dollars.

Extrapolation: statistical extrapolation of an error rate to the population requires a probability-based sample; non-random targeted samples cannot support extrapolation.

Audit tools: use a standard audit tool aligned to the coding guidelines and payer policy in effect on the date of service, and retain the tool version with the audit work papers.

Monitoring is ongoing and preventive (real-time edits, charge review, denial trending); auditing is periodic and retrospective; both are required and should be linked to the compliance work plan.

Findings management: each finding gets a root cause, a corrective action owner, a due date, and a re-audit to confirm remediation; repeat findings escalate to the compliance committee.

Overpayment identification triggers a duty to investigate and, for Medicare, report and return identified overpayments within 60 days of identification under the 60-day rule.

Training must be role-based: general workforce training on standards of conduct and privacy, plus targeted training for coders, billers, physicians, researchers, and sales staff on their specific risk areas.

Training frequency baseline: onboarding training before or shortly after hire, annual refresher training for all workforce members, and ad hoc training triggered by regulatory change or audit findings.

Documentation of training: retain the date, content or version, attendee identity, completion attestation, and test score; undocumented training is generally treated as not delivered.

Adult learning design: use case-based scenarios drawn from actual audit findings and enforcement actions, keep sessions short and spaced, and assess comprehension rather than attendance.

Competency assessment: coders should be tested on current code sets and guidelines annually, with remediation and re-testing for those below the threshold.

Training effectiveness measurement: track hotline volume, audit error rates, and help-desk questions before and after training to demonstrate behavior change rather than completion counts.

Excluded-person screening education: staff who onboard or contract with workforce members and vendors must be trained on screening against the OIG LEIE and state Medicaid exclusion lists at hire and monthly.

Board and executive education: governing body members receive periodic education on the compliance program, their oversight duties, and material risk areas.

Investigation intake: log every report (hotline, walk-in, audit-detected) with date, reporter (confidential if requested), allegation, and assigned investigator; preserve anonymity where promised and prohibit retaliation.

Investigation plan: define scope, preserve evidence (including emails and system logs), identify interviewees, and set a timeline; use privileged engagement through counsel where appropriate.

Privilege caution: attorney-client privilege applies to legal advice, not to underlying facts; internal investigation work product protection is not automatic and must be structured deliberately.

Corrective action plan elements: root cause, specific action, responsible owner, due date, verification method, and monitoring period; closure requires evidence of sustained correction.

Self-disclosure options: the OIG Self-Disclosure Protocol and the CMS Voluntary Self-Referral Disclosure Protocol for Stark violations; each has distinct eligibility, content, and timing requirements.

Overpayment repayment: identified Medicare overpayments must be reported and returned within 60 days of identification, with a written explanation, and the claim is retained for 10 years.

Exclusion screening remediation: remove the individual from federal health care program work, review claims furnished during the exclusion period, and self-disclose as appropriate.

Enforcement trends to monitor: OIG Work Plan updates, DOJ False Claims Act recoveries, OCR HIPAA settlements, and CIA requirements imposed on settling organizations.