CHCSP flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

Seven elements of compliance

Written policies and procedures; compliance officer and committee; training and education; lines of communication; enforcement and discipline; monitoring and auditing; prompt response and corrective action. These elements form the standard framework for an effective program.

Governing body oversight duty

The board must know the compliance program's content and operation, exercise reasonable oversight, and ensure the compliance officer has authority and resources, including direct access to the board.

Three lines model

First line: operational management owns and manages risk. Second line: compliance and risk functions monitor and advise. Third line: internal audit gives independent assurance to the board.

Compliance committee purpose

A cross-functional committee that oversees the compliance program, reviews risk assessment results and audit findings, approves the work plan, and escalates material issues to the governing body.

Compliance work plan

A time-bound schedule of audits, monitoring, training, and policy work derived from the compliance risk assessment, with assigned owners, deadlines, and reporting to the compliance committee.

Risk scoring formula

Risk equals likelihood multiplied by impact, often extended to include detectability or velocity. Document scale definitions so different reviewers assign comparable scores to the same facts.

Residual risk

The risk remaining after existing controls are evaluated. Prioritization and work plan allocation should be based on residual risk, not inherent risk, so that well-controlled areas do not crowd out exposure.

Risk assessment inputs

Sources include the OIG Work Plan, payer audit findings, prior internal audits, hotline trends, regulatory changes, industry settlements, and Corporate Integrity Agreement obligations.

Regulatory change log

A register of new or amended requirements with an assigned owner, impact analysis, implementation due date, and verification evidence confirming the change was actually adopted.

Medical necessity standard

A service must be reasonable and necessary for diagnosis or treatment to be payable. Correct coding does not make a non-covered service payable, and documentation must support the need.

Incident-to billing criteria

The physician must establish the plan of care, be physically present in the office suite, and the service must be an integral part of the physician's service, with state law and payer rules permitting it.

Teaching physician documentation

The teaching physician must document personal presence and participation in management, or reference the resident's note in a combined entry that shows the physician's involvement.

NCCI modifier indicator

Indicator 0 means the code pair cannot be unbundled with any modifier. Indicator 1 means a permitted modifier may override the edit when documentation supports a distinct service.

Advance Beneficiary Notice

A notice given to a Medicare beneficiary before a service the provider expects Medicare to deny as not medically necessary, allowing the provider to bill the beneficiary if denial occurs.

Modifier 25 use

Appended to an evaluation and management service on the same day as a procedure, only when the E/M service is significant and separately identifiable from the procedure.

Minimum necessary standard

Requires reasonable efforts to limit uses, disclosures, and requests of protected health information to the minimum needed. It does not apply to treatment disclosures or disclosures to the individual.

Breach notification timeline

Individuals must be notified without unreasonable delay and within 60 days of discovery. HHS is notified, and media notice is required when 500 or more residents of a state are affected.

Breach risk assessment factors

Four factors: nature and extent of PHI involved, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent to which risk has been mitigated.

Encryption safe harbor

PHI that is rendered unusable, unreadable, or indecipherable through encryption meeting HHS guidance is not considered breached, so notification obligations may not be triggered.

Security risk analysis

A required, documented assessment of risks and vulnerabilities to electronic PHI that drives remediation decisions. Its absence is the most frequently cited HIPAA Security Rule failure in enforcement.

Addressable implementation specification

A Security Rule requirement that must be implemented if reasonable and appropriate, or replaced with an equivalent alternative supported by a documented risk-based decision.

False Claims Act knowledge

Liability requires actual knowledge, deliberate ignorance, or reckless disregard of the truth or falsity of information. Specific intent to defraud is not required.

FCA damages and penalties

Damages are trebled, and a per-claim civil penalty adjusted annually for inflation applies. Qui tam relators may receive 15 to 30 percent of the recovery.

Anti-Kickback Statute

Prohibits knowingly and willfully offering or receiving remuneration to induce referrals of items or services payable by federal health care programs. Only one purpose of the payment need be improper.

Stark Law strict liability

A physician may not refer designated health services to an entity with which the physician has a financial relationship unless an exception applies. No intent to violate is required.

LEIE screening

The OIG List of Excluded Individuals and Entities identifies persons barred from federal health care program participation. Screening at hire and monthly prevents billing for excluded persons.

Audit error rate

The number of claims containing at least one error divided by the number of claims audited. The dollar error rate divides net overpayment dollars by total audited dollars.

Statistical extrapolation

Projecting a sample error rate to the full population requires a probability-based sample such as random or stratified random. Targeted samples cannot support statistical extrapolation.

Audit versus monitoring

Auditing is periodic and retrospective record review against rules. Monitoring is ongoing and preventive, using edits, charge review, and denial trending to catch issues before payment.

60-day overpayment rule

A Medicare overpayment must be reported and returned within 60 days of identification, with a written explanation, and the associated claim must be retained for 10 years.

Role-based training

Training content is tailored to the risk areas of each role, such as coding rules for coders, privacy for all staff, and anti-kickback limits for sales and physician liaisons.

Training documentation

Retain the date, content version, attendee identity, completion attestation, and assessment score. Training that cannot be evidenced is generally treated as not delivered.

Investigation intake log

A record of each report capturing date received, reporter and confidentiality request, allegation, assigned investigator, and status, supporting non-retaliation and consistent handling.

Corrective action plan

Documents root cause, the specific corrective step, the responsible owner, the due date, the verification method, and the monitoring period required before the finding is closed.

OIG Self-Disclosure Protocol

A voluntary process for disclosing conduct potentially violating federal fraud and abuse laws, with specific submission content and resolution requirements, typically used for kickback and similar matters.