CHCSP key terms

The framework from the Federal Sentencing Guidelines that regulators use to judge a compliance program: written standards and policies, program oversight, effective training, open communication, monitoring and auditing, consistent enforcement and discipline, and prompt corrective action.

The person charged with day-to-day operation of the compliance program, including policy development, training, monitoring, and investigation, and who reports to senior leadership and the governing body rather than to operational revenue owners.

A cross-functional group of leaders from clinical, billing, legal, human resources, and operations that advises the compliance officer, reviews risk, and helps carry compliance decisions into their own departments.

A governing document approved by the board that states the compliance program's authority, scope, reporting lines, resources, and independence, and that establishes the compliance officer's access to the governing body.

A program that is reasonably designed, implemented, and enforced so that it generally prevents and detects violations of law and that is actually followed in practice, as distinguished from a program that exists only on paper.

The visible, consistent commitment of governing body members and senior executives to legal and ethical conduct, which shapes whether staff at every level take the compliance program seriously.

A structured process that identifies, ranks, and documents the legal and regulatory risks facing the organization by likelihood and impact, so that compliance resources and monitoring are directed where exposure is greatest.

A living inventory that records each identified compliance risk, its owner, its likelihood and impact rating, the controls in place, and the planned mitigation, and that is refreshed at least annually or when circumstances change.

A comparison of current practices against a required standard, such as a regulation, contract term, or accreditation condition, that documents where the organization falls short and what must change.

The compliance department's schedule of planned audits, monitoring, education, and policy reviews for a defined period, typically prioritized using the compliance risk assessment and approved by the compliance committee.

A process for tracking new and amended laws, payer rules, and guidance, assessing their operational impact, assigning implementation responsibility, and confirming that required changes were actually made.

A federal statute imposing civil liability on persons who knowingly present, or cause to be presented, false or fraudulent claims to the government, and which authorizes treble damages plus per-claim penalties.

A lawsuit filed by a private relator on behalf of the government under the False Claims Act; the relator may receive a share of the recovery, and the government may intervene or decline to take over the case.

The False Claims Act standard covering actual knowledge, deliberate ignorance, or reckless disregard of the truth or falsity of a claim; specific intent to defraud is not required, and a reasonable but mistaken interpretation may still be actionable.

Liability under the False Claims Act for knowingly using a false record or statement to avoid or decrease an obligation to pay money to the government, such as concealing an identified overpayment.

A federal criminal law that prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce referrals of items or services payable by a federal health care program.

A civil statute that bars physicians from referring Medicare patients for designated health services to entities with which the physician, or an immediate family member, has a financial relationship, unless a specific exception applies.

A regulatory provision that describes an arrangement which, if all of its conditions are met, is protected from prosecution under the Anti-Kickback Statute.

The price that would result from bona fide bargaining between well-informed parties who are not otherwise in a position to generate business for each other, commonly required by physician compensation exceptions and safe harbors.

A CMS process through which a provider may self-disclose an actual or potential Stark Law violation and request a reduced repayment amount based on the circumstances of the violation.

A sanction by the HHS Office of Inspector General that bars a person or entity from participation in federal health care programs; billing for excluded individuals' services can create significant liability for the employer.

The List of Excluded Individuals and Entities maintained by the HHS Office of Inspector General, which compliance programs screen against at hire and monthly to avoid employing or contracting with excluded persons.

A federal statute authorizing civil money penalties and program exclusions for specified conduct, including certain false claims, improper remuneration to beneficiaries, and violations of the Anti-Kickback Statute.

A negotiated agreement between an entity and the HHS Office of Inspector General, often resolving a fraud settlement, that imposes defined compliance obligations such as an independent review organization, board reporting, and monitoring for a set term.

An outside entity approved by the HHS Office of Inspector General that reviews a provider's claims, coding, and arrangements and reports findings, commonly required under a corporate integrity agreement.

A voluntary report of identified noncompliance to a government agency, such as through the OIG Self-Disclosure Protocol or the CMS voluntary disclosure process, often mitigating penalties and supporting a finding of good faith.

Any funds received or retained by a provider to which it is not entitled; federal law requires identification and return of Medicare overpayments within 60 days of identification, with a lookback period for related claims.

The determination that a service is reasonable and necessary for the diagnosis or treatment of illness or injury and meets payer coverage criteria, documented in the record to support the billed service.

Billing a service or diagnosis code that is more intensive, complex, or costly than the service actually documented and performed, which can constitute a false claim when done knowingly.

Billing separately for components of a service that are properly reported under a single comprehensive code, or fragmenting a procedure to increase payment, which can violate payer rules and false claims law.

The practice of ensuring medical records accurately, completely, and contemporaneously reflect the care provided and the clinical rationale, so that billed codes are supported and defensible on review.

A retrospective review in which a qualified auditor compares billed codes against the medical record to measure accuracy, identify error patterns, and quantify financial exposure.

The defined boundaries of a review, including the population, time period, providers, claim types, and regulatory requirements covered, documented before fieldwork begins so results are defensible and reproducible.

Selecting a subset of claims or records for review to draw conclusions about a larger population, using statistically valid or judgmental methods depending on whether the results must be projected.

A review of submitted claims against documentation, coding rules, and payer requirements to detect improper payments, patterns of error, and potential fraud, waste, or abuse.

A documented set of steps, owners, and deadlines to fix a root cause identified in an audit or investigation, including follow-up testing to confirm the fix worked.

A structured method for determining the underlying process or system failure that produced a compliance problem, rather than merely identifying the individual who made the error.

The federal regulation governing the use and disclosure of protected health information by covered entities and their business associates, including patient rights and the minimum necessary standard.

Individually identifiable health information transmitted or maintained in any form or medium by a covered entity or business associate, excluding certain employment records and education records.

The requirement that a covered entity limit uses, disclosures, and requests for protected health information to the amount reasonably necessary to accomplish the intended purpose.

The federal regulation requiring covered entities and business associates to implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information.

An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information, which is the foundation of the Security Rule's management process.

The HIPAA requirement to notify affected individuals, HHS, and in some cases the media, without unreasonable delay and no later than 60 days after discovery of a breach of unsecured protected health information.

A written contract that permits a business associate to use or disclose protected health information for specified purposes and that imposes safeguards, breach reporting, and subcontractor obligations.

Ongoing, role-specific instruction that gives staff the knowledge and judgment to follow policies and detect problems, documented by attendance, completion, and comprehension records and refreshed at least annually.

Education directed at specific roles, departments, or risk areas, such as coding staff on modifier use or sales staff on anti-kickback limits, based on the compliance risk assessment and audit findings.

A confidential, accessible reporting channel, often anonymous, through which workforce members and others can raise suspected misconduct without fear of retaliation.

A written commitment, backed by training and enforcement, that no one who reports a concern in good faith will be disciplined, demoted, or otherwise punished for doing so.

A documented, objective inquiry into an allegation of noncompliance that preserves evidence, interviews relevant parties, reaches a supported conclusion, and triggers corrective action where warranted.

Checking employees, contractors, and vendors against exclusion and debarment lists, including the OIG LEIE and the SAM database, before hire and on a recurring schedule.

A periodic written statement by board members, physicians, and managers identifying financial interests and outside relationships that could bias decisions or create referral-law exposure.