Investigations, Enforcement, and Corrective Action
Investigations, Enforcement, and Corrective Action
This domain tests how to receive, triage, investigate, resolve, and remediate compliance concerns, and how to respond to government enforcement. Expect questions on privilege, documentation, overpayment, self-disclosure, discipline, and corrective action plans.
Core rules
- Intake should include multiple reporting channels, anonymity where possible, non-retaliation, and prompt triage. Not every report is an investigation, but every report needs a documented disposition.
- Investigations should have a scope, lead investigator, timeline, evidence preservation, interview plan, and confidentiality controls. Legal counsel should direct the investigation when privilege is desired; the attorney-client privilege and work-product protection are not automatic for compliance files.
- Preserve documents and issue a legal hold when litigation or government inquiry is reasonably anticipated. Never alter or destroy records.
- Determine whether misconduct occurred, quantify overpayments, identify root causes, and decide on disclosure. Medicare overpayments generally must be returned within 60 days of identification. Self-disclosure options include the OIG Self-Disclosure Protocol and CMS Self-Referral Disclosure Protocol for Stark matters.
- Enforcement responses may include subpoenas, civil investigative demands, OCR inquiries, and exclusion actions. Cooperate through counsel, avoid inconsistent statements, and coordinate parallel privacy breach obligations.
- Corrective action plans need root-cause analysis, measurable actions, owners, deadlines, monitoring, and validation. Discipline should be consistent and documented.
Worked example
A hotline alleges a coder upcoded E/M claims. Reasoning: preserve emails and audit trails, engage counsel, sample claims, compare documentation to codes, interview the coder and supervisor, quantify overpayment, report to the compliance committee, refund within 60 days if confirmed, and evaluate self-disclosure. Corrective actions include education, pre-bill review, and a 90-day re-audit.
Traps that cost marks
- Promising absolute confidentiality to a reporter.
- Assuming compliance investigation notes are privileged without counsel direction.
- Destroying or altering records after a complaint.
- Retaliating against a reporter or witness.
- Closing a CAP without validation or follow-up.