CCA (CNCF) cheat sheet

ICD-10-PCS characters are positionally fixed: 1 section, 2 body system, 3 root operation, 4 body part, 5 approach, 6 device, 7 qualifier; all seven positions must be filled, using Z as the no-device/no-qualifier placeholder.

ICD-10-PCS root operations are defined by objective, not by eponym: Excision cuts out a portion, Resection cuts out all of a body part, Destruction uses energy to eradicate, Extraction pulls out by force.

ICD-10-CM diagnosis codes carry 3-7 characters; the 7th character for injury and external cause codes denotes encounter (A initial, D subsequent, S sequela) and is required on the injury code itself.

Laterality, episode of care, and combination-code logic: ICD-10-CM combination codes report both the etiology and manifestation in one code, so a separate manifestation code is not added unless the tabular instructs otherwise.

CPT Evaluation and Management level selection under 2021+ office/outpatient rules for established patients turns on medical decision making or total time on the date of encounter, not on history and exam bullet counts.

Surgical package concept: the global surgical package includes the operation, local infiltration, metacarpal/digital/metatarsal anesthesia, and typical postoperative care; unrelated E/M during global days requires modifier 24.

Modifier rules: -25 for a significant, separately identifiable E/M on the same day as a procedure; -59 or the X{EPSU} subset for distinct procedural service; -26/-TC split professional and technical components.

Medical necessity drives code selection: query the provider when documentation is ambiguous, and never assign a code based on clinical inference alone; the physician query must be non-leading and support the final code.

Data definition: data elements are the smallest named units of information; a data set is a defined collection of elements; a data dictionary documents each element's name, definition, format, and allowed values.

Data quality dimensions commonly assessed are accuracy, completeness, consistency, timeliness, validity, and precision; completeness is measured as the proportion of fields populated against the expected total.

HL7 v2 messages are pipe-delimited segments (MSH, PID, PV1, OBX); FHIR uses RESTful resources (Patient, Encounter, Observation) in JSON or XML; CDA is an XML document standard for clinical summaries.

Terminology standards: ICD-10-CM/PCS for morbidity coding, SNOMED CT for clinical concepts, LOINC for laboratory and observation identifiers, RxNorm for medications, and CPT/HCPCS for procedures and supplies.

Interoperability levels: foundational (transport), structural (format/syntax), and semantic (shared meaning via coded vocabularies); semantic interoperability requires common terminology and value sets.

Abstraction is the process of reviewing a record and extracting specified data elements into a registry or database; the abstracted data must be traceable to the source documentation.

Health information exchange models include directed exchange, query-based exchange, and consumer-mediated exchange; each raises distinct consent and access-control requirements.

Information governance is the accountability framework for information: it sets decision rights, policies, and standards for data quality, access, retention, privacy, and security across the enterprise.

Record retention is driven by federal and state law plus statutes of limitation; when federal and state requirements conflict, apply the longer retention period unless the law specifies otherwise.

The designated record set under HIPAA includes medical and billing records, enrollment and payment records, and any information used to make decisions about an individual; it excludes psychotherapy notes and certain peer-review material.

Legal health record policy defines what constitutes the official business record; the designated record set is broader and governs patient access rights, so the two definitions must be documented separately.

Data stewardship assigns responsibility for a domain of data; a data owner is accountable for access decisions while a data custodian implements technical safeguards.

Destruction must render data unreadable and unrecoverable and be documented; retention holds triggered by litigation, audit, or investigation suspend routine destruction.

Amendment rights: a patient may request amendment of the designated record set; the covered entity may deny only on specified grounds and must document the denial and the patient's right to submit a statement of disagreement.

Revenue cycle sequence: preregistration, registration, charge capture, coding, claim submission, payer adjudication, remittance posting, denial management, and patient collections.

Clean claim rate = claims accepted on first submission / total claims submitted; first-pass denial rate = denials on initial submission / total initial claims.

Accounts receivable days (days in A/R) = total A/R / average daily charges; average daily charges = total charges / number of days in the period.

Net collection rate = payments / (gross charges - contractual adjustments); it measures collection effectiveness after contractual allowances are removed.

Charge capture integrity requires a chargemaster maintained with current CPT/HCPCS, revenue codes, and pricing; charge description master updates follow annual code set changes and payer fee schedule revisions.

Claim edits operate in tiers: scrubber or pre-bill edits catch data errors before submission, payer edits apply national and local coverage determinations, and clinical edits apply code-pair and medical-necessity logic.

Denial management classifies denials as clinical, technical, or registration-related; root-cause tracking by denial code drives prevention rather than repeated appeal work.

Payer mix and contractual allowance accuracy affect revenue: an unposted contractual adjustment overstates revenue, while an understated allowance inflates net revenue projections.

HIPAA Privacy Rule permits use or disclosure of PHI for treatment, payment, and health care operations without authorization; all other uses require a valid authorization with the required core elements.

The HIPAA Security Rule applies to electronic PHI and requires administrative, physical, and technical safeguards plus documented risk analysis and risk management.

Breach notification: individual notice without unreasonable delay and no later than 60 days after discovery; HHS notice annually for breaches under 500 individuals and contemporaneously for 500 or more.

The minimum necessary standard applies to uses and disclosures except for treatment purposes and disclosures to the individual; role-based access supports compliance.

Anti-kickback Statute prohibits remuneration to induce referrals for items or services payable by federal health care programs; the Stark Law is a strict-liability civil statute governing physician self-referral.

False Claims Act liability attaches to knowingly presenting a false claim; the reverse false claim provision covers obligations to repay overpayments, and the 60-day overpayment rule requires return of identified overpayments.

OIG Compliance Program elements include written policies, a compliance officer and committee, training and education, communication lines, internal monitoring and auditing, and enforcement through corrective action.

Coding compliance audits sample records against documentation; results are reported as error rates by code category and require corrective action plans and repayment when overpayments are identified.

ICD-10-PCS characters are positionally fixed: 1 section, 2 body system, 3 root operation, 4 body part, 5 approach, 6 device, 7 qualifier; all seven positions must be filled, using Z as the no-device/no-qualifier placeholder.

ICD-10-PCS root operations are defined by objective, not by eponym: Excision cuts out a portion, Resection cuts out all of a body part, Destruction uses energy to eradicate, Extraction pulls out by force.

ICD-10-CM diagnosis codes carry 3-7 characters; the 7th character for injury and external cause codes denotes encounter (A initial, D subsequent, S sequela) and is required on the injury code itself.

Laterality, episode of care, and combination-code logic: ICD-10-CM combination codes report both the etiology and manifestation in one code, so a separate manifestation code is not added unless the tabular instructs otherwise.

CPT Evaluation and Management level selection under 2021+ office/outpatient rules for established patients turns on medical decision making or total time on the date of encounter, not on history and exam bullet counts.

Surgical package concept: the global surgical package includes the operation, local infiltration, metacarpal/digital/metatarsal anesthesia, and typical postoperative care; unrelated E/M during global days requires modifier 24.

Modifier rules: -25 for a significant, separately identifiable E/M on the same day as a procedure; -59 or the X{EPSU} subset for distinct procedural service; -26/-TC split professional and technical components.

Medical necessity drives code selection: query the provider when documentation is ambiguous, and never assign a code based on clinical inference alone; the physician query must be non-leading and support the final code.

Data definition: data elements are the smallest named units of information; a data set is a defined collection of elements; a data dictionary documents each element's name, definition, format, and allowed values.

Data quality dimensions commonly assessed are accuracy, completeness, consistency, timeliness, validity, and precision; completeness is measured as the proportion of fields populated against the expected total.

HL7 v2 messages are pipe-delimited segments (MSH, PID, PV1, OBX); FHIR uses RESTful resources (Patient, Encounter, Observation) in JSON or XML; CDA is an XML document standard for clinical summaries.

Terminology standards: ICD-10-CM/PCS for morbidity coding, SNOMED CT for clinical concepts, LOINC for laboratory and observation identifiers, RxNorm for medications, and CPT/HCPCS for procedures and supplies.

Interoperability levels: foundational (transport), structural (format/syntax), and semantic (shared meaning via coded vocabularies); semantic interoperability requires common terminology and value sets.

Abstraction is the process of reviewing a record and extracting specified data elements into a registry or database; the abstracted data must be traceable to the source documentation.

Health information exchange models include directed exchange, query-based exchange, and consumer-mediated exchange; each raises distinct consent and access-control requirements.

Information governance is the accountability framework for information: it sets decision rights, policies, and standards for data quality, access, retention, privacy, and security across the enterprise.

Record retention is driven by federal and state law plus statutes of limitation; when federal and state requirements conflict, apply the longer retention period unless the law specifies otherwise.

The designated record set under HIPAA includes medical and billing records, enrollment and payment records, and any information used to make decisions about an individual; it excludes psychotherapy notes and certain peer-review material.

Legal health record policy defines what constitutes the official business record; the designated record set is broader and governs patient access rights, so the two definitions must be documented separately.

Data stewardship assigns responsibility for a domain of data; a data owner is accountable for access decisions while a data custodian implements technical safeguards.

Destruction must render data unreadable and unrecoverable and be documented; retention holds triggered by litigation, audit, or investigation suspend routine destruction.

Amendment rights: a patient may request amendment of the designated record set; the covered entity may deny only on specified grounds and must document the denial and the patient's right to submit a statement of disagreement.

Revenue cycle sequence: preregistration, registration, charge capture, coding, claim submission, payer adjudication, remittance posting, denial management, and patient collections.

Clean claim rate = claims accepted on first submission / total claims submitted; first-pass denial rate = denials on initial submission / total initial claims.

Accounts receivable days (days in A/R) = total A/R / average daily charges; average daily charges = total charges / number of days in the period.

Net collection rate = payments / (gross charges - contractual adjustments); it measures collection effectiveness after contractual allowances are removed.

Charge capture integrity requires a chargemaster maintained with current CPT/HCPCS, revenue codes, and pricing; charge description master updates follow annual code set changes and payer fee schedule revisions.

Claim edits operate in tiers: scrubber or pre-bill edits catch data errors before submission, payer edits apply national and local coverage determinations, and clinical edits apply code-pair and medical-necessity logic.

Denial management classifies denials as clinical, technical, or registration-related; root-cause tracking by denial code drives prevention rather than repeated appeal work.

Payer mix and contractual allowance accuracy affect revenue: an unposted contractual adjustment overstates revenue, while an understated allowance inflates net revenue projections.

HIPAA Privacy Rule permits use or disclosure of PHI for treatment, payment, and health care operations without authorization; all other uses require a valid authorization with the required core elements.

The HIPAA Security Rule applies to electronic PHI and requires administrative, physical, and technical safeguards plus documented risk analysis and risk management.

Breach notification: individual notice without unreasonable delay and no later than 60 days after discovery; HHS notice annually for breaches under 500 individuals and contemporaneously for 500 or more.

The minimum necessary standard applies to uses and disclosures except for treatment purposes and disclosures to the individual; role-based access supports compliance.

Anti-kickback Statute prohibits remuneration to induce referrals for items or services payable by federal health care programs; the Stark Law is a strict-liability civil statute governing physician self-referral.

False Claims Act liability attaches to knowingly presenting a false claim; the reverse false claim provision covers obligations to repay overpayments, and the 60-day overpayment rule requires return of identified overpayments.

OIG Compliance Program elements include written policies, a compliance officer and committee, training and education, communication lines, internal monitoring and auditing, and enforcement through corrective action.

Coding compliance audits sample records against documentation; results are reported as error rates by code category and require corrective action plans and repayment when overpayments are identified.