Compliance and Regulatory
Compliance and Regulatory tests the legal frame around coding: fraud and abuse statutes, HIPAA obligations, the structure of an effective compliance program, and how a coding professional responds to audits and to pressure to bill inaccurately.
Fraud and abuse laws
- False Claims Act: liability attaches when a person knowingly submits a false claim. Knowingly includes actual knowledge, deliberate ignorance, and reckless disregard. Penalties are treble damages plus per-claim amounts, and qui tam relators may share in the recovery.
- Anti-Kickback Statute: prohibits remuneration intended to induce referrals for federally payable items and services; it is intent-based.
- Physician Self-Referral (Stark) Law: prohibits referrals of designated health services to entities with which the physician has a financial relationship unless an exception applies; it is strict liability.
- Civil Monetary Penalties Law and OIG exclusion round out the enforcement set. Common coding schemes include upcoding, unbundling, billing for undocumented services, and cloning documentation.
HIPAA, privacy, and security
- Privacy Rule: minimum necessary, valid authorizations, and patient rights.
- Security Rule: administrative, physical, and technical safeguards.
- Breach Notification Rule: a four-factor risk assessment - nature and extent of the information, the unauthorized recipient, whether the information was actually acquired or viewed, and the extent of mitigation. Notice is due within 60 days; encryption can remove the notification obligation.
- HITECH extended HIPAA obligations directly to business associates.
The seven elements of a compliance program
Written standards and policies; a designated compliance officer and committee; training and education; communication lines with non-retaliation; internal auditing and monitoring; disciplinary mechanisms; and response to detected offenses, including investigation and corrective action.
Worked example
A supervisor asks a coder to add a diagnosis that the physician never documented so the claim will pay. That request would create a false claim. The coder refuses, documents the request, and reports it through the compliance hotline, which must be protected from retaliation. The organization investigates, corrects the claim, and refunds any overpayment within 60 days of identifying it.
Traps that cost marks
Believing only coders can be liable; treating everybody does it as a defense; mixing up Stark (strict liability) with the Anti-Kickback Statute (intent); assuming HIPAA preempts stricter state law; and missing the 60-day overpayment rule.