Compliance and regulatory standards
Compliance and regulatory standards
This domain tests billing integrity and the legal framework around claims. Expect HIPAA privacy and security, false claims, anti-kickback and Stark issues, Medicare overpayments, documentation standards, exclusion screening, and compliance-program elements.
Rules and concepts
- HIPAA requires minimum necessary use and disclosure of PHI, safeguards for electronic PHI, business associate agreements, and breach notification. Billing staff may share PHI for treatment, payment, and operations, but not for unrelated purposes without authorization.
- The False Claims Act prohibits knowingly submitting false or fraudulent claims, including reckless disregard of truth. Penalties can include treble damages and per-claim fines; qui tam relators may bring actions.
- The Anti-Kickback Statute prohibits remuneration to induce referrals for federally payable items or services, subject to safe harbors. Stark prohibits physician self-referral for designated health services with limited exceptions.
- Medicare overpayments must be reported and returned within 60 days of identification. Routine waiver of Medicare copays or deductibles can be an inducement unless a documented financial-hardship policy applies.
- Documentation must support the code, medical necessity, and units. Cloned notes, unsigned records, and services not documented are audit risks. Coding changes and payer policies should be monitored, and audit findings should lead to education and repayment when needed.
- A compliance program typically includes written policies, a compliance officer, training, communication, monitoring, enforcement, and corrective action.
Worked example
A practice advertises that it will waive all Medicare copays for new patients. Routine waiver of Medicare cost-sharing can violate the Anti-Kickback Statute and beneficiary-inducement rules because it may induce patients to choose the practice. A compliant policy waives cost-sharing only after an individualized financial-hardship determination, documented in advance, and applied consistently.
Traps
Treating compliance as coding only; missing the 60-day overpayment rule; routine copay waivers; billing from cloned or unsigned documentation; failing to screen employees and vendors against exclusion lists; and using PHI beyond treatment, payment, or operations without authorization.