I85PREP
⌘ K
CPCO Compliance Officer study materials
CPCO Compliance Officer study resources

CPCO Compliance Officer practice questions

One question at a time. Build your CPCO Compliance Officer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Healthcare Compliance

Under the federal Anti-Kickback Statute, remuneration paid to induce referrals of items or services reimbursed by a federal health care program is prohibited because the statute is best characterized as which type of offense?

  1. A strict liability offense requiring no proof of intent
  2. A vicarious offense that automatically imputes the payer's conduct to the provider
  3. A specific-intent offense requiring proof that the party knowingly and willfully offered or paid the remuneration Correct answer.
  4. A negligence offense judged by the reasonable compliance officer standard

Explanation

The Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), makes it a criminal offense to knowingly and willfully offer, pay, solicit, or receive remuneration to induce referrals of federally reimbursable items or services. The government must prove intent, so a good-faith but mistaken arrangement is not automatically a violation. The statute also expressly states that a person need not have actual knowledge of the statute or specific intent to violate it to be guilty of a related false claim.

Question 2Healthcare Compliance

A durable medical equipment supplier wants to give referring physicians free billing and prior-authorization software that has independent value unrelated to referrals. Which condition must the arrangement satisfy to fit the electronic health records and related software safe harbor framework?

  1. The software must be provided only to physicians who order at least a set monthly volume of equipment
  2. The software must be resold by the physician at fair market value within one year
  3. The software must be approved in advance by the OIG through an advisory opinion
  4. The software must be donated without charge and its value must not be tied to the volume or value of referrals Correct answer.

Explanation

Safe harbors protect only arrangements that meet every element, and software donations generally cannot take into account the volume or value of referrals or other business generated. The arrangement must also be structured so the donor retains no improper influence over the recipient's referrals. Tying the gift to ordering volume defeats the protection.

Question 3Healthcare Compliance

A hospital's compliance officer discovers that a billing manager has been submitting claims for services never rendered. Under the False Claims Act's reverse false claim provision, which situation creates liability separate from the underlying false claim?

  1. The hospital bills a service before the physician has signed the operative report
  2. The hospital fails to document a patient's refusal of treatment in the medical record
  3. The hospital submits a claim with a minor clerical error that has no effect on payment
  4. The hospital knowingly retains an overpayment after the 60-day reporting obligation has passed Correct answer.

Explanation

The reverse false claim provision, 31 U.S.C. § 3729(a)(1)(G), imposes liability for knowingly concealing or improperly avoiding an obligation to pay money to the government. An identified overpayment must be reported and returned within 60 days, and retaining it after that point can be treated as an obligation that was improperly avoided. Clerical errors without payment effect and documentation gaps generally do not meet the knowledge and materiality elements.

Question 4Healthcare Compliance

Which statutory provision was added by the Affordable Care Act to make clear that a claim resulting from an Anti-Kickback Statute violation can also be pursued as a false claim?

  1. The False Claims Act provision stating that a claim including an item or service resulting from a violation of the Anti-Kickback Statute constitutes a false or fraudulent claim Correct answer.
  2. The Anti-Kickback Statute's safe harbor rulemaking authority
  3. The Civil Monetary Penalties Law's beneficiary inducement provision
  4. The False Claims Act's public disclosure bar

Explanation

The ACA amended the False Claims Act at 31 U.S.C. § 3729(a)(1)(A) to provide that a claim that includes items or services resulting from a violation of the Anti-Kickback Statute is a false or fraudulent claim for purposes of the FCA. This removed the earlier argument that a kickback-tainted claim required separate proof of falsity. The provision also clarified that specific intent to violate the Anti-Kickback Statute is not required for FCA purposes.

Question 5Healthcare Compliance

A physician group compensates a medical director at fair market value for administrative services, but the written agreement expired eight months ago and the parties continued the same payments. Which compliance concern is most directly implicated?

  1. The Emergency Medical Treatment and Labor Act, because the director also covers the emergency department
  2. The Health Insurance Portability and Accountability Act, because the payments involve protected health information
  3. The Clinical Laboratory Improvement Amendments, because the group operates a point-of-care lab
  4. The Stark Law, because an arrangement must satisfy an applicable exception in full, including a signed writing covering the term Correct answer.

Explanation

The physician self-referral law, 42 U.S.C. § 1395nn, prohibits referrals for designated health services when a financial relationship exists unless an exception applies, and exceptions must be satisfied completely. A written agreement that lapsed means the personal services exception is not met during the gap, even if the rate was fair market value. The parties should document and correct the lapse promptly.

Question 6Healthcare Compliance

Which of the following best describes the function of an OIG advisory opinion in a healthcare compliance program?

  1. It serves as a judicial precedent binding on all providers in the circuit
  2. It grants a permanent exemption from all federal health care program requirements
  3. It replaces the need for an internal compliance program
  4. It binds the OIG to refrain from enforcement action against the requesting party's specific arrangement as described Correct answer.

Explanation

An advisory opinion issued under 42 U.S.C. § 1320a-7d(b) addresses a specific arrangement and protects only the requesting parties, and only to the extent they act in accordance with the facts certified and the opinion's terms. It does not create a general rule for other providers and does not eliminate other legal obligations. Advisory opinions are also published for public transparency.

Question 7Healthcare Compliance

A hospital learns that a nurse practitioner's documentation was copied into physician notes for several encounters. Under the Medicare Conditions of Participation, which response best reflects the compliance obligation?

  1. Conduct a focused audit, correct records as permitted, and assess whether claims were affected Correct answer.
  2. Report the issue only if a patient complains
  3. Ignore the issue because the physician reviewed the note before signing
  4. Immediately terminate all staff who accessed the record without further review

Explanation

Copy-paste documentation raises accuracy and medical necessity concerns, so a compliance program should investigate scope, correct records through permitted amendment processes, and determine whether any claims must be adjusted or disclosed. Termination decisions require a documented, proportionate review rather than an automatic response. Patient complaints are not the trigger for internal corrective action.

Question 8Healthcare Compliance

Which element is required for a claim to be actionable under the False Claims Act's presentment provision?

  1. The claim must have been presented to the government and the defendant must have acted knowingly Correct answer.
  2. The government must have suffered an actual loss equal to the claim amount
  3. The defendant must have been previously convicted of healthcare fraud
  4. The claim must exceed a statutory dollar threshold

Explanation

The presentment provision, 31 U.S.C. § 3729(a)(1)(A), requires a false or fraudulent claim presented to the government for payment or approval and that the defendant acted knowingly. Knowledge includes actual knowledge, deliberate ignorance, and reckless disregard of the truth. Actual loss is relevant to damages but is not an element of liability.

Question 9Healthcare Compliance

A compliance officer is designing a billing audit sampling methodology for a large physician network. Which approach best supports defensible extrapolation of error rates to the population?

  1. Reviewing claims chosen by the billing manager based on personal familiarity
  2. Auditing only claims that were previously denied and then appealed
  3. Using a statistically valid random sample with a documented methodology and confidence level Correct answer.
  4. Selecting only the highest-revenue claims to maximize recoveries

Explanation

Extrapolation is defensible when the sample is drawn using a documented, statistically valid method so that results can be projected to the population with a stated confidence level. Judgment-based or targeted selections can support findings about those claims but generally cannot be extrapolated. The methodology should be defined before sampling begins.

Question 10Healthcare Compliance

Under the HIPAA Privacy Rule, which situation generally permits disclosure of protected health information without patient authorization?

  1. Sharing a patient's full record with a marketing vendor for a new service line
  2. Providing psychotherapy notes to the patient's employer for wellness planning
  3. Disclosing information to a family member who calls and asks for the diagnosis
  4. Reporting a communicable disease to a public health authority as required by law Correct answer.

Explanation

The Privacy Rule permits disclosures without authorization for specified public interest purposes, including reports to public health authorities authorized by law to collect disease information. Marketing disclosures and most disclosures of psychotherapy notes require authorization. Disclosures to family members are limited to information directly relevant to the person's involvement in care.

Question 11Healthcare Compliance

A laboratory pays a referring physician's practice a per-specimen fee for each test sent to the lab. Which legal risk is most directly presented?

  1. An Anti-Kickback Statute violation because per-unit payments tied to referrals can constitute prohibited remuneration Correct answer.
  2. A Stark Law violation only, because laboratories are not designated health services
  3. A CLIA violation because the lab lacks a certificate of waiver
  4. A HIPAA violation because test orders contain protected health information

Explanation

Per-specimen payments to a referral source create remuneration that varies with the volume of business generated, which implicates the Anti-Kickback Statute unless a safe harbor applies. The discount safe harbor has specific disclosure and billing requirements, and a straightforward per-test payment to a referring practice generally does not fit. Arrangements should be reviewed against the applicable safe harbor elements.

Question 12Healthcare Compliance

Which statement accurately describes the role of a compliance committee in a healthcare organization's compliance program?

  1. It advises the compliance officer and helps review risk areas, but the governing body retains ultimate oversight Correct answer.
  2. It must be composed entirely of outside counsel
  3. It has authority to issue binding legal opinions on Stark Law exceptions
  4. It replaces the governing body's oversight responsibility

Explanation

OIG guidance describes a compliance committee that assists the compliance officer with implementation and monitoring while the governing body remains responsible for oversight of the program. The committee supports risk assessment and policy review but does not displace board accountability. It also does not provide legal opinions.

Question 13Healthcare Compliance

A hospital discovers a credible allegation of fraud against a contracted supplier. Under the CMS suspension and exclusion framework, what action may CMS take while an investigation proceeds?

  1. Suspend payments to the supplier without any notice or opportunity to respond
  2. Suspend payments to the supplier when there is a credible allegation of fraud, subject to the regulatory notice and good cause exceptions Correct answer.
  3. Require the hospital to repay all supplier claims regardless of fault
  4. Automatically exclude the supplier from all federal programs upon the allegation alone

Explanation

CMS may suspend payments to a provider or supplier when it determines there is a credible allegation of fraud, under 42 C.F.R. § 405.370 et seq. The regulations require notice and provide for good cause exceptions and reconsideration. An allegation alone does not trigger automatic program exclusion, which follows separate exclusion authority.

Question 14Healthcare Compliance

Which of the following is the best example of a compliance program's use of an effective training approach?

  1. Providing role-specific training on billing rules with documented completion and periodic refreshers Correct answer.
  2. Distributing a policy manual once at orientation with no further contact
  3. Requiring staff to sign an attestation without any training content
  4. Posting a generic code of conduct in the break room without tracking

Explanation

OIG guidance emphasizes training that is tailored to the audience, delivered with sufficient frequency, and documented so completion can be verified. Role-specific content on billing rules addresses the highest-risk functions and supports practical application. One-time distribution or untracked postings do not demonstrate effective education.

Question 15Healthcare Compliance

A physician practice wants to waive patient copayments for Medicare beneficiaries who cannot afford them. Which consideration is most relevant under the Civil Monetary Penalties Law's beneficiary inducement provision?

  1. Waivers are prohibited only for Medicaid beneficiaries
  2. Routine waivers of cost-sharing may constitute prohibited remuneration unless an exception such as financial need applies Correct answer.
  3. Waivers must be reported to the OIG within 24 hours
  4. Waivers are always permitted because they benefit patients

Explanation

The beneficiary inducement CMP provision, 42 U.S.C. § 1320a-7a(a)(5), prohibits offering remuneration to Medicare or Medicaid beneficiaries that the offeror knows is likely to influence the selection of a particular provider. Routine waiver of cost-sharing can be treated as remuneration, though exceptions exist for financial need and certain other circumstances. The practice should apply a documented, consistently applied policy.

Question 16Healthcare Compliance

Which document typically establishes the compliance officer's authority and reporting lines within a healthcare organization?

  1. The compliance program charter or written description approved by the governing body Correct answer.
  2. The hospital's charity care financial assistance policy
  3. The employee handbook's vacation policy
  4. The annual Medicare cost report

Explanation

A compliance program charter or written description approved by the governing body defines the compliance officer's responsibilities, authority, and reporting relationship. This documentation supports the program's independence and accountability. Cost reports, leave policies, and financial assistance policies serve different purposes.

Question 17Healthcare Compliance

A hospital's compliance hotline receives an anonymous report that a physician is receiving payments from a vendor whose products the physician orders. Which initial step best reflects an effective investigation?

  1. Refer the matter to law enforcement before any internal review
  2. Confront the physician in a public staff meeting to gather information
  3. Close the report because it is anonymous
  4. Preserve relevant records, document the allegation, and conduct a confidential review of the arrangement and ordering data Correct answer.

Explanation

An effective response includes documenting the allegation, preserving relevant records, and conducting a confidential review of the arrangement terms and ordering patterns. Anonymity does not reduce the obligation to investigate credible reports. Premature public confrontation or immediate external referral without assessment can compromise the review.

Question 18Healthcare Compliance

Which statement about the Physician Payments Sunshine Act reporting obligation is accurate?

  1. Reports are filed by the physician recipients rather than the manufacturers
  2. Only payments exceeding $10,000 must be reported
  3. The program is administered by the OIG rather than CMS
  4. Applicable manufacturers must report transfers of value to covered recipients, with limited exceptions, to the CMS Open Payments system Correct answer.

Explanation

The Sunshine Act, enacted as section 6002 of the ACA and implemented at 42 C.F.R. Part 403, requires applicable manufacturers and group purchasing organizations to report certain transfers of value to covered recipients. Reporting is submitted to CMS through Open Payments, with exceptions such as certain educational materials and payments under $10 thresholds that are aggregated. Manufacturers, not physicians, submit the data.

Question 19Healthcare Compliance

A compliance officer is evaluating a proposed physician recruitment incentive that includes income guarantees. Which analysis is most consistent with the Stark Law's physician recruitment exception?

  1. The arrangement is exempt if the physician is board certified
  2. The arrangement must meet each regulatory condition, including a signed writing, a term limit, and a requirement that the physician relocate to the geographic area Correct answer.
  3. The arrangement is exempt if the physician agrees to refer all patients to the hospital
  4. The arrangement is exempt whenever the hospital board approves it

Explanation

The physician recruitment exception at 42 C.F.R. § 411.357(e) has specific elements, including a signed written agreement, limits on the term and the amount of remuneration, and in many cases a relocation requirement. Board approval or credentials do not substitute for the regulatory elements. An agreement to refer patients to the hospital would itself raise Anti-Kickback concerns.

Question 20Healthcare Compliance

Which of the following best describes the purpose of a compliance risk assessment in a healthcare organization?

  1. To replace the internal audit function
  2. To identify and prioritize compliance risks so resources can be directed to the highest-risk areas Correct answer.
  3. To guarantee that no violations will occur
  4. To calculate the organization's tax liability

Explanation

A risk assessment evaluates the organization's exposure across areas such as billing, privacy, and referral arrangements, and ranks those risks so monitoring and training resources can be allocated effectively. It is a planning and prioritization tool, not a guarantee against violations. It complements rather than replaces internal audit.

Question 21Healthcare Compliance

A billing company that prepares claims on behalf of a provider learns that some claims include services not documented. Under the FCA, which factor is most relevant to assessing the billing company's potential liability?

  1. Whether the billing company knew the claims were false or acted with reckless disregard Correct answer.
  2. Whether the billing company is incorporated in the same state as the provider
  3. Whether the claims were submitted electronically
  4. Whether the provider has a compliance hotline

Explanation

The FCA imposes liability on any person who knowingly presents, or causes to be presented, a false claim, and knowledge includes deliberate ignorance and reckless disregard. A billing company that prepares or submits claims with awareness of the falsity may be liable even though the provider is the enrolled entity. State of incorporation, hotline existence, and submission format do not determine knowledge.

Question 22Healthcare Compliance

Which practice best supports the exclusion screening obligation in a healthcare compliance program?

  1. Screening employees once at hire and never again
  2. Screening employees and contractors against the OIG List of Excluded Individuals/Entities and state exclusion lists at hire and periodically thereafter Correct answer.
  3. Screening only licensed clinical staff
  4. Relying on employees to self-report any exclusion

Explanation

Providers should screen employees, contractors, and vendors against the OIG LEIE and applicable state Medicaid exclusion lists at hire and on a recurring basis. Employing or contracting with an excluded person can result in civil monetary penalties and denial of payment. Screening only clinicians or relying on self-reporting leaves significant gaps.

Question 23Healthcare Compliance

A hospital's compliance program receives a report that a department is upcoding evaluation and management visits. Which monitoring response is most appropriate?

  1. Discipline the entire department immediately
  2. Conduct a targeted audit comparing documented elements to the billed level and review patterns by provider Correct answer.
  3. Wait for the next external payer audit before acting
  4. Adjust all claims downward without review

Explanation

A targeted audit that compares documentation against the billed E/M level, with provider-level pattern analysis, identifies the scope and root cause of the concern. This supports focused education and any necessary claim corrections. Waiting for external review or indiscriminate adjustments or discipline is not a proportionate response.

Question 24Healthcare Compliance

Which of the following statements about the HIPAA Security Rule is correct?

  1. It applies only to large hospitals
  2. It requires covered entities to implement administrative, physical, and technical safeguards to protect electronic protected health information Correct answer.
  3. It applies only to paper records
  4. It requires encryption of all data with no exceptions

Explanation

The HIPAA Security Rule at 45 C.F.R. Part 164, Subpart C requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic protected health information. Encryption is an addressable implementation specification rather than an absolute mandate in every circumstance. The rule applies to covered entities of all sizes.

Question 25Healthcare Compliance

A compliance officer is reviewing a proposed arrangement in which a hospital provides free office space to a physician group. Which analysis is most complete?

  1. Conclude the arrangement is prohibited without further analysis
  2. Evaluate only whether the space is worth more than $500 per month
  3. Evaluate whether the arrangement fits a Stark exception and an Anti-Kickback safe harbor, including fair market value and no volume-based benefit Correct answer.
  4. Conclude the arrangement is permissible because it is free

Explanation

Free rent is remuneration to a referral source, so the arrangement must satisfy both a Stark exception and an Anti-Kickback safe harbor to be protected. Key elements include fair market value, a signed writing, a defined term, and the absence of compensation tied to the volume or value of referrals. A dollar threshold alone is not the test.

Question 26Healthcare Compliance

A compliance officer is asked to explain the difference between the Anti-Kickback Statute (AKS) and the physician self-referral law (Stark Law). Which statement correctly distinguishes the two?

  1. The AKS is a criminal statute requiring intent and covers all payers, while Stark is a civil strict-liability statute limited to designated health services paid by Medicare and Medicaid. Correct answer.
  2. The AKS prohibits only cash payments to physicians, while Stark prohibits only ownership interests and never applies to compensation arrangements.
  3. Both statutes are criminal provisions that require proof of willful intent and apply identically to all federal and commercial payers.
  4. The AKS applies only to Medicare claims, while Stark applies to all federal health care program beneficiaries and requires proof of specific intent.

Explanation

The Anti-Kickback Statute is a criminal law that requires knowing and willful conduct and reaches remuneration in connection with any item or service payable by a federal health care program. The Stark Law is a civil strict-liability statute that bars physician referrals of designated health services to entities with which the physician has a financial relationship, absent an exception, and applies to Medicare and Medicaid business.

Question 27Healthcare Compliance

Under the HIPAA Privacy Rule, a covered entity must generally act on a patient's request for access to their medical record within what timeframe?

  1. Within 60 days, with unlimited successive extensions as long as the patient is notified by phone.
  2. Within 30 days, with one 30-day extension permitted if the entity notifies the individual in writing of the reasons and date. Correct answer.
  3. Within 7 calendar days with no possibility of extension under any circumstance.
  4. Within 90 days, only after the treating physician provides written authorization for release.

Explanation

The Privacy Rule requires a covered entity to act on an access request no later than 30 days after receipt, and permits a single 30-day extension when a written statement of the reasons for delay and the expected date of completion is provided. The individual's right of access does not depend on physician authorization.

Question 28Healthcare Compliance

A compliance officer is building the seven fundamental elements of an effective compliance program for a small physician group. Which element is expressly required by the Federal Sentencing Guidelines and OIG guidance?

  1. Publishing the names of disciplined employees in a company-wide newsletter
  2. Maintaining a dedicated 24-hour staffed hotline with multilingual operators
  3. Assigning specific high-level personnel with day-to-day responsibility for the compliance program Correct answer.
  4. Obtaining annual independent certification from an external auditing firm

Explanation

The Federal Sentencing Guidelines and OIG program guidance require that specific high-level individuals be assigned operational responsibility for the program, alongside standards, training, monitoring, and enforcement. The other listed features may be helpful practices but are not mandated elements.

Question 29Healthcare Compliance

Which entity is responsible for issuing advisory opinions on the application of the Anti-Kickback Statute to specific proposed arrangements?

  1. The Department of Justice Antitrust Division
  2. The Office of Inspector General of the U.S. Department of Health and Human Services Correct answer.
  3. The Centers for Medicare & Medicaid Services Office of Financial Management
  4. The Government Accountability Office

Explanation

HHS-OIG has statutory authority to issue advisory opinions interpreting the Anti-Kickback Statute and the civil monetary penalty provisions it administers. CMS issues related Stark Law advisory opinions, but the AKS advisory function rests with OIG.

Question 30Healthcare Compliance

A compliance officer is reviewing a hospital's exclusion screening process. Which practice best satisfies the obligation to avoid employing or contracting with excluded individuals and entities?

  1. Screening only licensed clinical staff at the time of initial hire and never again
  2. Relying on a vendor's self-certification that none of its employees are excluded
  3. Screening employees and vendors against the OIG List of Excluded Individuals/Entities and the SAM.gov database at hire and periodically thereafter Correct answer.
  4. Screening only when a government payer requests confirmation of the workforce

Explanation

Providers should screen employees, contractors, and vendors against the OIG LEIE and the SAM exclusion records at onboarding and on a recurring basis, because exclusions can occur after hire. Relying solely on self-attestation or a one-time check leaves gaps that can result in civil monetary penalties for employing excluded persons.

Question 31Healthcare Compliance

Which statement accurately describes the compliance officer's reporting relationship in an effective healthcare compliance program?

  1. The compliance officer should have direct access to the governing body and report to it or its audit committee, independent of operational management. Correct answer.
  2. The compliance officer should report jointly to the human resources and facilities departments.
  3. The compliance officer should report to the marketing director so that public messaging aligns with compliance.
  4. The compliance officer should report exclusively to the billing manager to ensure claims accuracy.

Explanation

OIG guidance emphasizes that the compliance officer should have direct reporting lines to the governing body and sufficient independence from the functions being monitored. Reporting into an operational department such as billing or marketing compromises objectivity and authority.

Question 32Healthcare Compliance

A hospital wants to confirm that its compliance program includes the core training expectation set out in OIG guidance. Which approach best reflects that expectation?

  1. Provide a one-time orientation video to new clinical staff only, with no documentation
  2. Distribute a printed policy manual once and consider training complete when it is handed out
  3. Deliver role-specific training to all affected employees and contractors, document completion, and refresh it periodically and when regulations change Correct answer.
  4. Require only managers to complete training and rely on them to verbally inform their teams

Explanation

OIG guidance calls for training that reaches all affected employees and contractors, is tailored to their responsibilities, is documented, and is updated periodically and as requirements change. One-time, undocumented, or manager-only approaches do not demonstrate effective education.

Question 33Healthcare Compliance

Which law established the Medicare and Medicaid program integrity provisions, including the requirement for providers to report and return identified overpayments?

  1. The Patient Protection and Affordable Care Act of 2010, which added the 60-day overpayment reporting requirement to the Social Security Act Correct answer.
  2. The Emergency Medical Treatment and Labor Act of 1986, which mandates overpayment refunds
  3. The Clinical Laboratory Improvement Amendments of 1988, which governs overpayment reporting
  4. The Health Insurance Portability and Accountability Act of 1996, which created the overpayment return obligation

Explanation

The Affordable Care Act added section 1128J(d) to the Social Security Act, requiring a person who receives an overpayment to report and return it within 60 days of identification. HIPAA, CLIA, and EMTALA address privacy, laboratory standards, and emergency care respectively, not overpayment returns.

Question 34Healthcare Compliance

A compliance officer learns that a physician group billed Medicare for services rendered by a nurse practitioner but submitted the claims under the supervising physician's identifier without meeting incident-to requirements. Which issue is presented?

  1. A Stark Law violation only, because the nurse practitioner is not a physician
  2. A permissible billing convention because the physician supervised the practice generally
  3. A potential false claim arising from misrepresentation of the rendering provider, which should be investigated and remediated Correct answer.
  4. A privacy violation only, requiring notice to affected patients but no billing correction

Explanation

Billing under the wrong provider identifier misrepresents who rendered the service and can create false claims exposure if incident-to criteria are not satisfied. The compliance officer should investigate, quantify, and remediate through disclosure and repayment as appropriate.

Question 35Healthcare Compliance

A compliance officer is evaluating whether a proposed arrangement with a referring physician fits a Stark Law exception. Which analysis is most appropriate?

  1. Determine that the arrangement is profitable for the hospital and therefore commercially reasonable
  2. Confirm the arrangement satisfies every element of a specific exception, including writing, signature, term, and compensation set in advance at fair market value Correct answer.
  3. Conclude that no exception is needed because the physician refers only commercially insured patients
  4. Rely on the physician's verbal assurance that the arrangement is permitted

Explanation

Stark is a strict-liability statute, so an arrangement must fit within an exception in all respects, including documentation, term, and fair market value compensation not tied to referral volume. Profitability or verbal assurances do not satisfy the regulatory elements.

Question 36Healthcare Compliance

A compliance officer is designing a risk assessment for a multi-site physician network. Which approach best aligns with OIG expectations?

  1. Focus only on risks that have already resulted in a government investigation
  2. Complete a one-time assessment at program inception and never revisit it
  3. Rank risks using likelihood and impact, incorporate prior audit findings and industry enforcement trends, and refresh the assessment periodically Correct answer.
  4. Base the assessment solely on the personal opinions of senior executives without data

Explanation

OIG guidance describes risk assessment as an ongoing process that considers likelihood, impact, prior findings, and enforcement trends to prioritize compliance resources. A static or purely reactive assessment fails to keep pace with changing risk.

Question 37Healthcare Compliance

A compliance officer is reviewing a physician compensation arrangement that pays a medical director an hourly rate above market for services that require few hours. What is the primary compliance concern?

  1. The compensation may exceed fair market value and disguise remuneration for referrals, implicating the Anti-Kickback Statute and Stark Law Correct answer.
  2. The arrangement is automatically compliant because it is documented in a written agreement
  3. The only concern is whether the physician reports the income on a tax return
  4. The arrangement raises no issue because medical directors are exempt from fraud and abuse laws

Explanation

Compensation above fair market value for nominal services can constitute disguised remuneration for referrals, creating exposure under the Anti-Kickback Statute and the Stark Law's fair market value requirement. Written documentation alone does not cure an above-market rate.

Question 38Healthcare Compliance

A compliance officer discovers that a billing vendor submitted claims for services not documented in the medical record. What is the most appropriate immediate action?

  1. Destroy the affected claims records to limit potential liability
  2. Wait for the payer to identify the errors before taking any action
  3. Stop or suspend the affected billing, investigate the scope, and evaluate repayment and disclosure obligations Correct answer.
  4. Continue billing while quietly asking the vendor to be more careful in the future

Explanation

Upon identifying potentially false claims, the provider should halt the conduct, investigate the extent, and assess repayment and self-disclosure obligations. Continuing billing or destroying records can aggravate liability and may constitute obstruction.

Question 39Healthcare Compliance

A compliance officer is asked about the purpose of the OIG's Work Plan. Which description is accurate?

  1. It is a CMS payment rule that sets Medicare reimbursement rates
  2. It outlines the audits, evaluations, and enforcement priorities OIG intends to pursue in the coming year, helping providers target internal auditing Correct answer.
  3. It is a binding regulation that creates new safe harbors each year
  4. It lists the names of providers currently under investigation

Explanation

The OIG Work Plan summarizes planned audits, evaluations, and enforcement focus areas, and providers use it to prioritize internal monitoring. It is not a regulation, an investigation list, or a payment rate schedule.

Question 40Healthcare Compliance

A hospital's compliance committee is reviewing a report that a department is routinely unbundling laboratory tests to increase payment. Which response best reflects an effective compliance program?

  1. Refer the matter to the marketing department for a public statement
  2. Conduct a targeted audit, quantify the impact, correct coding processes, provide education, and evaluate repayment and disclosure Correct answer.
  3. Adjust the coding policy to permit unbundling when it increases revenue
  4. Dismiss the report because it came from an internal source rather than a payer

Explanation

An effective program investigates credible reports, quantifies the impact through auditing, corrects root causes, educates staff, and addresses repayment and disclosure. Dismissing internal reports or changing policy to permit improper billing undermines the program.

Question 41Healthcare Compliance

Which statement about the HIPAA Security Rule is accurate?

  1. It requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic protected health information Correct answer.
  2. It applies only to paper records maintained in a provider's file room
  3. It mandates a single government-approved encryption product for all covered entities
  4. It applies only to health plans and not to providers or clearinghouses

Explanation

The Security Rule requires administrative, physical, and technical safeguards for electronic protected health information and applies to covered entities and their business associates. It is technology-neutral and does not prescribe a single product.

Question 42Healthcare Compliance

A compliance officer is asked how the Physician Payments Sunshine Act reporting works. Which statement is accurate?

  1. Hospitals must report all payments they make to physicians to the OIG for publication
  2. Individual physicians must self-report their industry payments directly to CMS each year
  3. Applicable manufacturers and group purchasing organizations must report payments and other transfers of value to physicians and teaching hospitals to CMS, which publishes them Correct answer.
  4. Reporting is voluntary and occurs only when a manufacturer chooses to participate

Explanation

The Sunshine Act, implemented through the Open Payments program, requires applicable manufacturers and group purchasing organizations to report transfers of value to physicians and teaching hospitals to CMS for public display. Reporting is mandatory, and physicians do not self-report these payments.

Question 43Healthcare Compliance

A compliance officer is reviewing a hospital's arrangement to provide free office space to a physician group located on campus. Which analysis is most relevant?

  1. Whether the arrangement is approved by the hospital's marketing committee
  2. Whether the arrangement fits a Stark exception and an Anti-Kickback safe harbor, such as fair market value lease or a documented recruitment incentive Correct answer.
  3. Whether the physician group will purchase supplies from the hospital
  4. Whether the free space will improve the hospital's community reputation

Explanation

Free or below-market space given to referring physicians is remuneration that must satisfy a Stark exception and an Anti-Kickback safe harbor, such as a fair market value lease or a qualifying recruitment arrangement. Reputation, supply purchases, and marketing approval are not the governing legal tests.

Question 44Healthcare Compliance

A compliance officer is reviewing the organization's policy on responding to government subpoenas and investigator requests. Which practice is most appropriate?

  1. Instruct staff to decline all contact with government investigators
  2. Have the requesting department respond directly without notifying counsel
  3. Route the request to legal counsel immediately, preserve documents under a litigation hold, and cooperate through counsel Correct answer.
  4. Delete potentially responsive emails to reduce the volume of production

Explanation

Government inquiries should be routed promptly to counsel, with a litigation hold to preserve documents and cooperation coordinated through counsel. Direct departmental responses, destruction of records, or blanket refusal to cooperate can create obstruction and privilege problems.

Question 45Healthcare Compliance

A compliance officer is evaluating a proposed arrangement in which a laboratory provides free testing supplies to a referring physician practice. Which concern is most directly implicated?

  1. The arrangement is governed only by the Stark Law because supplies are not a designated health service
  2. The arrangement is permissible because supplies are inexpensive
  3. The free supplies may be prohibited remuneration to induce referrals under the Anti-Kickback Statute unless a safe harbor applies Correct answer.
  4. The arrangement raises no concern because no cash changes hands

Explanation

Free goods or services provided to a referral source can constitute remuneration under the Anti-Kickback Statute even without cash, unless a safe harbor applies. Cost or absence of cash does not remove the inducement concern.

Question 46Healthcare Compliance

A compliance officer is asked how the False Claims Act's qui tam provisions operate. Which statement is accurate?

  1. A relator must obtain the government's written permission before filing suit
  2. Qui tam actions may be filed only by federal employees
  3. A private relator may sue on behalf of the government, and the government may intervene and share in any recovery Correct answer.
  4. The relator receives no share of any recovery obtained by the government

Explanation

Under the False Claims Act's qui tam provisions, a private person may bring an action on the government's behalf, and the government may intervene; relators may receive a share of recovery. Relators do not need advance government permission to file.

Question 47Healthcare Compliance

A compliance officer is analyzing whether a hospital's below-market lease of equipment to a referring physician group creates fraud and abuse exposure. Which analysis is most defensible?

  1. The arrangement is compliant because equipment leases are outside the Anti-Kickback Statute
  2. The below-market rate is remuneration to a referral source that must satisfy a Stark exception and an Anti-Kickback safe harbor, including fair market value and written terms Correct answer.
  3. The arrangement is compliant because the hospital retains ownership of the equipment
  4. The arrangement is compliant if the physician group is satisfied with the service

Explanation

A below-market lease provides a benefit to the referring physician and is remuneration that must fit an applicable Stark exception and Anti-Kickback safe harbor, which generally require fair market value and written, signed terms. Ownership retention or physician satisfaction does not satisfy those elements.

Question 48Healthcare Compliance

A compliance officer is reviewing a physician recruitment arrangement that includes an income guarantee. Which set of conditions is most important to support compliance?

  1. The recruited physician agrees to refer all patients to the hospital regardless of medical need
  2. The guarantee is paid in cash with no written documentation to simplify administration
  3. The hospital recovers the full guarantee only if the physician's referral volume declines
  4. The arrangement serves a documented community need, the recruited physician is not currently practicing in the service area, and the guarantee is structured to fit a Stark exception and Anti-Kickback safe harbor Correct answer.

Explanation

Physician recruitment arrangements must address a documented community need, avoid recruiting physicians already serving the area, and fit within the applicable Stark exception and Anti-Kickback safe harbor with written terms. Tying repayment to referral volume or requiring all referrals would itself create inducement problems.

Question 49Healthcare Compliance

A compliance officer is assessing whether an organization's hotline and non-retaliation policy meet program expectations. Which feature is most important?

  1. Confidential or anonymous reporting channels, prompt investigation of reports, and documented protection of reporters from retaliation Correct answer.
  2. An investigation process that resolves reports only when the government requests follow-up
  3. A hotline that records every caller's name and shares reports with the caller's supervisor
  4. A policy that requires employees to report concerns only through their direct manager

Explanation

An effective reporting system offers confidential or anonymous channels, ensures reports are investigated promptly, and protects reporters from retaliation through documented policy and practice. Forcing disclosure to supervisors or delaying investigation undermines the program.

Question 50Healthcare Compliance

A compliance officer is evaluating a proposed gainsharing arrangement between a hospital and its employed physicians. Which consideration is most important?

  1. Whether the arrangement fits within an applicable Stark exception and Anti-Kickback safe harbor, and whether payments are tied to documented cost savings rather than referral volume Correct answer.
  2. Whether the arrangement increases physician salaries without regard to any legal exception
  3. Whether the hospital can recover payments if referral volume falls
  4. Whether the physicians agree not to disclose the arrangement to patients

Explanation

Gainsharing must be structured to fit an applicable Stark exception and Anti-Kickback safe harbor, with payments tied to documented cost savings rather than referral volume. Linking payments to referral volume or concealing the arrangement from patients would create significant exposure.