Healthcare Compliance
Healthcare compliance on the CPCO exam tests whether you can design, operate, and defend a compliance program that prevents, detects, and corrects legal and billing risk. Expect questions on the OIG seven elements, the Anti-Kickback Statute, Stark Law, False Claims Act, HIPAA, exclusion screening, and the compliance officer’s reporting relationship to the board.
Core rules and concepts
- A compliance program is not an audit function alone. The OIG framework requires written policies and standards of conduct, a compliance officer and committee, training and education, open communication lines, internal monitoring and auditing, enforcement and discipline, and prompt detection and correction.
- Risk assessment drives the annual work plan. Rank risk by likelihood and impact: coding and documentation, medical necessity, Stark/AKS arrangements, beneficiary inducements, privacy and security, and exclusion status.
- Screen employees, contractors, and vendors against the OIG LEIE and SAM exclusion lists at hire and monthly thereafter. Billing for an excluded person’s services can create overpayment and False Claims Act exposure.
- Under the 60-day overpayment rule, a provider that identifies a Medicare overpayment must report and return it by the later of 60 days after identification or the date the corresponding cost report is due.
- Stark Law is strict liability for financial relationships with referring physicians unless an exception applies. The Anti-Kickback Statute requires intent and covers remuneration for referrals of federally payable items or services.
Worked example
An internal audit finds 14 established-patient E/M claims coded 99215 when documentation supports 99213. The compliance officer quantifies $1,120 in overpayment, stops the pattern by re-educating coders, and confirms the root cause was a template change. Because the issue was identified on March 1, the refund must be initiated by April 30. The officer documents the investigation, repayment, and monitoring plan, and reports the issue to the compliance committee.
Traps that cost marks
- Treating the compliance officer as a billing manager with no independent authority or board access.
- Saying Stark requires proof of intent; it does not.
- Screening only at onboarding and not monthly.
- Missing the 60-day clock because “the audit is not final.” Identification, not final quantification, can start the clock.
- Assuming a corporate integrity agreement applies only to hospitals; it can bind physician practices and other entities.