CPMA Medical Auditor cheat sheet

OIG seven elements: written policies and procedures, designated compliance officer and committee, training and education, communication lines, internal monitoring and auditing, enforcement and discipline, prompt corrective action.

Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) is criminal and intent-based; it prohibits knowingly offering or paying remuneration to induce referrals of items or services payable by a federal health care program.

Stark Law (42 U.S.C. 1395nn) is civil and strict liability; it bars physician referrals of designated health services to Medicare patients unless a financial-relationship exception is satisfied.

False Claims Act remedies: treble damages plus per-claim civil penalties; qui tam relator share is 15-30% of recovery; the knowledge standard includes deliberate ignorance and reckless disregard.

A compliance program must be risk-based: audit frequency, training intensity, and budget scale with the likelihood and impact of each identified risk.

Deficit Reduction Act: entities receiving at least $5 million in annual Medicaid payments must provide written false claims education to employees, contractors, and agents.

OIG exclusion: mandatory exclusion follows conviction for specified offenses; permissive exclusion is discretionary; an excluded provider cannot be paid by Medicare or Medicaid for items or services.

HIPAA compliance requires the minimum necessary standard, breach notification within 60 days of discovery, and a documented sanction policy for privacy and security violations.

The sampling unit defines what is counted (claim, line item, or encounter); the sampling frame must match the defined universe exactly.

Random (probability) sampling supports extrapolation to the universe; judgmental or convenience sampling does not support statistical projection.

Required statistical sample size increases with the expected error rate, the desired confidence level (commonly 90% or 95%), and a tighter precision (margin of error).

Error rate = (number of units with at least one error ÷ number of units reviewed) × 100.

Projected overpayment = sample error rate × total universe dollar value; report it with the confidence interval and precision used.

RAT-STATS is the OIG's free software for random sample selection, confidence interval calculation, and overpayment projection.

A probe sample of roughly 20-50 units estimates the error rate before committing resources to a full statistical sample.

Monitoring is ongoing, operations-owned, real-time review; auditing is periodic, independent, and documented against defined criteria.

Re-audit after education and process changes; comparing pre-education and post-education error rates demonstrates whether correction occurred.

2021 office/outpatient E/M: select the level by medical decision making or by total time on the date of the encounter; history and examination are no longer scored components.

Medical decision making requires two of three elements: number and complexity of problems, amount and complexity of data reviewed, and risk of complications or morbidity.

Total time thresholds for office/outpatient E/M: 99202=15, 99203=30, 99204=45, 99205=60 minutes; 99212=10, 99213=20, 99214=30, 99215=40 minutes.

Modifier 25 requires a significant, separately identifiable E/M service on the same date as a procedure by the same physician; documentation must support both services.

Modifier 59 is used only when no more specific X{EPSU} modifier (XE, XP, XS, XU) applies; an NCCI modifier indicator of 0 blocks any override.

Global surgical package periods are 0-day (minor and endoscopic procedures), 10-day, or 90-day; related modifiers include 24 (unrelated E/M), 57 (decision for surgery), 78 (return to OR), and 79 (unrelated procedure).

Teaching physician documentation requires the GC modifier and evidence the teaching physician was physically present and personally performed or supervised the key portions of the service.

Incident-to requirements: established patient, service furnished as part of the physician's plan of care, and direct physician supervision in the office suite; incident-to does not apply in the hospital outpatient setting.

Authentication: each entry must be signed and dated by its author; missing or illegible signatures are documentation deficiencies, and amendments must be dated, traceable, and never obliterate prior text.

Medicare physician fee schedule payment = [(work RVU × work GPCI) + (practice expense RVU × PE GPCI) + (malpractice RVU × MP GPCI)] × conversion factor.

NCCI edits: the column 1 code is comprehensive and the column 2 code is the component; modifier indicator 0 means no override is allowed, indicator 1 means an appropriate modifier may bypass the edit.

An ABN (form CMS-R-131) is issued before a service when Medicare coverage is expected to be denied as not medically necessary; a properly signed notice transfers financial liability to the beneficiary.

LCDs and NCDs define coverage; a service that is correctly coded may still be denied for medical necessity, so both coding and coverage criteria must be audited.

Revenue cycle sequence: scheduling and registration, charge capture, coding, claim submission, remittance posting, denial management, and accounts receivable follow-up.

Clean claim rate = clean claims (accepted on first submission without edits or rejections) ÷ total claims submitted.

Days in accounts receivable = total accounts receivable ÷ average daily gross charges.

Allowed amount = the lesser of the billed charge or the contracted fee; contractual adjustment = billed charge − allowed amount, and it is not patient liability.

Payment methodologies: IPPS uses DRGs, OPPS uses APCs, and physician and non-facility services use the RBRVS fee schedule.

Report structure: executive summary, objective and scope, methodology and sampling, findings with criteria, root cause, recommendations, management response, and follow-up plan.

Each finding states the condition, criteria (regulation, policy, or coding rule), cause, and effect; language is objective and avoids accusatory or opinion statements.

Disclose the sample size, error rate, confidence level, precision, and any extrapolated overpayment so the reader can judge the reliability of results.

Classify findings by type: documentation, coding, medical necessity, and billing or claim submission, because each requires a different corrective action.

Corrective action plan components: root cause, specific action, responsible owner, target completion date, validation method, and re-audit timeframe.

The exit conference is held before the final report to confirm facts, clarify findings, and obtain management responses that are included in the report.

Work papers support every reported finding and retain purpose, scope, source documents, sample selection method, findings, and reviewer sign-off.

Distribution is limited to recipients with a need to know; reports are labeled confidential and legally sensitive findings are routed through compliance counsel.

A follow-up re-audit confirms corrective action; unresolved or repeat findings escalate to the compliance committee or governing board.