Compliance and Risk Management
Core concepts
Four federal authorities anchor this domain. The False Claims Act reaches knowingly false claims, including deliberate ignorance and reckless disregard. The Anti-Kickback Statute prohibits remuneration for referrals of federally payable business and is intent-based, satisfied by the "one purpose" test. The Stark law is a strict-liability prohibition on physician self-referral of designated health services to an entity with which the physician (or immediate family) has a financial relationship, unless an exception fits. Civil Monetary Penalties and OIG exclusion round out enforcement. A defensible compliance program has seven elements: written policies and procedures, a compliance officer and committee, effective training, open lines of communication, internal monitoring and auditing, enforcement and discipline, and prompt response and corrective action. Risk management adds informed consent, incident reporting, credentialing verification, OSHA compliance, and malpractice-claim review. HIPAA Privacy and Security Rules plus breach notification complete the picture.
Traps
- Describing Stark as intentional. Stark is strict liability; intent belongs to the Anti-Kickback Statute.
- Equating a policy binder with a program. Auditors want logs, training records, and documented corrective action.
- Missing incident-to requirements. The supervising physician must be immediately available, established the plan of care, and the service must be part of it.
- Late breach notice. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
Rule of thumb
Audit a small random sample of charts per provider each quarter, document findings, and close every issue with a written corrective action - the paper trail is what demonstrates an effective program.