IAMI CPMA cheat sheet

E/M level selection under 2021+ office/outpatient rules is based on either medical decision making (MDM) or total time on the date of the encounter; the two are alternatives, not additive.

MDM has three elements: number and complexity of problems addressed, amount and/or complexity of data reviewed/analyzed, and risk of complications, morbidity, or mortality; the level is set by the two of three elements met.

Total time includes face-to-face and non-face-to-face work on the date of the encounter (reviewing records, ordering tests, documenting); it excludes staff time and separately reported services.

Medical necessity is the overarching criterion for code selection; documentation must support the reason the service was performed, not just the code reported.

A modifier -25 is reported only when a significant, separately identifiable E/M service is performed on the same day as a procedure; the E/M must be above and beyond the procedure's usual work.

Modifier -59 and the X{EPSU} subset (XE, XP, XS, XU) communicate distinct procedural service; -59 is the least specific and is a frequent audit target.

Principal diagnosis for inpatient coding is the condition after study determined to have occasioned the admission; for outpatient, the first-listed diagnosis is the reason for the encounter.

Laterality, encounter type, and combination codes must be supported by provider documentation; coders may not infer a diagnosis from a medication list or test result alone.

Query the provider when documentation is ambiguous, conflicting, or incomplete; leading queries that suggest a diagnosis or code are noncompliant.

Standard audit sequence: define scope and objectives, select population and sample, obtain records, review against criteria, validate findings, report, and follow up on corrective action.

Sampling units must be defined before selection (claim, encounter, line item, provider, or beneficiary); mixing units invalidates extrapolation.

Random (probability) sampling supports statistical projection; judgmental or targeted sampling supports only descriptive findings, not extrapolation to the population.

A finding requires three elements: the criterion (rule/standard), the condition (what was found), and the cause/effect; missing any element weakens the report.

Inter-rater reliability is tested by independent review of the same records; disagreement is resolved by a second-level reviewer using the same criteria version.

Error rate = (number of records with at least one error) / (records reviewed) when measuring claim accuracy; line-item error rate counts each erroneous line separately.

Audit workpapers should capture the record identifier, date of service, reviewer, criteria source and version, finding, and disposition for each record reviewed.

Pre-audit and post-audit education should reference the specific criterion cited, not general coding guidance, so the corrective action is testable.

The Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) prohibits knowingly offering, paying, soliciting, or receiving remuneration to induce referrals for items or services payable by a federal health care program.

The Stark Law (42 U.S.C. 1395nn) is a strict-liability civil statute restricting physician self-referral for designated health services; compliance depends on fitting an exception, not on intent.

The False Claims Act imposes liability for knowingly presenting a false claim; the qui tam provision permits private relators to sue and share in recovery.

The Civil Monetary Penalties Law and the Exclusion Statute (42 U.S.C. 1320a-7) authorize penalties and program exclusion for fraud and other specified conduct.

HIPAA Privacy Rule permits use and disclosure for treatment, payment, and health care operations; the Security Rule requires administrative, physical, and technical safeguards for ePHI.

The minimum necessary standard applies to uses and disclosures for payment and operations, with exceptions for treatment and disclosures to the individual.

The 60-day overpayment rule requires reporting and returning identified Medicare overpayments within 60 days of identification.

An effective compliance program follows the seven elements: written policies, compliance officer/committee, training, communication lines, internal monitoring and auditing, enforcement and discipline, and response and prevention.

The HIPAA Breach Notification Rule requires notification without unreasonable delay and no later than 60 days from discovery of a breach affecting 500 or more individuals, including HHS and media notice.

Source documents (progress notes, operative reports, discharge summaries, labs) are the primary evidence; coded data, claim data, and billing summaries are secondary and must be traced back to source.

A valid record review confirms authentication (legitimate provider signature or attestation), timeliness, legibility, and that amendments are dated and attributed.

Copy-paste or cloned documentation is a red flag; look for identical text across encounters, internal contradictions, or documentation inconsistent with the clinical picture.

Data validation compares reported data elements against source documents and calculates accuracy as correct elements divided by elements reviewed.

Diagnosis-to-treatment linkage: a reported diagnosis should be supported by monitoring, evaluation, or treatment in the record; a problem list entry alone is weak support.

Hierarchy and sequencing rules (e.g., CC/MCC capture, principal diagnosis selection) must be validated, not just the presence of the code.

Reconciliation of claim line items to the encounter form and the medical record identifies unbundling, upcoding, and wrong-modifier errors.

Retrospective review is the standard for post-payment validation; concurrent review supports real-time correction before claim submission.

A report should state objectives, scope, period, population, sample size and method, criteria, findings, root cause, risk rating, and recommendations.

Reported error rates must state the denominator (claims, encounters, line items) and whether results are projectable or descriptive.

Findings should be written as condition, criteria, cause, and effect (or risk), with the record identifiers available in an appendix or workpaper reference.

Overpayment calculations should show the methodology per record (e.g., corrected code and allowed amount difference) and exclude records where documentation supports the original code.

Draft findings are typically shared with the audited entity for response before finalization; rebuttals are evaluated against the same criteria and documented.

Risk ratings (high/medium/low) should be defined in advance by likelihood and impact so ratings are consistent across reports.

Confidentiality: audit reports and workpapers containing PHI are protected; distribution should be limited to those with a need to know.

Follow-up should include a corrective action plan with an owner and due date, and re-audit to verify the fix reduced the error rate.

Fraud is intentional deception for gain; waste is misuse of resources without intent; abuse is conduct inconsistent with accepted business or medical practice that may cause unnecessary cost.

Common fraud schemes: billing for services not rendered, upcoding, unbundling, billing for non-covered services as covered, duplicate claims, and identity/beneficiary theft.

Red flags include services on dates of death, impossible volumes per provider per day, services outside the provider's specialty or licensure, and beneficiaries with no relationship to the provider.

Data analytics for detection: peer comparison, length-of-stay outliers, high-cost per beneficiary, modifier -25/-59 frequency, and same-day duplicate claim patterns.

The OIG Work Plan and the DOJ/HHS Health Care Fraud Prevention and Enforcement Action Team (HEAT) priorities indicate current enforcement focus areas.

Whistleblower protections under the False Claims Act prohibit retaliation against employees who report suspected fraud.

Providers should have a process to screen employees and vendors against the OIG List of Excluded Individuals/Entities and the SAM exclusion list.

Intent distinguishes fraud from error; the same billing pattern may be an honest mistake, requiring education, or fraud, requiring referral to counsel and potentially to the government.

Auditor independence means the reviewer has no operational responsibility for the process being audited and no incentive tied to the audit outcome.

Objectivity requires that findings be based on evidence and criteria, not on the auditor's personal coding preference or prior relationship with the provider.

Conflicts of interest must be disclosed and mitigated (e.g., reassigning the review) before the audit begins, not after findings are known.

Confidentiality: audit findings and PHI are shared only with authorized parties; discuss findings with the audited party before broader distribution.

Professional competence requires current knowledge of coding conventions, payer rules, and regulations applicable to the audit scope; document the criteria version used.

Auditors must not alter or destroy workpapers or source documents, and must retain records per the organization's retention policy and applicable law.

A finding should be reported even when it is unfavorable to the auditor's employer or to a colleague; suppressing findings violates integrity.

When a reviewer lacks expertise for a specialty, the review should be escalated to a qualified reviewer rather than guessed at.

Risk assessment ranks audit areas by likelihood and impact; inputs include prior audit results, claim volume and dollars, regulatory change, and known coding complexity.

Define the audit universe and then prioritize; a risk-based plan allocates more reviews to high-risk providers, services, or codes.

Attribute sampling estimates an error rate; variable sampling estimates a dollar amount; the choice depends on the audit objective.

Sample size increases with desired confidence, expected error rate, and tolerable error rate; precision is the margin of error around the estimate.

Statistical projection: estimated total error = sample error rate × population size (or dollars), with a confidence interval; the point estimate alone is insufficient for a conclusion.

Random selection without replacement from a defined population is the basis for valid extrapolation; document the random seed or selection method.

Stratified sampling divides the population into homogeneous groups (e.g., by dollar value or service type) and samples within strata to reduce variance.

Pilot or discovery samples test whether a problem exists; they should not be projected unless selected with a probability method.

Audit scope documentation should state inclusion/exclusion criteria, date range, payer, provider types, and the criteria source (e.g., CPT, ICD-10-CM, payer policy).