Regulatory Compliance and Accreditation
This domain tests how organizations meet licensure, certification, accreditation, privacy, and fraud-and-abuse requirements. Items often present a survey finding or a privacy incident and ask for the correct next step and owner.
Core rules and concepts
- Licensure is a state legal requirement; accreditation is a private evaluation that may convey deemed status for Medicare. Accreditation does not replace licensure.
- CMS Conditions of Participation set minimum health and safety requirements. Surveys may be complaint-driven; a plan of correction needs root cause, corrective action, responsible person, and monitoring.
- HIPAA sets a federal privacy and security floor. Stricter state law or other federal rules may apply; HIPAA does not automatically preempt stricter requirements.
- The Security Rule requires administrative, physical, and technical safeguards, risk analysis, and breach notification. Business associate agreements are required before sharing PHI for covered functions.
- Fraud-and-abuse exposure includes Stark physician self-referral and Anti-Kickback Statute inducements; compliance programs should include standards, oversight, training, monitoring, and enforcement.
Worked example
An employee emails a patient spreadsheet to a personal account to finish work at home. The privacy officer should treat it as a potential breach: contain and investigate, determine whether PHI was accessed, perform a risk assessment covering the nature and extent of PHI and mitigation, notify per the breach rule if required, and correct the underlying access-control failure. Reasoning: the issue is not intent alone; safeguards, minimum necessary access, and documented risk assessment determine the response.
Traps that cost marks
Assuming accreditation equals licensure; treating HIPAA as always preempting state law; believing annual training alone satisfies compliance; writing a plan of correction without monitoring; ignoring business associates and personal devices.