Compliance and Regulatory
What this domain tests
Compliance and Regulatory tests the legal and ethical rules that shape access work: HIPAA privacy and security, EMTALA, Medicare Secondary Payer, Advance Beneficiary Notice requirements, consent, and basic fraud, waste, and abuse awareness. Questions often place a routine registration task inside a regulatory conflict.
Core rules and concepts
- HIPAA: use and disclose only the minimum necessary protected health information (PHI). Verify identity and authority before releasing information; do not discuss PHI in public areas or leave screens visible.
- Breach response: report suspected breaches immediately. Notification generally must occur without unreasonable delay and no later than 60 days after discovery.
- EMTALA: any patient who comes to the emergency department requesting examination or treatment for a condition receives a medical screening examination and stabilizing treatment regardless of insurance or ability to pay. Registration and financial discussions may occur but must not delay screening or stabilization.
- Medicare Secondary Payer: ask the MSP questionnaire, document answers, and bill the correct primary payer first.
- ABN: use a voluntary, plain-language notice for Medicare items that may be denied as not medically necessary; state the specific item, reason, and estimated cost. Do not use a blanket ABN or one for services Medicare never covers.
- Consent and authorization: obtain the correct consent for treatment and a valid authorization before releasing PHI when required.
Worked example
A patient with chest pain arrives at the emergency department. The registrar begins asking for a deposit before triage because the patient has no insurance. This is wrong. EMTALA requires a medical screening examination and stabilizing treatment without delaying for payment. The registrar may collect registration data concurrently if it does not delay care, but financial counseling and payment discussion must wait until the clinical screening and stabilization are complete or can occur without interference.
Traps
Placing a blanket ABN at the front desk; discussing a patient's diagnosis in an elevator; delaying emergency screening to verify insurance; assuming a signed general consent permits any release of records; and failing to document MSP answers.