NCMOA cheat sheet

Scheduling methods: fixed-interval (same length for every visit), variable-interval (length set by visit type or provider), wave (patients arrive at the start of an hour and are seen in sequence), and modified-wave (staggered arrivals mixing short and long visits).

Appointment types typically include new patient, established patient, follow-up, procedure, annual/wellness, and urgent add-on; each type carries a default duration that drives slot selection.

No-show and late-cancellation policies must be disclosed and documented; many practices require 24 hours' notice and may charge a fee only where state law and payer contracts permit.

Recall/reminder systems use tickler files or EHR recall flags to bring patients back at clinically indicated intervals (for example, 6-month hygiene recall or annual wellness visit).

Overbooking decisions weigh provider template capacity against expected no-show rate; double-booking urgent slots is a capacity decision, not a clinical one.

Telehealth scheduling requires capturing modality, platform, patient consent, and a backup contact number before the visit.

Cancellation backfill means contacting waitlist patients in priority order when a slot opens; the waitlist record should note patient availability windows.

Appointment reminders commonly use automated calls, text, or portal messages at intervals such as 7 days and 1-2 days before the visit.

Closed-loop referral communication requires a documented referral, a confirmation of receipt from the receiving clinician, and a report back to the referring provider.

Telephone encounters are documented with date, time, caller identity, reason, advice given, and the name of the person providing advice; these notes become part of the medical record.

Protected health information in voicemail, email, or text should follow the practice's minimum-necessary policy; unencrypted email generally requires patient authorization or explicit consent under HIPAA.

Patient communication barriers include limited English proficiency and low health literacy; qualified interpreters and teach-back are the standard responses, and family members should not be used as interpreters for clinical consent.

Payer communication typically flows through the provider portal, phone, or fax; each inquiry should record the payer representative's name, call reference number, and date.

Professional-to-professional communication about orders uses read-back for verbal or telephone orders, especially for high-alert medications and critical results.

Shared decision-making documentation notes options discussed, patient preferences, and the agreed plan.

Release of information to third parties (attorneys, employers, insurers) requires a valid authorization unless the request falls under treatment, payment, or operations.

The medical record must be accurate, timely, legible, and authenticated; entries are dated and signed by the author, and late entries are labeled as such rather than backdated.

Corrections are made by addendum or strike-through with initials and date; never obliterate or delete original text in an electronic or paper record.

The problem-oriented record uses SOAP structure: Subjective (patient report), Objective (exam and data), Assessment (diagnosis or impression), and Plan (orders, education, follow-up).

Transcription quality controls include dictation templates, a style guide for abbreviations, and a quality-assurance sample review; critical values and medication doses should be verified against the source.

Retention schedules are set by state law and payer contracts; federal Medicare conditions of participation require hospitals to retain records for at least 5 years, and many states require longer for adults and for minors.

The legal health record is the subset of data the organization designates as its official business record; secondary databases and shadow charts are not part of it.

Amendments requested by patients under HIPAA must be acted on within a defined timeframe (commonly 60 days, extendable once by 30 days) with written acceptance or denial.

Destruction of records must be documented and performed by a method that renders PHI unreadable (cross-cut shredding, certified digital wiping).

Revenue cycle stages: preregistration, registration, charge capture, coding, claim submission, payer adjudication, patient billing, and collections.

Copay is a fixed amount; coinsurance is a percentage of the allowed amount; deductible is the amount the patient pays before the plan begins paying.

The allowed amount equals the contracted fee; payer payment plus patient responsibility should equal the allowed amount for in-network claims.

Clean-claim rate is the percentage of claims accepted on first submission without edits; denial rate is denials divided by total claims submitted.

Days in accounts receivable (A/R) = (total A/R / total charges) x days in period; a common benchmark target is 30-40 days for a healthy practice.

CPT codes describe procedures and services; ICD-10-CM codes describe diagnoses and must support medical necessity for the CPT code billed; HCPCS Level II covers supplies, drugs, and equipment.

Modifiers (for example, -25 for a significant, separately identifiable E/M service on the same day as a procedure) change how a code is paid and must be supported by documentation.

E/M level selection under current guidelines uses either medical decision making or total time on the date of the encounter, not both interchangeably.

HIPAA Privacy Rule permits use and disclosure of PHI for treatment, payment, and health care operations without authorization; all other uses require a valid authorization.

Minimum necessary standard limits PHI disclosed to the amount reasonably needed for the purpose, with exceptions for treatment and disclosures to the patient.

HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI; a documented risk analysis is a required administrative safeguard.

Breach notification: affected individuals must be notified without unreasonable delay and no later than 60 days after discovery; HHS must be notified, and media notice is required for breaches affecting 500 or more residents of a state or jurisdiction.

The HIPAA right of access requires providing patients copies of their records within 30 days, extendable once by 30 days, at a reasonable, cost-based fee.

OSHA Bloodborne Pathogens Standard requires an exposure control plan, hepatitis B vaccination offered at no cost, PPE, and post-exposure evaluation.

CLIA regulates laboratory testing by complexity; waived tests carry the fewest requirements, and moderate- and high-complexity testing requires certification and proficiency testing.

Stark Law prohibits physician self-referral for designated health services paid by Medicare when a financial relationship exists, unless an exception applies; the Anti-Kickback Statute is a separate criminal prohibition on remunerations for referrals.

Eligibility and benefits verification confirms active coverage, effective date, plan type, copay, coinsurance, deductible status, and whether prior authorization is required.

Coordination of benefits determines which plan pays first; the birthday rule generally applies to dependent children of parents who share custody, with the parent whose birthday falls earlier in the year paying primary.

Prior authorization (preauthorization) is payer approval before a service; retroactive authorization requests are generally limited and may be denied.

Claim status inquiry uses the payer portal or an 837/276 transaction; the 277 response reports claim status and the 835 remittance advice reports payment.

Common denial reason codes include CO-16 (claim lacks information), CO-97 (service bundled or included in another service), and CO-50 (not deemed medically necessary).

Appeals follow the payer's level structure, usually starting with a first-level internal appeal and moving to external review; deadlines are typically 180 days from the denial for commercial plans.

Explanation of Benefits (EOB) is the patient-facing summary; the remittance advice (ERA/835) is the provider-facing payment detail; both show allowed amount, paid amount, and patient responsibility.

In-network vs. out-of-network status changes the allowed amount and patient cost sharing; out-of-network balance billing is restricted by state surprise-billing laws and the federal No Surprises Act.

Scheduling methods: fixed-interval (same length for every visit), variable-interval (length set by visit type or provider), wave (patients arrive at the start of an hour and are seen in sequence), and modified-wave (staggered arrivals mixing short and long visits).

Appointment types typically include new patient, established patient, follow-up, procedure, annual/wellness, and urgent add-on; each type carries a default duration that drives slot selection.

No-show and late-cancellation policies must be disclosed and documented; many practices require 24 hours' notice and may charge a fee only where state law and payer contracts permit.

Recall/reminder systems use tickler files or EHR recall flags to bring patients back at clinically indicated intervals (for example, 6-month hygiene recall or annual wellness visit).

Overbooking decisions weigh provider template capacity against expected no-show rate; double-booking urgent slots is a capacity decision, not a clinical one.

Telehealth scheduling requires capturing modality, platform, patient consent, and a backup contact number before the visit.

Cancellation backfill means contacting waitlist patients in priority order when a slot opens; the waitlist record should note patient availability windows.

Appointment reminders commonly use automated calls, text, or portal messages at intervals such as 7 days and 1-2 days before the visit.

Closed-loop referral communication requires a documented referral, a confirmation of receipt from the receiving clinician, and a report back to the referring provider.

Telephone encounters are documented with date, time, caller identity, reason, advice given, and the name of the person providing advice; these notes become part of the medical record.

Protected health information in voicemail, email, or text should follow the practice's minimum-necessary policy; unencrypted email generally requires patient authorization or explicit consent under HIPAA.

Patient communication barriers include limited English proficiency and low health literacy; qualified interpreters and teach-back are the standard responses, and family members should not be used as interpreters for clinical consent.

Payer communication typically flows through the provider portal, phone, or fax; each inquiry should record the payer representative's name, call reference number, and date.

Professional-to-professional communication about orders uses read-back for verbal or telephone orders, especially for high-alert medications and critical results.

Shared decision-making documentation notes options discussed, patient preferences, and the agreed plan.

Release of information to third parties (attorneys, employers, insurers) requires a valid authorization unless the request falls under treatment, payment, or operations.

The medical record must be accurate, timely, legible, and authenticated; entries are dated and signed by the author, and late entries are labeled as such rather than backdated.

Corrections are made by addendum or strike-through with initials and date; never obliterate or delete original text in an electronic or paper record.

The problem-oriented record uses SOAP structure: Subjective (patient report), Objective (exam and data), Assessment (diagnosis or impression), and Plan (orders, education, follow-up).

Transcription quality controls include dictation templates, a style guide for abbreviations, and a quality-assurance sample review; critical values and medication doses should be verified against the source.

Retention schedules are set by state law and payer contracts; federal Medicare conditions of participation require hospitals to retain records for at least 5 years, and many states require longer for adults and for minors.

The legal health record is the subset of data the organization designates as its official business record; secondary databases and shadow charts are not part of it.

Amendments requested by patients under HIPAA must be acted on within a defined timeframe (commonly 60 days, extendable once by 30 days) with written acceptance or denial.

Destruction of records must be documented and performed by a method that renders PHI unreadable (cross-cut shredding, certified digital wiping).

Revenue cycle stages: preregistration, registration, charge capture, coding, claim submission, payer adjudication, patient billing, and collections.

Copay is a fixed amount; coinsurance is a percentage of the allowed amount; deductible is the amount the patient pays before the plan begins paying.

The allowed amount equals the contracted fee; payer payment plus patient responsibility should equal the allowed amount for in-network claims.

Clean-claim rate is the percentage of claims accepted on first submission without edits; denial rate is denials divided by total claims submitted.

Days in accounts receivable (A/R) = (total A/R / total charges) x days in period; a common benchmark target is 30-40 days for a healthy practice.

CPT codes describe procedures and services; ICD-10-CM codes describe diagnoses and must support medical necessity for the CPT code billed; HCPCS Level II covers supplies, drugs, and equipment.

Modifiers (for example, -25 for a significant, separately identifiable E/M service on the same day as a procedure) change how a code is paid and must be supported by documentation.

E/M level selection under current guidelines uses either medical decision making or total time on the date of the encounter, not both interchangeably.

HIPAA Privacy Rule permits use and disclosure of PHI for treatment, payment, and health care operations without authorization; all other uses require a valid authorization.

Minimum necessary standard limits PHI disclosed to the amount reasonably needed for the purpose, with exceptions for treatment and disclosures to the patient.

HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI; a documented risk analysis is a required administrative safeguard.

Breach notification: affected individuals must be notified without unreasonable delay and no later than 60 days after discovery; HHS must be notified, and media notice is required for breaches affecting 500 or more residents of a state or jurisdiction.

The HIPAA right of access requires providing patients copies of their records within 30 days, extendable once by 30 days, at a reasonable, cost-based fee.

OSHA Bloodborne Pathogens Standard requires an exposure control plan, hepatitis B vaccination offered at no cost, PPE, and post-exposure evaluation.

CLIA regulates laboratory testing by complexity; waived tests carry the fewest requirements, and moderate- and high-complexity testing requires certification and proficiency testing.

Stark Law prohibits physician self-referral for designated health services paid by Medicare when a financial relationship exists, unless an exception applies; the Anti-Kickback Statute is a separate criminal prohibition on remunerations for referrals.

Eligibility and benefits verification confirms active coverage, effective date, plan type, copay, coinsurance, deductible status, and whether prior authorization is required.

Coordination of benefits determines which plan pays first; the birthday rule generally applies to dependent children of parents who share custody, with the parent whose birthday falls earlier in the year paying primary.

Prior authorization (preauthorization) is payer approval before a service; retroactive authorization requests are generally limited and may be denied.

Claim status inquiry uses the payer portal or an 837/276 transaction; the 277 response reports claim status and the 835 remittance advice reports payment.

Common denial reason codes include CO-16 (claim lacks information), CO-97 (service bundled or included in another service), and CO-50 (not deemed medically necessary).

Appeals follow the payer's level structure, usually starting with a first-level internal appeal and moving to external review; deadlines are typically 180 days from the denial for commercial plans.

Explanation of Benefits (EOB) is the patient-facing summary; the remittance advice (ERA/835) is the provider-facing payment detail; both show allowed amount, paid amount, and patient responsibility.

In-network vs. out-of-network status changes the allowed amount and patient cost sharing; out-of-network balance billing is restricted by state surprise-billing laws and the federal No Surprises Act.