CMC Compliance & Regulatory Knowledge 2 — Questions and Answers
Question 1: Under HIPAA, which action by a covered entity constitutes a breach requiring patient notification?
- Accessing a patient record for treatment purposes
- An employee viewing a celebrity patient's records out of curiosity (Correct answer)
- Sending lab results to the ordering physician
- Sharing de-identified data with a researcher
Correct answer: An employee viewing a celebrity patient's records out of curiosity
Unauthorized access to PHI for non-treatment, non-payment, and non-operations purposes—such as curiosity—constitutes a HIPAA breach requiring notification.
Question 2: The False Claims Act allows private individuals to file lawsuits on behalf of the government through which mechanism?
- Habeas corpus
- Qui tam provisions (Correct answer)
- Subrogation rights
- Mandamus petitions
Correct answer: Qui tam provisions
The False Claims Act's qui tam provisions allow whistleblowers (relators) to sue on the government's behalf and receive a portion of any recovery.
Question 3: A medical coder discovers a pattern of upcoding in claims submitted over the past year. What is the FIRST recommended step under a compliance program?
- Immediately notify the OIG
- Report findings to the compliance officer or hotline (Correct answer)
- Contact the payer directly to retract claims
- Inform the patient of the billing error
Correct answer: Report findings to the compliance officer or hotline
Compliance programs require employees to report suspected violations internally to the compliance officer or designated hotline as the first step.
Question 4: Which federal regulation governs the Medicare Advantage (Part C) program's coding and risk adjustment requirements?
- 42 CFR Part 422 (Correct answer)
- 45 CFR Part 164
- 42 CFR Part 482
- 29 CFR Part 1910
Correct answer: 42 CFR Part 422
42 CFR Part 422 governs Medicare Advantage organizations, including risk adjustment data validation (RADV) audits and coding accuracy requirements.
Question 5: What is the primary purpose of the OIG's List of Excluded Individuals/Entities (LEIE)?
- To identify providers eligible for Medicaid bonuses
- To prevent Medicare and Medicaid payment to sanctioned individuals or entities (Correct answer)
- To track malpractice settlements nationwide
- To certify compliance officers for healthcare organizations
Correct answer: To prevent Medicare and Medicaid payment to sanctioned individuals or entities
The LEIE identifies individuals and entities excluded from participation in federal healthcare programs; billing for services by excluded parties results in significant penalties.
Question 6: A hospital's compliance audit finds that 15% of DRG assignments were incorrect, leading to overpayments. Which is the CORRECT course of action?
- Ignore it if the error rate is below 20%
- Self-disclose and repay the overpayments to CMS within 60 days (Correct answer)
- Wait for the next MAC audit to address the discrepancies
- Adjust only future claims and leave past claims unchanged
Correct answer: Self-disclose and repay the overpayments to CMS within 60 days
The ACA's 60-day rule requires providers to report and return identified overpayments to federal healthcare programs within 60 days of identification.
Question 7: Which element is NOT one of the seven components recommended in the OIG's Compliance Program Guidance for hospitals?
- Written policies and procedures
- Designated compliance officer
- Annual patient satisfaction surveys (Correct answer)
- Effective training and education
Correct answer: Annual patient satisfaction surveys
Patient satisfaction surveys are not among the OIG's seven recommended compliance program elements; the seven focus on internal controls, training, auditing, and reporting.
CMC Compliance & Regulatory Knowledge 2
Under HIPAA, which action by a covered entity constitutes a breach requiring patient notification?