CPHRM Regulatory Compliance 5 — Questions and Answers
Question 1: The Deficit Reduction Act of 2005 requires hospitals receiving more than $5 million annually in Medicaid payments to provide employees with information about:
- Medicaid billing requirements and documentation standards
- The False Claims Act and whistleblower protections (Correct answer)
- The hospital's charity care policies and eligibility criteria
- CMS audit rights and record retention requirements
Correct answer: The False Claims Act and whistleblower protections
The Deficit Reduction Act requires affected entities to educate employees about the federal and applicable state False Claims Acts, whistleblower protections, and the entity's policies for detecting and preventing fraud.
Question 2: Under HIPAA's Breach Notification Rule, a covered entity must notify affected individuals of a breach of unsecured PHI within:
- 30 days of discovery
- 60 days of discovery (Correct answer)
- 72 hours of discovery
- 90 days of discovery
Correct answer: 60 days of discovery
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days following discovery of a breach.
Question 3: A hospital's compliance program must include which element identified in the OIG's seven elements of an effective compliance program?
- A dedicated compliance department with at least 10 staff members
- Ongoing monitoring and auditing of compliance risks (Correct answer)
- Board-level approval of all compliance policies
- Mandatory external audits by an independent CPA firm
Correct answer: Ongoing monitoring and auditing of compliance risks
OIG's seven elements include: written standards, compliance officer/committee, training, communication channels, auditing/monitoring, disciplinary guidelines, and response to detected offenses — ongoing auditing and monitoring is one of the seven.
Question 4: A hospital employee reports to the compliance hotline that their supervisor instructed them to alter patient records to avoid a deficiency citation. This situation MOST immediately implicates:
- HIPAA Privacy Rule violations
- CMS Conditions of Participation record integrity requirements and potential obstruction (Correct answer)
- Joint Commission documentation standards
- State medical records retention laws
Correct answer: CMS Conditions of Participation record integrity requirements and potential obstruction
Altering medical records to conceal deficiencies violates CMS CoPs record integrity requirements and could constitute obstruction of a federal health care program audit, carrying significant legal consequences.
Question 5: The primary risk management concern with a hospital's non-compete agreements for employed physicians is:
- Potential HIPAA violations if patient lists are shared
- Antitrust implications and interference with patient access to care (Correct answer)
- Violation of the Stark Law's compensation exception requirements
- Non-compliance with medical staff bylaws
Correct answer: Antitrust implications and interference with patient access to care
Overly broad non-compete agreements for physicians raise antitrust concerns and can impair patient access to care, drawing FTC and state attorney general scrutiny.
Question 6: Under the CMS Hospital Conditions of Participation, a hospital must have a written policy addressing patient rights. Which right must be explicitly addressed?
- The right to choose one's own health insurance plan
- The right to receive care in a safe setting and be free from all forms of abuse (Correct answer)
- The right to request a specific physician from the medical staff
- The right to receive a private room when available
Correct answer: The right to receive care in a safe setting and be free from all forms of abuse
CMS CoPs §482.13 explicitly requires hospitals to have a patient rights process that includes the right to receive care in a safe setting and to be free from all forms of abuse or harassment.
Question 7: A compliance officer reviewing a physician arrangement discovers the compensation is above fair market value. The MOST significant legal risk this creates is:
- Violation of the HIPAA Privacy Rule
- Violation of the Anti-Kickback Statute and potentially the Stark Law (Correct answer)
- Non-compliance with Joint Commission credentialing standards
- Violation of EMTALA's stabilization requirements
Correct answer: Violation of the Anti-Kickback Statute and potentially the Stark Law
Compensation above fair market value is a hallmark indicator of improper remuneration under the Anti-Kickback Statute and may also fail a Stark Law compensation exception, exposing the hospital to significant False Claims Act liability.
CPHRM Regulatory Compliance 5
The Deficit Reduction Act of 2005 requires hospitals receiving more than $5 million annually in Medicaid payments to provide employees with information about: