Mixed Deck — All CHC Topics Flashcards

Which of the following is typically omitted from a benefit explanation?

Answer: Patient's medical history

A benefit explanation (Explanation of Benefits or EOB) details the financial aspects of healthcare services, including services rendered, dates, charges, and insurer payments. Its purpose is financial transparency regarding claims, not to provide clinical information, so a patient's comprehensive medical history is typically omitted.

What is the purpose of a 'charge master' (chargemaster) in hospital billing compliance?

Answer: A comprehensive list of all billable services, supplies, and fees used to generate claims

The chargemaster is the hospital's master price list containing every billable item with associated codes and charges, forming the basis for all claims submitted to payers.

Which of the following is a key output of a completed healthcare compliance risk assessment?

Answer: A prioritized risk register with recommended mitigation actions

The risk register documents identified risks, their scores, responsible owners, and recommended controls, serving as the central deliverable of the assessment.

What is the maximum civil monetary penalty per violation category for violations where the covered entity did not know and could not have known of the violation?

Answer: $100 per violation, up to $25,000 per year

The lowest tier of civil monetary penalties applies to unknowing violations at $100–$50,000 per violation, up to $25,000 per identical violation per year.

A compliance investigation uncovers evidence of a criminal act by a hospital employee. What is the FIRST step the compliance officer should take?

Answer: Consult with legal counsel and the organization's leadership

Discovering criminal activity requires immediate consultation with legal counsel to determine reporting obligations and protect the organization.

A compliance officer is reviewing a case where a nurse submitted false time records. The investigation is complete and discipline is warranted. Which sequence reflects BEST practice?

Answer: Investigate thoroughly, document findings, consult HR and legal, then impose proportional discipline

Best practice requires completing a thorough investigation and consulting HR and legal before imposing discipline to ensure fairness, accuracy, and legal defensibility.

Which regulation requires healthcare organizations to screen employees against federal exclusion databases prior to hire?

Answer: OIG exclusion screening requirements under the Social Security Act

The Social Security Act prohibits federal healthcare programs from paying for services rendered by excluded individuals, making pre-hire exclusion screening a compliance necessity.

The Office of Inspector General (OIG) has the authority to exclude individuals and entities from participation in federal healthcare programs. Which of the following would trigger a MANDATORY exclusion?

Answer: A felony conviction for patient abuse or neglect.

The OIG is required by law to exclude individuals and entities convicted of certain criminal offenses. These mandatory exclusions include felony convictions for Medicare or Medicaid fraud, patient abuse or neglect, and other healthcare-related felonies. The other options listed are grounds for a permissive exclusion, where the OIG has discretion.

Which of the following best describes the role of compliance champions or departmental liaisons in a training program?

Answer: They serve as local points of contact who reinforce compliance messages, answer questions, and facilitate training within their departments

Compliance champions extend the reach of the compliance program by embedding compliance awareness within each department and supporting peer-level education.

Which of the following is a key requirement for the ongoing management of compliance policies and procedures?

Answer: A system for annual review and updates to reflect changes in laws, regulations, and business operations.

Compliance policies and procedures are not static documents. An essential component of an effective compliance program is to have a system in place for their periodic (at least annual) review and update. This ensures they remain current with changing laws, regulations, and the organization's own operational realities.

When must you give participants a "Summary Plan Description" (SPD)?

Answer: Within 90 days of being covered

The Summary Plan Description (SPD) is a crucial document required by ERISA that provides participants with an easy-to-understand summary of their health plan's benefits, rights, and responsibilities. Plan administrators must provide this document to new participants within 90 days of them becoming covered by the plan. It serves as the primary source of information for participants about their plan.

A compliance officer discovers that a physician has been receiving monthly payments from a medical device company with no documented services being performed. The FIRST recommended action is:

Answer: Conduct a prompt internal investigation to determine the nature and extent of the issue

Best practice and OIG guidance call for a prompt, thorough internal investigation before taking action or making external reports, to understand the full scope of the issue.

A key distinction between the Stark Law and the Anti-Kickback Statute (AKS) is that the Stark Law:

Answer: applies only to referrals made by physicians for designated health services (DHS).

The Stark Law is more narrowly focused than the AKS. It specifically prohibits physicians from referring Medicare or Medicaid patients for 'designated health services' to entities with which they (or an immediate family member) have a financial relationship, unless an exception applies. The AKS applies more broadly to any remuneration for referrals of any federal healthcare business and is not limited to physicians or DHS.

The 'safe harbor' regulations under the Anti-Kickback Statute are important because they:

Answer: Describe arrangements that will not be prosecuted as kickbacks even if they technically involve remuneration

AKS safe harbors protect specified arrangements from prosecution because, while they may involve remuneration, they are unlikely to cause the types of abuses the statute was designed to prevent.

How long do you have to respond to a written request for a "plan document"?

Answer: 30 Days

Under the Employee Retirement Income Security Act (ERISA), plan administrators are legally obligated to respond to a written request for plan documents, such as a Summary Plan Description (SPD) or the plan agreement, within 30 days. This timeframe ensures participants have timely access to important information about their benefits. Failure to comply can result in penalties.

Which of the following is an example of 'credit card skimming' adapted to the healthcare context — i.e., a practice that involves billing the same service to multiple payers?

Answer: Duplicate billing

Duplicate billing involves submitting the same claim more than once to the same or different payers to receive multiple payments for a single service.

Which standard governs how healthcare organizations must safeguard electronic protected health information (ePHI) under federal law?

Answer: HIPAA Security Rule

The HIPAA Security Rule establishes national standards for protecting ePHI through administrative, physical, and technical safeguards.

Which federal agency primarily investigates and prosecutes healthcare fraud under the False Claims Act?

Answer: The Department of Justice (DOJ)

The Department of Justice prosecutes False Claims Act cases, though the OIG investigates and the DOJ litigates civil and criminal FCA violations.

Which disciplinary principle requires that employees in similar roles who commit comparable violations receive comparable sanctions?

Answer: Consistency

Consistency requires that the organization apply discipline equitably across similarly situated employees to avoid claims of discrimination or favoritism.

A covered entity discovers that a business associate has experienced a breach of unsecured protected health information (PHI) affecting 450 individuals. The business associate notified the covered entity 50 days after discovering the breach. According to the HIPAA Breach Notification Rule, what is the covered entity's primary notification responsibility?

Answer: Notify the affected individuals and the Secretary of HHS annually, as the breach affects fewer than 500 individuals.

For breaches affecting fewer than 500 individuals, covered entities are required to notify the Secretary of HHS by submitting an annual report of all such breaches within 60 days after the end of the calendar year in which the breaches were discovered. They must still notify the affected individuals without unreasonable delay and within 60 days of discovery.