CHC Certified in Healthcare Compliance Exam — Questions and Answers

Question 1: Under the Anti-Kickback Statute (AKS), which element must the government prove to establish a criminal violation?

The arrangement lacked a written contract
The defendant acted with willful intent to induce or reward referrals (Correct answer)
The referral resulted in a Medicare overpayment
The defendant received payment in excess of fair market value

Correct answer: The defendant acted with willful intent to induce or reward referrals

The AKS requires proof that the defendant acted knowingly and willfully to offer, pay, solicit, or receive remuneration to induce or reward referrals of federal healthcare program business.

Question 2: Whom do you need to notify of the "initial COBRA"?

Covered Employees and Covered Spouse (Correct answer)
Covered Employees
Anyone covered under the Plan
None of the above

Correct answer: Covered Employees and Covered Spouse

Under the Consolidated Omnibus Budget Reconciliation Act (COBRA), the initial COBRA notice must be provided to both covered employees and their covered spouses. This notice informs them of their rights to continue health coverage under certain qualifying events, ensuring both parties are aware of their options for extended benefits.

Question 3: An effective compliance education program should ensure that training is provided to employees at which key intervals?

Every two years to align with CHC certification renewal cycles.
Upon hire, annually, and when policies or job duties change significantly. (Correct answer)
Whenever a government agency releases a new advisory opinion.
Only upon the initial hiring of the employee.

Correct answer: Upon hire, annually, and when policies or job duties change significantly.

OIG guidance and compliance best practices state that training must be an ongoing process, not a one-time event. This includes initial training for new hires, regular periodic training (typically annually) for all employees, and additional, targeted training when an employee's responsibilities change or when new laws, regulations, or policies that affect their role are introduced.

Question 4: During a risk assessment, a compliance analyst finds that a control exists on paper but is not being followed in practice. This gap is BEST described as:

A documentation error
An operating effectiveness failure (Correct answer)
An inherent risk
A design deficiency

Correct answer: An operating effectiveness failure

A control that exists but is not consistently followed represents an operating effectiveness failure, as the control design is adequate but its execution is not.

Question 5: What is a Recovery Audit Contractor (RAC) and what is its role in billing compliance?

A state agency that audits Medicaid billing
An internal hospital audit team focused on revenue cycle
A CMS-contracted auditor that identifies and recovers improper Medicare payments (Correct answer)
A private accreditation body for billing departments

Correct answer: A CMS-contracted auditor that identifies and recovers improper Medicare payments

RACs are private contractors authorized by CMS to review Medicare claims and recover improper payments, working on a contingency fee basis.

Question 6: A procedure document should differ from a policy document in that a procedure document primarily:

Sets high-level expectations without operational detail
Describes the legal rationale for compliance requirements
Articulates the organization's values and mission
Provides step-by-step instructions for completing a specific task (Correct answer)

Correct answer: Provides step-by-step instructions for completing a specific task

Procedures operationalize policies by providing detailed, sequential steps employees follow to accomplish a specific task.

Question 7: A healthcare organization's policy requires dual authorization for wire transfers over $100,000. This control is designed primarily to prevent:

Coding and billing errors
Fraudulent financial transactions and embezzlement (Correct answer)
Violations of the Stark Law
HIPAA privacy breaches

Correct answer: Fraudulent financial transactions and embezzlement

Dual authorization controls on large financial transactions are a segregation-of-duties safeguard against internal fraud and embezzlement.

Question 8: The HIPAA Breach Notification Rule's 'harm threshold' was eliminated by which regulation, requiring notification for all breaches unless the low probability of compromise is demonstrated?

The Omnibus Rule of 2013 (Correct answer)
The Privacy Rule of 2003
The Security Rule of 2005
The HITECH Act of 2009

Correct answer: The Omnibus Rule of 2013

The 2013 Omnibus Rule replaced the harm threshold with a four-factor risk assessment, requiring notification unless the covered entity demonstrates a low probability that PHI was compromised.

Question 9: In a compliance risk assessment, 'inherent risk' refers to:

Risk remaining after controls are applied
Risk that exists before any controls are in place (Correct answer)
Risk identified by external auditors
Risk transferred to a third party

Correct answer: Risk that exists before any controls are in place

Inherent risk is the level of risk present in a process or activity before any mitigating controls are implemented.

Question 10: An effective compliance program is described by the OIG as having seven core elements. Which of the following is one of these fundamental elements?

Maintaining a specific ratio of compliance staff to total employees.
Guaranteeing that no compliance violations will ever occur.
Utilizing a government-mandated compliance software platform.
Conducting internal monitoring and auditing. (Correct answer)

Correct answer: Conducting internal monitoring and auditing.

The OIG's Seven Elements of an Effective Compliance Program are the foundational framework for healthcare compliance. 'Internal Monitoring and Auditing' is a critical element that focuses on the ongoing evaluation of the program's effectiveness and adherence to policies.

Question 11: Under HIPAA, which of the following represents a permissible secondary use of PHI for research without patient authorization?

Selling de-identified data to a research broker for profit
Posting patient case studies on a public research website
Sharing identified PHI with a pharmaceutical company for drug marketing
Using a limited data set with a data use agreement for research (Correct answer)

Correct answer: Using a limited data set with a data use agreement for research

A covered entity may share a limited data set (with certain direct identifiers removed) for research under a data use agreement without patient authorization.

Question 12: What is the PRIMARY purpose of conducting exit interviews as part of a compliance program?

To determine compensation for final paychecks
To update the employee's personnel file
To gather information about potential compliance issues from departing employees (Correct answer)
To fulfill a legal requirement under HIPAA

Correct answer: To gather information about potential compliance issues from departing employees

Exit interviews can uncover compliance concerns that departing employees may be more willing to share when leaving the organization.

Question 13: Under the HITECH Act, which party became directly liable for compliance with certain HIPAA Security Rule provisions?

HHS Office for Civil Rights investigators
Covered entities only
Patients and their authorized representatives
Business associates directly, not just through BAAs (Correct answer)

Correct answer: Business associates directly, not just through BAAs

HITECH made business associates directly liable for compliance with many HIPAA Security Rule and Privacy Rule provisions, not just contractually liable through BAAs.

Question 14: What is the significance of documenting training completion records for at least six years in a healthcare compliance program?

It is the minimum period required by state nursing boards
It is required by The Joint Commission for accreditation
It aligns with the six-year lookback period used in Medicare/Medicaid fraud investigations (Correct answer)
It satisfies IRS record retention requirements

Correct answer: It aligns with the six-year lookback period used in Medicare/Medicaid fraud investigations

Six years mirrors the False Claims Act's statute of limitations, ensuring organizations can demonstrate training occurred during any investigated period.

Question 15: What is 'upcoding' in the context of healthcare billing compliance?

Using outdated CPT codes on claims
Submitting duplicate claims for the same service
Assigning codes before a procedure is completed
Billing for a service with a higher-value code than the service actually performed (Correct answer)

Correct answer: Billing for a service with a higher-value code than the service actually performed

Upcoding involves intentionally billing a more expensive procedure code than the one actually performed to receive higher reimbursement.

Question 16: When a compliance officer conducts a root cause analysis following a compliance incident, what is the PRIMARY goal?

To determine whether to self-disclose the incident
To assign personal blame to the employee who committed the violation
To calculate the financial penalty owed to regulators
To identify the underlying systemic factors that allowed the violation to occur (Correct answer)

Correct answer: To identify the underlying systemic factors that allowed the violation to occur

Root cause analysis focuses on identifying systemic breakdowns in processes, training, or controls—not individual blame—so that effective corrective actions can be designed.

Question 17: Which law introduced a fresh set of guidelines for cooperative responsibility?

Sarbanes-Oxley Act (Correct answer)
Stark law
United States Patriot Act
Foreign Corrupt Practices Act

Correct answer: Sarbanes-Oxley Act

The Sarbanes-Oxley Act (SOX) of 2002 was enacted in response to major corporate and accounting scandals. It introduced stringent new rules for corporate governance, financial reporting, and accountability, including fresh guidelines for cooperative responsibility among executives and auditors to ensure accuracy and transparency in financial statements.

Question 18: A Business Associate Agreement (BAA) must include which of the following provisions?

A provision limiting the BA's subcontractors to US-based firms only
Permitted and required uses and disclosures of PHI by the business associate (Correct answer)
The business associate's annual revenue disclosures
A requirement for the BA to obtain malpractice insurance

Correct answer: Permitted and required uses and disclosures of PHI by the business associate

A BAA must describe the permitted and required uses and disclosures of PHI that the business associate may make on behalf of the covered entity.

Question 19: Under the OIG's Seven Elements of an Effective Compliance Program, policies and procedures should be reviewed at minimum:

Every five years
Only when a violation is discovered
Annually or when significant regulatory changes occur (Correct answer)
Every ten years unless laws change

Correct answer: Annually or when significant regulatory changes occur

The OIG recommends policies be reviewed at least annually and updated promptly when laws, regulations, or organizational operations change.

Question 20: What is the HIPAA Security Rule's requirement for a covered entity's risk analysis?

It must be conducted only at initial implementation
It must be conducted annually regardless of changes
It must be performed by an outside third-party auditor
It must be an accurate and thorough assessment of risks to ePHI (Correct answer)

Correct answer: It must be an accurate and thorough assessment of risks to ePHI

The Security Rule requires covered entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability.

Question 21: What is a 'Comparative Billing Report' (CBR) issued by CMS used for in compliance?

To audit payroll records for compliance
To compare hospital accreditation scores
To show a provider how their billing patterns compare to peers, flagging potential outliers (Correct answer)
To compare state Medicaid billing rules

Correct answer: To show a provider how their billing patterns compare to peers, flagging potential outliers

CBRs provide providers with data comparing their billing patterns to those of similar providers, helping them identify and correct potential anomalies before they become enforcement targets.

Question 22: Under the Civil Monetary Penalties Law (CMPL), what is the maximum per-claim penalty for knowingly presenting a false claim to Medicare?

$10,000 (Correct answer)
$25,000
$5,000
$50,000

Correct answer: $10,000

The CMPL imposes penalties of up to $10,000 per false or fraudulent claim submitted to Medicare or Medicaid, in addition to three times the amount claimed.

Question 23: Which HIPAA standard governs the electronic exchange of health information for claims and remittance advice?

The Breach Notification Rule
The Transactions and Code Sets Rule (Correct answer)
The Privacy Rule
The Security Rule

Correct answer: The Transactions and Code Sets Rule

The HIPAA Transactions and Code Sets Rule establishes standards for electronic health care transactions, including claims and remittance advice using ASC X12 standards.

Question 24: When selecting a sample for an audit of claims, which methodology is most appropriate for ensuring that high-dollar claims are adequately represented in the review?

Stratified random sampling (Correct answer)
Convenience sampling
Systematic sampling
Simple random sampling

Correct answer: Stratified random sampling

Stratified random sampling involves dividing the entire population of claims into different subgroups, or 'strata'—in this case, by dollar value. A random sample is then taken from each stratum. This method ensures that high-risk areas, such as high-dollar claims, are included in the audit sample, providing a more targeted and risk-based review than a simple random sample might.

Question 25: During a routine internal audit of physician billing, a small sample of 10 claims for a specific high-level E/M code reveals a 30% error rate due to insufficient documentation. What is the compliance professional's BEST next step?

Expand the audit to a statistically valid random sample to determine the scope of the problem. (Correct answer)
Immediately report the physician to the OIG for potential fraud.
Provide mandatory, system-wide training on E/M coding for all providers.
Discipline the physician for failing the audit.

Correct answer: Expand the audit to a statistically valid random sample to determine the scope of the problem.

A small, non-statistical sample is not sufficient to draw conclusions about the overall error rate or financial impact. The best practice is to expand the review to a statistically valid random sample to accurately quantify the scope and magnitude of the issue before determining appropriate corrective action, such as education or repayment.

Question 26: Under a Corporate Integrity Agreement (CIA), what type of auditing is typically required of the organization?

Annual audits conducted solely by the OIG
Ad hoc self-auditing based on leadership discretion
Independent Review Organization (IRO) audits of claims and arrangements (Correct answer)
Peer review by similar healthcare organizations

Correct answer: Independent Review Organization (IRO) audits of claims and arrangements

CIAs typically require the organization to engage an Independent Review Organization (IRO) to conduct objective audits of claims, arrangements, or other specified areas.

Question 27: A healthcare entity receives a subpoena from the DOJ for billing records. What is the compliance officer's first priority?

Notify the CEO and preserve all relevant documents under a litigation hold (Correct answer)
Destroy any records that may be incriminating
Immediately produce all records to avoid penalties
Contact CMS to report the investigation

Correct answer: Notify the CEO and preserve all relevant documents under a litigation hold

Upon receiving a government subpoena, the compliance officer must issue a litigation hold to preserve all relevant documents and promptly notify senior leadership and legal counsel.

Question 28: In the context of healthcare compliance, what does 'HEAT' stand for?

Hospital Error Analysis and Tracking
Health Care Fraud Prevention and Enforcement Action Team (Correct answer)
Healthcare Expenditure Accountability Team
Healthcare Enforcement and Audit Taskforce

Correct answer: Health Care Fraud Prevention and Enforcement Action Team

HEAT (Health Care Fraud Prevention and Enforcement Action Team) is a joint DOJ and HHS initiative to prevent and combat Medicare and Medicaid fraud.

Question 29: A compliance officer observes an increase in hotline reports related to potential conflicts of interest among clinical researchers. The annual training covers this topic generally. What is the MOST appropriate next step for the compliance officer to take?

Develop focused, scenario-based training specifically for the research department. (Correct answer)
Conclude that the training is working well because it encourages reporting.
Discipline the managers of the departments where the researchers work.
Increase the frequency of the existing general training from annual to quarterly for all staff.

Correct answer: Develop focused, scenario-based training specifically for the research department.

An increase in specific hotline reports suggests that while general awareness may exist, the nuances of the rules are not fully understood or being applied correctly by a specific group. Simply repeating the same general training is unlikely to resolve the issue. The best approach is to develop targeted, practical, and scenario-based training for the specific audience involved (the researchers) to address the behaviors and risks identified through the hotline data.

Question 30: A hospital compliance team is designing training for clinical staff on HIPAA. Which approach best addresses the needs of this audience?

Using generic privacy training written for all industries
Focusing only on the financial penalties for HIPAA violations
Providing a written policy manual without interactive elements
Creating scenario-based training using realistic clinical situations and patient data handling examples (Correct answer)

Correct answer: Creating scenario-based training using realistic clinical situations and patient data handling examples

Scenario-based training grounded in real clinical contexts improves relevance, engagement, and retention for clinical staff.

Question 31: Under the Sentencing Guidelines for Organizations, a robust compliance training program can reduce an organization's culpability score. What must the training program demonstrate to receive this credit?

That 100% of employees completed training without exception
That it was designed and implemented by a licensed attorney
That training was conducted by an external vendor
That it was effectively communicated and that the organization took reasonable steps to ensure compliance (Correct answer)

Correct answer: That it was effectively communicated and that the organization took reasonable steps to ensure compliance

The Sentencing Guidelines grant culpability score reductions when organizations demonstrate that compliance programs, including training, were genuinely effective and not merely nominal.

Question 32: A compliance team wants to validate that their risk assessment methodology is consistent with industry standards. Which resource BEST supports this?

CMS Medicare Advantage marketing guidelines only
Joint Commission National Patient Safety Goals
IRS Publication 15 (Employer Tax Guide)
OIG Compliance Program Guidance and the COSO Enterprise Risk Management Framework (Correct answer)

Correct answer: OIG Compliance Program Guidance and the COSO Enterprise Risk Management Framework

The OIG compliance program guidance and the COSO ERM framework together provide the most authoritative and widely accepted standards for healthcare compliance risk assessment methodology.

Question 33: Which of the following best describes the primary purpose of ongoing monitoring activities in a healthcare compliance program?

To provide an annual, independent assessment of the compliance program's effectiveness.
To satisfy the requirements of external government auditors.
To detect and correct compliance issues in real-time or near real-time. (Correct answer)
To serve as the sole basis for employee disciplinary actions.

Correct answer: To detect and correct compliance issues in real-time or near real-time.

Ongoing monitoring is designed to be a continuous process that allows for the early detection of potential compliance issues, enabling prompt correction before they become systemic problems. Audits, by contrast, are periodic, point-in-time assessments.

Question 34: When an organization decides to exclude an individual from participation in its operations following a compliance violation, it must first check the:

Employee's social media profiles
Medicare Advantage plan enrollment database
OIG List of Excluded Individuals and Entities (LEIE) and SAM.gov (Correct answer)
State tax records for outstanding liens

Correct answer: OIG List of Excluded Individuals and Entities (LEIE) and SAM.gov

Before and after any employment or contracting action, organizations must screen against the LEIE and SAM.gov to ensure they do not employ or contract with federally excluded parties.

Question 35: A compliance officer is rating risks on a 1-5 scale for both likelihood and impact. What does this technique produce?

A risk score used to rank and prioritize risks (Correct answer)
A corrective action plan
A compliance audit report
A regulatory submission document

Correct answer: A risk score used to rank and prioritize risks

Multiplying likelihood and impact scores produces a composite risk score that allows the compliance team to rank and prioritize mitigation efforts.

Question 36: What is the PRIMARY purpose of benchmarking against OIG Work Plans during a compliance risk assessment?

To determine employee compensation benchmarks
To replace internal audit findings
To satisfy Joint Commission accreditation requirements
To identify areas regulators are actively scrutinizing for potential fraud and abuse (Correct answer)

Correct answer: To identify areas regulators are actively scrutinizing for potential fraud and abuse

The OIG Work Plan highlights audit and enforcement priorities, helping organizations proactively focus their risk assessments on areas of heightened regulatory interest.

Question 37: What does 'materiality' mean in the context of evaluating potential False Claims Act liability during an investigation?

Whether the dollar amount of the overpayment exceeds $10,000
Whether the violation involved physical harm to a patient
Whether the false statement or omission had a natural tendency to influence the government's payment decision (Correct answer)
Whether the conduct was intentional rather than negligent

Correct answer: Whether the false statement or omission had a natural tendency to influence the government's payment decision

The Supreme Court's Escobar decision established that FCA liability requires the false statement to be material to the government's decision to pay.

Question 38: A 'root cause analysis' conducted as part of a corrective action plan should PRIMARILY answer which question?

Who is personally liable for the violation?
Why did the violation occur and what systemic conditions enabled it? (Correct answer)
How much revenue was lost due to the violation?
Which competitor organization has the same problem?

Correct answer: Why did the violation occur and what systemic conditions enabled it?

Root cause analysis identifies the underlying systemic or process failures that allowed a violation to occur, enabling targeted corrective actions.

Question 39: A patient reviews their medical record and finds an error in their diagnosis history. Under the HIPAA Privacy Rule, the patient has the right to request an amendment to their PHI. What is the covered entity's obligation after receiving this request?

Inform the patient that medical records cannot be changed once they are finalized.
Require the patient to obtain a court order before any amendment can be considered.
Immediately delete the incorrect information from the record as requested by the patient.
Act on the request within a reasonable time, typically within 60 days, by either making the amendment or providing a written denial. (Correct answer)

Correct answer: Act on the request within a reasonable time, typically within 60 days, by either making the amendment or providing a written denial.

The HIPAA Privacy Rule gives individuals the right to request an amendment to their PHI in a designated record set. The covered entity must act on the request, typically within 60 days (with a possible 30-day extension). It can either accept the amendment and notify the patient and relevant parties, or provide the individual with a timely, written denial explaining the basis for the decision and their right to submit a disagreement.

Question 40: The 'Yates Memo' issued by the DOJ in 2015 primarily focused healthcare compliance on which area?

Expanding qui tam whistleblower protections
Strengthening HIPAA enforcement
Holding individual employees accountable for corporate misconduct (Correct answer)
Requiring board-level compliance oversight

Correct answer: Holding individual employees accountable for corporate misconduct

The Yates Memo directed DOJ attorneys to focus on individual accountability in corporate misconduct cases, emphasizing that individuals—not just organizations—should be held responsible.

Question 41: Which of the following scenarios would MOST likely require a self-disclosure to the OIG's Self-Disclosure Protocol?

A minor HIPAA administrative safeguard deficiency
Potential violations of the Anti-Kickback Statute involving physician arrangements (Correct answer)
A coding error that resulted in a $50 underpayment
A documentation issue with no financial impact

Correct answer: Potential violations of the Anti-Kickback Statute involving physician arrangements

The OIG Self-Disclosure Protocol is designed for providers who identify potential fraud violations, particularly Anti-Kickback Statute or False Claims Act issues.

Question 42: Under the False Claims Act, what is 'qui tam' litigation?

A mandatory self-disclosure to the OIG
A government audit of Medicare claims
A type of compliance certification
A whistleblower lawsuit filed on behalf of the government by a private individual (Correct answer)

Correct answer: A whistleblower lawsuit filed on behalf of the government by a private individual

Qui tam provisions of the False Claims Act allow private individuals (relators) to sue on behalf of the government and share in any recovery.

Question 43: Which oversight body enforces the Emergency Medical Treatment and Labor Act (EMTALA)?

State Health Departments
DOJ
CMS (Correct answer)
OIG

Correct answer: CMS

CMS is responsible for enforcing EMTALA, which requires hospitals participating in Medicare to provide stabilizing treatment to all patients regardless of ability to pay.

Question 44: A compliance officer is reviewing the results of a claim audit and wants to report findings to leadership. Which metric BEST communicates the financial impact of identified errors?

The extrapolated overpayment amount based on the sample error rate (Correct answer)
The confidence interval width of the audit sample
The number of coders who submitted incorrect claims
The total number of claims reviewed in the sample

Correct answer: The extrapolated overpayment amount based on the sample error rate

Extrapolating the sample error rate to the full population provides leadership with the estimated financial exposure, which is the most actionable compliance metric.

Question 45: When conducting a medical record audit, what does 'legibility' of documentation primarily affect from a compliance perspective?

The organization's HIPAA privacy compliance
The accuracy of ICD-10 code assignment by coders
The speed at which auditors can complete their review
The ability of auditors to verify that services were documented and support the billed code (Correct answer)

Correct answer: The ability of auditors to verify that services were documented and support the billed code

Illegible documentation prevents auditors from verifying that services billed were actually rendered and properly supported, creating a compliance and reimbursement risk.

Question 46: Which federal agency maintains the List of Excluded Individuals and Entities (LEIE) that healthcare organizations must screen against?

Office of Inspector General (OIG) (Correct answer)
Office for Civil Rights (OCR)
Centers for Medicare & Medicaid Services (CMS)
Department of Justice (DOJ)

Correct answer: Office of Inspector General (OIG)

The OIG maintains the LEIE, and healthcare organizations must screen employees, contractors, and vendors against it to avoid employing or contracting with excluded parties.

Question 47: Which of the following BEST describes the concept of 'proportionality' in applying disciplinary actions under a compliance program?

Disciplinary actions should be kept secret to avoid embarrassment
All violations should result in immediate termination to deter misconduct
Discipline should only apply to senior-level employees
Discipline should be commensurate with the severity of the violation and applied consistently (Correct answer)

Correct answer: Discipline should be commensurate with the severity of the violation and applied consistently

Proportionality ensures that disciplinary sanctions fit the severity of the violation and are applied consistently to maintain fairness and deter future misconduct.

Question 48: Which method is most effective for measuring the long-term impact of compliance training on employee behavior?

Observation of behavior change over time and reduced violation rates (Correct answer)
Employee self-reported satisfaction surveys
Number of employees who completed training
Post-training quiz scores

Correct answer: Observation of behavior change over time and reduced violation rates

Behavioral observation and reduction in violations over time are the most meaningful indicators of training effectiveness beyond immediate knowledge recall.

Question 49: A compliance audit reveals that staff in one department are unaware of the organization's conflict-of-interest policy. This finding MOST directly indicates a failure in:

External regulatory oversight
Training and communication mechanisms (Correct answer)
The board's fiduciary duties
Policy drafting quality

Correct answer: Training and communication mechanisms

Staff unawareness of an existing policy signals a breakdown in training, communication, or distribution channels rather than a policy drafting problem.

Question 50: Which of the following categories has the lowest likelihood of reporting errors?

Primary care physician
Support staff
Nurses
Independent contractors (Correct answer)

Correct answer: Independent contractors

Independent contractors often operate with a degree of autonomy and may not be as integrated into an organization's internal reporting systems or culture of error reporting compared to direct employees. This can lead to a lower likelihood of errors being formally reported through the organization's channels, even if errors occur.

Question 51: In healthcare compliance, what is the significance of the 'Sunshine Act' (Open Payments Program)?

It governs disclosure of clinical trial data
It requires public reporting of HIPAA breaches
It requires manufacturers to report payments and transfers of value to physicians and teaching hospitals (Correct answer)
It mandates transparency in hospital pricing

Correct answer: It requires manufacturers to report payments and transfers of value to physicians and teaching hospitals

The Physician Payments Sunshine Act requires drug and device manufacturers to report payments and other transfers of value to physicians and teaching hospitals to CMS for public disclosure.

Question 52: A hospital compliance officer is reviewing an arrangement where physicians receive 'facility fees' for office visits conducted in a newly designated provider-based department. The PRIMARY compliance concern is:

Whether the physicians have completed annual billing compliance training
Whether the department is accredited by The Joint Commission
Whether the physicians have documented the visits in the electronic health record
Whether the provider-based designation meets CMS requirements and whether patients are properly notified of additional costs (Correct answer)

Correct answer: Whether the provider-based designation meets CMS requirements and whether patients are properly notified of additional costs

Provider-based billing allows facilities to charge facility fees, but CMS has strict requirements for provider-based status, and improper designation or lack of patient notification can constitute fraud.

Question 53: What is the primary purpose of developing a Corrective Action Plan (CAP) after an internal investigation substantiates a compliance deficiency?

To serve as the official report of the violation to the appropriate government agency.
To document the final disciplinary actions taken against the employees involved.
To identify and remedy the root cause of the non-compliance to prevent its recurrence. (Correct answer)
To calculate and quantify the precise financial overpayment resulting from the violation.

Correct answer: To identify and remedy the root cause of the non-compliance to prevent its recurrence.

A Corrective Action Plan (CAP) is a forward-looking tool designed to address the systemic issues that led to a compliance failure. [8, 14] Its main goal is to identify the root cause—such as a flawed process, inadequate training, or technical gap—and implement specific, measurable steps to fix the problem and prevent it from happening again. [6, 14]

Question 54: Under the Medicare Fee Schedule, what does 'medical necessity' require for a claim to be reimbursable?

The patient had prior authorization from their insurer
The service was ordered by a board-certified specialist
The service was reasonable and necessary for the diagnosis or treatment of illness or injury (Correct answer)
The service was performed in an accredited facility

Correct answer: The service was reasonable and necessary for the diagnosis or treatment of illness or injury

Medicare requires that services be 'reasonable and necessary' for the diagnosis or treatment of illness or injury as a fundamental condition for reimbursement.

Question 55: When conducting a root cause analysis after a compliance investigation, what is the GOAL?

To assign blame to the responsible employee
To identify the underlying systemic factors that enabled the violation (Correct answer)
To calculate financial penalties owed to the government
To determine which patients were harmed

Correct answer: To identify the underlying systemic factors that enabled the violation

Root cause analysis focuses on identifying systemic issues and process failures to prevent recurrence rather than assigning individual blame.

Question 56: Which of the following is an essential component for demonstrating the effectiveness of a compliance training program to government auditors?

Thorough documentation of attendance, topics covered, and comprehension assessments. (Correct answer)
Employee testimonials about their engagement with the training materials.
A list of all external vendors and consultants used to develop training content.
A detailed budget outlining the total cost of the training program.

Correct answer: Thorough documentation of attendance, topics covered, and comprehension assessments.

To prove that a compliance training program is robust and functioning, an organization must maintain meticulous documentation. This serves as critical evidence and should include attendance logs, dates of training, the specific materials and topics covered, and results from any post-training assessments or quizzes used to gauge understanding. This documentation demonstrates a good-faith effort to educate the workforce.

Question 57: Which element distinguishes the Stark Law from the Anti-Kickback Statute with respect to intent?

Stark requires proof of willful intent; AKS is strict liability
Neither statute requires intent if the financial benefit exceeds $10,000
Stark is strict liability; AKS requires proof of knowing and willful intent (Correct answer)
Both statutes require proof of intentional misconduct

Correct answer: Stark is strict liability; AKS requires proof of knowing and willful intent

Stark Law is a strict liability civil statute — no proof of intent is needed — while the AKS requires the government to prove the defendant acted knowingly and willfully.

Question 58: An organization's compliance training completion rate is 98%, yet audits reveal ongoing billing errors. What does this most likely indicate?

Training content or delivery is ineffective, and knowledge transfer is not translating to behavioral change (Correct answer)
The billing department needs more staff, not more training
The auditors are applying the wrong standards
The 2% non-completers are responsible for all billing errors

Correct answer: Training content or delivery is ineffective, and knowledge transfer is not translating to behavioral change

High completion rates measure activity, not effectiveness; persistent errors signal a disconnect between training and actual performance.

Question 59: Under the Affordable Care Act, providers must report and return Medicare overpayments within how many days of identifying the overpayment?

30 days
180 days
90 days
60 days (Correct answer)

Correct answer: 60 days

The ACA's 60-day rule requires providers to report and return identified Medicare and Medicaid overpayments within 60 days of identification, or the retained overpayment becomes a false claim.

Question 60: Which document outlines the standards of conduct and ethical expectations for all employees in a healthcare organization's compliance program?

The code of conduct (Correct answer)
The compliance work plan
The corporate integrity agreement
The audit report

Correct answer: The code of conduct

The code of conduct establishes the organization's ethical standards and behavioral expectations that all employees are required to follow.

Question 61: Under the Stark Law, which of the following is a permissible financial relationship between a physician and a designated health service (DHS) entity?

A referral agreement based on the volume of referrals
A direct ownership interest with no exceptions
A joint venture split based on anticipated DHS referrals
A compensation arrangement that meets the fair market value exception (Correct answer)

Correct answer: A compensation arrangement that meets the fair market value exception

Stark Law allows financial relationships if they meet specific statutory exceptions, including the fair market value compensation exception.

Question 62: Which of the following BEST describes the concept of 'risk-based auditing'?

Avoiding auditing low-volume service lines to reduce costs
Auditing only claims that have been denied by payers
Auditing only high-risk patients' medical records
Allocating audit resources to areas with the greatest potential for non-compliance or financial harm (Correct answer)

Correct answer: Allocating audit resources to areas with the greatest potential for non-compliance or financial harm

Risk-based auditing prioritizes areas that pose the greatest compliance risk, focusing limited resources where they will have the most impact.

Question 63: A covered entity may use or disclose PHI without patient authorization for which of the following purposes?

Selling PHI to a data analytics company
Reporting a gunshot wound to law enforcement as required by state law (Correct answer)
Marketing a third-party product using the patient's purchase history
Disclosing to an employer for employment decisions

Correct answer: Reporting a gunshot wound to law enforcement as required by state law

HIPAA permits disclosure to law enforcement when required by law, such as mandatory reporting of gunshot wounds.

Question 64: What is the role of the HIPAA Privacy Officer in a covered entity?

To conduct all external audits of business associates
To personally review every request for PHI access
To be responsible for development and implementation of privacy policies and procedures (Correct answer)
To negotiate all business associate agreements on behalf of the organization

Correct answer: To be responsible for development and implementation of privacy policies and procedures

The HIPAA Privacy Rule requires covered entities to designate a Privacy Officer responsible for developing and implementing privacy policies and procedures.

Question 65: The False Claims Act (FCA) imposes liability on healthcare organizations that submit claims that are:

Late but accurate
Coded using outdated but not incorrect billing codes
Denied and subsequently appealed
Knowingly false or fraudulent to government payers (Correct answer)

Correct answer: Knowingly false or fraudulent to government payers

The FCA targets knowingly false, fraudulent, or recklessly disregarded claims submitted to federal healthcare programs.

Question 66: Which metric is most useful for evaluating whether compliance training content remains current and relevant?

Time since the training was first published
Frequency of trainer availability
Rate of policy violations in areas covered by existing training modules (Correct answer)
Total number of staff who completed training

Correct answer: Rate of policy violations in areas covered by existing training modules

Ongoing violations in areas covered by training signal that content may be outdated, unclear, or ineffective and requires revision.

Question 67: When disciplining a licensed clinical professional for a compliance violation, the organization should also consider:

Whether the employee can be enrolled in a clinical research study
Whether the employee's salary should be reduced retroactively
Whether all prior performance reviews should be destroyed
Whether the violation triggers mandatory reporting to the relevant state licensing board (Correct answer)

Correct answer: Whether the violation triggers mandatory reporting to the relevant state licensing board

Many states require healthcare organizations to report certain practitioner misconduct to licensing boards, creating an obligation beyond internal discipline.

Question 68: A compliance officer for a hospital system is initiating the annual compliance risk assessment. In addition to reviewing internal data such as incident reports and past audit findings, which external resource is MOST critical for identifying potential new areas of regulatory scrutiny?

The Joint Commission's accreditation manual
The Office of Inspector General (OIG) Work Plan (Correct answer)
The American Medical Association (AMA) Code of Ethics
Press releases from competing hospital systems

Correct answer: The Office of Inspector General (OIG) Work Plan

The OIG Work Plan publicly outlines the audits, evaluations, and inspections the OIG plans to conduct for HHS programs during the fiscal year. Reviewing the Work Plan is a crucial step for any healthcare compliance professional to identify the government's enforcement priorities and proactively assess their own organization's risk in those specific areas.

Question 69: Which of the following scenarios constitutes prohibited retaliation under the False Claims Act's anti-retaliation provisions?

Terminating an employee who violated HIPAA privacy rules following a thorough investigation
Demoting an employee shortly after they reported billing irregularities to the compliance office (Correct answer)
Transferring an employee to a different department for documented operational restructuring reasons
Placing an employee on a performance improvement plan for documented, pre-existing performance deficiencies

Correct answer: Demoting an employee shortly after they reported billing irregularities to the compliance office

Demoting an employee as a direct consequence of their protected reporting activity—reporting billing irregularities—constitutes prohibited retaliation under the FCA's anti-retaliation provisions.

Question 70: A compliance officer discovers that new employees are bypassing required onboarding training modules by clicking through without reading. What is the best corrective action?

Remove the online training and replace with in-person sessions only
Report employees to HR for disciplinary action
Redesign training with mandatory time delays, knowledge checks, and attestations (Correct answer)
Send a memo reminding staff of training requirements

Correct answer: Redesign training with mandatory time delays, knowledge checks, and attestations

Redesigning training with embedded checks ensures meaningful engagement and prevents click-through behavior while maintaining scalability.

Question 71: What is the significance of the 'universe' in a compliance audit sampling context?

The list of all compliance policies applicable to the audited area
The complete roster of providers included in a group audit
The total population of records or transactions from which the audit sample is drawn (Correct answer)
The full set of payers billed during the audit period

Correct answer: The total population of records or transactions from which the audit sample is drawn

The 'universe' refers to the entire population of records or claims subject to audit, from which a representative sample is selected.

Question 72: What does the OIG's 'permissive exclusion' authority allow it to do, as opposed to mandatory exclusion?

Automatically exclude anyone under investigation
Exclude individuals at the OIG's discretion based on conduct less serious than mandatory triggers (Correct answer)
Exclude individuals only upon court order
Exclude entities only with CMS approval

Correct answer: Exclude individuals at the OIG's discretion based on conduct less serious than mandatory triggers

Permissive exclusion allows the OIG to exclude individuals or entities for conduct that is serious but does not automatically trigger mandatory exclusion, such as licensure revocations or excessive billing.

Question 73: Which of the following training topics is MOST critical for healthcare billing staff to receive annually?

OSHA workplace safety standards
Proper documentation requirements and coding compliance under federal billing rules (Correct answer)
Customer service techniques
Human resources onboarding procedures

Correct answer: Proper documentation requirements and coding compliance under federal billing rules

Billing staff must be trained on federal billing rules including proper documentation and coding to prevent False Claims Act violations.

Question 74: Under the False Claims Act, what is 'qui tam' as it relates to healthcare investigations?

A type of government subpoena for medical records
A requirement to report fraud to the OIG within 60 days
A provision allowing private individuals to file suit on behalf of the government and share in any recovery (Correct answer)
A compliance program certification requirement

Correct answer: A provision allowing private individuals to file suit on behalf of the government and share in any recovery

Qui tam provisions of the FCA allow whistleblowers (relators) to sue on behalf of the government and receive a portion of any funds recovered.

Question 75: What is the PRIMARY purpose of maintaining a detailed investigation log during a healthcare compliance inquiry?

To calculate investigator billable hours
To create a chronological record that supports defensibility and demonstrates thoroughness (Correct answer)
To satisfy state licensing requirements
To share progress updates with all hospital staff

Correct answer: To create a chronological record that supports defensibility and demonstrates thoroughness

A detailed investigation log creates a contemporaneous record that demonstrates the investigation was conducted fairly, thoroughly, and in good faith.

Question 76: Under the 60-day rule established in the ACA, once an organization has identified an overpayment it must report and return it within:

90 days of identification
30 days of identification
60 days of identification (Correct answer)
180 days of identification

Correct answer: 60 days of identification

The ACA's 60-day rule requires that identified Medicare and Medicaid overpayments be reported and returned within 60 days of quantification.

Question 77: EMTALA requires hospitals with emergency departments to provide which minimum level of service to all patients who present?

Admission to the hospital if any emergency condition is suspected
Transfer to a facility accepting Medicaid within two hours
Full treatment until the patient is cured or stabilized
A medical screening examination regardless of ability to pay (Correct answer)

Correct answer: A medical screening examination regardless of ability to pay

EMTALA mandates that hospitals provide an appropriate medical screening examination to any individual who comes to the emergency department requesting examination or treatment, regardless of payment status.

Question 78: Which regulation requires healthcare organizations to screen employees against federal exclusion databases prior to hire?

OIG exclusion screening requirements under the Social Security Act (Correct answer)
HIPAA Security Rule
Stark Law
Joint Commission accreditation standards

Correct answer: OIG exclusion screening requirements under the Social Security Act

The Social Security Act prohibits federal healthcare programs from paying for services rendered by excluded individuals, making pre-hire exclusion screening a compliance necessity.

Question 79: Which of the following is the MOST important characteristic of an effective healthcare compliance monitoring dashboard?

It should replace the need for periodic audits entirely
It should be accessible only to the compliance officer to maintain confidentiality
It should display real-time or near-real-time key risk indicators that allow for timely corrective action (Correct answer)
It must be submitted to CMS on a quarterly basis

Correct answer: It should display real-time or near-real-time key risk indicators that allow for timely corrective action

An effective monitoring dashboard provides timely, actionable key risk indicators so compliance issues can be identified and addressed promptly, before they escalate.

Question 80: A research institution wants to use a hospital's patient database for a study. To comply with HIPAA, they plan to de-identify the data. They choose the 'Safe Harbor' method. Which of the following is one of the 18 identifiers that MUST be removed under this method?

The patient's age expressed in years.
The patient's year of birth.
All geographic subdivisions smaller than a state, including ZIP codes. (Correct answer)
The state of the patient's residence.

Correct answer: All geographic subdivisions smaller than a state, including ZIP codes.

The HIPAA Safe Harbor method requires the removal of 18 specific identifiers to de-identify data. One of these identifiers is 'All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes.' An exception exists for the initial three digits of a ZIP code under certain population criteria.

Question 81: Which coding system is primarily used for inpatient hospital diagnoses and procedures for Medicare billing under the MS-DRG system?

ICD-10-CM/PCS (International Classification of Diseases) (Correct answer)
HCPCS Level II codes
DSM-5 codes
CPT (Current Procedural Terminology)

Correct answer: ICD-10-CM/PCS (International Classification of Diseases)

ICD-10-CM is used for diagnosis coding and ICD-10-PCS for inpatient procedure coding, which together drive the MS-DRG assignment and corresponding Medicare payment.

Question 82: Which federal agency publishes the OIG Work Plan that healthcare compliance officers use to prioritize audit areas each year?

Department of Justice (DOJ)
Office for Civil Rights (OCR)
Office of Inspector General (OIG) (Correct answer)
Centers for Medicare & Medicaid Services (CMS)

Correct answer: Office of Inspector General (OIG)

The OIG publishes its annual Work Plan to identify areas of focus for audits and investigations in Medicare and Medicaid programs.

Question 83: When developing a new compliance policy, stakeholder input should be gathered PRIMARILY from:

Subject matter experts, operational staff, legal counsel, and leadership (Correct answer)
The compliance department in isolation to maintain independence
Only the C-suite to ensure strategic alignment
External auditors only, to ensure objectivity

Correct answer: Subject matter experts, operational staff, legal counsel, and leadership

Effective policies reflect operational realities and regulatory requirements, requiring input from those who implement the policy, legal counsel, and organizational leadership.

Question 84: A patient requests an accounting of disclosures. Which type of disclosure must be included in the accounting?

Disclosures for treatment, payment, and operations
Disclosures pursuant to a valid patient authorization
Disclosures to public health authorities as required by law (Correct answer)
Disclosures made to the patient themselves

Correct answer: Disclosures to public health authorities as required by law

Disclosures required by law, such as those to public health authorities, must be included in the accounting of disclosures.

Question 85: A physician self-refers a patient to a physical therapy center in which the physician has an ownership interest. Under the Stark Law, which of the following must be true for this to be lawful?

The arrangement must fit within a recognized Stark Law exception (Correct answer)
The referral must be approved by the hospital's medical staff
The physical therapy center must be accredited by a national body
The physician must disclose the relationship to the patient only

Correct answer: The arrangement must fit within a recognized Stark Law exception

Stark Law prohibits self-referrals to DHS entities unless the arrangement meets a specific statutory or regulatory exception.

Question 86: What is the statute of limitations for the government to bring a False Claims Act civil suit not involving a qui tam relator?

5 years
6 years (Correct answer)
3 years
10 years

Correct answer: 6 years

The FCA provides a six-year statute of limitations for government-initiated civil actions, though it can extend to 10 years in qui tam cases depending on when the government knew or should have known of the violation.

Question 87: A compliance risk assessment at a behavioral health clinic identifies high risk in medical record documentation. Which next step is MOST appropriate?

Dismiss the finding because documentation is a clinical not a compliance issue
Design and implement a targeted audit and corrective action plan for documentation practices (Correct answer)
Report the finding directly to the state attorney general
Wait for the next annual assessment cycle to address the risk

Correct answer: Design and implement a targeted audit and corrective action plan for documentation practices

High-priority findings from a risk assessment must be addressed through targeted audits and corrective action plans, not deferred or ignored.

Question 88: What distinguishes a 'compliance program' from a 'paper program'?

A paper program is more detailed and comprehensive
A compliance program is actively implemented and enforced, while a paper program exists only on paper with no real implementation (Correct answer)
A paper program uses printed rather than electronic policies
A compliance program is required by law; a paper program is voluntary

Correct answer: A compliance program is actively implemented and enforced, while a paper program exists only on paper with no real implementation

A 'paper program' refers to a compliance program that has the required documents but lacks genuine implementation, enforcement, and cultural integration.

Question 89: Which Affordable Care Act provision created the first federal requirement to screen and re-screen providers and suppliers before enrolling them in Medicare and Medicaid?

Section 6401 — Provider Screening and Other Enrollment Requirements (Correct answer)
Section 1557 — Nondiscrimination in Health Programs
Section 3021 — Center for Medicare and Medicaid Innovation
Section 6402 — Enhanced Medicare and Medicaid Program Integrity

Correct answer: Section 6401 — Provider Screening and Other Enrollment Requirements

ACA Section 6401 established categorical screening levels (limited, moderate, high) and mandated that CMS and states screen all providers and suppliers upon enrollment and periodically thereafter.

Question 90: Under the HIPAA Privacy Rule, a covered entity's Notice of Privacy Practices must be provided to patients:

Only when the notice is materially revised
Only upon the patient's written request
No later than the date of first service delivery (Correct answer)
Annually for all current patients

Correct answer: No later than the date of first service delivery

Covered entities must provide the Notice of Privacy Practices no later than the date of first service delivery to the individual.

Question 91: A hospital's new Compliance Officer is developing the annual compliance training plan. To ensure the training is effective and meets OIG recommendations, which of the following elements is most crucial to include?

Training conducted exclusively by external legal counsel to ensure accuracy.
Job-specific training that addresses the high-risk areas relevant to different employee roles. (Correct answer)
A final exam with a mandatory 100% passing score for all employees.
A detailed review of every federal healthcare law and regulation.

Correct answer: Job-specific training that addresses the high-risk areas relevant to different employee roles.

The OIG emphasizes that effective training should be tailored to the audience. While general compliance awareness is important for everyone, job-specific training focuses on the particular compliance risks employees face in their daily duties (e.g., coding, billing, clinical care), making the information more relevant and actionable.

Question 92: Which of the following is an example of a SYSTEMIC remedial measure rather than an individual disciplinary measure?

Revising the billing policy and retraining the entire coding department (Correct answer)
Placing an individual employee on a performance improvement plan
Terminating the employee who submitted false claims
Issuing a written warning to a supervisor

Correct answer: Revising the billing policy and retraining the entire coding department

Systemic remedial measures address organizational processes and controls, whereas individual disciplinary measures target the specific wrongdoer.

Question 93: A hospital compliance officer discovers that the risk assessment has not been updated in three years. What is the MOST significant concern?

The document may have formatting inconsistencies
The assessment cost too much to complete originally
The assessment may not reflect current regulatory requirements and operational changes (Correct answer)
Staff may be unfamiliar with the original findings

Correct answer: The assessment may not reflect current regulatory requirements and operational changes

Risk assessments must be updated regularly to remain relevant as regulations, operations, and risk landscapes change.

Question 94: What is the significance of conducting compliance program audits on a 'risk-stratified' basis?

It ensures every department is audited equally regardless of risk level
It eliminates the need for routine audits
It focuses audits exclusively on billing and coding
It allocates audit resources to areas with the highest compliance risk first (Correct answer)

Correct answer: It allocates audit resources to areas with the highest compliance risk first

Risk-stratified auditing directs compliance resources toward the areas most likely to have compliance issues, maximizing the program's effectiveness.

Question 95: An employee subject to discipline has the right to 'due process' in a healthcare compliance context. This PRIMARILY means:

The employee can veto the disciplinary outcome
The employee receives notice of allegations and an opportunity to respond before final action (Correct answer)
The employee must be given a jury trial before any discipline is imposed
All discipline must be reviewed by the state medical board

Correct answer: The employee receives notice of allegations and an opportunity to respond before final action

Due process in the employment context means the employee is informed of the specific allegations and given a meaningful opportunity to respond before discipline is finalized.

Question 96: Which element is MOST critical when documenting disciplinary actions to protect the organization in future legal proceedings?

Omitting dates to preserve employee privacy
Using informal notes rather than official HR forms
Recording the supervisor's personal opinion of the employee
Documenting specific policy provisions violated and evidence supporting the finding (Correct answer)

Correct answer: Documenting specific policy provisions violated and evidence supporting the finding

Precise documentation of the specific policy violated and supporting evidence creates a defensible record if the discipline is later challenged.

Question 97: When using a risk assessment survey to gather input from department managers, the compliance team should PRIMARILY ensure that:

Surveys are completed only by the CEO and CFO
Questions are open-ended only, with no rating scales
All survey data is shared publicly with patients
Responses are anonymous to encourage candid feedback (Correct answer)

Correct answer: Responses are anonymous to encourage candid feedback

Anonymity encourages honest reporting of risks and concerns that employees might otherwise fear disclosing to leadership.

Question 98: Which federal law requires healthcare organizations to have compliance programs including auditing and monitoring as a condition of enrollment in federal healthcare programs?

The Affordable Care Act
Stark Law
Social Security Act Section 6401 (Correct answer)
HIPAA

Correct answer: Social Security Act Section 6401

Section 6401 of the Affordable Care Act, codified under the Social Security Act, requires certain providers to have compliance programs as a condition of enrollment in Medicare and Medicaid.

Question 99: Which of the following is a key characteristic of an effective compliance hotline?

It is managed exclusively by the HR department
It requires reporters to provide their employee ID number
It allows for anonymous reporting and is available 24/7 (Correct answer)
It only accepts reports from supervisors

Correct answer: It allows for anonymous reporting and is available 24/7

An effective compliance hotline must allow anonymous reporting and be accessible around the clock to encourage employees to report concerns without fear.

Question 100: A compliance audit identifies that a coder has been consistently adding diagnosis codes not documented by the physician. This practice is BEST classified as:

A billing error requiring a simple correction
An acceptable coding shortcut under Medicare guidelines
A documentation deficiency attributable to the physician
Upcoding fraud with potential False Claims Act liability (Correct answer)

Correct answer: Upcoding fraud with potential False Claims Act liability

Adding unsupported diagnosis codes inflates reimbursement claims, constituting upcoding that may create FCA liability for both the coder and the organization.

Question 101: When a compliance officer identifies a significant potential overpayment to Medicare, what is the required timeframe for self-reporting under the 60-day rule?

Within 180 days of the billing date
Within 90 days of the end of the fiscal year
Within 30 days of identification
Within 60 days of identification or when the overpayment is quantified (Correct answer)

Correct answer: Within 60 days of identification or when the overpayment is quantified

The ACA's 60-day rule requires providers to report and return identified Medicare/Medicaid overpayments within 60 days of identification or quantification.

Question 102: What is the purpose of the 'public disclosure bar' under the False Claims Act?

To require relators to publicly disclose their identity before filing suit
To prevent qui tam suits based on publicly available information unless the relator is the original source (Correct answer)
To require public posting of an organization's compliance policies
To mandate public disclosure of all fraud settlement agreements

Correct answer: To prevent qui tam suits based on publicly available information unless the relator is the original source

The public disclosure bar prevents qui tam suits based on information already in the public domain—such as in news reports or prior audits—unless the relator is the original source of that information.

Question 103: A compliance officer discovers that a vendor is on the SAM.gov exclusion list. What is the appropriate immediate action?

Report only to legal counsel and take no further action
Terminate or suspend the vendor relationship immediately to avoid program liability (Correct answer)
Apply for an OIG waiver before taking action
Continue the contract but add compliance monitoring clauses

Correct answer: Terminate or suspend the vendor relationship immediately to avoid program liability

Organizations must immediately suspend or terminate contracts with excluded vendors because payment for services rendered by excluded entities can result in civil monetary penalties and repayment obligations.

Question 104: Which of the following is an example of a 'red flag' that might trigger a reactive compliance audit?

Publication of the annual OIG Work Plan
A whistleblower complaint alleging systematic billing fraud (Correct answer)
Renewal of the compliance officer's certification
Receipt of an OIG advisory opinion

Correct answer: A whistleblower complaint alleging systematic billing fraud

A whistleblower complaint alleging systematic billing fraud is a specific trigger that warrants an immediate reactive audit to investigate the claim.

Question 105: What is 'place of service' coding and why is it critical in Medicare billing compliance?

It tracks which payer is responsible for the claim
It indicates where a service was rendered and affects reimbursement rates and coverage rules (Correct answer)
It identifies the type of insurance the patient carries
It identifies the city where the provider practices

Correct answer: It indicates where a service was rendered and affects reimbursement rates and coverage rules

Place of service codes on claims tell Medicare where the service was provided (e.g., office, hospital, telehealth), which directly affects applicable payment rates and coverage determinations.

Question 106: Which of the following scenarios demonstrates a conflict of interest in developing compliance training content?

A compliance officer using OIG advisory opinions to guide training topics
Aligning training content with an annually updated risk assessment
Using internal subject matter experts to review training accuracy
A vendor that sells billing software also providing the only approved coding compliance training to the organization (Correct answer)

Correct answer: A vendor that sells billing software also providing the only approved coding compliance training to the organization

Allowing a vendor with a financial interest in the subject matter to exclusively control compliance training creates an inherent conflict that could compromise the objectivity and rigor of the content.

Question 107: Which element is MOST critical when drafting a healthcare compliance policy to ensure enforceability?

Clear, unambiguous language with defined scope and applicability (Correct answer)
Use of technical legal jargon to demonstrate authority
References to competitor organization policies
Lengthy preambles explaining historical context

Correct answer: Clear, unambiguous language with defined scope and applicability

Enforceable policies require clear language, a defined scope, and explicit applicability so staff know exactly what is required of them.

Question 108: In a Corporate Integrity Agreement (CIA), what is the role of the Independent Review Organization (IRO)?

To replace the compliance officer during the CIA period
To conduct independent reviews of claims and practices as required by the CIA (Correct answer)
To negotiate the terms of the CIA with the OIG
To manage the organization's compliance training program

Correct answer: To conduct independent reviews of claims and practices as required by the CIA

An IRO conducts independent, objective reviews of the organization's billing, coding, and other practices as specified in the CIA to verify compliance.

Question 109: How frequently should the "Women's Health and Cancer Rights Act" notice be given?

Annually
Initial Enrollment
Initial Enrollment and Annually (Correct answer)
Upon Request

Correct answer: Initial Enrollment and Annually

The Women's Health and Cancer Rights Act (WHCRA) requires group health plans that cover mastectomies to also cover reconstructive surgery and related services. To ensure participants are aware of these rights, a notice must be provided at the time of initial enrollment and then annually thereafter. This regular notification helps ensure women are informed about their post-mastectomy care options.

Question 110: The term 'medically unnecessary services' in the context of healthcare fraud most commonly refers to:

Services provided and billed that do not meet accepted standards of medical practice for the patient's condition (Correct answer)
Services covered by Medicare but not Medicaid
Services provided by a specialist that could have been provided by a primary care physician
Services furnished in a hospital outpatient setting instead of a physician's office

Correct answer: Services provided and billed that do not meet accepted standards of medical practice for the patient's condition

Billing for medically unnecessary services means billing for procedures or tests that are not reasonable and necessary for the patient's diagnosis or treatment under accepted clinical standards.

Question 111: In healthcare compliance auditing, what does 'two-sided testing' refer to?

Auditing both the clinical and financial aspects of a record simultaneously
Reviewing claims from two different payers in the same audit
Conducting both internal and external audits of the same records
A statistical hypothesis test that checks for deviation in either direction from the expected value (Correct answer)

Correct answer: A statistical hypothesis test that checks for deviation in either direction from the expected value

Two-sided (two-tailed) statistical testing checks whether the observed error rate is significantly higher or lower than expected, not just in one direction.

Question 112: Under the Stark Law, which of the following financial relationships between a physician and a hospital would require a written exception?

A physician providing pro bono care at a community health fair
A physician employed full-time by the hospital under a salary arrangement
A physician treating Medicare patients at a non-related hospital
A physician who owns stock in the hospital and refers Medicare patients there (Correct answer)

Correct answer: A physician who owns stock in the hospital and refers Medicare patients there

Stark Law prohibits physician self-referrals unless a specific exception applies; physician ownership with referrals to that entity requires careful structuring under an applicable exception.

Question 113: What does an 'error rate' represent in a healthcare compliance audit?

The percentage of denied claims in a billing cycle
The number of compliance violations reported annually
The proportion of audited records found to be non-compliant or inaccurate (Correct answer)
The frequency of coding corrections made by coders

Correct answer: The proportion of audited records found to be non-compliant or inaccurate

The error rate is the proportion of records in the sample that contain inaccuracies or non-compliance, used to extrapolate issues across the entire population.

Question 114: A hospital's fundraising foundation wants to send a mailing to former patients. Under HIPAA, which of the following pieces of information may the hospital disclose to its foundation for fundraising purposes without obtaining prior patient authorization?

Dates of service, demographic information, and health insurance status. (Correct answer)
The patient's entire medical record.
Patient diagnosis and treatment details.
Information about the patient's specific treating physician and outcome.

Correct answer: Dates of service, demographic information, and health insurance status.

HIPAA permits a covered entity to use or disclose limited PHI for its own fundraising purposes without an individual's authorization. This is limited to demographic information (like name and address), dates of healthcare provided, department of service information, treating physician, outcome information, and health insurance status. The notice of privacy practices must inform patients about fundraising communications and their right to opt out.

Question 115: What does 'safe harbor' mean in the context of the Anti-Kickback Statute?

A HIPAA exemption for small providers
Specific arrangements that are protected from prosecution under the AKS (Correct answer)
An OIG-approved compliance program framework
A clause protecting patients from billing disputes

Correct answer: Specific arrangements that are protected from prosecution under the AKS

Safe harbors under the AKS are regulatory exceptions that protect certain business arrangements from prosecution if they meet specific criteria.

Question 116: Which of the following is an example of a compliance 'standard' as distinct from a 'policy' or 'procedure'?

The requirement that all PHI transmissions be encrypted to NIST standards (Correct answer)
A training schedule for annual compliance education
A memo announcing the new compliance officer's appointment
A step-by-step checklist for submitting a Medicare claim

Correct answer: The requirement that all PHI transmissions be encrypted to NIST standards

A standard defines a specific measurable requirement (e.g., encryption to NIST specifications) that policies and procedures must satisfy.

Question 117: A compliance officer is asked to report to the board of directors on the compliance program. Which type of information is MOST important to include?

Detailed descriptions of all individual employee discipline cases
Key metrics, significant risks identified, investigations completed, and program effectiveness measures (Correct answer)
A full list of all compliance policies in effect
The compliance officer's personal recommendations for salary increases

Correct answer: Key metrics, significant risks identified, investigations completed, and program effectiveness measures

Board reports should focus on program performance metrics, significant risks, investigation outcomes, and overall effectiveness to enable informed governance oversight.

Question 118: What does 'tone at the top' refer to in the context of healthcare compliance?

The order in which compliance policies are reviewed
The hierarchy of compliance reporting lines
Leadership's demonstrated commitment to ethical behavior and compliance (Correct answer)
The pitch of the compliance officer's presentation voice

Correct answer: Leadership's demonstrated commitment to ethical behavior and compliance

Tone at the top refers to the culture of integrity set by senior leadership, which significantly influences employee compliance behavior throughout the organization.

Question 119: Which of the following scenarios represents a 'trigger event' that should prompt an unscheduled compliance risk assessment update?

Acquisition of a new hospital or practice (Correct answer)
Routine quarterly board meeting
Annual open enrollment period for employee benefits
Filing of the organization's annual tax return

Correct answer: Acquisition of a new hospital or practice

An acquisition introduces new processes, staff, systems, and regulatory exposures that must be assessed before they are fully integrated.

Question 120: Which federal statute prohibits submitting claims for services that were not actually rendered to Medicare or Medicaid?

Stark Law
HITECH Act
Anti-Kickback Statute
False Claims Act (Correct answer)

Correct answer: False Claims Act

The False Claims Act prohibits knowingly submitting false or fraudulent claims for payment to any federal program, including Medicare and Medicaid.

Question 121: Which of the following BEST describes 'continuous monitoring' in a compliance program?

Monthly manual review of a random sample of records
Quarterly external audits performed by independent auditors
Automated, real-time or near-real-time oversight of transactions and processes for anomalies (Correct answer)
Annual review of all claims submitted to federal payers

Correct answer: Automated, real-time or near-real-time oversight of transactions and processes for anomalies

Continuous monitoring uses automated tools to provide ongoing, real-time oversight of processes and transactions, flagging anomalies as they occur.

Question 122: Which subpoena requires the submission of specific documents to the court?

Subpoena duces tecum (Correct answer)
Subpoena ad infinitum
Subpoena habeas corpus
Subpoena ads testicandum

Correct answer: Subpoena duces tecum

A subpoena duces tecum is a legal writ requiring the recipient to produce specific documents, records, or other tangible evidence in court or at a deposition. This differs from a subpoena ad testificandum, which compels a person to appear and give oral testimony.

Question 123: During an internal investigation, an employee asks if they can have a personal attorney present during their interview. What is the appropriate response?

Permit it, as employees retain the right to counsel, though counsel represents the employee, not the company (Correct answer)
Allow it only if the employee has been formally accused of wrongdoing
Require a written waiver from the employee before proceeding
Deny the request, as personal attorneys have no role in internal investigations

Correct answer: Permit it, as employees retain the right to counsel, though counsel represents the employee, not the company

Employees have the right to retain personal counsel during internal interviews; this counsel represents the employee, not the organization.

Question 124: Which of the following is a key requirement for the ongoing management of compliance policies and procedures?

A process for certifying that every employee has memorized all key policies.
A system for annual review and updates to reflect changes in laws, regulations, and business operations. (Correct answer)
Archiving all policies that are more than three years old, regardless of their current relevance.
Ensuring all policies are written exclusively by external legal counsel to guarantee compliance.

Correct answer: A system for annual review and updates to reflect changes in laws, regulations, and business operations.

Compliance policies and procedures are not static documents. An essential component of an effective compliance program is to have a system in place for their periodic (at least annual) review and update. This ensures they remain current with changing laws, regulations, and the organization's own operational realities.

Question 125: When must "Notice of Special Enrollment Rights" be provided?

Annually
Initial enrollment & annually
Upon Request
Initial enrollment (Correct answer)

Correct answer: Initial enrollment

The Notice of Special Enrollment Rights, mandated by HIPAA, informs individuals about their ability to enroll in a group health plan outside of the regular open enrollment period. This notice must be provided at the time of initial enrollment. It covers qualifying life events like marriage, birth or adoption of a child, or loss of other health coverage, allowing individuals to gain coverage when needed.

Question 126: In third-party vendor management, why is it important to include vendors in a healthcare compliance risk assessment?

Vendors are exempt from HIPAA obligations
Vendor contracts eliminate all compliance liability
Vendors handling PHI or performing regulated functions create compliance exposure for the covered entity (Correct answer)
Vendors are legally required to pay for the cost of the assessment

Correct answer: Vendors handling PHI or performing regulated functions create compliance exposure for the covered entity

Under HIPAA and the False Claims Act, covered entities can face liability for compliance failures occurring through their vendors, making vendor risk a key assessment area.

Question 127: Under the Beneficiary Inducement provisions of the CMPL, offering Medicare beneficiaries free transportation to a clinic is generally permissible when it meets which condition?

The beneficiary resides more than 25 miles from the facility
The transportation is provided only to established patients
Written consent is obtained and filed with CMS
It falls within an applicable safe harbor such as the local transportation safe harbor (Correct answer)

Correct answer: It falls within an applicable safe harbor such as the local transportation safe harbor

OIG's local transportation safe harbor permits free or discounted transportation for beneficiaries to receive items or services, provided certain conditions including mileage limits and non-marketing restrictions are met.

Question 128: According to the OIG, an effective compliance program includes auditing and monitoring as one of its seven core elements. The primary goal of this element is to:

Guarantee the organization will pass all external government investigations.
Reduce the compliance department's annual budget by identifying efficiencies.
Assign blame for compliance failures to specific individuals.
Evaluate the effectiveness of the compliance program and detect offenses. (Correct answer)

Correct answer: Evaluate the effectiveness of the compliance program and detect offenses.

The OIG's guidance on the seven elements of an effective compliance program clearly states that internal monitoring and auditing are crucial for evaluating adherence to the organization's policies, procedures, and applicable regulations, thereby assessing the program's overall effectiveness and helping to detect potential violations.

Question 129: Which standard is considered the benchmark for healthcare privacy and security policies in the United States?

HIPAA's Privacy and Security Rules (Correct answer)
The Joint Commission's Comprehensive Accreditation Manual
ISO 27001 Information Security Standard
The Sarbanes-Oxley Act

Correct answer: HIPAA's Privacy and Security Rules

HIPAA's Privacy and Security Rules establish the federal baseline requirements for protecting patient health information that healthcare organizations must embed in their policies.

Question 130: A healthcare organization conducts an internal investigation and finds evidence of FCA violations. Under the voluntary disclosure protocol, to which agency should it disclose?

The Department of Justice only
The relevant Medicare Administrative Contractor
The state Medicaid Fraud Control Unit
The OIG's Self-Disclosure Protocol or the DOJ's Civil Division (Correct answer)

Correct answer: The OIG's Self-Disclosure Protocol or the DOJ's Civil Division

Organizations with potential FCA violations can use the OIG's Self-Disclosure Protocol or, for matters involving the Civil Division, the DOJ's Voluntary Self-Disclosure Program to receive more favorable settlement terms.

Question 131: Which of the following scenarios most likely implicates the 'one-purpose test' applied to Anti-Kickback Statute analysis?

A physician group shares profits equally among all partners regardless of referral volume
A hospital pays a physician fair market value for administrative services under a written agreement
A vendor provides free consulting services to a hospital, hoping the hospital will purchase its products (Correct answer)
A pharmaceutical company sponsors an accredited CME program open to all physicians

Correct answer: A vendor provides free consulting services to a hospital, hoping the hospital will purchase its products

Under the one-purpose test, if one purpose of the remuneration is to induce referrals or purchases, the AKS is violated — even if there are legitimate business reasons too.

Question 132: Under the Civil Monetary Penalties Law (CMPL), which of the following conduct can result in exclusion from federal healthcare programs?

Employing or contracting with an excluded individual (Correct answer)
Failing to conduct annual compliance training
Billing a commercial payer for uncovered services
Not updating a provider enrollment record within 30 days

Correct answer: Employing or contracting with an excluded individual

The CMPL imposes penalties and potential exclusion on entities that employ or contract with individuals or entities excluded from federal healthcare programs.

Question 133: A hospital risk assessment reveals high inherent risk in physician self-referrals. Which law governs this area?

Stark Law (Physician Self-Referral Law) (Correct answer)
Anti-Kickback Statute only
Emergency Medical Treatment and Labor Act (EMTALA)
HIPAA Security Rule

Correct answer: Stark Law (Physician Self-Referral Law)

The Stark Law prohibits physicians from referring patients to entities with which they have a financial relationship unless a specific exception applies.

Question 134: A small physician practice wants to establish an effective compliance program but has limited resources. According to the OIG, what is a critical first step in designating compliance leadership?

Appointing a high-level, trusted employee, such as the office manager, to serve as the compliance contact and ensuring they have sufficient time and resources. (Correct answer)
Outsourcing the entire compliance function to a third-party vendor.
Assigning compliance duties equally among all staff members to foster a culture of ownership.
Hiring a full-time, dedicated Compliance Officer with a law degree.

Correct answer: Appointing a high-level, trusted employee, such as the office manager, to serve as the compliance contact and ensuring they have sufficient time and resources.

The OIG guidance is scalable. For a smaller organization, it is acceptable to designate an existing high-level employee to serve as the compliance officer or contact, provided they are given the necessary resources, training, and authority to be effective. The key is to have a designated person with oversight responsibility.

Question 135: Under the 21st Century Cures Act, information blocking is defined as a practice by a healthcare provider, developer, or network that is likely to interfere with what?

Interoperability testing required by ONC certification standards
Patient consent procedures for research data sharing
Access, exchange, or use of electronic health information (Correct answer)
The timely submission of quality measure data to CMS

Correct answer: Access, exchange, or use of electronic health information

The 21st Century Cures Act defines information blocking as a practice that is likely to interfere with the access, exchange, or use of electronic health information, except as required by law or covered by a regulatory exception.

Question 136: Which of the following BEST describes the role of the compliance committee in a healthcare organization?

Conducting annual financial audits
Replacing the compliance officer's duties during vacations
Providing oversight, guidance, and support for compliance program operations (Correct answer)
Handling all employee grievances related to workplace issues

Correct answer: Providing oversight, guidance, and support for compliance program operations

The compliance committee provides oversight, guidance, and multidisciplinary support to help administer and strengthen the compliance program.

Question 137: A hospital's compliance department concludes an internal investigation that substantiates improper billing to a federal healthcare program, resulting in a significant overpayment. According to federal law and OIG guidance, what is the organization's primary obligation after quantifying the overpayment?

Report and return the overpayment within 60 days of its identification. (Correct answer)
Implement a new training program for the entire billing department.
Wait for the next scheduled quarterly audit to report the findings.
Discipline the employees responsible for the improper billing.

Correct answer: Report and return the overpayment within 60 days of its identification.

The Affordable Care Act's "60-Day Rule" requires that overpayments from a federal healthcare program be reported and returned within 60 days of the date on which the overpayment was identified. Failure to do so can result in False Claims Act liability. While disciplinary action and training are important corrective actions, the most immediate and critical legal obligation is the timely return of the funds.

Question 138: Which law prohibits a physician from making referrals for designated health services to entities in which the physician has a financial relationship, absent an applicable exception?

Civil Monetary Penalties Law
Anti-Kickback Statute
False Claims Act
Stark Law (Correct answer)

Correct answer: Stark Law

The Physician Self-Referral Law (Stark Law) prohibits physicians from referring Medicare or Medicaid patients for designated health services to entities with which the physician has a financial relationship unless a specific exception applies.

Question 139: Which element of an effective compliance program focuses on identifying and addressing compliance risks before they result in violations?

Reactive auditing
Punitive enforcement
Retrospective review
Proactive risk assessment (Correct answer)

Correct answer: Proactive risk assessment

Proactive risk assessment identifies potential compliance vulnerabilities before they result in violations, allowing corrective action to be taken.

Question 140: A hospital's compliance officer is developing the annual audit plan. Which of the following is the most critical first step in this process?

Conducting a comprehensive risk assessment. (Correct answer)
Reviewing the previous year's audit findings.
Interviewing department heads about their concerns.
Analyzing the OIG's most recent Work Plan.

Correct answer: Conducting a comprehensive risk assessment.

A comprehensive risk assessment is the foundational element of an effective compliance program and should be the starting point for developing a risk-based audit plan. This process identifies and prioritizes the organization's specific risks, which then guides the focus of audit activities. The other options are valuable inputs to the risk assessment but are not the first or most critical step.

Question 141: When a compliance policy conflicts with a state law that is MORE restrictive than federal law, the organization must:

Follow federal law exclusively, as it preempts all state law
Follow the more restrictive state law unless federal law explicitly preempts it (Correct answer)
Apply whichever standard is less burdensome to operations
Petition the OIG for a waiver before implementing either standard

Correct answer: Follow the more restrictive state law unless federal law explicitly preempts it

HIPAA and most federal healthcare laws set a floor, not a ceiling; organizations must comply with more restrictive state laws unless federal law explicitly preempts the state provision.

Question 142: Which disciplinary principle requires that employees in similar roles who commit comparable violations receive comparable sanctions?

Proportionality
Consistency (Correct answer)
Due process
Progressive discipline

Correct answer: Consistency

Consistency requires that the organization apply discipline equitably across similarly situated employees to avoid claims of discrimination or favoritism.

Question 143: Which standard governs how healthcare organizations must safeguard electronic protected health information (ePHI) under federal law?

HIPAA Security Rule (Correct answer)
HITECH Breach Notification Rule
HIPAA Privacy Rule
21st Century Cures Act Information Blocking provisions

Correct answer: HIPAA Security Rule

The HIPAA Security Rule establishes national standards for protecting ePHI through administrative, physical, and technical safeguards.

Question 144: Which element distinguishes 'fraud' from 'abuse' in healthcare compliance?

Whether the payer is a government or commercial insurer
The dollar amount of the improper claim
Whether the provider is a hospital or individual practitioner
The intentional, knowing, or reckless nature of the conduct (Correct answer)

Correct answer: The intentional, knowing, or reckless nature of the conduct

Fraud requires intentional or knowing deception, whereas abuse involves practices that are inconsistent with sound fiscal, business, or medical practices but may lack specific intent.

Question 145: What is 'duplicate billing' and how does it constitute a compliance violation?

Charging a patient after insurance has already paid
Sending the same claim to two different state agencies
Submitting the same claim more than once for the same service rendered to the same patient on the same date (Correct answer)
Billing for a service twice in error during system migration

Correct answer: Submitting the same claim more than once for the same service rendered to the same patient on the same date

Duplicate billing—submitting identical claims multiple times for the same service—is a False Claims Act violation that results in overpayments subject to recoupment and potential penalties.

Question 146: The 'safe harbor' regulations under the Anti-Kickback Statute are important because they:

Describe arrangements that will not be prosecuted as kickbacks even if they technically involve remuneration (Correct answer)
Eliminate all civil and criminal liability for any healthcare arrangement
Apply only to arrangements involving government payers
Replace the Stark Law self-referral prohibitions

Correct answer: Describe arrangements that will not be prosecuted as kickbacks even if they technically involve remuneration

AKS safe harbors protect specified arrangements from prosecution because, while they may involve remuneration, they are unlikely to cause the types of abuses the statute was designed to prevent.

Question 147: The OIG's List of Excluded Individuals and Entities (LEIE) is significant for healthcare compliance programs primarily because:

Entities that employ or pay excluded individuals may be subject to civil monetary penalties (Correct answer)
It applies only to individuals excluded for fraud, not for quality-of-care violations
Exclusion from the LEIE automatically triggers loss of a provider's state medical license
It lists all providers who have been investigated but not charged

Correct answer: Entities that employ or pay excluded individuals may be subject to civil monetary penalties

Organizations that employ or contract with LEIE-excluded individuals for services paid by federal healthcare programs can face significant civil monetary penalties.

Question 148: A home health agency provides free housekeeping services to patients who agree to use the agency for Medicare-covered skilled nursing services. This arrangement most likely violates:

The Stark Law only
The Anti-Kickback Statute only
Both the Anti-Kickback Statute and the False Claims Act (Correct answer)
HIPAA and the Stark Law

Correct answer: Both the Anti-Kickback Statute and the False Claims Act

Providing free services (housekeeping) as an inducement to choose the agency for Medicare services violates the AKS, and any resulting Medicare claims would be false claims under the FCA.

Question 149: What is the recommended approach when a compliance investigation reveals that a violation was systemic rather than an isolated incident?

Immediately self-disclose to all relevant government agencies
Terminate the entire department involved
Implement systemic corrective actions, update policies, and provide targeted retraining (Correct answer)
Address only the individual employees involved and close the investigation

Correct answer: Implement systemic corrective actions, update policies, and provide targeted retraining

Systemic violations require systemic corrective actions including policy updates, process changes, and targeted training to prevent recurrence across the organization.

Question 150: Which of the following best describes 'phantom billing' in healthcare fraud?

Billing for services that were never provided to the patient (Correct answer)
Billing separately for procedures that should be bundled
Billing for a more expensive procedure than performed
Billing for a non-covered service using a covered service code

Correct answer: Billing for services that were never provided to the patient

Phantom billing refers to submitting claims for services, procedures, or supplies that were never actually provided to the patient.

Question 151: A compliance officer discovers that a departmental procedure contradicts a newly updated organization-wide policy. The BEST course of action is to:

Immediately suspend the department's operations until resolved
Allow departments to follow whichever document they prefer
Archive both documents and draft an entirely new policy from scratch
Escalate to department leadership and legal to align the procedure with the policy (Correct answer)

Correct answer: Escalate to department leadership and legal to align the procedure with the policy

Conflicting documents create compliance risk; the compliance officer should work with department leadership and legal counsel to reconcile the procedure with the governing policy.

Question 152: A healthcare compliance officer receives an anonymous hotline report alleging that a supervisor is falsifying patient records. What is the correct FIRST step?

Conduct a preliminary assessment to determine if an investigation is warranted (Correct answer)
Immediately terminate the supervisor
Notify the supervisor that a complaint has been filed
Discard the report since it is anonymous

Correct answer: Conduct a preliminary assessment to determine if an investigation is warranted

All hotline reports, including anonymous ones, require a preliminary assessment to determine scope, severity, and whether a formal investigation is needed.

Question 153: Which federal agency's Self-Disclosure Protocol should a healthcare organization use when voluntarily reporting Stark Law violations?

Department of Justice (DOJ)
Centers for Medicare & Medicaid Services (CMS) (Correct answer)
Office of Inspector General (OIG)
Department of Health and Human Services (HHS)

Correct answer: Centers for Medicare & Medicaid Services (CMS)

CMS administers the Stark Law Self-Referral Disclosure Protocol (SRDP) for voluntary reporting of Stark Law violations.

Question 154: A compliance investigation reveals that a physician self-referred patients to a facility in which he has an ownership interest. Which federal law is MOST directly implicated?

Anti-Kickback Statute
HIPAA Privacy Rule
Stark Law (Physician Self-Referral Law) (Correct answer)
False Claims Act

Correct answer: Stark Law (Physician Self-Referral Law)

The Stark Law prohibits physician self-referrals for designated health services when the physician has a financial relationship with the entity.

Question 155: A key distinction between the Stark Law and the Anti-Kickback Statute (AKS) is that the Stark Law:

is enforced exclusively by the Department of Justice (DOJ).
applies only to referrals made by physicians for designated health services (DHS). (Correct answer)
carries both criminal and civil penalties for violations.
requires proof of specific intent to violate the law for penalties to be imposed.

Correct answer: applies only to referrals made by physicians for designated health services (DHS).

The Stark Law is more narrowly focused than the AKS. It specifically prohibits physicians from referring Medicare or Medicaid patients for 'designated health services' to entities with which they (or an immediate family member) have a financial relationship, unless an exception applies. The AKS applies more broadly to any remuneration for referrals of any federal healthcare business and is not limited to physicians or DHS.

Question 156: Which of the following actions would MOST likely be considered an aggravating factor when determining the severity of discipline for a compliance violation?

The employee cooperated fully with the investigation
The employee self-reported the violation before it was discovered
The employee had no prior disciplinary history
The employee concealed evidence and continued the conduct after warnings (Correct answer)

Correct answer: The employee concealed evidence and continued the conduct after warnings

Concealment and continuation of misconduct after warnings are classic aggravating factors that justify more severe discipline than the underlying violation alone.

Question 157: An internal investigation reveals a pattern of upcoding. To calculate the potential overpayment, what statistical method is commonly used?

Simple random sampling with extrapolation (Correct answer)
Full universe review of all claims
Stratified purposive sampling without extrapolation
Time-series trending analysis

Correct answer: Simple random sampling with extrapolation

Random sampling with extrapolation is the standard method for estimating overpayments across a large population of claims efficiently.

Question 158: A hospital's internal audit identifies a systemic billing software error that resulted in significant overpayments from Medicare over the past two years. After quantifying the amount, what is the organization's primary obligation under the Patient Protection and Affordable Care Act (ACA)?

To immediately enter into a Corporate Integrity Agreement (CIA) with the Office of Inspector General (OIG).
To document the error internally and offset the amount against future claims.
To report and return the overpayment within 60 days of its identification. (Correct answer)
To wait until the Medicare Administrative Contractor (MAC) discovers the error through its own audits.

Correct answer: To report and return the overpayment within 60 days of its identification.

The ACA established the "60-day rule," which requires a person who has received an overpayment from a federal healthcare program to report and return it within 60 days of the date the overpayment was identified. [3, 27, 30] Failure to do so can convert the overpayment into a potential violation of the False Claims Act. [27, 29]

Question 159: Which document type provides the authoritative basis (the 'why') that all related procedures and work instructions should reference?

Standard operating procedure
Policy (Correct answer)
Audit checklist
Work instruction

Correct answer: Policy

A policy establishes the organizational rule or principle that gives authority and rationale to the procedures and work instructions that implement it.

Question 160: A compliance program's work plan should PRIMARILY be based on which of the following?

Requests from department heads only
National benchmarks with no local customization
Results of the organization's current risk assessment (Correct answer)
The prior year's work plan copied verbatim

Correct answer: Results of the organization's current risk assessment

The annual work plan should be driven by the current risk assessment to ensure compliance activities address the organization's most significant and timely risks.

Question 161: An employee alleges that they were wrongfully terminated in retaliation for reporting a compliance concern. Under the False Claims Act's anti-retaliation provisions, the employee may:

Only seek reinstatement but not back pay
Seek unlimited punitive damages without proof of harm
Only file a complaint with the state labor board
Seek reinstatement, double back pay, and attorneys' fees (Correct answer)

Correct answer: Seek reinstatement, double back pay, and attorneys' fees

The FCA's anti-retaliation provision (31 U.S.C. § 3730(h)) allows prevailing employees to recover reinstatement, double back pay, and attorneys' fees.

Question 162: Which of the following scenarios describes a permissible incidental disclosure under HIPAA?

A billing employee shares PHI with an unaffiliated third party for curiosity
A hospital staff member discusses a patient's condition in a hallway while taking reasonable precautions to limit overheard information (Correct answer)
A receptionist emails a patient's full medical record to the wrong address
A nurse loudly announces a patient's HIV status in a crowded waiting room

Correct answer: A hospital staff member discusses a patient's condition in a hallway while taking reasonable precautions to limit overheard information

Incidental disclosures that occur as a byproduct of otherwise permissible communications are allowed if the covered entity has reasonable safeguards in place and follows minimum necessary standards.

CHC Certified in Healthcare Compliance Exam

The CHC (Certified in Healthcare Compliance) Exam is administered by the Health Care Compliance Association (HCCA) and tests knowledge across all major domains of healthcare compliance including fraud and abuse prevention, HIPAA privacy and security, billing and coding compliance, auditing and monitoring, compliance program administration, and regulatory oversight. Candidates must demonstrate competency in designing and managing effective compliance programs within healthcare organizations.

150

Questions

180 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds