AAPC-CDEO Certified Documentation Expert Outpatient - Set 1 - Part 2

Correct Answer: Erroneous claim, outside False Claims Act coverage

OIG guidance treats innocent errors as erroneous claims. The civil False Claims Act covers only actual knowledge, deliberate ignorance, or reckless disregard, and does not encompass mistakes, errors, or negligence, so this claim falls outside it. Option a is incorrect because OIG guidance describes fraudulent claims as intentionally or recklessly false, and the False Claims Act does not encompass negligence or mistakes. Option b is incorrect because reckless disregard is a statutory knowing standard, yet the provider here had no awareness of the mistake, so that standard is not met. Option c is incorrect because deliberate ignorance is one of the knowing states under the statute, and nothing in the described facts shows the provider acted in that way.

Correct Answer: anti-kickback statute

OIG guidance tells small entities, including physician practices, that obtaining training through an affiliated hospital or other provider can raise Federal anti-kickback statute and physician self-referral implications, so the practice should be mindful of both. Option b is incorrect because fair market value is the payment measure that generally addresses kickback concerns; it is not a statute, so it does not fit the blank. Option c is incorrect because it is described as the Government's primary enforcement tool for knowingly false claims, not as the law raised by borrowed training arrangements with affiliated providers. Option d is incorrect because standards of conduct are internal entity documents that noncompliance is measured against, not a Federal law tied to arrangements with affiliated hospitals.

Correct Answer: Building on existing protocols and procedures

OIG guidance says practices can rely, at least in part, on standard protocols and current practice procedures, and many already have the framework of a program. This is how programs are scaled to a practice's size and resources. Option a is incorrect because OIG states that physicians face no penalties for innocent errors or negligence; erroneous claims lead only to return of the funds claimed in error. Option b is incorrect because under Element 5, all levels of employees should be subject to the same consequences for similar offenses, whatever the size of the practice. Option c is incorrect because written policies and procedures are Element 1, described as a critical part of any compliance program, so a small practice cannot drop them.

Correct Answer: A starting point for internal review

OIG describes its list of physician practice risk areas as not exhaustive. It should be viewed as a starting point for an internal review of potential vulnerabilities, so practices must look beyond it. Option a is incorrect because OIG states the list of risk areas is not exhaustive or all-encompassing, so a practice cannot treat it as covering every vulnerability. Option b is incorrect because written standards and procedures are a separate central component of a compliance program, developed after the internal audit identifies risk areas, not replaced by the list. Option d is incorrect because practices seeking more guidance on risk areas are directed to the OIG Work Plan and semiannual reports, which the four-area list does not replace.

Correct Answer: Federal anti-kickback statute

The Federal anti-kickback statute is an intent-based, criminal statute that prohibits remuneration, whether monetary, in-kind, or in other forms, in exchange for referrals of Federal health care program business. Free equipment qualifies as remuneration. Option a is incorrect because it is a privacy and security framework, separate from the primary fraud and abuse laws, and does not address payments for referrals. Option b is incorrect because it restricts physician referrals for designated health services to entities with which a financial relationship exists, unless an exception applies, and is not described as an intent-based criminal statute. Option c is incorrect because it gives OIG administrative authority to pursue assessments, penalties, and exclusion before an administrative law judge rather than serving as the criminal prohibition.

Correct Answer: Not more than 60 days

OIG guidance says that once credible evidence of a violation is determined to exist, the entity should promptly notify the appropriate Government authority, and not more than 60 days after that determination. Option b is incorrect because this period exceeds the limit OIG guidance gives, so waiting that long after the determination would not count as prompt notification. Option c is incorrect because five years is the length of a CIA period, a separate matter, and has no bearing on the reporting deadline. Option d is incorrect because the OIG guidance sets a different outer limit for notifying the Government; a 30-day period is not the standard it states.

Correct Answer: Gaining ideas for compliance program structure and audit plan design

OIG guidance explains that an entity not under a CIA can look to requirements for an entity in the same industry subsector that is under one, to glean ideas from compliance program structure to external and internal audit plan designs. Option a is incorrect because that agreement is what an entity receives in exchange for accepting its own CIA obligations in a settlement, not by reading another entity's agreement. Option c is incorrect because IRO reviews are an obligation written into a CIA for the settling entity, so an entity outside a CIA does not meet them through this practice. Option d is incorrect because the protocol is a separate voluntary process for reporting self-discovered evidence of potential fraud, and consulting another entity's CIA does not accomplish it.

Correct Answer: UPIC

Medicare manual guidance directs MAC, CERT, SMRC and RAC reviewers to refer cases with potentially fraudulent documentation entries to the UPIC. They may also consider referring to the RO and State Agency. Option a is incorrect because the State Agency is only one possible additional referral that reviewers may consider, and it is not the contractor that receives the required referral. Option b is incorrect because the MAC is one of the reviewers that identifies the questionable entries, so it is a referring contractor rather than the recipient. Option c is incorrect because reviewers may consider also referring cases to the RO, but the guidance does not make it the required recipient of suspected fraud referrals.

Correct Answer: Newly hired LPN

The MACs, MRAC, and CERT must use licensed nurses (RNs), therapists or physicians for these reviews. Current LPNs may be grandfathered in, but these contractors shall not hire any new LPNs for medical record review. Option a is incorrect because physicians are listed among the licensed professionals who may perform these reviews, and they may also be consulted for advice during a review. Option b is incorrect because licensed nurses (RNs) are named in the guidance as professionals who perform medical record reviews for coverage determinations at the MACs, MRAC, and CERT. Option d is incorrect because therapists appear in the same list as nurses and physicians, so they are a permitted reviewer type for these contractors.

Correct Answer: HHS Office for Civil Rights (OCR)

HHS's Office for Civil Rights (OCR) is responsible for administering and enforcing the HIPAA Privacy, Security, and Breach Notification Rules, according to OIG compliance guidance. Option b is incorrect because OIG is named among the law enforcement partners that pursue health care fraud cases, not as the office administering HIPAA rules. Option c is incorrect because CMS is not the office the guidance assigns to administer HIPAA's Privacy, Security, and Breach Notification Rules; that role belongs to HHS OCR. Option d is incorrect because DOJ works with OIG on criminal health care fraud prosecutions; the guidance does not give it enforcement of the HIPAA Privacy Rule.

Correct Answer: Operations disclosure without a relationship with the individual

Disclosure to another covered entity for its health care operations is allowed only if each entity has or had a relationship with the individual and the information pertains to that relationship. Without that relationship, it is not permitted. Option a is incorrect because the covered entity may use or disclose protected health information for its own treatment, payment, or health care operations, so this is expressly permitted. Option b is incorrect because a covered entity may disclose protected health information for the treatment activities of a health care provider, so this falls inside the permitted set. Option c is incorrect because these specifications allow release to another covered entity or a health care provider when the receiving entity needs the information for its own payment activities.

Correct Answer: Impermissible disclosure to an unauthorized person, where no risk assessment has been performed

An impermissible disclosure outside the listed exclusions is presumed to be a breach unless the entity demonstrates a low probability of compromise through a risk assessment. Skipping that assessment is not an exclusion. Option a is incorrect because the definition excludes this internal disclosure between authorized persons at one covered entity or business associate when the information is not passed on improperly. Option b is incorrect because it is a listed exclusion, covering good-faith access within the scope of authority that leads to no further use or disclosure not permitted. Option d is incorrect because this matches the third exclusion, which rests on the entity's good faith belief that the recipient would not reasonably have been able to retain the information.

Correct Answer: Refraining from intimidating or retaliatory acts

A covered entity may not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against an individual for exercising a right, including filing a complaint. Discharging the patient because of her complaint would be retaliation. Option a is incorrect because it applies to members of the workforce who fail to follow privacy policies, so it concerns staff discipline rather than treatment of the patient. Option b is incorrect because it obliges the entity to record complaints received and their disposition, which says nothing about taking action against the person who complained. Option c is incorrect because it requires a covered entity to reduce known harmful effects of an improper use or disclosure, not to govern how complainants are treated.

Correct Answer: I, II, and III

The AHIMA and ACDIS practice brief lists unsupported documented diagnoses, "history of" conditions that may be active, and differential diagnoses needing ruling in or out as query circumstances. A coder's view that a diagnosis is unusual is not listed. Option a is incorrect because it omits statement III, since clarifying whether a differential diagnosis condition was ruled in or ruled out is also a listed query circumstance. Option c is incorrect because it drops statement I, a listed circumstance, and adds statement IV, a coder's impression of an unusual diagnosis that the AHIMA and ACDIS list does not contain. Option d is incorrect because it includes statement IV, which is not a listed circumstance, and it leaves out statement II, the clarification of a "history of" condition.

Correct Answer: Substantial compliance

The brief states that substantial compliance with its principles, rather than rigid technical adherence to any specific element, is the appropriate standard for external review. A query meeting the core requirements satisfies it. Option b is incorrect because the brief rejects this approach, stating that substantial compliance with its principles is the appropriate standard rather than rigid technical adherence to any specific element. Option c is incorrect because the brief says organizations shape query practices within their own facility policies, but it does not name facility approval as the external review standard. Option d is incorrect because the brief leaves audit criteria of federal and state agencies and contractors to separate regulatory frameworks; it does not offer them as its own review standard.

Correct Answer: "Other, please specify"

A multiple-choice query must allow the provider to offer an alternative explanation or diagnosis other than the listed options, for example by adding "Other, please specify" or "Other explanation of clinical findings, please specify." Option a is incorrect because it is listed only among optional answer options that may be used when suitable, so no query is required to include it. Option b is incorrect because the guidance names it among optional wording used if suitable for the circumstances, not as the means of allowing an alternative diagnosis. Option d is incorrect because it appears in the guidance only as one of several optional choices, and its use is not required on any multiple-choice query.

Correct Answer: A query can be noncompliant without being leading

Query guidelines state that a query can be considered noncompliant without being leading. If required elements, such as specific clinical indicators or no reimbursement mention, are missing, the query is noncompliant even without overt direction. Option b is incorrect because the guidelines say no required number of clinical indicators exists, because relevance varies by diagnosis, patient, and clinical scenario. Option c is incorrect because the guidelines state that unmet required elements make a query noncompliant even when it does not overtly direct or lead the provider. Option d is incorrect because a properly answered, authenticated query that is part of the permanent health record is sufficient for code assignment without repetition.

Correct Answer: Sending a manual follow-up query to override the response

When a technology-generated query does not produce a desired response, sending a follow-up manual query for the same diagnosis solely to override the provider's prior response is noncompliant unless new clinical indicators exist. Option a is incorrect because the guidance permits a policy for nonresponse, provided that policy complies with the brief's standards, so it is an acceptable way to handle silence. Option b is incorrect because structured auditing is the expected safeguard for organizations that deliver automated queries without pre-delivery human review, not a prohibited response to an unwanted answer. Option c is incorrect because an "other" option, or a way to give an alternate explanation, is required for technology-generated answer options, so it supports compliance.

Correct Answer: Non-descriptive and not identifying an undocumented diagnosis

Under the naming conventions standard, an organization may hide template names from the provider. If names are visible, they must be non-descriptive and must not identify a diagnosis that has not already been documented. Option a is incorrect because formatting guidance calls for plain text in query content and rejects bolded text unless it appears that way in the original record. Option c is incorrect because a name that references a desired diagnosis is leading; visible names must not identify a diagnosis that has not already been documented. Option d is incorrect because visible template names must be non-descriptive, so naming a template for its clinical topic would work against the naming convention the brief sets.

Correct Answer: A clear "open door" policy

OIG guidance states that in a small physician practice the communication element may be met by a clear "open door" policy between physicians, compliance personnel and employees, used with informal techniques such as notices or a bulletin board. Option a is incorrect because this is a committee structure that supports the compliance officer in operating the program, not the less formal communication technique that small practices are encouraged to use. Option b is incorrect because federal guidance says a formal disclosure program may not be necessary or appropriate for a small organization, so it does not fit this setting. Option d is incorrect because OIG recognizes that protecting anonymity may not be feasible for small physician practices, so promising it cannot be the standard approach here.