AAPC-CPCO Certified Professional Compliance Officer - Set 4 - Part 1

Correct Answer: Intentional deception

Knowingly billing Medicare for appointments patients do not keep is a listed fraud example. Program integrity guidance places billing for services not provided under intentional deceptions, which result in fraud. Option b is incorrect because inefficiencies result in waste, such as ordering excessive diagnostic tests, which does not involve billing for services that were never furnished. Option c is incorrect because bending the rules results in abuse, such as improper billing practices like upcoding, while knowingly billing for services not provided is listed under fraud. Option d is incorrect because mistakes produce errors such as incorrect coding that is not widespread, and this conduct involves knowing billing rather than an innocent error.

Correct Answer: Three times the damages

The civil False Claims Act makes a liable person responsible for a civil penalty per claim plus 3 times the amount of damages the Government sustains because of the act, so liability can grow quickly. Option a is incorrect because the statute sets a figure higher than double the Government's damages, so this multiple falls short of the stated liability. Option c is incorrect because this overstates the statutory exposure, because the False Claims Act sets a lower multiple of the Government's damages, not a quadruple amount. Option d is incorrect because a single multiple would only repay the Government's loss, whereas the statute adds a larger multiple of damages on top of the per-claim penalty.

Correct Answer: The employee conducts it; no person other than the Government may bring a related action

When the Government notifies the court that it declines to take over, the person bringing the action has the right to conduct it. While the action is pending, no person other than the Government may intervene or bring a related action. Option a is incorrect because the statute bars every person other than the Government from bringing a related action on the underlying facts once a person has filed the pending action. Option b is incorrect because declining means the Government does not take over, so the conduct of the action passes to the person who brought it, not the Government. Option c is incorrect because the statute assigns no conduct role to the court on declination; it gives the person bringing the action the right to conduct it.

Correct Answer: Permission to delegate the power to a designee

FERA amended section 3733 to add 'or a designee' after the Attorney General and to replace 'may not delegate' with 'may delegate', so the civil investigative demand power can be delegated. Option b is incorrect because the amendment expressly allows demands to be issued before making an election under section 3730(b), so the election does not have to come first. Option c is incorrect because the amended text lets the Attorney General or a designee issue a demand before commencing a civil proceeding under section 3730(a) or other false claims law. Option d is incorrect because the amendment struck the words 'may not delegate' and inserted 'may delegate', and it added 'or a designee' after 'Whenever the Attorney General', so delegation became permitted.

Correct Answer: It can be remuneration, because any amount counts

OIG guidance defines remuneration as anything of value, in cash, in kind, or other form, regardless of the amount. A small payment given to induce referrals therefore can still be remuneration under the statute. Option a is incorrect because cash is just one listed form; the guidance also names cash equivalents, items, space, equipment and services, and defines remuneration as cash, in kind, or other form. Option c is incorrect because the guidance says remuneration can exist even where it was determined to be fair market value in an arm's-length transaction, so excess value is not required. Option d is incorrect because OIG guidance lists remuneration as covered regardless of the amount, so the statute sets no minimum value below which a payment is excluded.

Correct Answer: Common ownership or control

The affiliated covered entity standard allows legally separate covered entities to designate themselves as a single covered entity only if all entities designated are under common ownership or control, and the designation must be documented. Option a is incorrect because business associate arrangements are an organizational requirement the covered entity must meet separately, and the regulation does not make matching agreements a condition for affiliation. Option b is incorrect because a health care component is a concept for hybrid entities, and sharing one is not what the affiliated covered entity standard asks for. Option c is incorrect because the regulation lets the entities make the designation themselves and requires only that it be documented, with no approval step mentioned.

Correct Answer: Timeliness of the self-disclosure

The statute lets the Secretary consider the nature and extent of the improper or illegal practice, the timeliness of the self-disclosure, cooperation in providing additional information, and other factors the Secretary considers appropriate. Timeliness is expressly named. Option b is incorrect because the statute treats the SRDP as separate from the advisory opinion process, and it does not name an advisory opinion outcome among the listed factors. Option c is incorrect because physician headcount is not one of the three named factors. Only the general catch-all for other appropriate factors could reach it, and the statute does not name it. Option d is incorrect because the statute's named factors are the nature and extent of the practice, timeliness, and cooperation; patient population size appears nowhere in that express list.

Correct Answer: Inducements to beneficiaries are barred regardless of medical condition

Section 1128A(a)(5) bars inducements offered to Medicare and Medicaid beneficiaries regardless of the beneficiary's medical condition, so a beneficiary's health status does not remove the offer from the prohibition. Option a is incorrect because OIG describes the prohibition as covering Medicare and Medicaid beneficiaries generally, not as a rule limited to patients with chronic conditions. Option b is incorrect because remuneration is read broadly as anything of value, including free or discounted items and services and waived coinsurance or deductibles, so cash is just one form. Option d is incorrect because the inducement element uses a knows-or-should-know standard, met by deliberate ignorance or reckless disregard, and OIG states no proof of specific intent is required.

Correct Answer: Pays the claim as an exception

The regulation lists an exception to the payment ban for Part B enrollees. When an enrollee submits an otherwise payable claim for services by an excluded individual after the exclusion date, CMS pays the first claim submitted by the enrollee. Option a is incorrect because the regulation carves out an exception for an enrollee's first otherwise payable claim, so the general ban on payment does not require denial here. Option b is incorrect because an excluded individual or entity may not take assignment of an enrollee's claim on or after the effective date of exclusion. Option c is incorrect because the regulation does not tie the enrollee's first claim to reinstatement; the exception lets CMS pay it even though the physician remains excluded.

Correct Answer: It does not prevent a conviction

The statute states that a person need not have actual knowledge of the section or specific intent to violate it. The Government must still prove intent to defraud beyond a reasonable doubt, so ignorance of the statute is no defense. Option a is incorrect because OIG guidance places the burden on the Government, which must prove its case beyond a reasonable doubt, and that burden stays there. Option b is incorrect because the Government must still show the defendant acted with intent to defraud; only specific intent to violate the statute itself is excused. Option d is incorrect because the statute sets its penalty tiers by the harm resulting from the violation, such as serious bodily injury or death, and not by what the defendant knew of the law.

Correct Answer: When the person knowingly receives or retains the overpayment

Under 42 CFR 401.305, a person has identified an overpayment when the person knowingly receives or retains it. The term "knowingly" carries the False Claims Act meaning found in 31 U.S.C. 3729(b)(1)(A). Option a is incorrect because a cost report due date is only the alternative deadline for reporting and returning, applying when it is later; it does not trigger identification. Option c is incorrect because the 60 days are counted from the date the overpayment was identified, so the deadline's expiry comes after identification and cannot define it. Option d is incorrect because that acknowledgment suspends the deadline for returning the overpayment, which presumes the overpayment was already identified, so it is not the identification event.

Correct Answer: The Secretary

Under the Medicare suspension provision, the Secretary may suspend payments pending investigation of a credible allegation of fraud, and the Secretary must consult with the Inspector General of HHS in determining whether such an allegation exists. Option a is incorrect because the statute lets a State decide credible allegations only for Medicaid payments under the Secretary's regulations, and it places no consultation duty on the State here. Option b is incorrect because contractors are described as reporting performance statistics to the Inspector General and the Secretary, not as the official who consults on credible allegations. Option c is incorrect because the Medicare suspension provision assigns the consultation duty to the Secretary, and it does not name the Attorney General in that role.

Correct Answer: Subcontractor

The HIPAA definition of business associate includes a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate, so the obligations extend down the chain of service providers. Option b is incorrect because the definition expressly excludes a plan sponsor with respect to disclosures made to it by a group health plan, so it is not covered. Option c is incorrect because a provider receiving disclosures from a covered entity about an individual's treatment is listed as excluded from the business associate definition. Option d is incorrect because workforce members act within the covered entity itself, and the definition applies to persons acting other than in that capacity.

Correct Answer: HHS Office for Civil Rights (OCR)

HHS's Office for Civil Rights is responsible for administering and enforcing the HIPAA Privacy, Security, and Breach Notification Rules, which is why rising cybersecurity attacks make these rules a priority in risk assessments. Option a is incorrect because NIST developed the HSR Toolkit, a self-assessment survey for understanding the Security Rule, and is not the agency that enforces these rules. Option b is incorrect because ONC joined OCR in launching the HIPAA Security Risk Assessment Tool, which is a support role, not administration or enforcement of the rules. Option c is incorrect because DOJ is named alongside OIG as a law enforcement partner pursuing criminal health care fraud cases, a different statute from the HIPAA rules.

Correct Answer: Provider transmitting health information electronically in a covered transaction

The applicability provision lists health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a covered transaction. Such providers are covered entities. Option a is incorrect because keeping designation documentation is a duty that a covered entity must meet, so it describes an obligation rather than the trigger for covered entity status. Option c is incorrect because risk assessment is a Security Rule activity that covered entities carry out, not the condition that makes a provider a covered entity. Option d is incorrect because using a business associate does not create covered entity status; a business associate is a separate category that the standards reach only where provided.

Correct Answer: A data use agreement

The HIPAA Privacy Rule allows a covered entity to meet its business associate requirements when it discloses only a limited data set for a health care operations function and has a data use agreement with the business associate. Option b is incorrect because a subcontractor is a person to whom a business associate delegates a function, so it describes a downstream relationship rather than the covered entity's agreement. Option c is incorrect because that step applies when a business associate is required by law to perform a function and satisfactory assurances cannot be obtained, which is a different situation. Option d is incorrect because it addresses the exchange of information in electronic transactions and the duties of each party in a standard transaction, not limited data set use.

Correct Answer: 60 days after receipt

The amendment standard requires a covered entity to act on an individual's request no later than 60 days after receiving it. A single extension of no more than 30 days is allowed, with a written explanation of the delay. Option a is incorrect because 30 days is the longest extension a covered entity may take when it cannot act in time, not the initial deadline for acting. Option b is incorrect because 90 days would only result from adding the maximum 30-day extension to the initial period, so it is not the initial deadline itself. Option d is incorrect because 120 days exceeds both the initial period and the extended period, since an extension is capped at no more than 30 days.

Correct Answer: Authority under applicable law to make health care decisions

The personal representative standard requires that a person have authority under applicable law to act for an adult or emancipated minor in making health care decisions. The covered entity then treats that person as the individual. Option a is incorrect because the standard looks to authority under applicable law to make health care decisions, so kinship alone does not establish the role. Option c is incorrect because a subcontractor receives PHI from a business associate under satisfactory assurances, which is a separate arrangement from deciding health care matters for an individual. Option d is incorrect because that is the safeguard a covered entity obtains before disclosing PHI to a business associate, not a test for acting on an adult's behalf.

Correct Answer: Required disclosure to an individual

Under the general rule, a covered entity is required to disclose PHI to an individual when requested under and required by the access provision. A patient's request for her own records therefore falls in required disclosures to the individual. Option a is incorrect because an authorization is a separate permission route for disclosures to others, and the individual's own access request does not depend on signing one. Option b is incorrect because an incidental disclosure is one that occurs alongside a use or disclosure otherwise permitted, and a direct access request is not a byproduct of another disclosure. Option d is incorrect because that category covers disclosures demanded by the Secretary to investigate or determine compliance, and here the request comes from the patient, not the Secretary.

Correct Answer: business associate

Under the HIPAA definition, data aggregation is done by a business associate in its capacity as business associate of a covered entity. It combines that protected health information with information received as business associate of another covered entity. Option a is incorrect because it is defined as keeping medical and billing records about individuals, not as the party that combines protected health information from several covered entities. Option b is incorrect because it is a facility for confining or rehabilitating persons charged with or convicted of an offense, and has no role in combining protected health information. Option c is incorrect because the definitions place enrollment, payment, claims adjudication, and case or medical management record systems with a health plan, while data aggregation is assigned to another role.