AAPC-CRC Certified Risk Adjustment Coder - Set 1 - Part 2

Correct Answer: Federal anti-kickback statute

The Federal anti-kickback statute is an intent-based, criminal statute. It prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration, whether monetary, in-kind, or other, to induce or reward referrals of Federal health care program business. Option a is incorrect because it prohibits executing or attempting a scheme to defraud a health care benefit program or obtain money by false pretenses, not payments for referrals. Option b is incorrect because it addresses the use and disclosure of protected health information by covered entities and business associates, and has nothing to do with remuneration for referrals. Option d is incorrect because it sets administrative, physical, and technical safeguards protecting electronic PHI, so it governs data protection rather than referral payments.

Correct Answer: Security Rule

The Security Rule, promulgated under HIPAA, specifies a series of administrative, physical, and technical safeguards for covered entities and their business associates to ensure the confidentiality, integrity, and security of electronic PHI. Option a is incorrect because it restricts physician referrals for designated health services to entities with which a financial relationship exists, so data safeguards fall outside its scope. Option c is incorrect because it governs the use and disclosure of identifiable health information and gives individuals rights over their records, rather than prescribing safeguards specific to electronic PHI. Option d is incorrect because it is an intent-based criminal statute against remuneration for referrals of federal health care program business and says nothing about protecting electronic health information.

Correct Answer: General compliance training and fraud, waste, and abuse training

MA Parties should implement general compliance training and fraud, waste, and abuse training to comply with the requirements in CMS's regulations. Other courses described are specialized additions for particular departments. Option a is incorrect because the Federal anti-kickback statute appears only as a marketing-employee topic, and no governing body course is described as a CMS requirement. Option b is incorrect because marketing-related instruction is a specialized training the compliance department requires for particular employees, not one of the two trainings tied to CMS's regulations. Option c is incorrect because these name departments with frequent enrollee contact that MAOs may give specialized training, which is optional and not the required pair.

Correct Answer: The MA organization's enrollees

The regulation lists the compliance officer, compliance committee members, employees, managers, the governing body, and first tier, downstream, and related entities as connected parties. Enrollees are not named among them, so they are the exception. Option a is incorrect because the governing body appears in the regulation's list of parties between whom confidential communication must be established, together with employees and managers. Option c is incorrect because the regulation names compliance committee members, alongside the compliance officer, among the parties the confidential lines of communication must connect. Option d is incorrect because these entities are expressly included, which is why the lines of communication must be accessible to all, not just internal staff.

Correct Answer: An effective compliance program that is adopted and implemented

42 CFR 422.503(b)(4)(vi) requires the organization to adopt and implement an effective compliance program with measures that prevent, detect, and correct non-compliance with CMS program requirements and fraud, waste, and abuse. Option a is incorrect because written policies, procedures, and standards of conduct are just core requirement (A); the rule says the program must, at a minimum, include further core requirements too. Option b is incorrect because the regulation requires measures for non-compliance with CMS program requirements as well as for fraud, waste, and abuse, so limiting scope to one leaves a gap. Option d is incorrect because the regulation lists monitoring and auditing as only one of several core requirements, so a program limited to audits would omit written policies, training and the others.

Correct Answer: How the entity strives to comply with applicable requirements

Under Element 1, written policies and procedures demonstrate to stakeholders, including Government regulators, how the entity strives to comply with applicable laws, regulations, and requirements, while also serving as a roadmap of duties and controls. Option a is incorrect because meeting frequency is a separate Compliance Committee expectation, set at no less than quarterly, and is not what policies demonstrate to regulators. Option c is incorrect because the guidance does not describe policies as a record of discipline; they outline duties, workflow, documentation requirements, oversight roles, and entity-wide controls. Option d is incorrect because budget approval is not a stated purpose of written policies; the board's role concerns oversight of the compliance officer and Compliance Committee.

Correct Answer: Code of conduct

A code of conduct is the tool that communicates an organization's mission, goals, and ethical requirements. It defines ethical standards and governs the conduct of officers, employees, contractors, medical staff, and others working on behalf of the organization. Option b is incorrect because a handbook only delineates or expands upon the code and is regularly updated as requirements change; it is not the document that sets ethical requirements. Option c is incorrect because it addresses how the organization screens individuals and entities against the LEIE and State Medicaid exclusion lists, not the organization's mission and ethical standards. Option d is incorrect because it is a Compliance Committee product that is developed and evaluated for effectiveness, rather than a statement of mission and ethical standards for all who work for the organization.

Correct Answer: Report directly to the CEO or the board

OIG guidance says the compliance officer should report directly to the CEO or the board, not to legal or financial functions, and should not be responsible for billing, coding, or claim submission. Option a is incorrect because a billing manager sits within billing operations, which the compliance officer should keep separation from, so this line would repeat the conflict instead of resolving it. Option c is incorrect because the compliance officer chairs the Compliance Committee, whose purpose is to aid and support the officer, so the committee cannot be the reporting line. Option d is incorrect because OIG guidance says the compliance officer should not lead or report to the legal function, just as with the financial function.

Correct Answer: Compliance Committee

OIG guidance states the Compliance Committee should review the training plan at least annually so topics and materials address current needs, including issues found through monitoring and auditing and changes to Federal and State requirements. Option a is incorrect because HR is named only as a support function the compliance officer coordinates with; OIG guidance does not give it the annual plan review. Option b is incorrect because contractors are among those who should be trained at least annually, so they are an audience for the plan rather than its reviewer. Option c is incorrect because medical staff are learners who receive annual training, not the body assigned to evaluate whether the training plan meets current needs.

Correct Answer: Individual or department responsible for review

OIG guidance says the disclosure log should include pertinent information such as the date received, the individual or department responsible for review, investigation findings, corrective actions, policy changes, date resolved, and any referral to authorities. Option b is incorrect because the guidance stresses striving to maintain confidentiality of the reporter's identity, and it does not list identity as a standard log field. Option c is incorrect because consequences are handled through separate procedures involving managers and human resources, and the log's listed items cover findings and corrective actions instead. Option d is incorrect because reports should not be diverted by supervisors, and the log elements named in the guidance do not include the supervisor of the person reporting.

Correct Answer: A contemporaneous record of the investigation

OIG guidance states that, regardless of the size or severity of the violation being investigated, a contemporaneous record should be maintained so that a record of the investigation can be compiled, covering process, witnesses, results, and corrective action. Option a is incorrect because government notification depends on credible evidence of misconduct that may violate law, and an investigation can show nothing improper occurred, so no report follows automatically. Option b is incorrect because OIG self-disclosure programs are voluntary channels for reporting suspected fraud, and the guidance does not require one for every investigation regardless of size. Option c is incorrect because entities only consider engaging external counsel, auditors, or experts based on scope and severity, so this is a case-specific decision rather than a universal expectation.

Correct Answer: Assess it using the risk assessment methods

When the compliance officer or Compliance Committee identifies a new risk between assessments, such as one from a new entity acquisition, it should be assessed with the same methods used in the compliance risk assessment. The Compliance Committee then decides whether and how to address it. Option b is incorrect because anonymous reporting paths let individuals voice concerns about violations; they are not the way a compliance officer's newly found risk gets evaluated. Option c is incorrect because the guidance directs that a newly identified risk be assessed with the same methods as the compliance risk assessment, not held back until a later cycle. Option d is incorrect because the disclosure log records reports of concerns made by individuals, whereas a risk spotted through scanning calls for a formal assessment instead.

Correct Answer: The Compliance Committee

OIG guidance states the Compliance Committee should be responsible for conducting and implementing the compliance risk assessment. It then works with the compliance officer to prioritize resources and develop the compliance work plan, including audits and monitoring. Option a is incorrect because human resources is named as a function that may help decide consequences for noncompliance, not as the group responsible for conducting the risk assessment. Option c is incorrect because managers and supervisors are described as imposing consequences for noncompliant behavior consistently, which is an enforcement duty and not ownership of the risk assessment. Option d is incorrect because the compliance officer works with the committee to prioritize resources and build the work plan, but the committee is given responsibility for conducting the assessment.

Correct Answer: The position cannot be delegated to an FDR

For MAOs, CMS regulations do not allow the compliance officer position to be delegated to an FDR. The officer should also be full-time, have direct access to the board of directors, and not report to the general counsel. Option b is incorrect because the guidance says the compliance officer should not report to the general counsel, so that reporting line would add a second problem. Option c is incorrect because the position should be full-time for an MA Party, so a part-time arrangement does not cure the delegation issue. Option d is incorrect because attestations are a tool for confirming FDR employees completed training; they do not transfer the officer role, which stays inside the MAO.

Correct Answer: Written arrangements

OIG guidance states that the MAO is ultimately responsible for ensuring, through written arrangements, that contractors, subcontractors, and related entities follow all applicable laws, regulations, and program requirements. Option a is incorrect because attestations are only an example of how an MAO might confirm FDR staff training; they do not carry the MAO's ultimate responsibility. Option b is incorrect because OIG guidance advises MAOs to train FDRs directly rather than relying on FDRs to train themselves, so self-training cannot ensure compliance. Option d is incorrect because CMS regulations for MAOs state the compliance officer position cannot be delegated to an FDR, so this would not secure compliance.

Correct Answer: Summary of the audit work plan and audit results

OIG guidance states that when FDRs perform their own audits, MAOs should receive, at a minimum, a summary of the audit work plan and audit results relating to the services the FDR performs. Option a is incorrect because financial statements are not listed in OIG guidance as the minimum an MAO receives when an FDR conducts its own audits. Option b is incorrect because OIG guidance does not call for personnel files; the minimum it names concerns the FDR's audit work and its results for the services performed. Option c is incorrect because training records relate to education, where the MAO is encouraged to train FDRs directly, not to the audit information received from FDR-performed audits.

Correct Answer: Distribute policies and procedures to FDRs

OIG guidance says policies and procedures should be distributed to FDRs so they clearly understand the MAOs' compliance expectations. MAOs should also have a procedure ensuring the policies are distributed and reviewed. Option a is incorrect because the guidance directs MAOs to share their own policies with FDRs and to train FDRs directly, not to leave FDRs to build their own. Option b is incorrect because the guidance says MA program requirements may call for more frequent review and refresh of policies than non-managed care focused compliance programs use. Option d is incorrect because the guidance states that for MAOs the compliance officer position, per CMS regulations, cannot be delegated to an FDR.

Correct Answer: Issuer records maintenance requirements

The excerpt describes the issuer records maintenance requirements of the HHS risk adjustment standards. Issuers must keep paper, electronic or other records sufficient to evaluate their compliance, and must keep them for each benefit year for at least 10 years. Option a is incorrect because this requirement obliges the issuer to comply with data validation requests from the State or HHS, not to keep supporting records. Option b is incorrect because this covers submitting monthly enrollment and remitting a per-enrollee-per-month fee where HHS operates risk adjustment, not record keeping. Option c is incorrect because this sets the timeframe for remitting net charges after notification, which concerns payment rather than retention of documents.

Correct Answer: Certified medical coders in good standing

The initial validation audit must be conducted by medical coders certified as such and in good standing by a nationally recognized accrediting agency, as the HHS risk adjustment audit rule states. Option b is incorrect because States may collect risk adjustment data under their own programs, but the audit rule assigns the initial validation audit to certified coders, not State examiners. Option c is incorrect because the rule requires auditors to be reasonably free of conflicts of interest, so issuer staff are not the designated group to perform the audit. Option d is incorrect because providers supply medical record documentation to the auditor, which is a separate role from conducting the audit, and their impartiality would be open to question.

Correct Answer: Default data validation charge

Under 45 CFR 153.630, HHS will impose a default data validation charge when an issuer fails to engage an initial validation auditor or fails to submit audit results. Civil money penalties are a separate possible action. Option a is incorrect because it describes a validation audit procedure for checking enrollee health status through paid pharmacy claims, so it is part of the audit itself, not a consequence. Option b is incorrect because it is an audit step in which a certified medical coder with required experience confirms errors found during the initial validation audit; it is not imposed on issuers. Option d is incorrect because it is a duty of the initial validation auditor, who reports consistency rates among its reviewers to the issuer and HHS, rather than a penalty.