This guide organizes sixty study concepts into ten topic groups, moving from compliance program foundations through fraud and abuse laws, HIPAA, EMTALA, CLIA, and OSHA, to auditing and physician-practice risk areas. Read the groups in order for first exposure, or jump to a weak area for targeted review. Each concept pairs a rule with a worked example and a common error, so use the mistakes as self-checks. This is unofficial study support, not a substitute for the official study guide or current regulations.
Foundations of Healthcare Compliance Oversight
1. Role of the Office of Inspector General
The OIG is the HHS agency that audits, evaluates, and investigates federal healthcare programs, and it publishes compliance program guidance, advisory opinions, and a Work Plan identifying areas of scrutiny. Compliance officers track OIG outputs to anticipate where audits and enforcement attention will concentrate.
Example: A practice reviews the newly released Work Plan and finds its specialty's billing pattern listed; it prioritizes an internal review of those claims because listed areas signal coming audit attention.
Mistake to avoid: Treating OIG guidance as optional reading rather than a roadmap of enforcement priorities.
Reference: AAPC CPCO study guide sample
2. Department of Justice enforcement role
The Department of Justice pursues criminal healthcare fraud prosecutions, working alongside OIG on matters involving kickbacks, false claims, and mail or wire fraud. Compliance officers distinguish OIG civil administrative actions from DOJ criminal prosecution when assessing exposure and deciding when to involve legal counsel.
Example: A scheme involving deliberate claim fabrication is referred for criminal prosecution rather than civil settlement because proven intent to defraud triggers DOJ involvement.
Mistake to avoid: Assuming every billing error is a civil matter immune from criminal referral.
Reference: AAPC CPCO study guide sample
3. Corporate Integrity Agreements versus Certification of Compliance Agreements
Corporate Integrity Agreements and Certification of Compliance Agreements are negotiated settlements resolving fraud allegations, imposing multi-year external compliance obligations such as independent reviews and reporting. The compliance officer must calendar and track every requirement because missed obligations extend monitoring and revive enforcement risk.
Example: A practice under a CIA schedules its required independent billing review before the deadline because late completion itself breaches the agreement and reopens exposure.
Mistake to avoid: Letting CIA deadlines slip after the underlying settlement payment is made.
Reference: AAPC CPCO study guide sample
4. Office for Civil Rights and privacy enforcement
The Office for Civil Rights within HHS administers and enforces the HIPAA Privacy Rule through complaint investigations, compliance reviews, technical assistance, and civil money penalties. Complaints from patients or workforce members typically trigger OCR involvement, so complaint intake and documented response are compliance functions.
Example: A patient files a complaint after staff discuss her record in a waiting area; the practice documents its investigation and safeguards because OCR may open a review.
Mistake to avoid: Dismissing patient privacy complaints without a documented investigation and response.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
5. General versus industry-specific compliance program guidance
Under its modernization initiative, the OIG issued the General Compliance Program Guidance covering universal program elements, plus Industry-Specific Compliance Program Guidance tailored to segments such as physician practices, laboratories, and billing companies. Apply the general guidance first, then layer the industry guidance for your entity type.
Example: A third-party billing company builds its program on the GCPG elements, then adds ICPG controls for client claims because its industry guidance addresses billing-specific risks.
Mistake to avoid: Using only generic guidance and ignoring the supplemental requirements of your industry segment.
Reference: AAPC CPCO study guide sample
6. The compliance officer's mandate under the ACA
The Affordable Care Act indicated that compliance programs become mandatory as a condition of enrollment in federal healthcare programs, elevating the compliance officer from optional to essential. The role covers developing, implementing, and monitoring the program and helping others based on governmental regulatory guidelines.
Example: A newly enrolled practice appoints a compliance officer and adopts the OIG elements because enrollment conditioning makes a functioning program an eligibility matter, not a preference.
Mistake to avoid: Assigning compliance as an untrained sideline duty with no authority or resources.
Reference: AAPC CPCO study guide sample
The Seven Elements of an Effective Compliance Program
7. Element one: written policies and procedures
The foundational element requires documented standards of conduct and procedures that translate laws into daily workflow. Policies must be distributed, accessible, and revised when regulations change; unwritten practices cannot be enforced, audited, or defended to investigators or contractors reviewing the program.
Example: A practice converts its verbal rule about verifying licenses into a written policy because auditors and staff need a documented standard to follow and test.
Mistake to avoid: Writing policies once and never revising them after regulatory changes.
Reference: AAPC CPCO study guide sample
8. Element two: compliance leadership and oversight
A designated compliance officer and, for larger entities, a compliance committee must hold authority and a reporting line high enough to act. Leadership oversees the program, allocates resources, and receives risk information; oversight fails when the role lacks independence from the functions it monitors.
Example: The compliance officer reports directly to the governing body rather than the billing manager because oversight of billing cannot sit inside billing.
Mistake to avoid: Burying the compliance officer under the very department being monitored.
Reference: AAPC CPCO study guide sample
9. Element three: training and education
Training must reach all workforce members, teach job-specific compliance duties, and convey that compliance is a condition of continued employment. When no violations are identified, a yearly training cycle suffices; identified violations trigger retraining targeted at the problem found.
Example: A new coder receives documentation and coding compliance training before independent work because every role, not just clinical roles, carries compliance duties.
Mistake to avoid: Limiting training to clinical staff while billing and front-desk personnel go untrained.
Reference: AAPC CPCO study guide sample
10. Element four: open communication and non-retaliation
Effective programs require accessible lines to the compliance officer plus disclosure channels, protected by strict non-retaliation. Fear of retribution keeps whistleblowers silent and allows known fraud to continue; open communication surfaces problems before they mature into violations.
Example: A biller reports suspected upcoding through the hotline without fear because the practice enforces anti-retaliation, letting the issue be fixed internally.
Mistake to avoid: Punishing or sidelining employees who raise compliance concerns.
Reference: AAPC CPCO study guide sample
11. Element five: enforcing standards through consequences and incentives
Standards mean nothing without consistent enforcement. Apply disciplinary measures uniformly regardless of the violator's seniority, and use incentives to reward compliant behavior. Selective enforcement destroys the program's credibility with regulators and aggravates exposure when violations surface.
Example: A high-producing physician is disciplined the same as staff for documentation violations because uniform consequences protect the program's defensibility.
Mistake to avoid: Excusing senior or revenue-generating staff from the same discipline as others.
Reference: AAPC CPCO study guide sample
12. Element six: auditing, monitoring, and corrective response
Risk assessment drives periodic audits and ongoing monitoring, and detected offenses must trigger corrective action: repayment, education, policy revision, and focused re-auditing. Document the level of confidence in correction so the response demonstrates sustained compliance rather than a one-time fix.
Example: An audit finds overpayments; the practice repays, retrains billers, revises the policy, and schedules follow-up audits because a corrective loop closes the finding.
Mistake to avoid: Stopping at repayment without education, policy change, and verification re-audits.
Reference: AAPC CPCO study guide sample
Fraud, Abuse, and the False Claims Act
13. Distinguishing fraud from abuse
Fraud requires knowing, intentional deception for unauthorized benefit; abuse describes practices inconsistent with sound fiscal or clinical standards without proven intent. The distinction drives response: abuse usually warrants correction and education, while suspected fraud requires evidence protection and prompt involvement of legal counsel.
Example: A repeated pattern of billing higher levels after warnings suggests fraud rather than error because knowledge plus continuation supplies the intent element.
Mistake to avoid: Labeling deliberate conduct a billing error to avoid escalation.
Reference: AAPC CPCO study guide sample
14. False Claims Act liability
The False Claims Act penalizes submitting, or causing to be submitted, claims that are knowingly false or fraudulent, including with reckless disregard for truth. Liability extends beyond the person transmitting the claim to anyone who causes it, and penalties attach claim by claim.
Example: A manager who directs staff to unbundle claims faces FCA exposure because causing false claims creates liability, not just submitting them.
Mistake to avoid: Believing only the person pressing submit is liable.
Reference: AAPC CPCO study guide sample
15. Civil Monetary Penalties Law enforcement
The Civil Monetary Penalties Law authorizes OIG administrative penalties for conduct such as claims based on altered records or services rendered by unlicensed personnel, often resolved after self-disclosure. CMP actions proceed administratively rather than through criminal court but still carry payments and exclusion risk.
Example: A facility self-discloses claims for services by an unlicensed nurse and resolves them through a CMP settlement because the administrative channel applies to disclosed violations.
Mistake to avoid: Assuming self-disclosure eliminates all financial consequences.
Reference: AAPC CPCO study guide sample
16. Provider Self-Disclosure Protocol
OIG's Provider Self-Disclosure Protocol lets providers voluntarily disclose potential violations of federal healthcare program rules, typically resolving them on better terms than government-discovered fraud. Disclosure should follow a thorough internal investigation, and the decision to disclose should involve legal counsel weighing reporting obligations.
Example: Counsel confirms a billing error meets disclosure criteria; the practice uses the OIG protocol because voluntary disclosure generally yields a better resolution than discovery.
Mistake to avoid: Disclosing prematurely before facts are established, or concealing after discovery.
Reference: AAPC CPCO study guide sample
17. Altered documentation as a compliance red line
Claims supported by improperly altered medical records violate the Civil Monetary Penalties Law even when the underlying service was actually provided. Documentation integrity is absolute: corrections must be traceable addendums or visible strikethroughs with attribution, never obliteration, rewriting, or backdating.
Example: A coder asks to fix an error; the correct method is a dated addendum because erasing the original entry converts a valid claim into an altered-records violation.
Mistake to avoid: Allowing records to be rewritten to match what was billed.
Reference: AAPC CPCO study guide sample
18. Routine copayment waivers as a violation
Routinely waiving Medicare Part B copayments or deductibles constitutes prohibited remuneration and has produced settled Civil Monetary Penalties cases after self-disclosure. Waivers must be tied to documented financial-need assessments or genuine uncollectible determinations, not offered as routine courtesy or marketing.
Example: A clinic advertises no-copay visits to attract patients and must stop because routine waivers function as remuneration inducing federal program business.
Mistake to avoid: Treating copay waivers as harmless customer service.
Reference: AAPC CPCO study guide sample
Anti-Kickback and Stark Laws
19. Anti-Kickback remuneration definition
Remuneration under the Anti-Kickback Statute means anything of value, directly or indirectly, overtly or covertly, in cash or in kind. Bribes, rebates, free rent, excessive fees, and gifts all qualify; the value of what is transferred, not its form, determines whether the statute applies.
Example: A supplier gives a physician's staff free conference tickets; this counts as remuneration because anything of value, in any form, falls within the statute.
Mistake to avoid: Reading the statute to cover only direct cash payments.
Reference: AAPC CPCO study guide sample
20. Prohibited Anti-Kickback conduct and consequences
The Anti-Kickback Statute makes it a felony to knowingly and willfully offer, pay, solicit, or receive remuneration for referrals or to induce federal-program business. OIG targets these schemes because they drive overutilization, higher costs, corrupted medical decision-making, patient steering, and unfair competition; consequences include criminal fines, treble damages, imprisonment, and exclusion.
Example: A practice solicits a lab's payment for referrals and declines because solicitation, not just payment, is prohibited and carries criminal exposure.
Mistake to avoid: Thinking only the payer, not the requester, violates the statute.
Reference: AAPC CPCO study guide sample
21. Recognizing Anti-Kickback violation patterns
Classic violation patterns include below-fair-market-value rental to referring physicians, routine copay waivers, supplier incentives tied to product promotion, and exorbitant speaking fees paid by those receiving referrals. Payments received should reflect fair market value for services actually documented as performed.
Example: A hospital rents office space to a referrer at a steep discount; this signals exposure because rent below fair market value is remuneration.
Mistake to avoid: Evaluating each arrangement in isolation without fair-market-value benchmarks.
Reference: AAPC CPCO study guide sample
22. Anti-Kickback safe harbors
Safe harbors in 42 CFR specify arrangements the OIG will not treat as violations, such as payments meeting every element of the applicable regulatory criteria. Failing a safe harbor does not automatically create a violation, but it removes protection and requires an intent analysis with experienced health law counsel.
Example: A rental agreement is restructured to meet the space-rental safe harbor criteria because fitting all elements gives protection that informal arrangements lack.
Mistake to avoid: Assuming an arrangement is safe because it is common in the industry.
Reference: AAPC CPCO study guide sample
23. Stark Law self-referral prohibition and exceptions
The Stark Law prohibits physician self-referral of Medicare patients for designated services to entities with which the physician has a financial relationship, unless a statutory or regulatory exception applies. Unlike the Anti-Kickback Statute, no intent is required; the existence of the relationship and referral itself triggers the prohibition.
Example: A physician refers imaging to a lab he invests in; the referral is prohibited unless a specific exception is satisfied, regardless of intent.
Mistake to avoid: Analyzing Stark referrals with an anti-kickback intent framework.
Reference: AAPC CPCO study guide sample
24. Advisory opinions and their limits
The OIG issues advisory opinions on Anti-Kickback Statute arrangements, while CMS provides opinions on Stark Law. Opinions apply only to the requesting party's specific arrangement, cannot be extended to anyone else's facts, and tend to be granted only where approval is highly likely, making them conservative guidance.
Example: A practice copies a competitor's advisory opinion for its own arrangement and cannot rely on it because opinions bind only the requesting party.
Mistake to avoid: Treating someone else's advisory opinion as clearance for your arrangement.
Reference: AAPC CPCO study guide sample
Financial Relationship Risk Areas
25. Rental of office space arrangements
Renting space to or from referral sources must reflect fair market value, be commercially reasonable, and be documented in a signed lease covering the actual space and term. Below-market rent to a referrer functions as remuneration under the fraud and abuse laws regardless of the stated rationale.
Example: A practice rents a suite to a referring physician at market rate under a written lease because documented fair-market terms defeat the below-market-rent kickback pattern.
Mistake to avoid: Using month-to-month verbal rental terms with a referral source.
Reference: AAPC CPCO study guide sample
26. Professional courtesy, discounts, and adjustments
Professional courtesy, discounts, and adjustments must be applied consistently under a written policy, with hardship-based waivers documented case by case. Routine write-offs for federal-program patients function as remuneration, while properly structured discounts for documented, legitimate reasons remain defensible.
Example: A practice waives a Medicare deductible after documenting financial hardship because a needs-based documented waiver differs from routine waiver of beneficiary amounts.
Mistake to avoid: Granting discretionary write-offs to insured federal-program patients without documentation.
Reference: AAPC CPCO study guide sample
27. Gainsharing arrangements
Gainsharing ties a physician's payment to reductions in a practice's or hospital's costs, creating incentives to withhold or limit care. Civil monetary penalties reach hospital payments that reward reduced or limited services, so any cost-savings sharing structure must be reviewed and shaped by counsel before adoption.
Example: A hospital proposes paying physicians a share of supply savings; counsel reviews the structure because payments linked to limiting services trigger penalty risk.
Mistake to avoid: Entering cost-savings payment arrangements without legal structuring.
Reference: AAPC CPCO study guide sample
28. Joint ventures with referral sources
Joint ventures between providers and referral sources create fraud and abuse exposure when ownership returns flow from referred business. Investment interests must be fair, proportionate to actual capital contributed, and structured so returns do not track the investor's referral volume.
Example: A physician declines a lab investment offering returns scaled to his referral volume because returns tracking referrals constitute disguised remuneration.
Mistake to avoid: Accepting ownership interests priced by expected referrals.
Reference: AAPC CPCO study guide sample
29. Gifts and gratuities
Gifts and gratuities to or from patients, vendors, and referral sources must remain nominal, be governed by written policy, and never relate to referral or purchasing decisions. Even small items become violations when offered with the purpose of inducing business payable by a federal healthcare program.
Example: A vendor offers concert tickets to a scheduler who controls supply orders; the practice declines because gifts aimed at purchasing decisions are remuneration.
Mistake to avoid: Permitting vendor gifts with no nominal-value policy limit.
Reference: AAPC CPCO study guide sample
30. Conflicts of interest management
Conflicts of interest arise when personal financial interests could influence professional decisions, such as self-referral interests or family vendor relationships. Effective programs require annual-style disclosure forms, a review process, and documented management plans rather than silent coexistence with the conflict.
Example: A physician discloses his spouse owns the therapy company he refers to; the practice documents and manages it because undisclosed conflicts cannot be monitored.
Mistake to avoid: Relying on individuals to self-police undisclosed interests.
Reference: AAPC CPCO study guide sample
HIPAA Privacy Rule Fundamentals
31. Who is a covered entity
Three categories are covered by the Privacy Rule: health plans, healthcare clearinghouses, and providers that transmit health information electronically in connection with standard HIPAA transactions such as claims. Using email alone does not create coverage; the transmission must relate to a standard transaction.
Example: A small practice billing electronically through a clearinghouse is covered because transmitting standard transactions, even via a third party, brings it within the rule.
Mistake to avoid: Assuming paper-only practices escape coverage while using a billing service.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
32. Scope of protected health information
Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate in any form—electronic, paper, or oral—relating to health, care, or payment for care. Employment records kept in an employer capacity and certain education records are excluded.
Example: A nurse discusses a patient in an elevator; the conversation involves PHI because the rule protects spoken information, not just records.
Mistake to avoid: Limiting PHI policies to written and electronic records.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
33. Treatment, payment, and health care operations
Covered entities may use and disclose PHI without authorization for their own treatment, payment, and healthcare operations, and for specified activities of other providers and plans that have a relationship with the patient. Operations include quality assessment, credentialing, audits, legal services, and compliance programs.
Example: A practice discloses records to its auditor for a fraud-and-abuse compliance review because auditing is a healthcare operation permitted without authorization.
Mistake to avoid: Requiring patient authorization for internal compliance audits.
Reference: HHS Summary of the HIPAA Privacy Rule
34. Minimum necessary standard
Uses, disclosures, and requests must be limited to the least PHI reasonably needed for the purpose, supported by role-based access policies. The standard does not apply to disclosures for treatment, disclosures to the individual, uses pursuant to a valid authorization, or disclosures required by law.
Example: A billing query retrieves only the service and payer fields rather than the full chart because whole-record access requires specific justification.
Mistake to avoid: Sending entire charts when the purpose needs only selected elements.
Reference: HHS Summary of the HIPAA Privacy Rule
35. Authorizations and the limits of revocation
Authorizations must be written in plain language and specify the information, the persons disclosing and receiving, an expiration, and revocation rights. An individual may revoke in writing at any time, but revocation is prospective only; disclosures already made in reliance on the valid authorization cannot be undone.
Example: A patient revokes her release after records went to an attorney; the prior disclosure stands because reliance on a valid authorization is protected.
Mistake to avoid: Promising patients that prior disclosures can be retracted on revocation.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
36. De-identification pathways
PHI can be de-identified either through a formal determination by a qualified statistician or by removing all specified identifiers of the individual and of relatives, household members, and employers, with no actual knowledge that the remaining information could identify the person. De-identified data carries no use or disclosure restrictions.
Example: A research export strips names, dates, and identifiers and documents no residual knowledge because the removal method requires both steps to qualify.
Mistake to avoid: Removing only the name and calling the dataset de-identified.
Reference: HHS Summary of the HIPAA Privacy Rule
HIPAA Security, Business Associates, and Breach
37. Security Rule protection goals for ePHI
The Security Rule sets national standards protecting the confidentiality, integrity, and availability of electronic protected health information. Unlike the Privacy Rule, which covers PHI in any medium, the Security Rule targets ePHI specifically and requires administrative, physical, and technical safeguards scaled to the entity's size and risk.
Example: A practice adds automatic logoff and encryption because safeguards must address electronic records, which paper-oriented privacy policies alone do not cover.
Mistake to avoid: Applying privacy policies to ePHI without distinct security safeguards.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
38. HITECH and the Omnibus Rule expansion
The HITECH Act, implemented through the 2013 Omnibus Rule, made business associates directly liable for specified Privacy and Security Rule requirements, strengthened limits on marketing and fundraising uses, prohibited the sale of PHI without authorization, and expanded individuals' rights to electronic copies and restrictions on plan disclosures.
Example: A billing vendor now faces direct OCR enforcement for safeguard failures because Omnibus removed the shield of purely indirect liability.
Mistake to avoid: Treating HITECH as merely a breach-notification statute.
Reference: AAPC CPCO study guide sample
39. Business associate agreements
Before a contractor performing functions like claims processing, billing, or data analysis uses PHI, a written business associate agreement must impose specified safeguards and restrict uses to those the covered entity could make itself. A covered entity cannot contractually authorize any use or disclosure the Rule forbids.
Example: A practice signs a business associate agreement before its new billing vendor receives records because the required protections must precede any PHI flow.
Mistake to avoid: Allowing vendor PHI access while the agreement is still being drafted.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
40. Marketing and the sale of PHI
Marketing is any communication encouraging purchase or use of a product or service, and it requires authorization—disclosing any remuneration involved—except face-to-face communications and promotional gifts of nominal value. The sale of PHI in exchange for direct or indirect remuneration is prohibited without individual authorization.
Example: A practice wants to send a vendor's product mailing; it must obtain authorization revealing the vendor's payment because remunerated third-party marketing is covered.
Mistake to avoid: Treating third-party promotional mailings as treatment communications needing no authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
41. Self-paid services and electronic copies
Individuals have expanded rights to receive electronic copies of their health information and to request that a covered entity restrict disclosures to a health plan about treatment for which the individual paid out of pocket in full. The restriction must be requested by the patient and then honored prospectively.
Example: A patient pays cash for a procedure and requests the plan restriction; the practice must honor it because self-paid care can be shielded from the payer.
Mistake to avoid: Reporting self-paid services to the payer after a valid restriction request.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
42. Breach notification duties
Breaches of unsecured PHI trigger notification to affected individuals, to HHS, and in large breaches to the media, with deadlines running from discovery. Compliance officers carry reporting responsibilities when violations occur, alongside documented investigation, mitigation, and safeguards against recurrence.
Example: A stolen unencrypted laptop triggers individual and HHS notification because a breach of unsecured ePHI creates mandatory reporting duties.
Mistake to avoid: Delaying notification while the internal investigation remains open.
Reference: AAPC CPCO study guide sample; HHS Summary of the HIPAA Privacy Rule
EMTALA and CLIA Laboratory Compliance
43. EMTALA screening and stabilization duty
Hospitals with emergency departments must provide a medical screening examination to anyone who comes seeking emergency care, stabilize emergency medical conditions or active labor, and transfer only under defined conditions. EMTALA obligations apply regardless of the patient's ability to pay or insurance status.
Example: An uninsured patient with chest pain receives the same screening as insured patients because payment status cannot gate the examination.
Mistake to avoid: Triaging by insurance before the screening examination.
Reference: AAPC CPCO study guide sample
44. EMTALA on-call and remote consultation
CMS guidance addresses EMTALA on-call requirements and permits remote consultation, including pathologists reviewing slides remotely when defined conditions are met. On-call coverage arrangements must ensure the emergency department can actually reach a physician who can respond, whether physically or through compliant tele-consultation.
Example: A rural hospital uses a remote radiologist who meets the defined conditions because tele-consultation can satisfy on-call needs when the requirements are followed.
Mistake to avoid: Leaving the emergency department without reachable on-call coverage.
Reference: AAPC CPCO study guide sample
45. Matching CLIA certificates to testing complexity
Any practice performing laboratory tests or procedures in the office must hold a valid CLIA certificate appropriate to the type and complexity of testing performed. Performing categories beyond the certificate's level is a violation even when the testing itself is technically competent and results are accurate.
Example: A clinic adds moderate-complexity testing and upgrades its certificate first because the certificate must cover the highest complexity performed on site.
Mistake to avoid: Adding new tests without confirming the existing certificate covers them.
Reference: AAPC CPCO study guide sample
46. Procedure manuals for PPMP and above
Practices performing provider-performed microscopy procedures or higher complexity testing must maintain a laboratory procedure manual with written procedures complying with the CLIA standards for the category of laboratory maintained. The manual is the primary evidence surveyors use to confirm a controlled, standardized testing process.
Example: A physician performing wet mounts documents each procedure in the manual because PPMP-level testing requires written, CLIA-conforming procedures.
Mistake to avoid: Running in-office tests from memory with no written procedures.
Reference: AAPC CPCO study guide sample
47. Proficiency testing rule updates
CMS-3355-F updated the CLIA proficiency testing regulations, the first revision since 1992, with enrollment-related provisions effective shortly after publication and the remaining standards effective later. Compliance officers must verify which effective dates govern their laboratory's specific obligations before relying on either old or new requirements.
Example: A lab checks the effective dates of the revised PT enrollment rules before its next survey because the update changed obligations on a staggered schedule.
Mistake to avoid: Assuming all CLIA requirements changed simultaneously with the rule.
Reference: AAPC CPCO study guide sample
48. Lab orders, billing, and campus certificates
Laboratory compliance risks include billing tests that were not ordered or performed, and misapplying certificate coverage across sites. Laboratories located within a hospital campus may hold a single certificate covering laboratory sites at the same physical location or street address, but distinct locations generally need their own.
Example: A hospital's outpatient draw station at the same street address operates under the hospital's certificate because same-address campus sites may share one certificate.
Mistake to avoid: Billing tests lacking a documented physician order.
Reference: AAPC CPCO study guide sample
OSHA Workplace Safety Compliance
49. Bloodborne Pathogens Standard
The Bloodborne Pathogens Standard requires employers to protect workers with occupational exposure to blood and other potentially infectious materials through exposure control planning, engineering controls, safe work practices, and personal protective equipment. Exposure means contact risk, not confirmed illness, so controls must precede any incident.
Example: A phlebotomist uses puncture-resistant containers and gloves because the standard controls exposure risk, whether or not transmission ever occurs.
Mistake to avoid: Waiting for an infection before implementing controls.
Reference: AAPC CPCO study guide sample
50. Exposure Control Plan
Employers must maintain a written exposure control plan identifying job classifications with exposure risk, the controls applied, and the triggers for plan review, kept updated and accessible to employees. The plan is the audit document demonstrating systematic, current control of bloodborne hazards rather than ad hoc practices.
Example: A practice adds newly hired medical assistants to the plan's exposure list because job-classification coverage must stay current with staffing.
Mistake to avoid: Keeping a generic template plan that never names actual positions.
Reference: AAPC CPCO study guide sample
51. Sharps Injury Log versus Sharps Injury Report
The sharps injury log is a running facility record of sharps injuries capturing device type, brand, and how each incident occurred; the sharps injury report is the individual employee's incident documentation. They are distinct documents serving aggregate pattern tracking and personal incident investigation respectively.
Example: After a needlestick, the supervisor completes both the employee's report and the log entry because one documents the incident, the other tracks patterns.
Mistake to avoid: Recording the incident on one document and assuming both requirements are met.
Reference: AAPC CPCO study guide sample
52. Training in a language workers understand
OSHA-required training must be delivered in a language and vocabulary the workers can understand. Posting English-only materials or conducting English-only sessions does not satisfy training duties for a workforce with limited English proficiency, regardless of how often the sessions are repeated.
Example: A practice conducts bloodborne pathogens training in Spanish for its Spanish-speaking cleaners because comprehension, not attendance, satisfies the requirement.
Mistake to avoid: Counting English-only sessions as training for non-English-speaking staff.
Reference: AAPC CPCO study guide sample
53. Fatality and severe-injury reporting timelines
Work-related fatalities must be reported to OSHA within eight hours, and work-related inpatient hospitalizations, amputations, and losses of an eye within twenty-four hours. These clocks run from when the employer learns of the event, and separate recordkeeping duties cover the injury and illness log.
Example: A maintenance worker is hospitalized after a fall; the practice reports within twenty-four hours of learning of it because the clock starts at knowledge.
Mistake to avoid: Confusing the fatality and hospitalization deadlines.
Reference: AAPC CPCO study guide sample
54. Workers' compensation scope
Workers' compensation covers employees injured while performing duties within the scope of their job, or who contract an illness directly connected to employment. Independent contractors and purely personal events, like food poisoning from a homemade lunch or a commuting accident, fall outside coverage.
Example: A file clerk struck by a falling cabinet qualifies because the injury arose from job duties, unlike a commuter's auto accident en route to work.
Mistake to avoid: Assuming any injury on the premises is compensable.
Reference: AAPC CPCO study guide sample
Auditing, Monitoring, and Physician Risk Areas
55. Using the OIG Work Plan
Released twice a year, the OIG Work Plan sets forth the projects the agency's audit, evaluation, investigation, and counsel offices will address in the fiscal year, listing problem areas receiving special scrutiny. Compliance officers map Work Plan topics against their own claims to target internal audits where government attention is heading.
Example: After the Work Plan lists E/M utilization, a practice audits its own E/M distribution because government-listed areas warrant self-scrutiny first.
Mistake to avoid: Auditing only areas the practice already feels confident about.
Reference: AAPC CPCO study guide sample
56. RACs, UPICs, and MFCU roles
Recovery Audit Contractors identify Medicare fee-for-service overpayments; Unified Program Integrity Contractors conduct program integrity audits and investigations; and Medicaid Fraud Control Units pursue Medicaid fraud cases. Identifying which contractor has contacted the practice determines the response path, documentation obligations, and appeal strategy.
Example: A UPIC records request is routed to counsel and the compliance officer because UPIC investigations signal integrity review rather than routine payment audit.
Mistake to avoid: Treating every contractor letter as a routine payment recoupment.
Reference: AAPC CPCO study guide sample
57. MACs and Local Coverage Determinations
Medicare Administrative Contractors administer the payment of Medicare services, and providers submit claims to them for payment under locally influenced fee schedules. MACs may issue Local Coverage Determinations—coverage rules for services within their jurisdiction—plus informal guidance through newsletters and provider communications.
Example: A claim is denied under the MAC's LCD despite a valid CPT code because payer coverage policy, not code existence, controls payment.
Mistake to avoid: Assuming a correctly coded claim is automatically payable.
Reference: AAPC CPCO study guide sample
58. E/M utilization benchmarking
Compare the practice's evaluation and management code distribution against published national Medicare averages for the specialty. A bell-curve distribution near the averages is unremarkable, while identical codes on nearly all claims, or large point deviations, mark a pattern that invites audit and warrants internal review.
Example: A provider bills the same mid-level code on virtually every visit; the pattern is flagged for review because uniform coding is atypical and likely inappropriate.
Mistake to avoid: Reading only total charges and ignoring the shape of the code distribution.
Reference: AAPC CPCO study guide sample
59. Medical necessity and Advance Beneficiary Notices
Services must be supported by documentation establishing medical necessity; a finding of no documentation triggers automatic denial or refund requests because the service does not meet medical necessity criteria. Advance Beneficiary Notices shift liability for potentially non-covered services to the patient only when properly executed before service.
Example: A screening test lacking a documented indication is refunded because no documentation means no medical necessity, regardless of any ABN on file.
Mistake to avoid: Treating a signed ABN as a substitute for medical necessity documentation.
Reference: AAPC CPCO study guide sample
60. Supervision-based billing: incident-to and teaching physicians
Incident-to rules allow certain clinical staff services to be billed under physician billing numbers when required physician involvement and supervision are met, while teaching physician rules govern when resident-performed services are billable based on the teaching physician's presence and participation. The frameworks differ, and both require physician work distinct from staff work.
Example: A nurse's follow-up visit bills under the physician only because the physician initiated the plan and remains present, satisfying incident-to supervision.
Mistake to avoid: Billing staff or resident services as physician work without meeting the supervision rules.
Reference: AAPC CPCO study guide sample
References and further reading
Source links checked on Oct 2, 2026.