HCCA CHC Health Care Compliance Association
Certified in HealthCare Compliance 100% Verified
Main Sub Topics
• Healthcare Regulations
• Compliance Programs
• Auditing
• Investigations
• Risk Management
• Professional Ethics and Goverance
• Governance, and Medicare Advantage Risk Adjustment (HCC) Data Mining Audits
Part A:
Healthcare Regulations & Medicare Advantage HCC Coding
1: A clinical data analyst at a Medicare Advantage (MA) plan runs a specialized data
mining script. The algorithm identifies a significant spike in the submission of Hierarchical
Condition Category (HCC) code 19 (Diabetes with Chronic Complications) across three
regional network clinics. A retrospective review of the underlying medical records reveals
that while the patients have documented Type 2 diabetes, there is no clinical evidence of
chronic manifestations, active treatment for complications, or physician evaluation
matching the diagnostic expansion. Assess the legal status of the capitated premium
adjustments generated by these codes.
Answer: The capitated premium adjustments generated by these unsupported HCC codes are
non-compliant, invalid, and constitute false records under the False Claims Act (FCA). Under
Centers for Medicare & Medicaid Services (CMS) risk adjustment guidelines, a diagnosis code
must be explicitly documented as evaluated, treated, monitored, or addressed (the MEAT
criteria) during a face-to-face encounter within that specific collection calendar year. Submitting
a higher-severity complication code purely to elevate the plan's risk score and extract inflated
,risk-adjusted capitation payments without clinical substantiation constitutes actionable upcoding,
creating immediate corporate liability for treble damages and per-claim civil penalties.
2: A healthcare organization is expanding its Medicare Advantage network and enters into
an arrangement with a high-volume referring cardiology group. The network provides the
group with free access to a proprietary electronic data analytics dashboard that helps the
cardiologists capture undocumented patient comorbidities to optimize risk scores in their
private commercial practice. This transfer of value primarily triggers exposure under
which federal statute?
A. The Emergency Medical Treatment and Labor Act (EMTALA)
B. The Clinical Laboratory Improvement Amendments (CLIA)
C. The Anti-Kickback Statute (AKS)
D. The Health Insurance Portability and Accountability Act (HIPAA)
Rationale: The Anti-Kickback Statute criminalises the knowing and willful offer, payment,
solicitation, or receipt of any remuneration (including free software, tools, or data analytics
functionality) designed to induce or reward the referral or generation of business reimbursable
under a federal healthcare program, which explicitly encompasses Medicare Advantage plans.
Providing an exclusive, valuable financial benefit to an active referral source outside of standard
fair market value boundaries invalidates regulatory safe harbors and taints downstream claims.
3: True or False: Under CMS Medicare Advantage risk adjustment regulations, if an
internal data mining audit uncovers that an HCC diagnosis code submitted to the Risk
Adjustment Processing System (RAPS) was completely unsupported by the clinical medical
record, the plan is legally permitted to keep the resulting premium adjustment if the error
was caused by an automated coding vendor glitch rather than intentional fraud.
A. True
B. False
Rationale: Under the Affordable Care Act's 60-day overpayment rule, any federal healthcare
funds received to which an organization is not contractually or legally entitled constitute an
overpayment. The absence of initial fraudulent intent does not eliminate the plan's strict statutory
obligation to execute a formal code deletion and refund the excess capitated premium within 60
calendar days of verifying the documentation deficiency.
,4: An internal auditor notes that a hospital-owned outpatient clinic has been billing
Medicare for complex evaluation and management (E&M) services using modifier 25 to
bypass automated claims processing edits, even though the medical records show no
separate and distinct evaluation was performed alongside the minor surgical procedure.
Detail the compliance implications.
Answer: Systematically appending modifier 25 without documented clinical justification to
override National Correct Coding Initiative (NCCI) edits constitutes upcoding and intentional
misrepresentation. Modifier 25 should only be applied when a significant, separately identifiable
evaluation and management service is performed by the same physician on the same day as a
procedure. In the absence of clinical documentation supporting a distinct service, these claims
are fraudulent, creating direct liability under the False Claims Act and violating coding integrity
standards.
5: An internal risk adjustment audit reveals that a Medicare Advantage provider has been
systematically pulling historical, completely resolved diagnostic codes (such as an acute
myocardial infarction from three years prior) into active encounter fields to artificially
inflate the annual patient risk score. This data manipulation represents an acceptable
method of chronic disease longitudinal tracking.
A. True
B. False
Rationale: Automatically pulling historical, completely resolved conditions into active claim
files strictly to manipulate the capitated risk score violates CMS Risk Adjustment parameters.
Diagnoses must reflect active conditions evaluated or treated during an encounter within that
specific calendar year. Presenting historical or cured illnesses as active clinical burdens
constitutes a material misrepresentation under the False Claims Act.
6: A multi-specialty physician group plans to lease a high-tech diagnostic ultrasound
machine from a local community hospital to which it refers a high volume of Medicare
patients. To ensure this arrangement does not violate the Stark Law, which condition must
be met?
A. The hospital must provide the machine for free as a standard recruitment incentive.
B. The rental fees can be adjusted monthly based on how many scans the group performs.
, C. The agreement can be a flexible, verbal understanding as long as it reflects market values.
D. The lease must be set forth in writing, signed by the parties, and reflect fair market
value independent of referrals.
Rationale: The Stark Law equipment rental exception strictly requires that the arrangement be
documented in a signed writing, specify the exact equipment covered, last for at least one year,
and establish rental rates that reflect fair market value determined through objective
commercial metrics. The compensation cannot take into account the volume or value of any
referrals or other business generated between the parties.
7: A hospital registration clerk uses her personal smartphone to take a photograph of an
operating room whiteboard showing the day's full surgical schedule—including patient
names, medical record numbers, and scheduled procedures—and posts it to a public social
media group. Analyze this incident under the HIPAA Breach Notification Rule.
Answer: This act constitutes an impermissible disclosure of Protected Health Information (PHI)
under the HIPAA Privacy Rule. Because the photograph contains highly identifiable patient
details and was distributed on an unsecured public platform, it violates the minimum necessary
standard and permitted uses. The hospital must conduct a formal four-factor breach risk
assessment looking at the nature of the data, the unauthorized person who viewed it, whether it
was acquired, and mitigation steps. Unless a low probability of data compromise can be
demonstrated, this must be treated as a reportable breach requiring individual notifications,
notification to the Secretary of HHS, and potentially media notices depending on state
thresholds.
8: A patient arrives at a hospital emergency department presenting with symptoms of an
acute stroke. The registration desk clerk demands that the patient fill out financial
responsibility forms and provide a credit card for a copayment before allowing them to be
seen by the triage nurse. Which law is violated?
A. HIPAA Security Rule
B. Stark Law
C. Emergency Medical Treatment and Labor Act (EMTALA)
D. Health Information Technology for Economic and Clinical Health (HITECH) Act
Certified in HealthCare Compliance 100% Verified
Main Sub Topics
• Healthcare Regulations
• Compliance Programs
• Auditing
• Investigations
• Risk Management
• Professional Ethics and Goverance
• Governance, and Medicare Advantage Risk Adjustment (HCC) Data Mining Audits
Part A:
Healthcare Regulations & Medicare Advantage HCC Coding
1: A clinical data analyst at a Medicare Advantage (MA) plan runs a specialized data
mining script. The algorithm identifies a significant spike in the submission of Hierarchical
Condition Category (HCC) code 19 (Diabetes with Chronic Complications) across three
regional network clinics. A retrospective review of the underlying medical records reveals
that while the patients have documented Type 2 diabetes, there is no clinical evidence of
chronic manifestations, active treatment for complications, or physician evaluation
matching the diagnostic expansion. Assess the legal status of the capitated premium
adjustments generated by these codes.
Answer: The capitated premium adjustments generated by these unsupported HCC codes are
non-compliant, invalid, and constitute false records under the False Claims Act (FCA). Under
Centers for Medicare & Medicaid Services (CMS) risk adjustment guidelines, a diagnosis code
must be explicitly documented as evaluated, treated, monitored, or addressed (the MEAT
criteria) during a face-to-face encounter within that specific collection calendar year. Submitting
a higher-severity complication code purely to elevate the plan's risk score and extract inflated
,risk-adjusted capitation payments without clinical substantiation constitutes actionable upcoding,
creating immediate corporate liability for treble damages and per-claim civil penalties.
2: A healthcare organization is expanding its Medicare Advantage network and enters into
an arrangement with a high-volume referring cardiology group. The network provides the
group with free access to a proprietary electronic data analytics dashboard that helps the
cardiologists capture undocumented patient comorbidities to optimize risk scores in their
private commercial practice. This transfer of value primarily triggers exposure under
which federal statute?
A. The Emergency Medical Treatment and Labor Act (EMTALA)
B. The Clinical Laboratory Improvement Amendments (CLIA)
C. The Anti-Kickback Statute (AKS)
D. The Health Insurance Portability and Accountability Act (HIPAA)
Rationale: The Anti-Kickback Statute criminalises the knowing and willful offer, payment,
solicitation, or receipt of any remuneration (including free software, tools, or data analytics
functionality) designed to induce or reward the referral or generation of business reimbursable
under a federal healthcare program, which explicitly encompasses Medicare Advantage plans.
Providing an exclusive, valuable financial benefit to an active referral source outside of standard
fair market value boundaries invalidates regulatory safe harbors and taints downstream claims.
3: True or False: Under CMS Medicare Advantage risk adjustment regulations, if an
internal data mining audit uncovers that an HCC diagnosis code submitted to the Risk
Adjustment Processing System (RAPS) was completely unsupported by the clinical medical
record, the plan is legally permitted to keep the resulting premium adjustment if the error
was caused by an automated coding vendor glitch rather than intentional fraud.
A. True
B. False
Rationale: Under the Affordable Care Act's 60-day overpayment rule, any federal healthcare
funds received to which an organization is not contractually or legally entitled constitute an
overpayment. The absence of initial fraudulent intent does not eliminate the plan's strict statutory
obligation to execute a formal code deletion and refund the excess capitated premium within 60
calendar days of verifying the documentation deficiency.
,4: An internal auditor notes that a hospital-owned outpatient clinic has been billing
Medicare for complex evaluation and management (E&M) services using modifier 25 to
bypass automated claims processing edits, even though the medical records show no
separate and distinct evaluation was performed alongside the minor surgical procedure.
Detail the compliance implications.
Answer: Systematically appending modifier 25 without documented clinical justification to
override National Correct Coding Initiative (NCCI) edits constitutes upcoding and intentional
misrepresentation. Modifier 25 should only be applied when a significant, separately identifiable
evaluation and management service is performed by the same physician on the same day as a
procedure. In the absence of clinical documentation supporting a distinct service, these claims
are fraudulent, creating direct liability under the False Claims Act and violating coding integrity
standards.
5: An internal risk adjustment audit reveals that a Medicare Advantage provider has been
systematically pulling historical, completely resolved diagnostic codes (such as an acute
myocardial infarction from three years prior) into active encounter fields to artificially
inflate the annual patient risk score. This data manipulation represents an acceptable
method of chronic disease longitudinal tracking.
A. True
B. False
Rationale: Automatically pulling historical, completely resolved conditions into active claim
files strictly to manipulate the capitated risk score violates CMS Risk Adjustment parameters.
Diagnoses must reflect active conditions evaluated or treated during an encounter within that
specific calendar year. Presenting historical or cured illnesses as active clinical burdens
constitutes a material misrepresentation under the False Claims Act.
6: A multi-specialty physician group plans to lease a high-tech diagnostic ultrasound
machine from a local community hospital to which it refers a high volume of Medicare
patients. To ensure this arrangement does not violate the Stark Law, which condition must
be met?
A. The hospital must provide the machine for free as a standard recruitment incentive.
B. The rental fees can be adjusted monthly based on how many scans the group performs.
, C. The agreement can be a flexible, verbal understanding as long as it reflects market values.
D. The lease must be set forth in writing, signed by the parties, and reflect fair market
value independent of referrals.
Rationale: The Stark Law equipment rental exception strictly requires that the arrangement be
documented in a signed writing, specify the exact equipment covered, last for at least one year,
and establish rental rates that reflect fair market value determined through objective
commercial metrics. The compensation cannot take into account the volume or value of any
referrals or other business generated between the parties.
7: A hospital registration clerk uses her personal smartphone to take a photograph of an
operating room whiteboard showing the day's full surgical schedule—including patient
names, medical record numbers, and scheduled procedures—and posts it to a public social
media group. Analyze this incident under the HIPAA Breach Notification Rule.
Answer: This act constitutes an impermissible disclosure of Protected Health Information (PHI)
under the HIPAA Privacy Rule. Because the photograph contains highly identifiable patient
details and was distributed on an unsecured public platform, it violates the minimum necessary
standard and permitted uses. The hospital must conduct a formal four-factor breach risk
assessment looking at the nature of the data, the unauthorized person who viewed it, whether it
was acquired, and mitigation steps. Unless a low probability of data compromise can be
demonstrated, this must be treated as a reportable breach requiring individual notifications,
notification to the Secretary of HHS, and potentially media notices depending on state
thresholds.
8: A patient arrives at a hospital emergency department presenting with symptoms of an
acute stroke. The registration desk clerk demands that the patient fill out financial
responsibility forms and provide a credit card for a copayment before allowing them to be
seen by the triage nurse. Which law is violated?
A. HIPAA Security Rule
B. Stark Law
C. Emergency Medical Treatment and Labor Act (EMTALA)
D. Health Information Technology for Economic and Clinical Health (HITECH) Act
