HCCA Health Care Compliance Association
CHC 2026/2027 Latest Review
Main Sub Topics
• Healthcare Regulations
• Compliance Programs
• Auditing
• Investigations
• Risk Management
• Professional Ethics and Goverance
• Governance, and Medicare Advantage Risk Adjustment (HCC) Data Mining Audits
• CHC Certified in HealthCare Compliance 100% Verified
Section I: Healthcare Regulations & Medicare Advantage HCC
Coding
1: A clinical data analyst at a Medicare Advantage (MA) plan runs a specialized data
mining script. The algorithm identifies a significant spike in the submission of Hierarchical
Condition Category (HCC) code 19 (Diabetes with Chronic Complications) across three
regional network clinics. A retrospective review of the underlying medical records reveals
that while the patients have documented Type 2 diabetes, there is no clinical evidence of
chronic manifestations, active treatment for complications, or physician evaluation
matching the diagnostic expansion. Assess the legal status of the capitated premium
adjustments generated by these codes.
Answer: The premium adjustments are completely invalid and create immediate False
Claims Act (FCA) exposure. Under Centers for Medicare & Medicaid Services (CMS) risk
adjustment guidelines, a diagnosis code must be explicitly documented as evaluated, treated,
monitored, or addressed (the MEAT criteria) during a face-to-face encounter within that
,specific collection calendar year [INDEX]. Submitting a higher-severity complication code
purely to elevate the plan's risk score and extract inflated risk-adjusted capitation payments
without clinical substantiation constitutes actionable upcoding, creating direct corporate liability
for treble damages and per-claim civil penalties [INDEX].
2: A healthcare organization is expanding its Medicare Advantage network and enters into
an arrangement with a high-volume referring cardiology group. The network provides the
group with free access to a proprietary electronic data analytics dashboard that helps the
cardiologists capture undocumented patient comorbidities to optimize risk scores in their
private commercial practice. This transfer of value primarily triggers exposure under
which federal statute?
A. The Emergency Medical Treatment and Labor Act (EMTALA)
B. The Clinical Laboratory Improvement Amendments (CLIA)
C. The Anti-Kickback Statute (AKS)
D. The Health Insurance Portability and Accountability Act (HIPAA)
Rationale: The Anti-Kickback Statute criminalises the knowing and willful offer, payment,
solicitation, or receipt of any remuneration (including free software, tools, or data analytics
functionality) designed to induce or reward the referral or generation of business reimbursable
under a federal healthcare program, which explicitly encompasses Medicare Advantage plans
[INDEX]. Providing an exclusive, valuable financial benefit to an active referral source outside
of standard fair market value boundaries invalidates regulatory safe harbors and taints
downstream claims.
3: True or False: Under CMS Medicare Advantage risk adjustment regulations, if an
internal data mining audit uncovers that an HCC diagnosis code submitted to the Risk
Adjustment Processing System (RAPS) was completely unsupported by the clinical medical
record, the plan is legally permitted to keep the resulting premium adjustment if the error
was caused by an automated coding vendor glitch rather than intentional fraud.
A. True
B. False
Rationale: Under the Affordable Care Act's 60-day overpayment rule, any federal healthcare
funds received to which an organization is not contractually or legally entitled constitute an
,overpayment [INDEX]. The absence of initial fraudulent intent does not eliminate the plan's
strict statutory obligation to execute a formal code deletion and refund the excess capitated
premium within 60 calendar days of verifying the documentation deficiency [INDEX].
4: An internal auditor notes that a hospital-owned outpatient clinic has been billing
Medicare for complex evaluation and management (E&M) services using modifier 25 to
bypass automated claims processing edits, even though the medical records show no
separate and distinct evaluation was performed alongside the minor surgical procedure.
Detail the compliance implications.
Answer: The clinic faces direct, severe civil fraud exposure under the False Claims Act.
Modifier 25 should only be applied when a significant, separately identifiable evaluation and
management service is performed by the same physician on the same day as a procedure
[INDEX]. Systematically appending modifier 25 without documented clinical justification to
override National Correct Coding Initiative (NCCI) edits constitutes intentional
misrepresentation and upcoding [INDEX]. In the absence of clinical documentation supporting a
distinct service, these claims are fraudulent, necessitating immediate billing holds and a
retroactive extrapolation to calculate government refunds [INDEX].
5: An internal risk adjustment audit reveals that a Medicare Advantage provider has been
systematically pulling historical, completely resolved diagnostic codes (such as an acute
myocardial infarction from three years prior) into active encounter fields to artificially
inflate the annual patient risk score. This data manipulation represents an acceptable
method of chronic disease longitudinal tracking.
A. True
B. False
Rationale: Automatically pulling historical, completely resolved conditions into active claim
files strictly to manipulate the capitated risk score violates CMS Risk Adjustment parameters.
Diagnoses must reflect active conditions evaluated or treated during an encounter within that
specific calendar year. Presenting historical or cured illnesses as active clinical burdens
constitutes a material misrepresentation under the False Claims Act [INDEX].
6: A multi-specialty physician group plans to lease a high-tech diagnostic ultrasound
machine from a local community hospital to which it refers a high volume of Medicare
, patients. To ensure this arrangement does not violate the Stark Law, which condition must
be met?
A. The hospital must provide the machine for free as a standard recruitment incentive.
B. The rental fees can be adjusted monthly based on how many scans the group performs.
C. The agreement can be a flexible, verbal understanding as long as it reflects market values.
D. The lease must be set forth in writing, signed by the parties, and reflect fair market
value independent of referrals.
Rationale: The Stark Law equipment rental exception strictly requires that the arrangement
be documented in a signed writing, specify the exact equipment covered, last for at least one
year, and establish rental rates that reflect fair market value determined through objective
commercial metrics [INDEX]. The compensation cannot take into account the volume or value
of any referrals or other business generated between the parties [INDEX].
7: A hospital registration clerk uses her personal smartphone to take a photograph of an
operating room whiteboard showing the day's full surgical schedule—including patient
names, medical record numbers, and scheduled procedures—and posts it to a public social
media group. Analyze this incident under the HIPAA Breach Notification Rule.
Answer: This incident constitutes an unauthorized data exposure that is legally presumed to
be a reportable breach. Under the HIPAA Breach Notification Rule, any non-permitted
disclosure of Protected Health Information (PHI) requires a formal four-factor risk assessment
evaluating the nature of the data, the unauthorized recipient, whether it was actually viewed, and
mitigation steps [INDEX]. Because the photo contained explicit identifiers (names and medical
record numbers) broadcasted to an unencrypted public platform, the organization must notify all
affected individuals, the Secretary of HHS, and potentially prominent media outlets within 60
calendar days of discovery [INDEX].
8: A patient arrives at a hospital emergency department presenting with symptoms of an
acute stroke. The registration desk clerk demands that the patient fill out financial
responsibility forms and provide a credit card for a copayment before allowing them to be
seen by the triage nurse. Which law is violated?
A. HIPAA Security Rule
B. Stark Law
CHC 2026/2027 Latest Review
Main Sub Topics
• Healthcare Regulations
• Compliance Programs
• Auditing
• Investigations
• Risk Management
• Professional Ethics and Goverance
• Governance, and Medicare Advantage Risk Adjustment (HCC) Data Mining Audits
• CHC Certified in HealthCare Compliance 100% Verified
Section I: Healthcare Regulations & Medicare Advantage HCC
Coding
1: A clinical data analyst at a Medicare Advantage (MA) plan runs a specialized data
mining script. The algorithm identifies a significant spike in the submission of Hierarchical
Condition Category (HCC) code 19 (Diabetes with Chronic Complications) across three
regional network clinics. A retrospective review of the underlying medical records reveals
that while the patients have documented Type 2 diabetes, there is no clinical evidence of
chronic manifestations, active treatment for complications, or physician evaluation
matching the diagnostic expansion. Assess the legal status of the capitated premium
adjustments generated by these codes.
Answer: The premium adjustments are completely invalid and create immediate False
Claims Act (FCA) exposure. Under Centers for Medicare & Medicaid Services (CMS) risk
adjustment guidelines, a diagnosis code must be explicitly documented as evaluated, treated,
monitored, or addressed (the MEAT criteria) during a face-to-face encounter within that
,specific collection calendar year [INDEX]. Submitting a higher-severity complication code
purely to elevate the plan's risk score and extract inflated risk-adjusted capitation payments
without clinical substantiation constitutes actionable upcoding, creating direct corporate liability
for treble damages and per-claim civil penalties [INDEX].
2: A healthcare organization is expanding its Medicare Advantage network and enters into
an arrangement with a high-volume referring cardiology group. The network provides the
group with free access to a proprietary electronic data analytics dashboard that helps the
cardiologists capture undocumented patient comorbidities to optimize risk scores in their
private commercial practice. This transfer of value primarily triggers exposure under
which federal statute?
A. The Emergency Medical Treatment and Labor Act (EMTALA)
B. The Clinical Laboratory Improvement Amendments (CLIA)
C. The Anti-Kickback Statute (AKS)
D. The Health Insurance Portability and Accountability Act (HIPAA)
Rationale: The Anti-Kickback Statute criminalises the knowing and willful offer, payment,
solicitation, or receipt of any remuneration (including free software, tools, or data analytics
functionality) designed to induce or reward the referral or generation of business reimbursable
under a federal healthcare program, which explicitly encompasses Medicare Advantage plans
[INDEX]. Providing an exclusive, valuable financial benefit to an active referral source outside
of standard fair market value boundaries invalidates regulatory safe harbors and taints
downstream claims.
3: True or False: Under CMS Medicare Advantage risk adjustment regulations, if an
internal data mining audit uncovers that an HCC diagnosis code submitted to the Risk
Adjustment Processing System (RAPS) was completely unsupported by the clinical medical
record, the plan is legally permitted to keep the resulting premium adjustment if the error
was caused by an automated coding vendor glitch rather than intentional fraud.
A. True
B. False
Rationale: Under the Affordable Care Act's 60-day overpayment rule, any federal healthcare
funds received to which an organization is not contractually or legally entitled constitute an
,overpayment [INDEX]. The absence of initial fraudulent intent does not eliminate the plan's
strict statutory obligation to execute a formal code deletion and refund the excess capitated
premium within 60 calendar days of verifying the documentation deficiency [INDEX].
4: An internal auditor notes that a hospital-owned outpatient clinic has been billing
Medicare for complex evaluation and management (E&M) services using modifier 25 to
bypass automated claims processing edits, even though the medical records show no
separate and distinct evaluation was performed alongside the minor surgical procedure.
Detail the compliance implications.
Answer: The clinic faces direct, severe civil fraud exposure under the False Claims Act.
Modifier 25 should only be applied when a significant, separately identifiable evaluation and
management service is performed by the same physician on the same day as a procedure
[INDEX]. Systematically appending modifier 25 without documented clinical justification to
override National Correct Coding Initiative (NCCI) edits constitutes intentional
misrepresentation and upcoding [INDEX]. In the absence of clinical documentation supporting a
distinct service, these claims are fraudulent, necessitating immediate billing holds and a
retroactive extrapolation to calculate government refunds [INDEX].
5: An internal risk adjustment audit reveals that a Medicare Advantage provider has been
systematically pulling historical, completely resolved diagnostic codes (such as an acute
myocardial infarction from three years prior) into active encounter fields to artificially
inflate the annual patient risk score. This data manipulation represents an acceptable
method of chronic disease longitudinal tracking.
A. True
B. False
Rationale: Automatically pulling historical, completely resolved conditions into active claim
files strictly to manipulate the capitated risk score violates CMS Risk Adjustment parameters.
Diagnoses must reflect active conditions evaluated or treated during an encounter within that
specific calendar year. Presenting historical or cured illnesses as active clinical burdens
constitutes a material misrepresentation under the False Claims Act [INDEX].
6: A multi-specialty physician group plans to lease a high-tech diagnostic ultrasound
machine from a local community hospital to which it refers a high volume of Medicare
, patients. To ensure this arrangement does not violate the Stark Law, which condition must
be met?
A. The hospital must provide the machine for free as a standard recruitment incentive.
B. The rental fees can be adjusted monthly based on how many scans the group performs.
C. The agreement can be a flexible, verbal understanding as long as it reflects market values.
D. The lease must be set forth in writing, signed by the parties, and reflect fair market
value independent of referrals.
Rationale: The Stark Law equipment rental exception strictly requires that the arrangement
be documented in a signed writing, specify the exact equipment covered, last for at least one
year, and establish rental rates that reflect fair market value determined through objective
commercial metrics [INDEX]. The compensation cannot take into account the volume or value
of any referrals or other business generated between the parties [INDEX].
7: A hospital registration clerk uses her personal smartphone to take a photograph of an
operating room whiteboard showing the day's full surgical schedule—including patient
names, medical record numbers, and scheduled procedures—and posts it to a public social
media group. Analyze this incident under the HIPAA Breach Notification Rule.
Answer: This incident constitutes an unauthorized data exposure that is legally presumed to
be a reportable breach. Under the HIPAA Breach Notification Rule, any non-permitted
disclosure of Protected Health Information (PHI) requires a formal four-factor risk assessment
evaluating the nature of the data, the unauthorized recipient, whether it was actually viewed, and
mitigation steps [INDEX]. Because the photo contained explicit identifiers (names and medical
record numbers) broadcasted to an unencrypted public platform, the organization must notify all
affected individuals, the Secretary of HHS, and potentially prominent media outlets within 60
calendar days of discovery [INDEX].
8: A patient arrives at a hospital emergency department presenting with symptoms of an
acute stroke. The registration desk clerk demands that the patient fill out financial
responsibility forms and provide a credit card for a copayment before allowing them to be
seen by the triage nurse. Which law is violated?
A. HIPAA Security Rule
B. Stark Law
