2025/2026 EDITION: UHC ETHICS AND
COMPLIANCE CERTIFICATION EXAM PREP BY
UNITEDHEALTHCARE TRAINING
DEPARTMENT – COMPREHENSIVE GUIDE
1. A healthcare organization receives a subpoena duces tecum for patient records related to a fraud
investigation. The compliance officer must balance legal obligations with HIPAA privacy rules.
Which of the following actions best demonstrates compliance with both subpoena requirements
and HIPAA's minimum necessary standard?
A. Provide all requested records without redaction to avoid obstruction of justice.
B. Disclose only the records explicitly listed in the subpoena and redact any extraneous protected health
information.
C. Object to the subpoena on privacy grounds and refuse production until a court order is obtained.
D. Release a summary of the records with patient identifiers removed to satisfy the investigation.
Answer: B
Rationale: Under HIPAA, disclosures in response to a subpoena must be limited to the minimum
necessary information. Option B achieves this by disclosing only the specifically requested records and
redacting unnecessary PHI. Option A violates the minimum necessary rule. Option C is too aggressive
without legal basis. Option D may not meet the subpoena's specificity requirements.
2. A compliance officer discovers that a physician group is systematically upcoding evaluation and
management (E/M) services by using a higher level of medical decision-making than documented.
The group's billing manager claims this is standard practice to 'optimize revenue.' Which of the
following federal laws is most directly implicated in this scenario?
A. False Claims Act (FCA)
B. Anti-Kickback Statute (AKS)
C. Stark Law (Physician Self-Referral Law)
D. Civil Monetary Penalties Law (CMPL)
Answer: A
Rationale: Upcoding E/M services constitutes submitting false claims to federal healthcare programs,
directly violating the False Claims Act. The AKS involves remuneration for referrals; Stark Law involves
self-referral for designated health services; CMPL imposes penalties for various violations but FCA is
the primary law for false billing. The scenario does not involve kickbacks or self-referral.
3. Under the UnitedHealthcare Compliance Program, which of the following scenarios represents a
prohibited conflict of interest that must be disclosed and managed?
A. A compliance officer serves on the board of a local hospital that is a network provider.
Page 1
,B. A claims processor's spouse works for a competitor health plan.
C. A network manager owns stock in a medical device company that is a contracted vendor.
D. A nurse reviewer participates in a clinical trial for a drug that is not yet FDA-approved.
Answer: C
Rationale: Ownership of stock in a contracted vendor creates a direct financial conflict of interest that
could influence contracting decisions. Option A may be permissible with disclosure if no
decision-making role. Option B is a personal relationship but not directly tied to contracting or
decision-making. Option D is professional development and not inherently conflicting.
4. A pharmaceutical company offers a hospital's pharmacy director an all-expenses-paid
conference trip to Hawaii. The director states this is a 'business meeting' with educational sessions.
Under the OIG Compliance Guidance for Pharmaceutical Manufacturers, which factor most
strongly indicates this arrangement could violate the Anti-Kickback Statute?
A. The conference is accredited for continuing education credits.
B. The trip includes first-class airfare and resort accommodations.
C. The director has authority to select the hospital's formulary drugs.
D. The pharmaceutical company invites multiple pharmacy directors from different hospitals.
Answer: C
Rationale: The key factor is the director's ability to influence drug purchases, creating a potential link
between the remuneration (trip) and referrals. While lavish accommodations (B) raise concerns, the
statutory focus is on intent to induce referrals. Accreditation (A) and group invitations (D) can be
legitimate but do not negate the risk when the recipient has purchasing authority.
5. A compliance investigation reveals that a data analyst accessed the medical records of a celebrity
without authorization and shared the information on social media. The analyst claims it was a
'one-time mistake.' Which of the following penalties is the organization most likely to face under
HIPAA?
A. Civil monetary penalty of $100 per violation, capped at $25,000 per year
B. Criminal penalties including fines and up to 10 years imprisonment for the analyst
C. Exclusion from participation in federal healthcare programs
D. Corrective action plan and mandatory training for all staff
Answer: B
Rationale: HIPAA's criminal penalty provisions apply when an individual knowingly obtains or discloses
PHI for malicious reasons, including for personal gain or harm. The analyst's intentional access and
sharing for social media (likely for notoriety) constitutes knowing disclosure with intent to cause harm,
carrying up to 10 years imprisonment. Civil penalties (A) may also apply but criminal penalties are
more severe. Exclusion (C) is for program-related violations. Corrective action (D) is insufficient given
the criminal nature.
Page 2
,6. A hospital's compliance committee is evaluating a proposed arrangement where a local
physician group will receive a monthly 'management fee' of $5,000 for 'administrative services'
that are poorly defined. The group refers a high volume of Medicare patients to the hospital.
Which element of the OIG's seven elements of an effective compliance program is most directly
relevant to addressing this risk?
A. Element 2: Designation of a compliance officer and committee
B. Element 5: Communication and education on compliance policies
C. Element 6: Enforcement of standards through well-publicized disciplinary guidelines
D. Element 7: Auditing and monitoring of arrangements
Answer: D
Rationale: Element 7 requires ongoing auditing and monitoring to detect potential fraud or abuse. The
poorly defined management fee with high referral volume warrants scrutiny through audits to ensure
fair market value and legitimate services. Element 2 (A) is about structure, not review. Element 5 (B) is
education. Element 6 (C) is discipline, which may follow but is not the primary preventive mechanism.
7. Under the Stark Law, which of the following physician compensation arrangements with a
hospital is most likely to qualify for the 'personal services arrangement' exception?
A. A physician is paid 15% of the hospital's net revenue from services ordered by the physician.
B. A physician receives a flat monthly fee of $10,000 for providing on-call coverage, set in advance and
consistent with fair market value.
C. A physician is compensated based on the number of patients referred to the hospital's outpatient clinic.
D. A physician's compensation includes a bonus tied to the hospital's overall profitability.
Answer: B
Rationale: The personal services arrangement exception requires written agreement, set in advance, fair
market value, and not taking into account the volume or value of referrals. Option B meets these criteria.
Option A is a percentage of revenue tied to referrals, violating the volume/value standard. Option C
directly ties compensation to referrals. Option D's bonus tied to overall profitability may still indirectly
reflect referrals.
8. An organization's compliance hotline receives an anonymous report alleging that a senior
executive directed staff to delete emails related to a potential billing error. The executive denies the
allegation. Under the U.S. Sentencing Guidelines for organizations, what is the most critical factor
in determining whether the organization qualifies for a reduced penalty?
A. The organization had a compliance program in place at the time of the alleged conduct.
B. The organization self-reports the conduct to the government within a reasonable time.
C. The executive is terminated immediately after the investigation.
D. The organization reimburses any overpayments identified.
Answer: B
Rationale: The Sentencing Guidelines provide for reduced penalties if the organization voluntarily
discloses the offense, cooperates, and accepts responsibility. Self-reporting is a key mitigating factor.
Having a compliance program (A) is important but not determinative if the organization fails to report.
Termination (C) and repayment (D) are positive but less impactful than self-reporting.
Page 3
, 9. A compliance officer is reviewing a contract between a health plan and a pharmacy benefit
manager (PBM). The contract includes a clause that the PBM will receive a 'rebate' from a drug
manufacturer for each prescription of a specific brand-name drug filled. Which of the following
best describes the compliance risk associated with this arrangement?
A. The rebate may constitute a kickback if it is intended to influence the PBM to favor that drug over cheaper
alternatives.
B. The rebate is illegal per se under the Anti-Kickback Statute because it involves a third party.
C. The rebate is permissible if disclosed to the health plan and reflected in lower premiums.
D. The rebate violates the Stark Law because it involves a self-referral by the PBM.
Answer: A
Rationale: Rebates from manufacturers to PBMs can violate the Anti-Kickback Statute if they are
intended to induce the PBM to place the drug on a favorable formulary tier, potentially increasing costs.
They are not per se illegal (B) but must be structured to fit safe harbors. Disclosure (C) alone is
insufficient; the arrangement must also be at fair market value and not tied to volume. Stark Law (D)
applies to physician self-referrals, not PBM arrangements.
10. A healthcare organization's compliance program includes a policy requiring all employees to
report potential violations within 30 days of discovery. An employee discovers a possible
overpayment but delays reporting for 60 days because she wants to gather more evidence. Which
of the following statements best reflects the legal implications of this delay?
A. The employee has violated the organization's internal policy but faces no legal liability.
B. The delay may trigger liability under the False Claims Act's reverse false claims provision if the overpayment
is not reported within 60 days of discovery.
C. The delay is permissible under the Affordable Care Act's 60-day overpayment rule because the employee did
not have conclusive evidence.
D. The organization must report the overpayment within 30 days of the employee's discovery to avoid penalties.
Answer: B
Rationale: The Affordable Care Act requires reporting and repayment of overpayments within 60 days of
the date the overpayment is identified. The employee's discovery likely triggers the clock, and a 60-day
delay could result in liability under the reverse false claims provision. Option A is incorrect because the
delay may create legal liability. Option C misstates the rule; 'identified' means when the person knows
or should know. Option D is incorrect because the federal rule is 60 days, not 30.
11. A healthcare provider receives a request from a patient's family member to access the patient's
medical records without the patient's explicit consent. The patient is currently incapacitated due to
a medical emergency. Under UHC ethics and compliance policies, which of the following actions is
most appropriate?
A. Grant access to the family member immediately because the patient is incapacitated and the family member
has implied authority.
B. Deny access unless the family member provides a valid power of attorney or the patient's prior written
authorization.
C. Release records only after obtaining verbal consent from the patient once they regain capacity, regardless of
the urgency.
Page 4
COMPLIANCE CERTIFICATION EXAM PREP BY
UNITEDHEALTHCARE TRAINING
DEPARTMENT – COMPREHENSIVE GUIDE
1. A healthcare organization receives a subpoena duces tecum for patient records related to a fraud
investigation. The compliance officer must balance legal obligations with HIPAA privacy rules.
Which of the following actions best demonstrates compliance with both subpoena requirements
and HIPAA's minimum necessary standard?
A. Provide all requested records without redaction to avoid obstruction of justice.
B. Disclose only the records explicitly listed in the subpoena and redact any extraneous protected health
information.
C. Object to the subpoena on privacy grounds and refuse production until a court order is obtained.
D. Release a summary of the records with patient identifiers removed to satisfy the investigation.
Answer: B
Rationale: Under HIPAA, disclosures in response to a subpoena must be limited to the minimum
necessary information. Option B achieves this by disclosing only the specifically requested records and
redacting unnecessary PHI. Option A violates the minimum necessary rule. Option C is too aggressive
without legal basis. Option D may not meet the subpoena's specificity requirements.
2. A compliance officer discovers that a physician group is systematically upcoding evaluation and
management (E/M) services by using a higher level of medical decision-making than documented.
The group's billing manager claims this is standard practice to 'optimize revenue.' Which of the
following federal laws is most directly implicated in this scenario?
A. False Claims Act (FCA)
B. Anti-Kickback Statute (AKS)
C. Stark Law (Physician Self-Referral Law)
D. Civil Monetary Penalties Law (CMPL)
Answer: A
Rationale: Upcoding E/M services constitutes submitting false claims to federal healthcare programs,
directly violating the False Claims Act. The AKS involves remuneration for referrals; Stark Law involves
self-referral for designated health services; CMPL imposes penalties for various violations but FCA is
the primary law for false billing. The scenario does not involve kickbacks or self-referral.
3. Under the UnitedHealthcare Compliance Program, which of the following scenarios represents a
prohibited conflict of interest that must be disclosed and managed?
A. A compliance officer serves on the board of a local hospital that is a network provider.
Page 1
,B. A claims processor's spouse works for a competitor health plan.
C. A network manager owns stock in a medical device company that is a contracted vendor.
D. A nurse reviewer participates in a clinical trial for a drug that is not yet FDA-approved.
Answer: C
Rationale: Ownership of stock in a contracted vendor creates a direct financial conflict of interest that
could influence contracting decisions. Option A may be permissible with disclosure if no
decision-making role. Option B is a personal relationship but not directly tied to contracting or
decision-making. Option D is professional development and not inherently conflicting.
4. A pharmaceutical company offers a hospital's pharmacy director an all-expenses-paid
conference trip to Hawaii. The director states this is a 'business meeting' with educational sessions.
Under the OIG Compliance Guidance for Pharmaceutical Manufacturers, which factor most
strongly indicates this arrangement could violate the Anti-Kickback Statute?
A. The conference is accredited for continuing education credits.
B. The trip includes first-class airfare and resort accommodations.
C. The director has authority to select the hospital's formulary drugs.
D. The pharmaceutical company invites multiple pharmacy directors from different hospitals.
Answer: C
Rationale: The key factor is the director's ability to influence drug purchases, creating a potential link
between the remuneration (trip) and referrals. While lavish accommodations (B) raise concerns, the
statutory focus is on intent to induce referrals. Accreditation (A) and group invitations (D) can be
legitimate but do not negate the risk when the recipient has purchasing authority.
5. A compliance investigation reveals that a data analyst accessed the medical records of a celebrity
without authorization and shared the information on social media. The analyst claims it was a
'one-time mistake.' Which of the following penalties is the organization most likely to face under
HIPAA?
A. Civil monetary penalty of $100 per violation, capped at $25,000 per year
B. Criminal penalties including fines and up to 10 years imprisonment for the analyst
C. Exclusion from participation in federal healthcare programs
D. Corrective action plan and mandatory training for all staff
Answer: B
Rationale: HIPAA's criminal penalty provisions apply when an individual knowingly obtains or discloses
PHI for malicious reasons, including for personal gain or harm. The analyst's intentional access and
sharing for social media (likely for notoriety) constitutes knowing disclosure with intent to cause harm,
carrying up to 10 years imprisonment. Civil penalties (A) may also apply but criminal penalties are
more severe. Exclusion (C) is for program-related violations. Corrective action (D) is insufficient given
the criminal nature.
Page 2
,6. A hospital's compliance committee is evaluating a proposed arrangement where a local
physician group will receive a monthly 'management fee' of $5,000 for 'administrative services'
that are poorly defined. The group refers a high volume of Medicare patients to the hospital.
Which element of the OIG's seven elements of an effective compliance program is most directly
relevant to addressing this risk?
A. Element 2: Designation of a compliance officer and committee
B. Element 5: Communication and education on compliance policies
C. Element 6: Enforcement of standards through well-publicized disciplinary guidelines
D. Element 7: Auditing and monitoring of arrangements
Answer: D
Rationale: Element 7 requires ongoing auditing and monitoring to detect potential fraud or abuse. The
poorly defined management fee with high referral volume warrants scrutiny through audits to ensure
fair market value and legitimate services. Element 2 (A) is about structure, not review. Element 5 (B) is
education. Element 6 (C) is discipline, which may follow but is not the primary preventive mechanism.
7. Under the Stark Law, which of the following physician compensation arrangements with a
hospital is most likely to qualify for the 'personal services arrangement' exception?
A. A physician is paid 15% of the hospital's net revenue from services ordered by the physician.
B. A physician receives a flat monthly fee of $10,000 for providing on-call coverage, set in advance and
consistent with fair market value.
C. A physician is compensated based on the number of patients referred to the hospital's outpatient clinic.
D. A physician's compensation includes a bonus tied to the hospital's overall profitability.
Answer: B
Rationale: The personal services arrangement exception requires written agreement, set in advance, fair
market value, and not taking into account the volume or value of referrals. Option B meets these criteria.
Option A is a percentage of revenue tied to referrals, violating the volume/value standard. Option C
directly ties compensation to referrals. Option D's bonus tied to overall profitability may still indirectly
reflect referrals.
8. An organization's compliance hotline receives an anonymous report alleging that a senior
executive directed staff to delete emails related to a potential billing error. The executive denies the
allegation. Under the U.S. Sentencing Guidelines for organizations, what is the most critical factor
in determining whether the organization qualifies for a reduced penalty?
A. The organization had a compliance program in place at the time of the alleged conduct.
B. The organization self-reports the conduct to the government within a reasonable time.
C. The executive is terminated immediately after the investigation.
D. The organization reimburses any overpayments identified.
Answer: B
Rationale: The Sentencing Guidelines provide for reduced penalties if the organization voluntarily
discloses the offense, cooperates, and accepts responsibility. Self-reporting is a key mitigating factor.
Having a compliance program (A) is important but not determinative if the organization fails to report.
Termination (C) and repayment (D) are positive but less impactful than self-reporting.
Page 3
, 9. A compliance officer is reviewing a contract between a health plan and a pharmacy benefit
manager (PBM). The contract includes a clause that the PBM will receive a 'rebate' from a drug
manufacturer for each prescription of a specific brand-name drug filled. Which of the following
best describes the compliance risk associated with this arrangement?
A. The rebate may constitute a kickback if it is intended to influence the PBM to favor that drug over cheaper
alternatives.
B. The rebate is illegal per se under the Anti-Kickback Statute because it involves a third party.
C. The rebate is permissible if disclosed to the health plan and reflected in lower premiums.
D. The rebate violates the Stark Law because it involves a self-referral by the PBM.
Answer: A
Rationale: Rebates from manufacturers to PBMs can violate the Anti-Kickback Statute if they are
intended to induce the PBM to place the drug on a favorable formulary tier, potentially increasing costs.
They are not per se illegal (B) but must be structured to fit safe harbors. Disclosure (C) alone is
insufficient; the arrangement must also be at fair market value and not tied to volume. Stark Law (D)
applies to physician self-referrals, not PBM arrangements.
10. A healthcare organization's compliance program includes a policy requiring all employees to
report potential violations within 30 days of discovery. An employee discovers a possible
overpayment but delays reporting for 60 days because she wants to gather more evidence. Which
of the following statements best reflects the legal implications of this delay?
A. The employee has violated the organization's internal policy but faces no legal liability.
B. The delay may trigger liability under the False Claims Act's reverse false claims provision if the overpayment
is not reported within 60 days of discovery.
C. The delay is permissible under the Affordable Care Act's 60-day overpayment rule because the employee did
not have conclusive evidence.
D. The organization must report the overpayment within 30 days of the employee's discovery to avoid penalties.
Answer: B
Rationale: The Affordable Care Act requires reporting and repayment of overpayments within 60 days of
the date the overpayment is identified. The employee's discovery likely triggers the clock, and a 60-day
delay could result in liability under the reverse false claims provision. Option A is incorrect because the
delay may create legal liability. Option C misstates the rule; 'identified' means when the person knows
or should know. Option D is incorrect because the federal rule is 60 days, not 30.
11. A healthcare provider receives a request from a patient's family member to access the patient's
medical records without the patient's explicit consent. The patient is currently incapacitated due to
a medical emergency. Under UHC ethics and compliance policies, which of the following actions is
most appropriate?
A. Grant access to the family member immediately because the patient is incapacitated and the family member
has implied authority.
B. Deny access unless the family member provides a valid power of attorney or the patient's prior written
authorization.
C. Release records only after obtaining verbal consent from the patient once they regain capacity, regardless of
the urgency.
Page 4
