Certified Compliance Technician (CCT) Study Guide

Apply it

Registration staff repeatedly disagree about documenting insurance information. The compliance team revises the policy to identify required questions, acceptable documentation, supervisory review triggers, and a process for correcting incomplete records before claims are submitted.

Apply it

A supervisor asks a collector to imply that an unapproved discount expires today. The employee recognizes a conflict with the organization’s honesty standard and seeks guidance before using the proposed collection script.

Apply it

An audit questions a billing practice favored by the finance director. The compliance officer needs an authorized route to report the findings to senior leadership and the governing body without obtaining that director’s permission.

Apply it

A board receives only the number of employees trained. It requests additional reporting on significant allegations, corrective actions, repeat findings, and staffing limitations so members can evaluate whether the compliance program actually works.

Apply it

Incorrect provider information enters claims through registration, credentialing, and billing systems. A compliance committee assigns coordinated changes to each department and establishes one owner to verify that the combined correction prevents further errors.

Apply it

During orientation, a new scheduler learns how to report an instruction to alter a record, where to obtain confidential guidance, and why reporting a concern in good faith must not trigger retaliation.

Apply it

An organization identifies repeated Medicare Secondary Payer errors at intake. It gives registration staff practice with employment and coverage scenarios, while supervisors learn how to review incomplete payer questionnaires and coach affected employees.

Apply it

After training on refund routing, all employees complete the module, but misrouted credits continue. The team reviews actual cases and discovers that the software defaults to an obsolete queue, requiring a workflow correction.

Apply it

A billing specialist suspects that her manager orders unsupported changes. She uses the compliance hotline because the organization permits reports outside the management chain and accepts anonymous information that can support a focused review.

Apply it

After an employee reports suspected false billing, her supervisor removes preferred shifts without a documented business reason. Compliance and human resources examine the change and protect the reporting process while reviewing the underlying allegation.

Apply it

A top collector knowingly uses a prohibited script. Management applies the same conduct standards used for other staff, considers the deliberate behavior, and revises a bonus structure that rewarded collections without assessing compliant methods.

Apply it

A practice begins performing a new diagnostic service with unfamiliar referral arrangements. Compliance evaluates billing, financial relationships, and documentation controls before assigning review resources, rather than waiting for the service to produce a large claim volume.

Apply it

Billing supervisors review daily duplicate-claim alerts. Later, an independent audit samples claims and alert dispositions to determine whether the monitoring system detects duplicates accurately and whether supervisors resolve the identified exceptions before payment.

Apply it

Several claims appear to contain services absent from records. Compliance preserves the relevant billing data, assigns reviewers outside the implicated reporting line, examines supporting documentation, and assesses whether additional claims require review or temporary controls.

Apply it

An audit finds unsupported charges caused by an outdated template. The organization corrects the template, evaluates affected claims, trains users on the revised workflow, and samples subsequent claims to verify that the same problem has stopped.

Apply it

A review examines whether a provider’s claimed Medicare payments satisfy applicable reimbursement requirements and quantifies unsupported amounts. The work’s audit objectives and testing of payment compliance align most directly with the Office of Audit Services.

Apply it

A national study asks whether a Medicare oversight process consistently identifies a recurring provider risk and whether its safeguards need improvement. Its emphasis on program performance and systemic recommendations fits the Office of Evaluation and Inspections.

Apply it

Evidence suggests that a supplier deliberately billed Medicare for equipment never delivered and used fabricated delivery records. Investigation of the suspected scheme aligns with OIG’s investigative function and may involve coordination with prosecuting authorities.

Apply it

A provider settlement includes negotiation of a corporate integrity agreement and related OIG administrative obligations. The legal and compliance-agreement work points to the Office of Counsel to the Inspector General rather than a routine program evaluation.

Apply it

Patients complain that a hospital routinely exposes records through an unsecured portal. The complaint concerns HIPAA safeguards and disclosures, making OCR the relevant HHS enforcement office, with criminal referral possible if the facts warrant it.

Apply it

A government investigation identifies knowingly fabricated claims across several facilities. Federal attorneys bring a civil False Claims Act case seeking statutory remedies, while any ordinary claim-payment disputes follow their separate administrative processes and appeal rules.

Apply it

A provider disputes an Original Medicare claim determination and wants the first formal appeal. Staff prepare a redetermination request for the responsible MAC instead of sending the dispute to OCR or beginning with a federal court.

Apply it

A state receives evidence that a Medicaid-funded facility bills for nonexistent services and that residents may be neglected. The allegations fit MFCU responsibilities, while the state Medicaid agency retains its separate program-administration role and duties.

Apply it

Staff discover that several infusion devices appear to malfunction during use. Alongside immediate patient-safety actions and internal reporting, they evaluate reporting the suspected device problem through the appropriate FDA safety-reporting process, including MedWatch when applicable.

Apply it

A clinic with a Certificate of Waiver wants to add a new analyzer. Before patient testing, its manager verifies the exact test system’s FDA classification and determines whether the current certificate supports the proposed testing.

Apply it

A newly contracted clinician supplies an NPI, and a scheduler assumes billing can begin immediately. The enrollment team separately verifies licensure, credentials, payer enrollment, and effective participation details before authorizing claims under the relevant arrangements.

Apply it

A review finds one paid claim lacking required support and another claim paid below the amount allowed by applicable rules. Both findings fit recovery auditing because the program addresses overpayments as well as underpayments.

Apply it

A report attributes many sampled errors to missing documentation. An analyst correctly describes the result as evidence of improper payments and documentation weaknesses, rather than announcing that the same percentage of providers committed healthcare fraud.

Apply it

A provider has received an unfavorable QIC reconsideration and seeks the next review. Staff evaluate the requirements for the OMHA level, including any applicable amount threshold, rather than requesting another initial MAC redetermination.

Apply it

A hospital must both contest a disputed claim determination and examine evidence that a manager directed false documentation. It assigns the appeal to revenue cycle staff and routes the misconduct concern through compliance for appropriate investigation.

Apply it

A small practice adapts the recommended compliance structure to its size while preserving reporting and oversight functions. It separately identifies the HIPAA, billing, and other legal requirements that remain binding regardless of its chosen organizational structure.

Apply it

Two offices submit unsupported claims. One discovers a configuration error and promptly corrects it; the other fabricates records after repeated warnings. Both require review, but the second situation supplies stronger evidence relevant to knowing misconduct.

Apply it

A laboratory offers a practice free office equipment if it sends federally reimbursed testing to the laboratory. Compliance examines the value provided and its referral-linked purpose instead of accepting the arrangement’s description as a marketing partnership.

Apply it

A laboratory continuously rents a specified office suite from a referring physician under a signed six-month lease. All rented premises are listed; aggregate rent is set in advance at arm’s-length fair market value without referral-based adjustments; and the space is reasonably necessary for a commercially reasonable business purpose. The periodic-use schedule condition is inapplicable because access is continuous. The six-month term fails the minimum one-year condition, so this lease lacks the space-rental harbor’s protection.

Apply it

A physician refers Medicare patients to an imaging entity in which her spouse owns an interest. The reviewer identifies the designated service and family financial relationship, then evaluates whether a specific exception protects the arrangement.

Apply it

A group assumes every service performed in its office qualifies for an in-office exception. Compliance instead checks the actual service category, who performs it, where it is furnished, and the exception’s other applicable requirements.

Apply it

A billing employee requests an entire psychiatric record to resolve a simple coverage issue. The privacy team identifies the information actually needed for that payment task and provides appropriate limited access under the organization’s established policies.

Apply it

An emergency physician requests records from another provider to treat an unconscious patient. The receiving organization recognizes the treatment-request exception rather than automatically restricting the response to the limited data set normally used for billing.

Apply it

A practice hires a company to process claims using patient information. Before the service begins, the practice evaluates the business associate relationship and obtains contractual assurances covering permitted processing, safeguards, incident reporting, and appropriate subcontractor obligations.

Apply it

A clinic secures remote access with appropriate authentication but discovers that backup restoration has never been tested. It addresses availability as well as access protection, using its risk analysis to prioritize reliable recovery of electronic patient information.

Apply it

A 67-year-old patient has Medicare and group coverage through her spouse’s current job at a company with 80 employees. Registration identifies the working-aged conditions and lists the employer group plan ahead of Medicare for billing.

Apply it

Medicare pays for care after an accident while a liability claim remains unresolved. When a settlement later provides payment for related medical expenses, the parties evaluate Medicare’s recovery claim instead of treating the earlier payment as final responsibility.

Apply it

An uninsured patient arrives with severe abdominal pain. Registration can collect information through a process that does not delay care, but cannot require a deposit or coverage approval before the appropriate medical screening examination begins.

Apply it

A patient with an unstabilized emergency condition needs specialist treatment unavailable locally. Receiving-hospital acceptance does not by itself authorize transfer. The physician documents why the expected treatment benefits outweigh transfer risks and signs the certification. If no physician is physically present in the emergency department, a designated qualified medical person may sign only through the physician-consultation, agreement, and subsequent timely countersignature process. Alternatively, a patient requesting transfer after receiving the required information must sign the written request documenting the reasons and awareness of risks and benefits. The sending hospital provides treatment within its capacity to reduce risk, confirms receiving capability and acceptance, sends available records, and arranges appropriate personnel and transport equipment. A pending laboratory result unavailable at departure must be sent as soon as practicable afterward.

Apply it

A practice discovers prohibited Stark referrals, with no kickback arrangement or indications of FCA liability: CMS’s SRDP is the relevant voluntary route. A hospital discovers referral-linked free rent implicating OIG’s CMP authority: OIG’s protocol is relevant, with any FCA or criminal exposure assessed separately. If review identifies a potential civil FCA violation involving HHS administrative authorities that was previously unknown to the federal government, assess eligibility for the joint DOJ–HHS pilot. If federal investigators already know of that potential violation, the pilot is unavailable, but cooperation may still support credit through the applicable enforcement process. Evidence of criminal conduct calls for the DOJ criminal disclosure route rather than relying on coordinated civil resolution. In every case, stop the conduct, quantify affected payments, and address repayment obligations. CMS acknowledgment of an SRDP submission suspends the specified return obligation for disclosed overpayments under the governing rule; merely considering disclosure does not.

Apply it

A manager receives repeated reports that a billing rule creates unsupported charges but refuses to examine the examples and orders continued submission. The deliberate avoidance of the problem raises concerns beyond an isolated good-faith coding error.

Apply it

For a simplified exercise, assume established government damages of $12,000 and ordinary treble damages without reduction. The damages component is $36,000, before considering any separate per-claim civil penalties or other applicable consequences in the case.

Apply it

A provider discovers hundreds of small claims submitted through the same knowing misrepresentation. Compliance recognizes that evaluating aggregate government loss alone would omit potentially significant per-claim penalties and seeks a complete assessment of the conduct.

Apply it

A supplier knowingly pays for federally reimbursable referrals and asks whether exposure is limited to returning the referral payments. The reviewer explains that criminal prosecution and imprisonment are possible, alongside separately authorized civil and administrative consequences.

Apply it

A clinic proposes valuable gifts only for Medicare beneficiaries who choose it for covered services. Compliance evaluates the likely influence on provider selection and whether a specific exception applies, rather than assuming that a public advertisement makes the offer permissible.

Apply it

A provider plans to hire an excluded worker for tasks supporting federally reimbursed services and assumes payment is safe because the organization bills under its own number. Compliance evaluates the worker’s functions and the exclusion’s payment consequences.

Apply it

An applicant was convicted of a state felony relating to unlawful dispensing of controlled substances committed in 2024. The felony classification, specified unlawful activity, and post-August 21, 1996 offense date match section 1128(a)(4). The employer verifies actual OIG exclusion status rather than assuming the conviction and exclusion process are interchangeable.

Apply it

A professional license is suspended for reasons involving professional competence. The employer recognizes a potential permissive exclusion basis and checks the individual’s actual OIG status instead of assuming that only criminal convictions can produce exclusion.

Apply it

A contractor states that his exclusion ended last month because its minimum term elapsed. Before assigning work affecting federally reimbursed services, the organization verifies whether OIG has approved reinstatement and assesses the current exclusion status.

Apply it

After settling a fraud matter, an organization must submit reports and complete reviews required by its CIA. Its compliance team builds a calendar from the actual agreement instead of relying on its previous voluntary compliance work plan.

Apply it

A CIA requires an independent claims review. Management selects a qualified reviewer without disqualifying conflicts, supplies the required data, and separately assigns internal owners to address findings and report corrective actions under the agreement’s requirements.

Apply it

A patient spreadsheet is emailed to an unauthorized external recipient. The privacy team identifies the information involved, determines whether an exception applies, and performs the required assessment rather than closing the incident because nobody has complained.

Apply it

A misdirected file contains names and detailed diagnoses. The recipient’s identity, evidence of access, and documented mitigation are considered alongside the sensitivity and identifiability of the information before the organization decides whether notification is required.

Apply it

A covered entity discovers a reportable breach on the first day of a month. Its response team promptly prepares individual notices and does not schedule them automatically for day 60 merely because the investigation remains open.

Apply it

An investigation finds inadequate access controls even though no reportable disclosure is established. The organization corrects its Security Rule deficiencies and recognizes that the absence of notification duties does not automatically eliminate HIPAA enforcement concerns.