Certified Professional Compliance Officer (CPCO) Study Guide

Apply it

A manager says every practice must adopt the exact organizational chart illustrated in guidance. The compliance officer identifies the underlying legal duties, then selects oversight arrangements suited to the practice’s size and actual risks.

Apply it

A RAC identifies an unsupported payment, while a UPIC examines allegations of fabricated services. The officer preserves responsive records in both matters but distinguishes payment correction and appeal issues from suspected-fraud investigation.

Apply it

Two practices have identical written policies. One documents ignored complaints; the other investigates promptly and verifies correction. When assessing program operation, the officer gives greater weight to demonstrated actions and outcomes than matching policy language.

Apply it

A planning exercise includes screening applicants, reviewing payment incentives, educating providers, auditing claims, and correcting misconduct. The learner assigns each activity to its corresponding principle and identifies gaps across the full prevention-to-response cycle.

Apply it

A small office repeatedly submits duplicate claims. Its officer links claim-edit policies, staff instruction, an assigned reviewer, reporting channels, consistent accountability, monitoring, and a corrective-action check instead of treating the issue as training alone.

Apply it

An office replaces “bill accurately” with a procedure requiring documentation review, a defined coding query route, a claim hold when support is missing, and supervisor review of unresolved discrepancies before transmission to the payer.

Apply it

The billing supervisor also coordinates compliance, and a concern involves that supervisor’s bonus calculations. The practice provides direct access to a physician owner and an independent reviewer so the allegation can be evaluated without self-review.

Apply it

After an audit finds notices issued after services, the officer trains scheduling staff on advance timing and escalation. Staff then work through appointment scenarios, and a later review checks whether notices are issued correctly.

Apply it

An employee suspects the office manager is directing unsupported claims. The practice’s procedure lets the employee contact the compliance lead or physician owner directly, and the recipient logs the concern and initiates appropriate review promptly.

Apply it

Soon after reporting questionable billing, an employee loses preferred shifts without explanation. The officer reviews scheduling records and management communications separately from the billing allegation, documenting legitimate reasons or arranging correction if retaliation occurred.

Apply it

A high-producing physician repeatedly ignores required documentation queries. The practice applies its established review and disciplinary process while revising a bonus measure that rewarded claim volume without considering accuracy or unresolved compliance findings.

Apply it

A practice adds office testing while unresolved billing errors persist. The officer assesses certificate scope, ordering controls, claim volume, and prior findings, then schedules targeted reviews based on both potential harm and control weaknesses. New workflows receive testing before and after implementation.

Apply it

Billing staff review rejected claims each day. Separately, an auditor tests paid claims and examines whether staff override required edits. The combined results distinguish routine operational exceptions from weaknesses in the control itself over time.

Apply it

A coder reports that a template inserts services not performed. The officer preserves template versions and claim records, arranges a focused independent review, and temporarily holds affected claims while determining scope and appropriate correction.

Apply it

After correcting a claim-edit setting, a practice assigns an owner and reviews subsequent affected claims against documentation. Persistent errors lead to revised testing and workflow changes before the corrective-action item is formally closed.

Apply it

A vendor notices that a client’s procedure list conflicts with signed records. It pauses the affected claims, requests clarification through the agreed process, and alerts the client’s compliance contact rather than selecting the higher-paying interpretation.

Apply it

A billing company receives a spreadsheet assigning the same high-level service to every encounter. Reviewers compare records with coding requirements, query unsupported entries, and withhold affected claims until the service level can be determined accurately.

Apply it

A client asks its biller to split a bundled service into component charges because reimbursement is lower than expected. The biller checks the applicable rules and declines separate submission when the records show no qualifying distinction.

Apply it

A requisition identifies one test, but the laboratory’s intake software adds a broader group automatically. Staff compare the order with the proposed work, remove unsupported additions, and seek clarification when the request itself is unclear.

Apply it

A laboratory discovers that its requisition preselects a large panel. It removes the default, clarifies individual selections, educates ordering offices, and reviews affected claims to determine whether unsupported tests or improper component charges occurred.

Apply it

A requisition lacks the reason for testing. A billing employee finds several covered diagnoses online. The laboratory requests patient-specific clarification from the ordering office and holds the claim instead of selecting a convenient covered condition.

Apply it

A hospital’s coding reviews are satisfactory, but incident reports show recurring delays in essential patient care. The compliance committee adds quality and operational controls to its assessment rather than limiting the annual plan to reimbursement reviews.

Apply it

A hospital board receives training totals but no status of required independent reviews. The officer adds agreement deadlines, overdue deliverables, significant findings, certifications, and reportable events so leadership can oversee actual obligations.

Apply it

A hospital board receives only training attendance totals. The compliance officer adds major risk changes, substantiated concerns, overdue corrective actions, and results of follow-up reviews so members can question management and assess whether resources are sufficient.

Apply it

A hospital proposes sharing savings from removing routinely unused supplies from procedure packs while keeping clinically necessary supplies available and preserving individualized treatment decisions. Those facts distinguish waste reduction from inducing limits on medically necessary services. By contrast, knowingly paying physicians bonuses to withhold medically necessary services from Medicare or Medicaid patients under their direct care meets the operative gainsharing conditions. Review the bonus formula, clinical exceptions, actual access to necessary supplies, and quality monitoring. Even the waste-reduction arrangement requires separate AKS and Stark analysis.

Apply it

A records subpoena specifies a future production date; the hospital preserves records and organizes counsel-reviewed production. When officers execute a warrant, staff activate the response procedure immediately and document the search without obstructing it.

Apply it

A test was performed and coded accurately, but its frequency exceeds the applicable coverage limit without documented qualifying circumstances. The reviewer evaluates coverage and necessity rather than treating the correct procedure code as sufficient support for payment.

Apply it

A note automatically states that an examination was completed, but the practitioner confirms that portion was not performed. The practice corrects the record through its established process and determines the supported claim before submission.

Apply it

A practice expects Medicare to deny a scheduled test because an applicable frequency requirement is not met. Before providing it, staff explain a properly completed notice and the beneficiary’s choices instead of obtaining a signature afterward.

Apply it

Dr. Patel establishes a treatment course and remains actively involved. At a later office visit, a qualified employed nurse performs an ordered follow-up service while Dr. Chen, another physician in the group, provides the required direct supervision. Assuming all other coverage conditions are satisfied, the service may qualify as incident-to. The claim must appropriately identify Dr. Chen as the supervising practitioner, with payment to the group subject to valid reassignment requirements. Dr. Patel's original treatment plan does not justify substituting Dr. Patel's identity for Dr. Chen's. In contrast, a nurse independently evaluating a new problem and initiating its treatment course without the required initial professional service cannot qualify that work merely by obtaining a later physician signature.

Apply it

After identifying a duplicate Part B payment, a practice promptly investigates the same software defect’s related payments. It documents identification, investigation, aggregate calculation, suspension endpoint, and the resulting return deadline.

Apply it

An account shows a credit after both a patient and an insurer paid. Staff reconcile the allowed amount, payments, and contractual adjustments to identify the rightful recipient and process the appropriate refund or correction with documentation.

Apply it

An incident-to benchmark alert leads the officer to compare actual records with CMS manual chapter 15, sections 60–60.3, and the service-date version of 42 CFR 410.26, documenting each satisfied or missing condition.

Apply it

A clinic does not advertise waivers or routinely excuse cost sharing. After reviewing an individual patient's income and necessary expenses, it documents a good-faith determination of financial need and waives that patient's coinsurance. This example satisfies the stated CMP waiver criteria. An occasional waiver after documented, unsuccessful reasonable collection efforts provides an alternative pathway without requiring a financial-need finding. In contrast, advertising that Medicare patients never pay copayments fails the advertising and nonroutine conditions, even if some recipients have financial hardship.

Apply it

A physician selecting supplies receives consulting payments from one bidder. The organization obtains details, removes the physician from the purchasing decision where appropriate, and independently reviews the service agreement and selection process for financial and referral risks.

Apply it

A physician leases a diagnostic company's examination room for a documented independent business need. A signed 12-month lease identifies all leased premises and specifies every Tuesday, 8 a.m. to noon, the charge for each session, and total rent in advance. The independently supported market rent does not change with referrals; the room is appropriately sized, excludes the lessor during those sessions, and allocates common-area expenses proportionately. These terms address both provisions. Changing access to unspecified sessions loses the safe harbor's required intermittent schedule. Allowing the lessor to share the examination room during those sessions defeats Stark's exclusive-use condition. Replacing fixed rent with a percentage of office revenue defeats Stark's rental-formula condition even if projected payments appear market-rate.

Apply it

A venture promises distributions tied to physicians’ referral volume. Reviewers examine its economics for potential AKS and Stark issues, determine affected claims, and select the appropriate disclosure route rather than treating it as an ordinary duplicate-payment refund.

Apply it

A targeted review finds six erroneous claims among thirty selected because of an alert. The officer reports a 20% error proportion in that reviewed set and investigates the pattern without presenting it as the practice-wide rate.

Apply it

A manager receives repeated, documented warnings that claims include services not performed but instructs staff to continue without review. The officer recognizes potential deliberate-ignorance or reckless-disregard issues rather than treating the absence of an explicit confession as decisive.

Apply it

An audit finds a transposed code and a separate pattern of knowingly billing nonexistent services. The officer corrects both problems while distinguishing an isolated clerical mistake from conduct requiring more extensive fraud-focused investigation and legal analysis.

Apply it

A practice quantifies a government overpayment, but a manager directs staff to conceal the analysis and retain the funds. The officer identifies potential reverse false-claims concerns and initiates the applicable reporting, repayment, and investigation processes promptly.

Apply it

A compliance educator explains why an employee’s internal report and a later qui tam lawsuit are different processes. Management strengthens internal investigation and nonretaliation practices without suggesting employees must surrender lawful external reporting rights.

Apply it

A supplier offers a physician free office staff if the practice directs reimbursable orders to it. The officer recognizes the staffing benefit as potential remuneration and examines the business-generation condition rather than focusing only on cash payments.

Apply it

A proposed service arrangement meets several features of a safe harbor but fails another required condition. The reviewer declines to call it protected, then separately evaluates statutory risk and possible revisions instead of declaring automatic illegality.

Apply it

A physician refers Medicare patients for imaging to an entity partly owned by the physician’s spouse. The officer identifies the designated-service and family financial-relationship issues, then evaluates whether an applicable exception covers the actual arrangement.

Apply it

An arrangement appears to meet a Stark exception, but emails describe payments as a reward for more federal-program orders. Compliance separately reviews AKS exposure rather than treating the Stark conclusion as a complete legal clearance.

Apply it

A supplier offers a valuable gift only to beneficiaries who switch their covered purchases to it. Compliance evaluates the selection-related benefit and applicable exceptions, while also considering whether a separate kickback analysis is required.

Apply it

A hospital proposes hiring a worker into a reimbursed support function and finds a possible exclusion-list match. It verifies identity and evaluates the role’s payment implications before allowing work, rather than checking only whether the employee bills personally.

Apply it

A billing reviewer needs records supporting selected charges. The practice limits access to relevant information under its role-based policies instead of granting unrestricted access to every patient chart simply because the reviewer works for the organization.

Apply it

A treating specialist requests the clinical record needed for ongoing care. Staff recognize the treatment disclosure exception to minimum necessary, verify the recipient and permissible purpose, and use an appropriate secure disclosure process for the records.

Apply it

A clinic emails an unencrypted patient file to an unintended recipient. It contains and investigates the incident, evaluates applicable exceptions and the required risk factors, and documents its notification determination rather than waiting for evidence of identity theft.

Apply it

A misdirected file reaches another regulated healthcare organization. The reviewer examines the file’s contents, recipient, evidence about viewing, and verified deletion or other mitigation, rather than treating the recipient’s professional status as sufficient by itself.

Apply it

A system outage prevents clinicians from viewing records, although no data were disclosed. The officer recognizes an availability problem and evaluates recovery and contingency controls rather than concluding that security was unaffected because confidentiality remained intact.

Apply it

A practice moves records to a cloud service but still exports patient spreadsheets to laptops. Its risk analysis includes both environments and the transfer process, then assigns safeguards and follow-up for the identified weaknesses.

Apply it

A practice hires a company to prepare claims using patient records. Before routine information sharing begins, it evaluates the billing relationship, executes the required agreement, and establishes access, incident-reporting, and subcontractor expectations appropriate to the service.

Apply it

An uninsured person requests evaluation at a covered emergency department. Staff perform triage, place the person in the appropriate screening workflow, and collect basic registration information without interrupting evaluation. They do not require a deposit, insurance verification, financial-assistance interview, or payer authorization before the required examination. For an insured patient whose completed screening identifies an emergency medical condition, staff may seek authorization after the required further examination and stabilizing treatment have begun, provided those administrative activities do not delay care. Stabilizing treatment need not be completed before authorization is sought.

Apply it

An unstabilized patient requests transfer closer to family. Before obtaining that request, staff explain the hospital’s EMTALA obligations, including stabilizing treatment within its capabilities, and the transfer risks. The written request states the family-related reason and acknowledges risks and benefits. Staff still provide risk-minimizing care, obtain acceptance from a receiving facility with appropriate space and personnel, send the required records, and arrange suitable transport.

Apply it

Suppose a waived test's approved instructions permit only nasal-swab specimens. An office proposes substituting saliva for patient testing. That unapproved specimen-type change makes the modified testing high complexity, even if staff use the same kit and instrument. The office cannot proceed under its Certificate of Waiver. It must either perform the test exactly as authorized in the approved instructions or obtain appropriate certification and satisfy the applicable high-complexity requirements before using the modified procedure.

Apply it

A manager excludes phlebotomy staff from the exposure determination because they wear gloves. The officer corrects the assessment based on the task’s exposure potential and ensures the plan addresses appropriate controls, training, and other required protections.

Apply it

After repeated sharps injuries, an employer reviews safer devices with frontline staff, evaluates disposal practices, and updates controls and training. Providing thicker gloves alone would not address the required examination of engineering and work-practice protections.