Home › Resources › Billing Terms Glossary › Audits & Compliance

Billing Terms Glossary

Billing Compliance Terms: Definitions for Therapists and Psychiatrists

These billing compliance terms are defined in plain English for therapists and psychiatrists. Audits and compliance terms describe how payers and regulators review billing and how practices protect patient data. These definitions cover audits, HIPAA, exclusion lists, and fraud laws.

In this section

67 terms defined
Written for psychotherapists and psychiatrists
Source organization linked on every entry

Back to the full billing terms glossary

Quiet behavioral health practice office with a desk and armchairs, the setting for our billing compliance terms glossary

42 CFR Part 2

General (all payers)

Also called: Part 2; substance use disorder confidentiality

Definition: Federal regulations that protect the confidentiality of substance use disorder treatment records from certain programs, with stricter consent rules than HIPAA in many cases.
Why it matters: Affects billing and record sharing for substance use disorder programs.
Illustrative example: A program obtains patient consent that meets Part 2 requirements before disclosing records for payment.

Verify: rules were revised recently; confirm the current version at samhsa.gov.

Reference source SAMHSA

Categories Audits & ComplianceBehavioral Health Specific Terms

60-Day Overpayment Rule

Medicare and Medicaid

Also called: report and return overpayments; 60 day rule; Medicare overpayment refund deadline

Definition: The 60-day overpayment rule is a federal requirement that a provider report and return a Medicare or Medicaid overpayment within a set period after it has been identified. It comes from the Social Security Act and CMS regulations.
Why it matters: Holding an overpayment past the deadline can create false claims exposure. Set up a process to review credit balances and payer refund requests, and ask counsel how the rule applies.
Illustrative example: A billing team finds a duplicate Medicare payment, reports it to the MAC, and returns the money within the required time.

Time-sensitive: CMS revised the rule for 2025. Confirm the current standard and timeline with counsel.

Reference source CMS (Centers for Medicare & Medicaid Services) · HHS Office of Inspector General (OIG)

Categories Audits & CompliancePayment & Reimbursement MedicareMedicaid

Accounting of Disclosures

General (all payers)

Also called: HIPAA accounting of disclosures; disclosure log

Definition: An accounting of disclosures is a list of certain disclosures of a patient's protected health information that a patient may request under HIPAA. It generally does not include disclosures for treatment, payment, and health care operations.
Why it matters: Keep a log of disclosures that fall outside routine use, such as certain legally required reports, so you can answer a request.
Illustrative example: A patient asks who received their records outside routine care, and the practice provides its disclosure log.

Verify: Confirm the look-back period and exceptions with OCR.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Additional Documentation Request (ADR)

General (all payers)

Also called: ADR; records request; medical records request

Definition: A payer or contractor's request for records to support a claim before or after payment.
Why it matters: Deadlines are short and non-response usually leads to denial or recoupment.
Illustrative example: A MAC sends an ADR for progress notes and the practice replies on time.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceDenials & Appeals

Age of Majority (Healthcare)

State law (varies by state)

Also called: age of majority; age of consent for medical treatment; legal adult age for health care; adult age for consent

Definition: The age of majority for healthcare is the age at which state law treats a person as an adult who can consent to their own medical and mental health care and sign for it. In most states it is 18. A few states set it higher, such as Alabama at 19, Nebraska at 19, and Mississippi at 21 for most purposes. Many states also let a minor consent to certain services, such as outpatient mental health care, before that age.
Why it matters: Two questions decide who can consent and who receives billing and privacy information: how old the patient is, and whether state law lets a minor consent to that service. A patient's 18th birthday, or 19th or 21st where the state sets it higher, usually changes who signs consent forms, who acts as personal representative under HIPAA, who is the guarantor, and who can get records. The rule is set by each state, so never apply one state's age to another.
Illustrative example: A 16-year-old in Colorado seeks psychotherapy. The practice checks whether Colorado law lets a minor of that age consent, whether a parent is still the HIPAA personal representative, and who signs the financial agreement, before the first session.

Time-sensitive: State statutes change. This entry reflects the National Center for Youth Law compendium (2024). Confirm the current statute for the patient's state and talk to counsel before you rely on it.

Reference source National Center for Youth Law, Minor Consent Compendium 2024: Alabama · National Center for Youth Law, Minor Consent Compendium 2024: Nebraska · National Center for Youth Law, Minor Consent Compendium 2024: Mississippi · HHS, Personal Representatives (HIPAA)

Categories Audits & ComplianceEligibility & BenefitsPatient Financial Responsibility Terms

AHIMA

General (all payers)

Also called: American Health Information Management Association

Definition: A professional association for health information management, records, coding, and data governance.
Why it matters: Source for documentation, coding, and records standards.
Illustrative example: A practice uses AHIMA guidance on record integrity.

Related terms Documentation Data Retention

Reference source AHIMA

Categories Audits & ComplianceEHR & Healthcare Technology Terms

American Counseling Association Code of Ethics

General (all payers)

Also called: ACA Code of Ethics; counselor ethics code

Definition: The ACA Code of Ethics is the American Counseling Association's ethical standard for professional counselors. It covers topics such as confidentiality, informed consent, and fees.
Why it matters: State boards and payers may look to it or to their own rules. Follow the code that applies to your license and state board.
Illustrative example: A counselor reviews the code when writing a policy on telehealth informed consent.

Verify: Confirm the current edition and your state board's rules.

Reference source American Counseling Association

Categories Audits & ComplianceBehavioral Health Specific Terms

American Hospital Association (AHA)

General (all payers)

Also called: AHA; American Hospital Association

Definition: A national association of hospitals and health systems that also publishes advisories and, for facilities, some coding resources.
Why it matters: Publishes advisories on issues such as clearinghouse outages.
Illustrative example: A facility checks an AHA advisory.

Reference source American Hospital Association (AHA)

Categories Audits & ComplianceEHR & Healthcare Technology Terms

Anti-Kickback Statute

General (all payers)

Also called: AKS; kickback law

Definition: A federal law that prohibits offering or receiving payment to induce or reward referrals of federal health care program business.
Why it matters: Referral arrangements and marketing must be reviewed for AKS risk.
Illustrative example: A referral fee arrangement raises an AKS concern.

Verify: consult counsel.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Audit

General (all payers)

Also called: payer audit; billing audit

Definition: A formal review of claims and documentation to check billing accuracy and compliance.
Why it matters: Audits can lead to recoupments, corrective plans, and referrals.
Illustrative example: A payer requests records for a sample of claims.

Reference source HHS Office of Inspector General (OIG) · CMS (Centers for Medicare & Medicaid Services)

Categories Audits & Compliance

Behavioral Health Parity Complaint

General (all payers)

Also called: parity complaint; parity appeal

Definition: A complaint or appeal claiming a plan's mental health benefit limits are stricter than comparable medical benefits.
Why it matters: A route for challenging restrictive limits, with regulators and external review options.
Illustrative example: A patient files a parity complaint after repeated therapy authorization denials.

Reference source U.S. Department of Labor, EBSA

Categories Audits & ComplianceBehavioral Health Specific Terms

Breach Notification Rule

General (all payers)

Also called: HIPAA breach notification; data breach reporting

Definition: A HIPAA rule requiring covered entities and business associates to notify affected individuals, and in some cases HHS and media, after a breach of unsecured PHI.
Why it matters: Missing deadlines adds penalties.
Illustrative example: A practice notifies patients after a lost unencrypted laptop.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Business Associate

General (all payers)

Also called: HIPAA business associate

Definition: A person or organization that performs functions for a covered entity involving PHI, such as billing.
Why it matters: Business associates are directly liable for certain HIPAA requirements.
Illustrative example: A billing service is a business associate of its clients.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Business Associate Agreement (BAA)

General (all payers)

Also called: BAA; business associate contract

Definition: A written contract required under HIPAA when a vendor handles PHI on behalf of a covered entity, setting safeguards and obligations.
Why it matters: Billing services, clearinghouses, and software vendors that access PHI generally require one.
Illustrative example: A practice signs a BAA with its billing company.

Related terms HIPAA Covered Entity Business Associate

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

CERT (Comprehensive Error Rate Testing)

General (all payers)

Also called: CERT; improper payment measurement

Definition: A CMS program that measures improper payments in Medicare fee-for-service through claim sampling.
Why it matters: Drives CMS education and policy emphasis.
Illustrative example: A provider receives a CERT records request.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceMedicare & Medicaid Terms

Civil Monetary Penalties (CMP)

General (all payers)

Also called: CMP; OIG civil monetary penalty

Definition: Civil monetary penalties are fines that OIG or other agencies can impose for certain violations of federal health care laws, such as submitting false claims or violating the anti-kickback statute.
Why it matters: Penalties can be assessed per claim, so errors can add up. Compliance programs aim to prevent them.
Illustrative example: A regulator alleges a pattern of upcoded claims and proposes a monetary penalty for each claim.

Verify: Talk to counsel about any enforcement matter.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Compliance Officer

General (all payers)

Also called: privacy officer; security officer

Definition: A person responsible for overseeing compliance policies, training, and investigations in an organization.
Why it matters: A named person should own compliance duties even in small practices.
Illustrative example: A practice names an owner as compliance and privacy officer.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Compliance Program

General (all payers)

Also called: corporate compliance plan; compliance plan

Definition: A set of written policies, training, auditing, and reporting processes that a practice uses to prevent and detect billing and privacy violations.
Why it matters: OIG guidance describes elements of an effective plan.
Illustrative example: A group adopts written policies, annual training, and a compliance contact.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Confidential Communications Request

General (all payers)

Also called: HIPAA confidential communications; alternative contact request; request to send EOB elsewhere

Definition: A confidential communications request is a patient's request under HIPAA to receive communications about their health information by another means or at another location, such as a different address, phone number, or email.
Why it matters: For minors and for adults on someone else's plan, it can keep billing notices and explanations of benefits from reaching the policyholder. Providers must accommodate reasonable requests. Health plans must accommodate reasonable requests when the person says that disclosure could endanger them. Record the request and tell the billing team.
Illustrative example: A young adult on a parent's plan asks that appointment reminders go only to their own phone, so the practice records the request in the chart.

Verify: Confirm current HHS guidance and any state rules on explanation of benefits.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & CompliancePatient Financial Responsibility Terms

Corporate Integrity Agreement (CIA)

General (all payers)

Also called: CIA; OIG corporate integrity agreement

Definition: A corporate integrity agreement is a multi-year agreement between OIG and a health care provider or entity, often as part of resolving federal health care fraud allegations. It sets compliance obligations in exchange for OIG not excluding the entity.
Why it matters: It signals a serious enforcement outcome. Anyone who receives one needs counsel.
Illustrative example: A provider settles a False Claims Act case and enters a CIA that requires training and audits.

Verify: Talk to counsel about any enforcement matter.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Covered Entity

General (all payers)

Also called: HIPAA covered entity

Definition: A health plan, clearinghouse, or health care provider that transmits health information electronically in connection with standard transactions.
Why it matters: Determines who must follow HIPAA rules.
Illustrative example: A therapist who bills insurance electronically is a covered entity.

Related terms Business Associate HIPAA

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Data Retention

General (all payers)

Also called: record retention; medical record retention

Definition: How long records must be kept, set by law, contracts, and payer rules, which vary.
Why it matters: Retention periods affect audits and disputes.
Illustrative example: A state sets a minimum retention period for records.

Verify: state- and payer-specific.

Related terms Medical Record Audit Documentation

Reference source AHIMA

Categories Audits & Compliance

Designated Record Set

General (all payers)

Also called: DRS; designated record set HIPAA; medical and billing records

Definition: A designated record set is the group of records a covered entity keeps that are used to make decisions about an individual. It includes medical and billing records, and it defines what a patient can access or ask to amend under HIPAA.
Why it matters: Know what is in it before you answer a records request. Psychotherapy notes kept separately are not part of it.
Illustrative example: A practice decides that the chart, the intake forms, and the billing ledger are part of the designated record set, and keeps separate psychotherapy notes out of it.

Verify: Confirm with a compliance officer.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Documentation

General (all payers)

Also called: clinical documentation; documentation requirements

Definition: The clinical record that shows what service was provided, when, for how long, and why, in support of the claim.
Why it matters: Good documentation is the best defense in audits and appeals.
Illustrative example: A note records date, start and end times, diagnosis, intervention, and plan.

Reference source AHIMA

Categories Audits & ComplianceBehavioral Health Specific Terms

Emancipated Minor

State law (varies by state)

Also called: emancipation; emancipated youth; minor with adult legal status

Definition: An emancipated minor is a person under the age of majority whom the law treats as an adult for certain purposes, such as consenting to their own health care. Common paths include active military duty, marriage, or a court order.
Why it matters: The paths and the rights that follow vary by state. In Georgia, for example, an emancipated minor may authorize their own mental health care without parental knowledge or liability. Keep a copy of the court order or other proof in the record.
Illustrative example: A 17-year-old provides a court emancipation order at intake, and the practice records it before treating the patient as the consenting adult.

Verify: Requirements differ by state. Confirm with counsel.

Reference source National Center for Youth Law, Minor Consent Compendium 2024: Georgia

Categories Audits & ComplianceBehavioral Health Specific Terms

ERISA

General (all payers)

Also called: Employee Retirement Income Security Act

Definition: A federal law that sets standards for most employer-sponsored health and retirement plans, including claim and appeal procedures for those plans.
Why it matters: Sets appeal timelines and rights for many commercial members, and makes many self-funded plans exempt from state insurance law.
Illustrative example: An ERISA plan's denial letter cites internal and external review rights.

Reference source U.S. Department of Labor, EBSA

Categories Audits & ComplianceEligibility & Benefits

False Claims Act

General (all payers)

Also called: FCA; qui tam

Definition: A federal law that imposes liability on those who knowingly submit false claims to the government, including in Medicare and Medicaid, and allows whistleblower suits.
Why it matters: Keeping known overpayments or billing without support can create exposure.
Illustrative example: A practice knowingly bills for services not rendered and faces FCA liability.

Verify: consult counsel; this glossary is operational, not legal, guidance.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

HIPAA

General (all payers)

Also called: Health Insurance Portability and Accountability Act

Definition: A federal law that sets national standards for protecting health information and for electronic health care transactions.
Why it matters: Governs how practices handle patient data and how claims are sent.
Illustrative example: A practice signs business associate agreements with vendors that handle patient data.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

HIPAA Authorization

General (all payers)

Also called: authorization for release of information; release of information form; ROI

Definition: A HIPAA authorization is a patient's signed permission for a covered entity to use or disclose protected health information for a purpose that HIPAA does not otherwise allow.
Why it matters: It is required for most uses of psychotherapy notes and for many disclosures outside treatment, payment, and operations. It must contain specific elements and can be revoked.
Illustrative example: A patient signs an authorization so a school can receive a summary of her child's therapy.

Verify: Confirm required elements with OCR guidance.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

HIPAA Privacy Rule

General (all payers)

Also called: privacy rule; PHI protection

Definition: The HIPAA rule that sets standards for use and disclosure of protected health information and gives patients rights over it.
Why it matters: Sets when information may be shared for treatment, payment, and operations.
Illustrative example: A practice shares only the minimum information a payer needs to process a claim.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

HIPAA Security Rule

General (all payers)

Also called: security rule; ePHI safeguards

Definition: The HIPAA rule that requires administrative, physical, and technical safeguards for electronic protected health information.
Why it matters: Requires risk analysis and safeguards such as access controls and encryption.
Illustrative example: A practice conducts a security risk analysis annually.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

HITECH Act

General (all payers)

Also called: HITECH; Health Information Technology for Economic and Clinical Health Act

Definition: The HITECH Act is a 2009 federal law that promoted the use of electronic health records, strengthened HIPAA privacy and security rules, and created the breach notification requirements.
Why it matters: It is the source of the breach notification rule and higher HIPAA penalties. Practices meet its requirements through their privacy and security programs.
Illustrative example: A practice's breach response plan follows requirements that come from the HITECH Act.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & ComplianceEHR & Healthcare Technology Terms

In Loco Parentis

State law (varies by state)

Also called: person acting in place of a parent; acting in loco parentis

Definition: In loco parentis is a Latin phrase for a person who acts in the place of a parent. HHS names such a person, along with parents and guardians, as a possible personal representative of a minor child.
Why it matters: A caregiver who is not a legal parent or guardian may still act in this role in some situations, but only if state law recognizes it. Ask for proof, such as a court order, before releasing records or discussing care.
Illustrative example: A grandmother who has raised a patient brings a court order that shows she acts in loco parentis, and the practice files it before sharing information.

Verify: Whether a caregiver qualifies depends on state law. Confirm with counsel.

Reference source HHS, Personal Representatives (HIPAA)

Categories Audits & ComplianceBehavioral Health Specific Terms

LEIE (List of Excluded Individuals/Entities)

General (all payers)

Also called: LEIE; exclusion list; OIG exclusion

Definition: The OIG list of individuals and entities excluded from federal health care programs.
Why it matters: Billing for services by an excluded person can lead to penalties.
Illustrative example: A group checks each new hire against the list.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Limited English Proficiency (LEP)

General (all payers)

Also called: LEP; language access; interpreter services

Definition: Limited English Proficiency describes a person who does not speak English as a primary language and has a limited ability to read, speak, write, or understand it. Federal rules can require covered health programs to provide language assistance.
Why it matters: Plan how you will offer interpreters and translated materials. Bilingual staff can help, but check whether they are qualified to interpret clinical content.
Illustrative example: A practice arranges a qualified interpreter for a Spanish-speaking patient's intake.

Verify: Confirm what applies to your practice with counsel.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Medical Record Audit

General (all payers)

Also called: chart audit; documentation audit

Definition: A review of clinical records to confirm they support the codes billed.
Why it matters: Internal audits find problems before payers do.
Illustrative example: A practice reviews a sample of notes for time and diagnosis support.

Related terms Audit Documentation Compliance Program

Reference source AHIMA

Categories Audits & Compliance

Mental Health Parity (MHPAEA)

General (all payers)

Also called: Mental Health Parity and Addiction Equity Act; parity law; MHPAEA

Definition: A federal law requiring most group health plans that cover mental health or substance use disorder benefits to apply financial requirements and treatment limits no more restrictive than those for medical and surgical benefits.
Why it matters: It is the legal basis for many appeals about visit limits, prior authorization, and reimbursement gaps in behavioral health.
Illustrative example: A plan requires prior authorization for outpatient therapy but not for comparable medical visits; that comparison is analyzed under parity.

Time-sensitive: federal rules and enforcement change; confirm current status at dol.gov and cms.gov.

Reference source U.S. Department of Labor, EBSA · CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceBehavioral Health Specific Terms

MHPAEA Comparative Analysis

General (all payers)

Also called: NQTL comparative analysis; parity comparative analysis; MHPAEA analysis

Definition: A comparative analysis is a written analysis that a health plan or issuer must be able to provide to show that its non-quantitative treatment limits for mental health and substance use disorder benefits are comparable to and no more stringent than those for medical and surgical benefits.
Why it matters: Providers can ask a plan for it in a parity dispute, and regulators can request it. Prior authorization and network rules are common targets.
Illustrative example: A practice files a parity complaint about a plan's prior authorization rules and asks for the plan's analysis.

Time-sensitive: Federal parity rules and enforcement have changed. Confirm the current status with the Departments of Labor, HHS, and Treasury.

Reference source HHS (U.S. Department of Health and Human Services) · SAMHSA

Categories Audits & ComplianceEligibility & Benefits

Minimum Necessary

General (all payers)

Also called: minimum necessary standard

Definition: A HIPAA standard that requires limiting the use and disclosure of PHI to the minimum needed for the purpose, with exceptions such as treatment.
Why it matters: Applies to what a biller shares with payers and vendors.
Illustrative example: A biller sends only the notes a payer requested.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

No Surprises Act

General (all payers)

Also called: NSA; surprise billing law

Definition: A federal law that limits surprise out-of-network bills in certain situations and requires good faith estimates for some uninsured or self-pay patients.
Why it matters: Sets rules on estimates for self-pay behavioral health patients.
Illustrative example: A practice provides a good faith estimate to a self-pay client before the first session.

Verify: check current CMS guidance.

Reference source CMS (Centers for Medicare & Medicaid Services) · CMS No Surprises Act

Categories Audits & CompliancePatient Financial Responsibility Terms

Non-Quantitative Treatment Limitation (NQTL)

General (all payers)

Also called: NQTL; nonquantitative treatment limit

Definition: A parity term for a limit on the scope or duration of benefits that is not expressed numerically, such as prior authorization, step therapy, or network admission standards.
Why it matters: Plans must be able to show NQTLs for mental health are comparable to those for medical benefits.
Illustrative example: A payer's credentialing standards are examined as an NQTL.

Time-sensitive: confirm current rules.

Reference source U.S. Department of Labor, EBSA · CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceBehavioral Health Specific Terms

Notice of Privacy Practices (NPP)

General (all payers)

Also called: NPP; HIPAA notice; privacy notice

Definition: A notice of privacy practices is the document a covered entity gives patients that explains how it may use and share their health information and describes their rights under HIPAA.
Why it matters: Providers with a direct treatment relationship generally give the notice at the first service and post it. Keep proof that it was provided.
Illustrative example: A practice hands new patients the notice at intake and keeps the signed acknowledgment.

Verify: Confirm the current content requirements with OCR.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

OCR (Office for Civil Rights)

General (all payers)

Also called: OCR; HHS OCR

Definition: The HHS office that enforces HIPAA privacy, security, and breach rules and civil rights laws in health programs.
Why it matters: OCR investigates HIPAA complaints and publishes enforcement guidance.
Illustrative example: A patient files a HIPAA complaint with OCR.

Related terms HIPAA HIPAA Privacy Rule

Reference source HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

OIG (Office of Inspector General)

General (all payers)

Also called: OIG; HHS OIG

Definition: The HHS office that investigates fraud, waste, and abuse in health programs and publishes exclusion lists and compliance guidance.
Why it matters: OIG guidance shapes compliance programs and its exclusion list must be checked.
Illustrative example: A practice screens staff against the OIG exclusion list monthly.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

OIG General Compliance Program Guidance

General (all payers)

Also called: OIG compliance program guidance; GCPG; OIG seven elements

Definition: OIG General Compliance Program Guidance is a voluntary guidance document from the HHS Office of Inspector General that describes how health care organizations can design a compliance program.
Why it matters: Practices use it to build a compliance program that fits their size. It covers elements such as policies, training, monitoring, and response to problems.
Illustrative example: A small group uses the OIG guidance to write its compliance policies and training plan.

Verify: Confirm the current version at oig.hhs.gov.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

OIG Self-Disclosure Protocol

General (all payers)

Also called: SDP; OIG self disclosure; voluntary self-disclosure

Definition: The OIG Self-Disclosure Protocol is a process that lets a provider voluntarily disclose potential violations of federal health care fraud laws to OIG and seek resolution.
Why it matters: It is for potential fraud, not simple overpayments that can go through normal refund channels. Use it only after counsel reviews the facts.
Illustrative example: A practice finds a possible kickback issue, and its attorney evaluates whether to use the protocol.

Verify: Talk to counsel before any self-disclosure.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

OIG Work Plan

General (all payers)

Also called: OIG audit priorities; HHS OIG work plan

Definition: The OIG Work Plan is a list of audits and evaluations that the HHS Office of Inspector General plans or has under way. OIG updates it on a regular basis.
Why it matters: It shows what regulators are looking at, such as behavioral health billing or telehealth. Compliance teams review it to guide internal audits.
Illustrative example: A compliance officer checks the work plan and schedules an internal review of the practice's high-level psychotherapy claims.

Time-sensitive: The work plan is updated often. Confirm current items at oig.hhs.gov.

Reference source HHS Office of Inspector General (OIG)

Categories Audits & Compliance

Parity Complaint

General (all payers)

Also called: parity complaint filing

Definition: A formal complaint to a regulator about a plan's possible parity violation.
Why it matters: Regulators such as the Department of Labor and state agencies handle these.
Illustrative example: A provider assists a patient in filing a complaint with a state insurance department.

Reference source U.S. Department of Labor, EBSA

Categories Audits & ComplianceBehavioral Health Specific Terms

Personal Representative (HIPAA)

State law (varies by state)

Also called: HIPAA personal representative; parent as personal representative; authorized representative

Definition: Under HIPAA, a personal representative is a person authorized under state or other applicable law to act for an individual in making health care decisions. HHS says a parent, guardian, or person acting in loco parentis is generally the personal representative of a minor child.
Why it matters: A parent is not treated as the personal representative in three situations HHS describes: when state or other law does not require a parent's consent for a service and the minor consents, when someone other than the parent is authorized by law to consent and does, and when a parent agrees to a confidential relationship between the minor and the provider. A provider may also decline to treat someone as a personal representative in abuse, neglect, or endangerment situations.
Illustrative example: A 15-year-old lawfully consents to outpatient therapy under state law, so the practice does not treat the parent as the personal representative for that care. It releases information to the parent only where HIPAA and state law allow.

Verify: State law decides who can consent. Confirm with counsel or a compliance officer.

Reference source HHS, Personal Representatives (HIPAA) · HHS, HIPAA FAQ 516: disclosure to parents of a teen

Categories Audits & ComplianceBehavioral Health Specific Terms

Post-Payment Review

General (all payers)

Also called: postpayment review; retrospective review

Definition: A review of paid claims after payment, which can lead to recoupment if errors are found.
Why it matters: Can reach back over a period set by law or contract.
Illustrative example: A payer requests records for claims paid in the last year.

Related terms Pre-Payment Review Recoupment Audit

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & Compliance

Pre-Payment Review

General (all payers)

Also called: prepayment review; claim hold for review

Definition: A payer review of claims and records before payment is made, often triggered by patterns or risk.
Why it matters: Delays payment and requires quick response to record requests.
Illustrative example: A payer holds claims for a provider until records are submitted.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & Compliance

Prompt Pay Law

General (all payers)

Also called: prompt payment law; prompt payment statute

Definition: State or federal laws that require payers to pay clean claims within set periods or owe interest.
Why it matters: Gives leverage to follow up on slow payers in states that have such laws.
Illustrative example: A state requires payment of clean claims within a set number of days.

Verify: state-specific; never merge two states.

Related terms Clean Claim Adjudication

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & CompliancePayment & Reimbursement

Protected Health Information (PHI)

General (all payers)

Also called: PHI; ePHI

Definition: Individually identifiable health information held or transmitted by a covered entity or business associate.
Why it matters: Applies to claims, notes, and messages that identify a patient.
Illustrative example: A claim containing a patient's diagnosis and name is PHI.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Psychotherapy Notes

General (all payers)

Also called: process notes; HIPAA psychotherapy notes

Definition: Notes by a mental health professional that document or analyze conversation contents and are kept separate from the rest of the record, receiving extra HIPAA protection.
Why it matters: They generally require specific patient authorization to disclose and are distinct from progress notes used for billing.
Illustrative example: A therapist keeps private process notes apart from the chart used for claims.

Related terms Progress Note HIPAA Privacy Rule

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & ComplianceBehavioral Health Specific Terms

Recovery Audit Contractor (RAC)

General (all payers)

Also called: RAC; recovery audit

Definition: A CMS contractor that reviews Medicare and Medicaid payments to find improper payments.
Why it matters: RAC findings can lead to overpayment demands.
Illustrative example: A RAC reviews claims and requests records.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceMedicare & Medicaid Terms

Right of Access (HIPAA)

General (all payers)

Also called: HIPAA right of access; patient access to records; record request

Definition: The HIPAA right of access is a patient's right to see and get a copy of their protected health information in a designated record set. Providers generally must respond within 30 days, with one possible extension.
Why it matters: Psychotherapy notes kept separately are excluded from this right. Have a written process for requests, verify identity, and check state law and minor rules before releasing records.
Illustrative example: A patient asks for a copy of their chart, and the practice releases the record within the required time.

Verify: Confirm the current OCR guidance and any stricter state law.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

SAM Exclusions

General (all payers)

Also called: System for Award Management exclusions; SAM.gov debarment

Definition: A federal database of parties barred from federal contracts and some federal programs.
Why it matters: Often checked alongside the OIG list.
Illustrative example: A practice checks SAM when hiring.

Verify: confirm screening requirements with counsel.

Reference source HHS (U.S. Department of Health and Human Services)

Categories Audits & Compliance

Section 1557 (Nondiscrimination in Health Programs)

General (all payers)

Also called: Section 1557; ACA nondiscrimination; language access rule

Definition: Section 1557 of the Affordable Care Act is a federal nondiscrimination provision that applies to certain health programs and activities that receive federal financial assistance. HHS Office for Civil Rights enforces it.
Why it matters: It can require language assistance and notices. Practices that take Medicaid or Medicare may be covered, so ask counsel what applies.
Illustrative example: A practice that accepts Medicaid reviews its notices and its process for language assistance.

Time-sensitive: Rules and their enforcement have changed. Confirm current requirements with counsel.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Security Risk Analysis

General (all payers)

Also called: HIPAA risk analysis; SRA; security risk assessment

Definition: A security risk analysis is the assessment a covered entity or business associate must do under the HIPAA Security Rule to find risks to the confidentiality, integrity, and availability of electronic protected health information.
Why it matters: It is one of the first things regulators ask for after a breach. Do it, document it, and update it when systems change.
Illustrative example: A practice reviews its EHR, devices, and telehealth tools each year and records its findings.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & ComplianceEHR & Healthcare Technology Terms

Stark Law

General (all payers)

Also called: physician self-referral law

Definition: A federal law restricting physicians from referring Medicare patients for certain designated health services to entities with which they have a financial relationship.
Why it matters: Most relevant to hospital-affiliated arrangements.
Illustrative example: A physician's ownership interest in a lab triggers Stark review.

Verify: consult counsel.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & Compliance

State Insurance Department

General (all payers)

Also called: department of insurance; DOI

Definition: A state agency that regulates insurers, handles consumer and provider complaints, and enforces state insurance laws.
Why it matters: A complaint route for fully insured plans, but self-funded plans are usually outside its authority.
Illustrative example: A practice files a complaint with a state department of insurance about late payments.

Verify: state-specific.

Reference source HHS (U.S. Department of Health and Human Services)

Categories Audits & Compliance

State Mandate

General (all payers)

Also called: state benefit mandate; mental health mandate

Definition: A state law requiring insured plans to cover certain services or providers, such as some behavioral health benefits.
Why it matters: Mandates apply to fully insured plans, not usually to self-funded ERISA plans, and vary by state.
Illustrative example: A state requires coverage of licensed professional counselors' services.

Verify: state-specific; never merge two states.

Reference source HHS (U.S. Department of Health and Human Services)

Categories Audits & ComplianceEligibility & Benefits

Targeted Probe and Educate (TPE)

General (all payers)

Also called: TPE; Medicare TPE review

Definition: A Medicare review approach where a contractor reviews a sample of a provider's claims and offers education, with repeated rounds if error rates remain high.
Why it matters: Poor results can escalate to other actions.
Illustrative example: A MAC starts TPE for a specific code.

Verify: confirm current programs at cms.gov.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceMedicare & Medicaid Terms

Treatment, Payment, and Health Care Operations (TPO)

General (all payers)

Also called: TPO; treatment payment operations HIPAA

Definition: Treatment, payment, and health care operations, or TPO, are the routine purposes for which HIPAA lets a covered entity use and share protected health information without a patient's written authorization.
Why it matters: Billing a claim is payment. Psychotherapy notes are treated differently and generally need an authorization. Share only the minimum necessary for payment and operations.
Illustrative example: A practice sends diagnosis and session dates to an insurer to get paid, which falls under payment.

Reference source HHS (U.S. Department of Health and Human Services) · HHS Office for Civil Rights (OCR)

Categories Audits & Compliance

Unified Program Integrity Contractor (UPIC)

General (all payers)

Also called: UPIC; program integrity contractor

Definition: A CMS contractor that investigates potential fraud, waste, and abuse in Medicare and Medicaid.
Why it matters: A UPIC contact is a serious event that calls for counsel.
Illustrative example: A provider receives a records request from a UPIC.

Verify: talk to counsel if contacted.

Reference source CMS (Centers for Medicare & Medicaid Services)

Categories Audits & ComplianceMedicare & Medicaid Terms

Can't pin down a billing term or a payer rule?

Tell us what you are seeing on your remittances or denial letters. We will point you to the right answer.

Billing Compliance Terms: Definitions for Therapists and Psychiatrists

In this section

More billing terms

Keep reading

Billing Terms Glossary

CPT & E/M Code Guide

FAQ

Can't pin down a billing term or a payer rule?