Appendix F — Federal Law and Regulation Reference

This is a map. It is not legal advice, it is not a substitute for counsel, and nothing in it should be relied on as a statement of what the law currently requires. It exists to do one narrow, useful thing: to put the federal statutes and rules this book teaches in one place, in plain language, with the citation you need to go find the current text and the chapter and section where the book taught the reasoning.

That distinction matters more here than anywhere else in the book. Appendix A can tell you what the seventh character of an ICD-10-CM code does, and that is knowledge you can act on. This appendix cannot tell you what to do, because every one of the questions people actually ask about these laws — is this arrangement all right, do we have to report this, may we bill this patient — depends on facts a reference page cannot see, on a state law this page does not cover, and on a contract nobody outside your organization has read.

So the register here is deliberately narrow: here is what the law is about, here is who enforces it, here is roughly what exposure looks like, and here is where to look it up. When the answer matters, the next step is not another page of this book. It is your compliance officer, your payer's published policy, and counsel.

F.1 Three layers, and the one that governs most of your Tuesdays

Every billing decision you will ever make sits inside three layers of rule, and new practitioners reliably overweight the first and underweight the third.

   THE THREE LAYERS — and how often each one decides your day

   ┌─────────────────────────────────────────────────────────────┐
   │  FEDERAL LAW AND REGULATION                                 │
   │  statutes, regulations, and the federal payment systems.    │
   │  Sets the outer boundary. Applies to everyone.              │
   │  ► THIS APPENDIX                                            │
   └─────────────────────────────────────────────────────────────┘
                    ▲
   ┌─────────────────────────────────────────────────────────────┐
   │  STATE LAW                                                  │
   │  medical practice acts, insurance regulation, Medicaid,     │
   │  collection and charity-care statutes, records retention,   │
   │  state balance-billing and audit rules, state privacy law   │
   │  ► THIS BOOK CANNOT SUMMARIZE IT. Fifty answers.            │
   └─────────────────────────────────────────────────────────────┘
                    ▲
   ┌─────────────────────────────────────────────────────────────┐
   │  THE INDIVIDUAL PAYER CONTRACT                              │
   │  the participation agreement, the provider manual, the      │
   │  medical policies, the companion guide, the fee schedule    │
   │  ► DECIDES MOST OF WHAT YOU ACTUALLY DO ALL DAY             │
   │  ► Varies by payer, by product, and by contract year        │
   │  ► CHANGES WITHOUT NOTICE                                   │
   └─────────────────────────────────────────────────────────────┘

The federal layer sets the boundary of what is lawful. The contract layer sets almost everything else — what is covered, what must be authorized, what modifier that payer wants, how long you have to appeal, whether the payer may extrapolate an audit finding at all. Chapter 22 §22.10 is the whole argument: a commercial plan's medical policy is not federal law and does not have to resemble it, and the policy that governs your claim is the one published by the payer you are billing.

The state layer is the one this book is most honest about not covering. Chapter 3 §3.7 says it plainly for Medicaid — fifty programs, one name, no national substitute for your state's provider manual. Chapter 32 says it again for collections, charity care, and interest on medical debt. Chapter 37 §37.5 says it a third time about commercial audits, where a number of states now regulate notice, lookback, and extrapolation. Where the three layers disagree, the answer is a legal question, not a coding question, and it is one of the places this appendix will consistently tell you to stop.

One more layer that is easy to miss. For a self-funded employer plan, the plan is governed by the Employee Retirement Income Security Act of 1974 (ERISA), 29 U.S.C. § 1001 et seq., rather than by state insurance law — which is why a protection that reaches one patient's plan may not reach the next patient's, and why the third-party administrator on the card is not the risk-bearer (Chapter 2 §2.5). The Department of Labor's claims procedure regulation at 29 C.F.R. § 2560.503-1 sets the appeal timelines for those plans; Chapter 30 §30.5 is where the book uses it.

F.2 How to read an entry, and one standing caution

Every entry below has the same six fields, in the same order.

⚠️ Read this before you use any entry below, and read it again before you quote one.

Every statute here has been amended, every regulation here has been re-rulemade, and several have been reinterpreted by courts since they were written. A citation is a place to look, not a statement of what the text says today.

Penalty amounts under the False Claims Act, the Civil Monetary Penalties Law, and the price transparency rule are adjusted for inflation annually by rule. This appendix prints no penalty figure, and that is deliberate rather than lazy: any number a book prints in this category is wrong within about a year, and quoting a stale one to a physician or a board is worse than saying you do not know. Look up the current range in the current regulation.

And nothing here is legal advice. Chapter 5's own callouts say it on every compliance topic and Chapter 37 §37.9 says it again about disclosure: verify with your compliance officer and the primary sources, and involve counsel before you act on any of it.

F.3 The False Claims Act

The certification theory, in one paragraph. A claim submitted to a federal health program is not a request; it is a statement of fact to which representations attach — that the services were furnished, that they were medically necessary, that the information is true and complete, and that the claim complies with applicable law, including the kickback and self-referral prohibitions (Chapter 5 §5.1). The code on that claim is part of the representation. That is why this book's third theme says every code is a legal attestation, and it is why a modifier is a factual assertion rather than a formatting choice.

The definition that does all the work is "knowingly," at § 3729(b)(1). It reaches actual knowledge, deliberate ignorance, and reckless disregard — and it states expressly that no proof of specific intent to defraud is required. Chapter 5 §5.3 spends its length on the second and third prongs, because those are the ones that reach ordinary organizations doing ordinary work: the macro that appends a modifier nobody read, the audit finding nobody acted on, the edit override nobody ever sampled. A great deal of enforcement exposure in this field is generated by defaults rather than by decisions, which is exactly why the book teaches detection.

Falsity must also be material — capable of influencing the payment decision. Chapter 5 §5.3 notes that courts have engaged with materiality at length; the practical point is that ordinary coding and documentation cases are comfortably material, because a payer that knew the record did not support the code would not have paid.

Qui tam, and the whistleblower next to you. Section 3730 permits a private person — a relator — to file suit on the government's behalf, under seal, while the government investigates and decides whether to intervene; a successful relator receives a share of the recovery, and retaliation against an employee for lawful acts in furtherance of an action, or in efforts to stop a violation, is prohibited. A large share of health care cases originate with insiders, and the insider best positioned to know that a practice is systematically overcoding is the person doing the coding. Chapter 5 §5.3's structural conclusion is the one worth carrying: the person who reports is protected, the person who complies is not, and "I was told to" has never been a defense.

What this appendix will not do. It will not tell you whether a particular claim, pattern, or arrangement creates False Claims Act exposure. That determination is legal and fact-specific, and Chapter 5 §5.9's sequence ends where this one does — escalate in writing, and get counsel.

F.4 The Anti-Kickback Statute

"Remuneration" means anything of value, not just cash — free rent, subsidized staff, discounted equipment, meals, speaking fees, free supplies, waived cost sharing. Chapter 5 §5.4 lists these because the breadth is the part people underestimate.

Intent is required, and it is a lower bar than "intent to defraud." Chapter 5 §5.4 records that courts have applied a one-purpose standard: an arrangement can violate the statute if one purpose of the remuneration is to induce referrals, even where legitimate purposes coexist.

Safe harbors, as a concept. The regulations define arrangements that are protected if every element is satisfied. Two properties of that design are worth understanding and are frequently misunderstood:

• They are all-or-nothing. Substantial compliance with a safe harbor is not compliance with a safe harbor.
• Failing to fit one is not itself a violation. An arrangement outside every safe harbor is evaluated on its facts — which is a legal analysis, and not one a coding reference performs.

Why it appears in a billing book at all, which is Chapter 5 §5.4's answer and worth repeating here: a financial relationship is invisible on a claim form, but a referral pattern is exactly what data analytics finds. A coder or biller is unlikely to structure anyone's financial arrangements and is extremely likely to be the first person who notices that essentially all of a practice's imaging goes to one facility, or that a new arrangement produced a step change in volume. You are not expected to render a legal opinion. You are expected to notice, and to have somewhere to say it — which is what the compliance program's reporting channel exists for (Chapter 5 §5.6, element 4).

F.5 The physician self-referral law — "Stark"

The distinction from the Anti-Kickback Statute is the operationally consequential fact on this page, and Chapter 5 §5.4 puts it in one sentence: Stark requires no intent. None. An arrangement that fails to satisfy an exception violates the statute regardless of why it was structured that way or whether anyone meant anything by it.

Three consequences follow, and they are the reason the two statutes are managed by different disciplines inside an organization:

Operationally, the difference is this. Anti-kickback compliance is partly an ethics problem — you can ask what a payment was for. Stark compliance is a documentation and structuring discipline: the question is not what anyone meant but whether the written arrangement satisfies every enumerated requirement of an exception, on paper, continuously. Chapter 5 §5.4 says the structure of the statute explains the discipline — a broad prohibition followed by exceptions, each with enumerated requirements — and that is also why a lapsed signature or an expired lease term can matter in a way that would be irrelevant under a statute with an intent element.

And it is why Stark has its own disclosure protocol. Chapter 37 §37.9's reasoning: a financial relationship can violate the physician self-referral law without anyone intending anything, which means "we did not mean to" is not a resolution and an ordinary refund does not fit. §F.14.

F.6 The Civil Monetary Penalties Law, exclusion, and the corporate integrity agreement

The structural point about per-item penalties, which Chapter 5 §5.5 makes and which this page will not undercut with a number: penalties assessed per claim across a high-volume service line reach very large totals quickly, independent of the size of the underlying overpayment. That is why an enforcement figure and a repayment figure are frequently orders of magnitude apart, and why reasoning from "we only got paid a little extra" is the wrong instinct.

Exclusion is the consequence practitioners most underestimate, and Chapter 5 §5.5 spends its length there for a reason.

• Mandatory exclusion follows conviction of program-related crimes, patient abuse or neglect, felony health care fraud, and certain felony controlled-substance convictions.
• Permissive exclusion covers a longer list, including misdemeanor fraud convictions, license revocation or suspension, and submitting claims for excessive charges or unnecessary services.
• The effect reaches further than billing. No federal health care program may pay for an item or service furnished, ordered, or prescribed by an excluded person, and the prohibition reaches administrative and management services and employment in any capacity by a provider that bills federal programs.

Which is why exclusion screening is a routine business-office function rather than a legal one: the LEIE is free and searchable, screening obligations commonly extend to employees, contractors, and vendors, many organizations screen monthly, and liability for employing an excluded person accrues from the date of exclusion, not from the date anyone found out. The scope of your own obligation comes from federal guidance, state requirements, and payer contracts — verify what applies to you.

The corporate integrity agreement (CIA) is a negotiated settlement obligation, typically running five years, under which an organization agrees to specific compliance measures — an independent review organization, mandatory training, reporting obligations, board certifications. Chapter 5 §5.5 describes it accurately in four words: expensive, intrusive, and public. Note for §F.14: the OIG's disclosure protocol carries a stated general presumption against requiring a CIA of a disclosing party, which is one of the reasons the protocol exists.

F.7 The sixty-day overpayment provision

This is the one provision in the appendix the book teaches in three places on purpose, because it is three different problems wearing one name.

   THE SAME PROVISION, THREE CHAPTERS

   Ch. 5 §5.1   THE LAW           Retaining a known overpayment is
                                  itself a violation. The FCA reaches
                                  the improper avoidance of an
                                  OBLIGATION, not only a false claim.

   Ch. 31 §31.9 THE WORKFLOW      How overpayments surface, what
                                  "identified" means, how a refund is
                                  made, how a recoupment is worked,
                                  and why identification is DATE-STAMPED.

   Ch. 37 §37.9 THE DECISION      When a pattern stops being a refund
                                  and becomes a disclosure — and which
                                  protocol it goes to.

"Identified" is the operative word and it does not mean "suspected." The chapters agree on the shape: identification generally requires both knowing an overpayment was received and quantifying it — but credible information that an overpayment probably exists starts an obligation to investigate promptly, and no version of the standard has ever rewarded the organization that declined to look (Chapter 31 §31.9; Chapter 37 §37.9). A lookback period attaches, and both it and the identification standard have moved by rulemaking. Verify the current text of 42 CFR 401.305 with your compliance officer.

Two operational facts the book treats as non-negotiable and this page will repeat:

Date-stamp identification. The day the organization concluded an overpayment exists is a fact the sixty-day rule turns on, and a contemporaneous record — what was found, when, how quantified, when repaid — is simultaneously the compliance file and the proof of good faith (Chapter 31 §31.9).

Direction decides the chapter. An underpayment is Chapter 28 §28.8 and a reconsideration window. An overpayment is Chapter 31 §31.9 and a clock. The same audit produces both, they are tracked separately, and they are never netted against each other (Chapter 37 §37.9).

⚖️ The inversion worth internalizing, stated in Chapter 31 §31.9 and true nowhere else in this book: everywhere else, money in the door is the goal and speed serves collection. Here, money in the door is the hazard and speed serves return. A credit-balance backlog that would be ordinary sloppiness in another industry is, on federal-program accounts, a queue of potential obligations aging toward a deadline.

F.8 HIPAA — three rules under one name — and HITECH

The vocabulary, defined once in Chapter 5 §5.7:

Minimum necessary is the standard a revenue cycle professional touches daily, and Chapter 5 §5.7 makes it concrete rather than abstract: send the relevant records with an appeal rather than the entire chart; write a query that quotes the pertinent excerpt rather than the whole admission; configure access by role; do not discuss an account where it can be overheard, including from home. Chapter 30's appeal packet and Chapter 36's model query are both built to demonstrate the standard rather than merely to cite it.

The Transactions and Code Sets Rule is the one people forget is HIPAA at all, and it is the reason your professional vocabulary is national. Chapter 27 §27.1: Administrative Simplification required standard formats for defined electronic transactions (the 837, 835, 270/271, 276/277, 278), adopted standard code sets — ICD-10-CM, ICD-10-PCS, CPT, HCPCS Level II, and CDT — and adopted standard identifiers, the NPI for providers and the EIN for employers. When Chapter 9 §9.1 says adherence to the ICD-10-CM Official Guidelines is required, this is the rule that carries the code set into national standard status; Part 162 is where the mandate actually lives.

And what it did not standardize is the part that decides your working life (Chapter 27 §27.1): which situational elements a given payer requires, what that payer does with them, the payer's own edits, and what it will accept as an attachment. That gap is why the companion guide exists and why this book tells you to read one four separate times.

HITECH. The Health Information Technology for Economic and Clinical Health Act added the breach notification requirements Chapter 5 §5.7 describes: notification to affected individuals, to HHS, and — above a threshold — to the media, within defined timeframes. It also strengthened enforcement and extended direct liability to business associates. Verify current thresholds, timeframes, and penalty tiers; they are set by regulation and adjusted.

The mundane failures are the real ones. Chapter 5 §5.7's list is not hackers: the whole chart sent with an appeal when four pages were needed, a fax number stored from years ago, unencrypted email because the portal was down and the deadline was today, an account discussed where the next patient can hear it, a shared device at home — and curiosity, which is detected by audit-log review, is not a gray area, and most reliably ends employment.

F.9 The No Surprises Act

The structural idea is that the patient is taken out of the middle. For a protected service the patient's cost sharing is computed at the in-network level — generally from a qualified payment amount (QPA), or under a state regime where one applies — and counts toward in-network accumulators. What the provider is ultimately paid is settled between plan and provider, and failing agreement, through federal independent dispute resolution: an arbitration the patient never sees. Chapter 32 §32.4 has the protected-service table; verify the current scope, because the edges have moved and litigation over the IDR process has been continuous.

Two distinctions the chapter draws that are worth carrying into any conversation about this law:

Cost sharing is not a balance bill. A deductible, a copay, and coinsurance are patient responsibility inside the allowed amount. A balance bill asks the patient to make up the discount — the amount above it (Chapter 32 §32.4). Collecting a protected patient's in-network coinsurance is correct; billing the spread is what the statute ended.

The notice-and-consent exception is narrow by design, and some services can never use it. It exists for a patient who genuinely chooses an out-of-network provider — not as a waiver slid across a check-in desk. It cannot be used for emergency care before stabilization, and it cannot be used at all for the ancillary specialties Chapter 32 §32.4 lists.

The good faith estimate is the second half. It is required for uninsured and self-pay patients, must be furnished around scheduling or on request, and contains the expected items and services with their codes and expected charges, the providers involved, and required disclaimers. Chapter 32 §32.3's operational conclusion is that a GFE is a document with legal consequences built from the same code-level discipline as a claim, which is why the biller rather than the receptionist should own its accuracy — and it flags that the equivalent instrument for insured patients has awaited rulemaking, so verify its status before promising anyone one.

Timing, thresholds, and scope in this entry are all regulatory and all moving. Chapter 32's further reading opens with the same warning. Go to CMS's No Surprises pages, not to a book.

F.10 The Hospital Price Transparency rule

The format standards, the required file layout, and the enforcement amounts have all been revised since the rule took effect. Chapter 32 §32.5 says so explicitly and this appendix will not freeze any of them.

Two consequences a revenue cycle professional lives with. The machine-readable file is rebuilt from the chargemaster on a schedule, so every chargemaster decay mechanism Chapter 23 §23.8 and Chapter 26 §26.5 taught you to find is now published, with your organization's name on it. And a companion set of rules aims at the payers — the Transparency in Coverage requirements for plans to publish their own negotiated rates — so the negotiated rate this book spent Chapters 2 and 23 treating as a trade secret is now visible from both directions.

F.11 The Medicare statutory framework

Parts A, B, C, and D, in one line each, per Chapter 3 §3.2: A is the hospital/institutional benefit; B is the medical benefit, where physician services and outpatient care live; C is Medicare Advantage, the same benefit delivered by a private plan under contract with CMS, with its own rules and its own prior authorization (Chapter 3 §3.6); D is the outpatient prescription drug benefit. Medicaid is a separate program, jointly funded and state-administered — Chapter 3 §3.7's "fifty programs, one name" — and its rules are your state's, not this page's.

"Reasonable and necessary" is statutory, and the structure of the sentence is instructive (Chapter 22 §22.2). It is written as an exclusion, not a grant: Medicare pays for covered benefits and then excludes what is not reasonable and necessary, which is why coverage documents describe when a service is covered rather than whether it exists. The statute does not define the phrase. The content comes from coverage determinations — which is why those documents, not the statute, are the operative authority.

The single most operationally valuable fact in this entry, and both chapters state it: the LCD states the policy and the billing and coding article carries the covered diagnosis list. A practitioner who reads the LCD and stops has usually not found the thing they needed. Chapter 22 §22.5's five-step lookup is the procedure; and its step 5 is the one nobody expects — most services have no NCD and no LCD, which means no published criteria govern and the record's clinical rationale is what supports the claim.

The Advance Beneficiary Notice of Noncoverage (Form CMS-R-131) is the instrument that shifts financial liability to a Medicare beneficiary when a normally covered service is expected to be denied as not reasonable and necessary (Chapter 3 §3.5; Chapter 22 §22.8). Four properties are worth carrying:

• It is a Medicare instrument. It has no effect on a commercial patient's liability; commercial plans have their own notice mechanisms, defined in the provider contract (Chapter 22 §22.10).
• It is not required for a statutorily excluded service — a service that is not a Medicare benefit at all. A voluntary notice may be given as a courtesy, which modifier GX records.
• It must be given in advance, identify the specific service, state a specific reason to expect denial, include a cost estimate, and let the beneficiary choose among the form's options (Chapter 22 §22.8).
• A routine or blanket ABN is improper, and Chapter 22 §22.8's conclusion is the sharpest sentence in the chapter: a defective ABN is worse than none, because it produces a document showing the practice knew a notice was required and produced one that does not work.

The liability modifiers GA, GX, GY, and GZ are how the claim reports all of that to the payer (Chapter 22 §22.9; Appendix B §B.10). The Medicare appeal ladder is five levels fixed in law and regulation — redetermination, reconsideration, ALJ hearing, Medicare Appeals Council, judicial review — and it belongs to Chapter 30 §30.6, including the deadlines and the amount-in-controversy thresholds that adjust annually.

F.12 The annual payment rules, and site-neutral payment

Treat the annual rule as a recurring event on a calendar, not as a document you might read. The final rules are where weights, rates, and policy changes are published, together with the agency's reasoning in the preamble — which is frequently the only place a change is actually explained. Appendix A §A.1 has the whole update calendar; the short version is that MPFS, IPPS weights, and OPPS rates change annually by rule, ICD-10-CM changes October 1, CPT changes January 1, and HCPCS Level II and the NCCI files change quarterly.

Two structural facts the book teaches that make rulemaking legible:

OPPS is budget-neutral by law (Chapter 34 §34.2). When CMS moves money inside the system — raises one APC, packages one category — the annual rule offsets the change so aggregate spending stays on its statutory path. Inside a budget-neutral system, every winner is funded by everyone else, which is the quiet explanation for a large share of the policy fights in outpatient payment.

And a payment differential is a policy, renegotiated every year. Chapter 34's Case Study 1 is the book's worked example.

Site-neutral payment and BBA 2015 § 603

⚠️ A note on where this lives. The book teaches site-neutral payment and the 340B litigation in Chapter 34's two case studies, not in a numbered section. Cite them as case studies; §34.8 is where G0463, the code the policy turns on, is introduced.

Section 603 of the Bipartisan Budget Act of 2015, enacted November 2, 2015, drew a line by date through the provider-based payment differential. Off-campus provider-based departments not already billing under OPPS as of the date of enactment became non-excepted — paid under a different applicable payment system rather than under OPPS. Departments already billing under OPPS on that date were excepted, or grandfathered. On-campus departments were untouched, and dedicated emergency departments were carved out.

The whole statute arrives at a coder's desk as two HCPCS Level II modifiers: PO for an excepted service furnished at an off-campus provider-based department, PN for a non-excepted one. CMS later extended a site-neutral amount to the clinic visit (G0463) at excepted off-campus departments as well, invoking not § 603 but the OPPS statute's volume-control provision; the district court set that policy aside in 2019, the D.C. Circuit reversed in 2020, and the Supreme Court declined the case. The reduction stands. Chapter 34's Case Study 1 tells it from the documented record.

The 340B Drug Pricing Program, established by statute in 1992, requires participating drug manufacturers to offer discounted outpatient drugs to defined categories of covered entities. Medicare's payment rate for 340B-acquired drugs under OPPS was reduced in the CY 2018 OPPS final rule, litigated to the Supreme Court, and reversed — and the remedy, worked out in a later rulemaking, had to unwind both the underpayment to 340B hospitals and the budget-neutral overpayment everyone else had received. Chapter 34's Case Study 2 is that story, and the modifiers that carried it — JG and TB — are in the roster with a warning attached: the assignments were revised as the policy changed, and no one should present the current assignment as settled.

Both cases teach the same lesson: a national payment argument compresses into two characters on a claim line, the fact those characters assert is usually owned by somebody in operations rather than in coding, and the claim asserts an answer either way.

F.13 The audit-contractor architecture and the OIG Work Plan

   THE FEDERAL REVIEW ALPHABET      [structure; verify current program
                                     parameters at CMS — all of it moves]

   MAC    Medicare Administrative Contractor — processes your claims,
          issues local policy, effects most recoveries.  Ch. 3 §3.3

   TPE    Targeted Probe and Educate — a MAC PROGRAM, not an entity.
          Provider- and issue-specific; small probe samples with
          one-on-one education.  "The cheapest audit you will receive."

   RAC    Recovery Audit Contractor — paid a CONTINGENCY FEE. Post-
          payment; required to find UNDERPAYMENTS as well; issues are
          approved and POSTED IN ADVANCE.  Read your region's list.

   SMRC   Supplemental Medical Review Contractor — national, project-
          based, reviews what CMS directs.  DOES NOT RECOVER MONEY;
          refers findings to the MAC, which acts.

   CERT   Comprehensive Error Rate Testing — a MEASUREMENT program.
          Random national sample producing the improper payment rate.
          Selection means nothing about you; the sampled claim is
          still a claim.  An ERROR rate, not a fraud rate.

   UPIC   Unified Program Integrity Contractor — BENEFIT INTEGRITY:
          fraud, waste, abuse. Records, interviews, site visits,
          payment suspension, referral to law enforcement.
          ► A DIFFERENT CATEGORY OF EVENT.

Identify the sender before you respond. Chapter 37 §37.5's operating rule: a CERT request, a TPE probe, a RAC complex review, an SMRC project, and a UPIC contact call for four different documents and one phone call to counsel — and the letterhead tells you which. If you cannot tell, call and ask what program the request is under, and write the answer down.

Three things that belong in the picture precisely because they are not Medicare contractors (Chapter 37 §37.5):

• The OIG audits and evaluates rather than reviewing claim by claim, and its findings become industry-wide expectations. It also administers exclusion (§F.6) and the Self-Disclosure Protocol (§F.14).
• Commercial payers run their own review, under your contract, not under federal rules. A commercial special investigations unit derives its record-request rights, lookback period, recoupment mechanism, appeal path, and whether it may extrapolate at all from the participation agreement you signed, plus state law. The Program Integrity Manual does not govern it.
• Risk adjustment has its own audit — RADV, where diagnoses submitted for payment are checked against the record (Chapter 36 §36.8 owns chart review).

Extrapolation is the mechanism that turns an audit finding into a business event, and it has a statutory limit worth knowing by name: Social Security Act § 1893(f)(3) permits a Medicare contractor to extrapolate only on a determination of a sustained or high level of payment error, or where documented educational intervention has failed. Chapter 37 §37.6 works the arithmetic; §37.8's practical conclusion is that this is the first question a response letter should test.

The OIG Work Plan is the Office of Inspector General's published, continuously updated list of what it is currently examining — each item stating the issue, why it was opened, and an expected report date. Chapter 37 §37.2 treats it as a forecast and builds internal audit scope from it, which is the highest-yield twenty minutes a quarter available to a compliance function. The RAC's approved-issues list does the same job for your region.

F.14 The two disclosure protocols

The routing question is which door, and Chapter 37 §37.9 draws four:

Two facts about this table are the reason it is in an appendix at all.

Stark's strict liability is why it has a separate protocol. An ordinary refund does not resolve an arrangement that violates a statute with no intent element, and the SRDP exists because the ordinary route does not fit (§F.5).

And the routing decision is not a coder's to make. Chapter 37 §37.9 is unusually firm about this, and this appendix will not soften it: a coder or auditor who finds a pattern escalates it, in writing, with the evidence and the quantification, to the compliance officer. They do not call the payer, they do not characterize the conduct, and they do not decide which door. Writing down what you found and when you found it is the whole of your obligation, and it is not a small one.

Two things Chapter 37 §37.9 says that are worth reading twice. A refund is not an admission of fraud and a self-disclosure is not a confession — both are mechanisms the system provides on purpose, and treating an ordinary quantified overpayment as a catastrophe produces paralysis, then retention, then an obligation. And do not investigate a compliance question by asking the payer: a provider-services representative gives a spoken opinion with no authority behind it and creates a record you do not control.

F.15 The sub-regulatory layer — the documents a coder actually works from

Almost none of what governs your daily decisions is a statute, and this section is the honest version of that.

The honest note, and it is the most important paragraph in this appendix.

Sub-regulatory guidance is not law. A CMS manual, a policy manual chapter, a coverage article, and a payer's medical policy are not statutes and are not regulations, and the distinction is real — it matters in litigation, it matters on appeal, and it is a distinction lawyers argue about.

And it is nonetheless what a contractor applies to your claim. A reviewer working a Medicare record is reading the Program Integrity Manual. A reviewer deciding whether an injection was covered is reading the LCD and its article. A payer's medical director is reading that payer's policy. An appeal that argues on the reviewer's own ground — quoting the Policy Manual section that governs the edit, or the article that carries the diagnosis list — is arguing where the decision is actually made (Chapter 21 §21.5; Chapter 30 §30.4).

Both halves are true at once, and holding both is what separates a practitioner from a rule-follower. Know that guidance is not law, cite the guidance anyway because it is what will be applied, and when the gap between the two becomes the whole question — which happens, and it is what several of this book's case studies are about — that is a question for counsel, not for a coder.

One more property of this layer that is easy to miss: it is versioned, and the version in force on the date of service governs. Chapter 6 §6.6 makes the habit explicit — read the effective date and the revision history, every time. An appeal argued against the current version of a policy, for a service furnished under a prior version, loses.

F.16 The whole appendix on one page

F.17 How to look any of this up

Everything on the federal side of this appendix is free. That is worth stating plainly, because the assumption that legal and regulatory material sits behind a paywall is what keeps people from looking. The only thing between a coder and the primary source is usually the habit.

The discipline, in four rules

Cite the current text, and cite it as of a date. Chapter 22 §22.5's lookup and Chapter 6 §6.6's search technique both end in the same place: read the effective date and the revision history. The version in force on the date of service governs, not the one on your screen.

Never quote a textbook back to a payer or a reviewer — including this one. Appendix E §E.12 makes the point about code lists and it is truer here: every plain-language rendering in this appendix is a teaching paraphrase, written to be understood rather than to be operative.

Never quote a penalty amount from memory. They are indexed and they change by rule. If a number matters enough to say out loud, it matters enough to look up.

And know where the boundary is. This appendix ends where the questions get interesting. Is this arrangement all right? Do we have to report this? May we bill this patient? Does our state's law change the answer? — those are legal questions, and the answer to every one of them is the same: your compliance officer, the primary source, and counsel. Chapter 5 §5.9 gives the sequence for the day you need it; the discipline in Chapter 6 §6.10 — look it up, every time, and be able to explain the path you took two years later to a stranger — is the same discipline that makes this appendix usable rather than reassuring.