Healthcare Compliance · Regulatory · Reference
Plain-language definitions of the federal compliance and regulatory terms that arise in healthcare matters. Each entry is grounded in primary authority, with a link to the governing statute, regulation, or agency source.
A voluntary evaluation in which an independent organization assesses a health care facility against published quality and safety standards. Accreditation by a CMS-approved body such as The Joint Commission can confer deemed status, meaning the facility is treated as meeting Medicare Conditions of Participation without a separate state survey.
Primary source: CMS / Social Security Act § 1865 (42 U.S.C. § 1395bb)
A written notice a provider gives a Medicare beneficiary before furnishing an item or service that Medicare is expected to deny as not reasonable and necessary. A valid ABN shifts financial liability to the patient and lets the patient decide whether to proceed and pay out of pocket. Without a proper ABN, the provider generally cannot bill the patient for the denied service.
Primary source: CMS / Social Security Act § 1879 (42 U.S.C. § 1395pp)
The mandatory process of reporting unfavorable medical occurrences associated with a drug, biologic, or device to the FDA. Drug and biologic sponsors report under postmarketing safety rules, device manufacturers and facilities report through Medical Device Reporting, and clinicians and patients can submit voluntary reports through FDA MedWatch. Reports support FDA safety surveillance and signal detection.
Primary source: FDA, 21 CFR 314.80 (drugs), 21 CFR Part 803 (device MDR)
A federal criminal law that prohibits knowingly and willfully offering, paying, soliciting, or receiving any remuneration to induce or reward referrals of items or services reimbursable by a federal health care program. Intent matters but is broadly construed: if even one purpose of a payment is to induce referrals, the statute is violated. Conviction is a felony, with penalties of up to a $100,000 fine and up to 10 years in prison per violation following the Bipartisan Budget Act of 2018.
Primary source: 42 U.S.C. § 1320a-7b(b) (Social Security Act § 1128B(b))
A civil prohibition, enforced through the Civil Monetary Penalties Law, against offering or giving remuneration to a Medicare or Medicaid beneficiary that the offeror knows or should know is likely to influence the beneficiary's choice of a particular provider, practitioner, or supplier. Statutory exceptions and a promotes-access-to-care exception narrow its reach.
Primary source: OIG / 42 U.S.C. § 1320a-7a(a)(5)
An OSHA standard that protects workers with reasonably anticipated exposure to blood or other potentially infectious materials. It requires an exposure control plan, engineering and work-practice controls, free hepatitis B vaccination, personal protective equipment, post-exposure evaluation, and training.
Primary source: OSHA, 29 CFR 1910.1030
The HIPAA rule requiring covered entities and business associates to notify affected individuals, the HHS Secretary, and in some cases the media after a breach of unsecured protected health information. Individual notice must be made without unreasonable delay and no later than 60 days from discovery. Breaches affecting 500 or more individuals trigger contemporaneous media and HHS notice; smaller breaches are logged and reported to HHS annually.
Primary source: HHS Office for Civil Rights, 45 CFR 164.400–414
A person or entity that creates, receives, maintains, or transmits protected health information to perform a function or service on behalf of a HIPAA covered entity, such as billing, claims processing, data analysis, or cloud storage. Business associates are directly liable for compliance with applicable HIPAA Privacy and Security Rule provisions.
Primary source: HHS Office for Civil Rights, 45 CFR 160.103
A written contract required by HIPAA between a covered entity and a business associate (or between business associates) that establishes the permitted uses and disclosures of protected health information and obligates the business associate to safeguard the information and report breaches. A missing or deficient BAA is itself a HIPAA violation.
Primary source: HHS Office for Civil Rights, 45 CFR 164.502(e), 164.504(e)
The agency within the U.S. Department of Health and Human Services that administers Medicare, works with states on Medicaid and the Children's Health Insurance Program, sets and enforces Conditions of Participation, and operates much of the federal payment and quality-reporting infrastructure for health care.
Primary source: U.S. Department of Health and Human Services
A federal law authorizing the HHS Office of Inspector General to impose administrative money penalties, assessments, and program exclusion for a wide range of conduct, including submitting false or fraudulent claims, violating the Anti-Kickback Statute, and improperly inducing beneficiaries. Penalty amounts are set by statute and adjusted annually for inflation.
Primary source: OIG, 42 U.S.C. § 1320a-7a
Federal standards governing all laboratory testing performed on humans in the United States, except certain research. CLIA establishes certification, personnel, quality, and proficiency requirements scaled to test complexity (waived, moderate, or high). CMS administers the program with FDA categorizing tests by complexity.
Primary source: CMS, 42 U.S.C. § 263a; 42 CFR Part 493
An organized set of internal controls a health care organization adopts to prevent, detect, and correct legal and regulatory violations. OIG guidance identifies seven core elements: written standards and policies, a designated compliance officer and committee, effective training, open lines of communication, internal auditing and monitoring, enforcement through disciplinary standards, and prompt corrective action. An effective program is a recognized factor in enforcement and sentencing decisions.
Primary source: HHS Office of Inspector General
The health and safety standards that hospitals and other providers must meet to participate in and receive payment from Medicare and Medicaid. They cover areas such as governance, medical staff, patient rights, infection control, and quality assessment, and are enforced through survey and certification.
Primary source: CMS, 42 CFR Part 482 (hospitals)
A negotiated settlement document the HHS Office of Inspector General enters with a provider or entity, typically to resolve False Claims Act allegations, in exchange for the provider's continued participation in federal health care programs. A CIA imposes multi-year compliance obligations such as independent review, training, reporting, and OIG oversight, usually running five years.
Primary source: HHS Office of Inspector General
Under HIPAA, a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction. Covered entities bear primary responsibility for compliance with the HIPAA Privacy, Security, and Breach Notification Rules.
Primary source: HHS Office for Civil Rights, 45 CFR 160.103
The systematic process by which a health care organization or payer verifies a practitioner's education, training, licensure, certification, work history, and other qualifications before granting participation or network status. Credentialing relies on primary source verification and is a baseline patient-safety and liability control.
Primary source: CMS Conditions of Participation, 42 CFR 482.22; NCQA / The Joint Commission standards
FDA-enforced minimum standards for the methods, facilities, and controls used in manufacturing, processing, and packaging a drug, biologic, or device to assure identity, strength, quality, and purity. Failure to follow cGMP can render a product adulterated as a matter of law, independent of any demonstrated defect.
Primary source: FDA, 21 CFR Parts 210–211 (drugs); 21 CFR Parts 600–680 (biologics); 21 CFR Part 820 (devices)
The HIPAA process of removing identifiers so health information no longer identifies an individual and is no longer protected health information. HIPAA recognizes two methods: Expert Determination, in which a qualified statistician certifies very small re-identification risk, and Safe Harbor, which requires removal of 18 specified identifier categories.
Primary source: HHS Office for Civil Rights, 45 CFR 164.514(a)–(b)
An arrangement in which a health plan or organization formally delegates credentialing activities to another entity, such as a hospital or credentials verification organization, while retaining oversight responsibility. The delegating party remains accountable and must audit the delegate against recognized standards.
Primary source: NCQA credentialing standards
The categories of services to which the Stark Law's referral prohibition applies, including clinical laboratory services, imaging, physical and occupational therapy, durable medical equipment, home health, outpatient prescription drugs, and inpatient and outpatient hospital services. CMS publishes an annual code list identifying the specific services.
Primary source: CMS, 42 CFR 411.351
Protected health information that a covered entity or business associate creates, receives, maintains, or transmits in electronic form. ePHI is the specific subject of the HIPAA Security Rule, which requires administrative, physical, and technical safeguards.
Primary source: HHS Office for Civil Rights, 45 CFR 160.103
A federal criminal law enacted in 2018 that prohibits knowingly and willfully paying or receiving remuneration to induce referrals to recovery homes, clinical treatment facilities, and laboratories. Unlike the Anti-Kickback Statute, EKRA reaches services paid by private insurers as well as federal programs, and its exceptions do not mirror AKS safe harbors.
Primary source: 18 U.S.C. § 220
A federal law requiring Medicare-participating hospitals with emergency departments to provide a medical screening examination to anyone who comes seeking care, and to stabilize or appropriately transfer any individual with an emergency medical condition or in active labor, regardless of ability to pay. Violations can trigger civil monetary penalties and termination from Medicare.
Primary source: 42 U.S.C. § 1395dd; 42 CFR 489.24
An OIG action barring an individual or entity from participation in all federal health care programs, meaning no program will pay for items or services they furnish, order, or prescribe. Mandatory exclusions follow certain convictions; permissive exclusions are discretionary. Excluded parties are listed in the List of Excluded Individuals/Entities (LEIE), which providers must screen against.
Primary source: OIG, 42 U.S.C. § 1320a-7 (Social Security Act § 1128)
The ongoing verification that employees, contractors, vendors, and ordering practitioners are not excluded from federal health care programs, performed by checking the OIG LEIE and the System for Award Management. Employing or contracting with an excluded person can expose an organization to civil monetary penalties and overpayment liability.
Primary source: HHS Office of Inspector General
The federal government's primary civil fraud enforcement tool, imposing liability on anyone who knowingly submits, or causes the submission of, false or fraudulent claims for government payment. Liability includes treble damages plus per-claim penalties adjusted annually for inflation. Knowledge includes actual knowledge, deliberate ignorance, and reckless disregard; specific intent to defraud is not required.
Primary source: U.S. Department of Justice, 31 U.S.C. §§ 3729–3733
The agency within HHS responsible for protecting public health by regulating the safety and effectiveness of drugs, biologics, medical devices, food, cosmetics, and tobacco products. FDA authority derives chiefly from the Federal Food, Drug, and Cosmetic Act and, for biologics, the Public Health Service Act.
Primary source: FDA, Federal Food, Drug, and Cosmetic Act (21 U.S.C. § 301 et seq.)
An international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials involving human subjects. GCP protects subject rights, safety, and well-being and assures data credibility. In the United States it is operationalized through FDA regulations on investigational studies, IRBs, and informed consent, and through the ICH E6 guideline.
Primary source: FDA, 21 CFR Parts 50, 56, 312; ICH E6(R2)
An OSHA standard requiring that the hazards of chemicals in the workplace be classified and communicated to workers through labels, safety data sheets, and training. It is aligned with the Globally Harmonized System of Classification and Labeling of Chemicals.
Primary source: OSHA, 29 CFR 1910.1200
A federal law that grants qualified immunity from money damages to participants in professional peer review actions that meet statutory due-process and good-faith standards, and that established the National Practitioner Data Bank. It is intended to encourage effective peer review while protecting reviewers who act properly.
Primary source: 42 U.S.C. §§ 11101–11152
A 2009 law, enacted as part of the American Recovery and Reinvestment Act, that promoted adoption of electronic health records and strengthened HIPAA by extending direct liability to business associates, creating the Breach Notification Rule, and increasing penalty tiers and enforcement.
Primary source: Title XIII of ARRA, Pub. L. 111-5 (2009)
The 1996 federal law that, among other things, established national standards to protect the privacy and security of individually identifiable health information and to set transaction and identifier standards. Its privacy and security protections are implemented through HHS rules at 45 CFR Parts 160, 162, and 164.
Primary source: Pub. L. 104-191; 45 CFR Parts 160, 162, 164
The HIPAA standards governing the use and disclosure of protected health information by covered entities and business associates, and granting individuals rights over their information, including rights of access, amendment, and an accounting of disclosures. Disclosures generally require authorization unless an exception applies.
Primary source: HHS Office for Civil Rights, 45 CFR Part 164, Subpart E
The HIPAA standards requiring covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information. A documented risk analysis and risk management process are foundational requirements.
Primary source: HHS Office for Civil Rights, 45 CFR Part 164, Subpart C
A practice by a health care provider, developer of certified health IT, or health information network that is likely to interfere with the access, exchange, or use of electronic health information, except as required by law or covered by a defined exception. The 21st Century Cures Act prohibits information blocking and authorizes penalties and disincentives.
Primary source: ONC, 21st Century Cures Act § 4004 (42 U.S.C. § 300jj-52); 45 CFR Part 171
The legal and ethical requirement that a person voluntarily agree to treatment or research participation after receiving adequate information about the nature, risks, benefits, and alternatives. In FDA-regulated research, the required elements and documentation of consent are prescribed by regulation; the clinical-treatment duty is governed primarily by state law.
Primary source: FDA, 21 CFR Part 50; Common Rule, 45 CFR 46.116
A formally designated committee that reviews, approves, and monitors biomedical and behavioral research involving human subjects to protect their rights and welfare. An IRB has authority to approve, require modification of, or disapprove research and must operate under federal regulations governing membership, review procedures, and recordkeeping.
Primary source: FDA, 21 CFR Part 56; Common Rule, 45 CFR Part 46
The submission a sponsor must have in effect with the FDA before administering an investigational drug or biologic to humans, allowing the product to be shipped across state lines for clinical study. An IND contains animal pharmacology and toxicology data, manufacturing information, and clinical protocols, and takes effect 30 days after submission unless FDA places a clinical hold.
Primary source: FDA, 21 CFR Part 312
The standard, central to Medicare and most payer coverage, that an item or service must be reasonable and necessary for the diagnosis or treatment of illness or injury to be covered. Services that are not medically necessary are not payable, and billing for them can give rise to overpayment and False Claims Act exposure.
Primary source: CMS / Social Security Act § 1862(a)(1)(A) (42 U.S.C. § 1395y(a)(1)(A))
The HIPAA Privacy Rule principle that a covered entity must make reasonable efforts to limit the use, disclosure of, and requests for protected health information to the minimum necessary to accomplish the intended purpose. Certain disclosures, such as those for treatment or to the individual, are exempt.
Primary source: HHS Office for Civil Rights, 45 CFR 164.502(b), 164.514(d)
A federal repository, established under HCQIA, that collects and discloses certain information on health care practitioners, including medical malpractice payments, adverse licensure and clinical-privilege actions, and certain other actions. Hospitals must query it during credentialing and re-privileging, and eligible entities must report qualifying actions.
Primary source: HRSA, 42 U.S.C. § 11101 et seq.; 45 CFR Part 60
The document a HIPAA covered entity must provide describing how it may use and disclose protected health information, the individual's rights, and the entity's legal duties with respect to that information. Direct treatment providers must make a good-faith effort to obtain written acknowledgment of receipt.
Primary source: HHS Office for Civil Rights, 45 CFR 164.520
The agency within the U.S. Department of Labor that sets and enforces workplace safety and health standards. In health care, OSHA standards on bloodborne pathogens, hazard communication, personal protective equipment, and respiratory protection are frequently implicated, alongside the general duty to provide a workplace free of recognized hazards.
Primary source: Occupational Safety and Health Act of 1970 (29 U.S.C. § 651 et seq.)
The office within HHS that enforces the HIPAA Privacy, Security, and Breach Notification Rules and certain federal civil rights laws in health and human services. OCR investigates complaints, conducts compliance reviews, and can impose civil monetary penalties or negotiate resolution agreements.
Primary source: U.S. Department of Health and Human Services
The HHS component charged with protecting the integrity of departmental programs through audits, evaluations, investigations, and enforcement. OIG administers program exclusions, imposes civil monetary penalties, issues advisory opinions and compliance guidance, and refers criminal matters, with a particular focus on Medicare and Medicaid fraud and abuse.
Primary source: HHS Office of Inspector General, Inspector General Act of 1978
The HHS office, now operating as the Assistant Secretary for Technology Policy/ONC, responsible for coordinating nationwide health information technology policy, running the health IT certification program, and implementing interoperability and information-blocking rules under the 21st Century Cures Act.
Primary source: U.S. Department of Health and Human Services
A federal transparency program requiring applicable manufacturers of drugs, devices, biologics, and medical supplies to report payments and transfers of value to physicians and teaching hospitals, and certain ownership interests, which CMS publishes in a public database. It is intended to expose potential conflicts of interest.
Primary source: CMS, 42 U.S.C. § 1320a-7h; 42 CFR Part 403, Subpart I
The requirement that a person who has received an overpayment from Medicare or Medicaid report and return it within 60 days of identifying it, or by the date a corresponding cost report is due. Retaining an identified overpayment beyond the deadline is a reverse false claim and can create False Claims Act liability.
Primary source: CMS / Affordable Care Act § 6402 (42 U.S.C. § 1320a-7k(d)); 42 CFR 401.305
The structured evaluation of a practitioner's clinical performance by qualified colleagues, used to make credentialing, privileging, and corrective-action decisions and to improve quality. Qualified peer review actions that meet HCQIA standards carry immunity from money damages, and peer review records are protected from discovery under many state laws.
Primary source: 42 U.S.C. §§ 11101–11152 (HCQIA)
Equipment worn to minimize exposure to hazards, including gloves, gowns, masks, respirators, and eye protection. OSHA requires employers to assess hazards, provide appropriate PPE, and train workers in its use; in health care, PPE requirements intersect with the bloodborne pathogens standard.
Primary source: OSHA, 29 CFR 1910.132; 29 CFR 1910.1030
The most stringent FDA device-marketing pathway, required for most Class III devices that support or sustain life or present a potential unreasonable risk of illness or injury. PMA requires the applicant to submit valid scientific evidence, typically including clinical data, demonstrating reasonable assurance of safety and effectiveness.
Primary source: FDA, FD&C Act § 515 (21 U.S.C. § 360e); 21 CFR Part 814
An FDA submission demonstrating that a device is substantially equivalent to a legally marketed predicate device, used to clear most moderate-risk (Class II) devices for marketing. Clearance under 510(k) is not the same as PMA approval and does not by itself establish safety and effectiveness through clinical trials.
Primary source: FDA, FD&C Act § 510(k) (21 U.S.C. § 360(k)); 21 CFR Part 807, Subpart E
Verification of a practitioner's reported credentials directly with the original issuing source, such as a medical school, licensing board, or certifying body, rather than relying on copies supplied by the applicant. PSV is a core requirement of credentialing under accreditation standards.
Primary source: The Joint Commission / NCQA credentialing standards
The process by which a health care organization authorizes a credentialed practitioner to perform specific procedures or provide specific services within the organization, based on demonstrated competence. Privileging decisions are distinct from credentialing and are typically granted and renewed by the governing body on recommendation of the medical staff.
Primary source: CMS Conditions of Participation, 42 CFR 482.22
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form, that relates to a person's health condition, care, or payment for care. PHI is the information HIPAA's Privacy and Security Rules protect; de-identified information falls outside the definition.
Primary source: HHS Office for Civil Rights, 45 CFR 160.103
The provision under which a biological product is licensed by the FDA through a Biologics License Application upon a showing that it is safe, pure, and potent and that the manufacturing facility meets standards. A 351(a) license is the principal lawful pathway to market for most biologics, including many cell and gene therapy products.
Primary source: FDA, PHS Act § 351 (42 U.S.C. § 262)
The authority under which the FDA regulates certain human cells, tissues, and cellular and tissue-based products solely to prevent the transmission of communicable disease, without requiring premarket approval. A product qualifies for this lighter pathway only if it meets all of the 21 CFR 1271.10 criteria, including minimal manipulation and homologous use; products that fall outside those criteria are regulated as drugs, devices, or biologics.
Primary source: FDA, PHS Act § 361 (42 U.S.C. § 264); 21 CFR Part 1271
A provision of the False Claims Act that allows a private person, called a relator, to file a fraud suit on behalf of the United States and to share in any recovery. The government may intervene and take over the action. Qui tam suits are the source of a large share of federal health care fraud recoveries and carry anti-retaliation protection for whistleblowers.
Primary source: U.S. Department of Justice, 31 U.S.C. § 3730(b)
The periodic re-verification of a practitioner's credentials and continued qualification for participation or privileges, generally conducted at least every three years under accreditation standards. It confirms current licensure, certification, competence, and the absence of new adverse actions or exclusions.
Primary source: NCQA / The Joint Commission credentialing standards
The accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information that the HIPAA Security Rule requires as a foundational, ongoing administrative safeguard. A deficient or missing risk analysis is among the most frequently cited findings in OCR enforcement.
Primary source: HHS Office for Civil Rights, 45 CFR 164.308(a)(1)(ii)(A)
One of the regulatory provisions that immunize specified payment and business arrangements from Anti-Kickback Statute liability when every condition is met. Safe harbor protection is all-or-nothing: an arrangement that fails to satisfy each element of a safe harbor is not automatically illegal but receives no protection and is judged on the facts and intent.
Primary source: OIG, 42 CFR 1001.952
A standardized document, required under OSHA's Hazard Communication Standard, that a chemical manufacturer or importer must provide describing a hazardous chemical's properties, hazards, handling, storage, exposure controls, and emergency measures. Employers must keep SDSs accessible to workers.
Primary source: OSHA, 29 CFR 1910.1200(g)
The voluntary reporting of potential fraud or regulatory violations to the government, which can reduce penalties and demonstrate good faith. The OIG Self-Disclosure Protocol covers conduct implicating fraud and abuse authorities, while the CMS Self-Referral Disclosure Protocol covers actual or potential Stark Law violations.
Primary source: OIG Self-Disclosure Protocol; CMS SRDP (Affordable Care Act § 6409)
A federal law prohibiting a physician from referring Medicare patients for designated health services to an entity with which the physician or an immediate family member has a financial relationship, unless an exception applies, and barring the entity from billing for those referred services. Stark is a strict-liability statute: a violation does not require proof of intent, and every element of an exception must be met.
Primary source: CMS, 42 U.S.C. § 1395nn; 42 CFR 411.350–411.389
Federal regulations that impose heightened confidentiality protection on records of patients treated by federally assisted substance use disorder programs, generally restricting disclosure without specific patient consent more tightly than HIPAA. The rules have been amended to better align consent and enforcement with HIPAA while preserving core protections.
Primary source: SAMHSA, 42 U.S.C. § 290dd-2; 42 CFR Part 2
The body of requirements governing remotely furnished health care, spanning Medicare and Medicaid coverage and billing conditions, state licensure and practice standards, prescribing limits, privacy and security of the technology used, and fraud and abuse rules. Coverage flexibilities have shifted substantially over time and require checking current CMS policy.
Primary source: CMS
The cabinet-level federal department responsible for protecting the health of Americans and administering health and human services programs. Its divisions include CMS, FDA, CDC, HRSA, OCR, and OIG, which together set and enforce most federal health care regulation.
Primary source: U.S. Department of Health and Human Services
Billing separately for procedures or services that should be reported and paid under a single comprehensive code, in order to increase reimbursement. CMS's National Correct Coding Initiative defines code pairs that should not be billed separately, and unbundling can give rise to overpayment and False Claims Act liability.
Primary source: CMS National Correct Coding Initiative
Assigning a billing code that reflects a more severe diagnosis or a more extensive or costly service than was actually documented or provided, resulting in higher reimbursement than warranted. Upcoding is a common theory of False Claims Act and Civil Monetary Penalties Law liability.
Primary source: U.S. Department of Justice / OIG, enforced under 31 U.S.C. § 3729 and 42 U.S.C. § 1320a-7a
This glossary is general educational information, not legal advice, and does not create any attorney-client or expert engagement. Statutory citations and agency authorities are provided for reference; penalty amounts and regulatory details change over time and should be confirmed against the current statute, regulation, or agency guidance for any specific matter.