Medicare, Medicaid, and commercial coding and billing requirements
Which written rule controls this claim when the manual, the contract, and a phone call disagree.
ReadRegulatory Guidance
Medicare, Medicaid, commercial payor, and HIPAA requirements applied to daily operations.
The rule count in healthcare is not the hard part. The hard part is knowing which rule applies to this claim, this disclosure, or this OCR letter. The firm translates that pile into the next action.
Reviewed by Joseph Rivet · September 29, 2026
The Challenge
CMS text versus payor folklore
Staff often follow a payor’s phone advice or a clearinghouse edit as if it were the manual. When those sources disagree, the written CMS or contract language is what a reviewer will use.
Compliance audits and compliance plans
A plan with an owner and a last-used date, not a binder that no one opens.
Learn moreHIPAA policy review, education, and legal analysis
Privacy rules applied to the systems this organization actually uses.
ReadOffice for Civil Rights inquiries and audits
The timeline and the original record, starting the day the letter arrives.
Read
Who We Help
Who this work is for
Guidance is written by counsel who has implemented the same Medicare, Medicaid, and HIPAA requirements on the operations side. The output is a decision the billing or privacy lead can use, not a restatement of the Federal Register.
- Privacy officers facing an OCR inquiry
- Groups adapting to a new CMS final rule
- Practices unsure whether a state law or a payor policy controls
- Leaders who need a plain-language read before they change a workflow
Our Process
First steps you can take today
These steps organize the file. They are not a substitute for counsel.
- 1
Write the question in one sentence: what decision do you need to make this week?
- 2
Collect the statute or manual page, the payor policy, and the internal procedure that conflict.
- 3
If this is an OCR or patient-access issue, start the timeline the same day.
- 4
Do not amend the record until someone has preserved the original.
CMS text versus payor folklore
Staff often follow a payor’s phone advice or a clearinghouse edit as if it were the manual. When those sources disagree, the written CMS or contract language is what a reviewer will use.
Proposed rules are useful for planning. They are not authority to change billing today. The firm will say which is which.
HIPAA as an operation, not a poster
Most OCR files start with a delayed response, a business associate no one listed, or access that was not logged. The first week after a complaint is about the timeline and the complete record of what happened.
Training that names the systems this clinic actually uses is worth more than a generic video. That is a regulatory point and an operations point.
Common questions
- Is payor policy the same as Medicare law?
- No. A commercial policy can be stricter than CMS, or simply wrong. The analysis names the source and which one controls for that claim.
- What should we do the day an OCR letter arrives?
- Preserve the file, calendar the deadline, and stop informal email about the incident. Then build a timeline. The checklist on this page is the first pass.
800 E. Ellis Road, Ste 515, Norton Shores, MI 49441
(231) 799-4870
info@rivethealthlaw.com
rivethealthlaw.com
+
OCR week-one
7 itemsIf a privacy letter just arrived
Work top to bottom. This is preservation and intake, not the response itself.
Check items off as you collect them. Your progress is saved on this device.
This sheet is a gather list for your own file. It is not legal advice.
When you want help
Bring the letter, the remittance, or the agreement.
If the first steps on this page raised a question, the firm can sit with the file.
This page is educational. It is not legal advice and does not create an attorney-client relationship. Facts, contracts, and appeal windows control the next step.