| Course | HCR 363 Risk Management, Auditing and Monitoring for Health Care Compliance |
|---|---|
| Module | Module 6 |
| Paper type | Root cause analysis |
| Length | About 708 words, 5 pages |
| Format | APA 7 student paper |
| School | Arizona State University |
| Program | BS in Health Care Compliance and Regulations |
| Updated | October 2026 |
Free sample paper for HCR 363 Module 6
Asking Why Five Times: Root Causes of Sonoran Ridge Health's Five Highest-Ranked Billing Risks
Student Name
BS in Health Care Compliance and Regulations, Arizona State University
HCR 363: Risk Management, Auditing and Monitoring for Health Care Compliance
Instructor Name
Month Day, Year
Asking Why Five Times: Root Causes of Sonoran Ridge Health's Five Highest-Ranked Billing Risks
Purpose and Method
The Evaluate and Rank tab of Sonoran Ridge Health's risk workbook ranked 22 risks by likelihood and impact. This analysis takes the five highest and asks why each occurs, repeating the question until the answer is a systemic cause: a process, policy, structure or incentive that management can change. A chain stops early if the answer reaches such a cause before the fifth why, and it continues past five if needed. The goal is to find causes that, once fixed, prevent the risk rather than catch it after the fact, which is what federal guidance expects of a program's response to problems (Office of Inspector General [OIG], 2023).
Risk 1: Clinic E/M Levels Not Supported by Documentation
1. Why are E/M levels unsupported? Physicians select levels that their notes do not justify under the 2021 office visit guidelines.
2. Why? Many physicians still choose levels by habit from the old history-and-exam rules.
3. Why? Training on the 2021 guidelines was a single online module in 2021, and new physicians since then have had none.
4. Why? Coding education is not part of physician onboarding or annual requirements.
5. Why? No one owns provider coding education; coding staff train coders, and medical staff leaders assume compliance does it.
Root cause: no assigned owner and no recurring program for provider documentation education.
Risk 2: Surgery Center Claims Unbundling Procedures
1. Why are procedures unbundled? Modifier 59 is appended to override edits for procedures that should be billed together.
2. Why? Coders add the modifier when a claim scrubber rejects the pair.
3. Why? The scrubber's rejections slow claims, and coders are measured on claims completed per hour.
4. Why? The ASC's productivity standard was set without a quality measure.
Root cause: an incentive that rewards speed over accuracy, with no quality check on modifier use.
Risk 3: Medicare Credit Balances Older Than 60 Days
1. Why are credit balances aging past the 60-day refund deadline (42 C.F.R. § 401.305)? Refunds are not processed until a supervisor reviews them.
2. Why? Only one supervisor has authority to approve refunds across all three settings.
3. Why? The refund policy was written when the system had one hospital and was never updated.
4. Why? Policies are reviewed only when a regulator raises a problem.
5. Why? The organization has no policy review calendar.
Root cause: outdated refund authority and no schedule for reviewing billing policies.
Risk 4: Billing for Referrals Under Expired Physician Agreements
1. Why are claims billed under expired agreements? Billing does not know when agreements expire.
2. Why? Contracts are tracked in a legal department spreadsheet that billing cannot see.
3. Why? Contract management and billing use separate systems with no link.
4. Why? No process connects contract status to billing or to physician credentialing.
Root cause: no integrated contract management process shared by legal, billing and the medical staff office.
Risk 5: Billing Staff Access Not Removed at Role Changes
1. Why do former billing staff keep record access? Access is removed only when someone leaves the organization.
2. Why? Human resources notifies IT of terminations but not of transfers.
3. Why? The access procedure covers termination only.
4. Why? The procedure was written to meet the HIPAA termination requirement (45 C.F.R. § 164.308), and transfers were overlooked.
5. Why? Policies are reviewed only when a regulator raises a problem.
Root cause: an access procedure limited to terminations, maintained without a policy review calendar.
Patterns Across the Five Chains
Two systemic problems explain four of the five risks: no one owns processes that cross departments, and policies are updated only after a regulator complains. Fixing those two problems would reduce several risks at once, which is the advantage of root cause analysis over treating each risk separately. The mitigation planning in Assignment 7 will start with them.
| Risk | Root cause | Shared cause |
|---|---|---|
| Unsupported E/M levels | No owner for provider coding education | Ownership gap |
| ASC unbundling | Productivity incentive with no quality measure | Incentive design |
| Aging credit balances | Outdated refund authority | No policy review calendar |
| Expired agreements | No integrated contract process | Ownership gap |
| Access at role changes | Termination-only access procedure | No policy review calendar |
References
Office of Inspector General. (2023). General compliance program guidance. U.S. Department of Health and Human Services. https://oig.hhs.gov/documents/compliance-guidance/1135/HHS-OIG-GCPG-2023.pdf
Reporting and returning of overpayments, 42 C.F.R. § 401.305 (2024).
Security standards: Administrative safeguards, 45 C.F.R. § 164.308 (2024).
HCR 363 Module 6 instructions, in plain terms
Assignment 6 comes in Week 5 of HCR 363, after the risk assessment exam and the workbook tabs where you identified, analyzed, evaluated and ranked your risks. The syllabus asks you to identify your top five risks and analyze each to its systemic root cause using the Five Whys technique, in which each answer becomes the next question until the chain lands on something the organization's own systems produce. The key word is systemic. An answer such as "the coder made a mistake" or "the physician did not document" is a symptom; the root cause is the process, policy, incentive or ownership gap that made the mistake likely. Your five risks should come straight from your Evaluate and Rank tab, so the analysis continues the same organization and data you have been building since Assignment 1. It is worth 65 points.
How this HCR 363 Module 6 example is built
The sample states where the five risks come from and how the method will be applied, including when a chain may stop before the fifth why. Each risk then gets its own numbered chain, written as question and answer, and ends with a one-line root cause in bold terms a manager could act on. The chains stay specific to the organization's settings: clinic physicians, surgery center coders, a refund approver, a legal spreadsheet and an access procedure. A final table lists all five root causes side by side and identifies shared causes, and a short paragraph explains why fixing two systemic problems would reduce four of the five risks, which sets up the mitigation work in the next assignment.
HCR 363 Module 6 rubric: what earns full marks
Canvas scores Assignment 6 out of 65 points. Readers give credit when the five risks match the student's own ranked list, when each chain moves logically from symptom to cause with every answer explaining the one before it, when the root causes are systemic and within management's control, when the analysis stays specific to the organization's settings and when patterns across the five risks are noticed. Points are lost when chains stop at individual blame, when answers jump without explaining the link, when the same generic cause, such as "lack of training," is given for every risk without evidence, and when the risks come from nowhere rather than the workbook. Graders often reward analysis that finds a shared cause, because that is where a compliance program gets the most return on its effort.
HCR 363 Module 6 help from the desk
Pull your top five risks from the Evaluate and Rank tab before writing. For each, write the first why as a plain description of what happens. Make every answer explain the answer above it, and test the chain by reading it backward with "therefore." Stop when you reach a cause management can change, even before five. Avoid blaming a person; ask why the system let that person make the error. Put all five root causes in one table and look for overlaps. If a chain keeps ending in "training," ask why training was missing. The desk can review a chain that feels stuck.
Write yours, or have the desk draft it
This paper is an original model document written by our desk, not a submitted student paper and not an official Arizona State University document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.
More HCR 363 and BS in Health Care Compliance and Regulations sample papers
- HCR 363 Module 1: Assignment 1: Risk Assessment Pre-Work
- HCR 363 Module 2: Assignment 2: Compliance Risk Assessment Survey
- HCR 363 Module 7: Assignment 7: Auditing, Monitoring and Mitigation Planning
- HCR 363 Module 8: Assignment 8: Audit Plan From the OIG Work Plan
- HCR 264 Module 1: Short Topical Paper: Element 5, Enforcing Standards
- HCR 262 Module 1: Writing Assignment 1: Licensure Scenario and Work Plan
- HCR 350 Module 1: Paper 1: The NIH Website and the Clinical Research Field
HCR 363 Module 6 questions, answered
Where can I find a free HCR 363 Module 6 sample paper?
Above on this page: a full Five Whys analysis of five ranked billing risks in a hospital, clinic and surgery center system.
What is the Five Whys technique?
Name the problem, question its cause, then question the cause of that cause, and keep going until you stop at a cause built into the way the organization works.
What counts as a systemic root cause?
A process, policy, incentive or ownership gap that management can change, rather than one person's error.
Do you always ask why exactly five times?
No. Stop when you reach a systemic cause; five is a guide, not a rule.
Where do the top five risks in HCR 363 come from?
From your own Evaluate and Rank tab in the mock workbook built in Assignments 4 and 5.