With the release of the CIA changes within the General Compliance Program Guidance (GCPG), the OIG has officially moved the goal posts. This isn’t just a new set of rules for organizations under investigation. 

The May 2026 update to the Corporate Integrity Agreement (CIA) framework signals a definitive shift from passive reporting to active governance. Compliance is no longer an administrative sub-function. It’s now a board-level strategic imperative. 

The OIG’s Modernized CIA: Your New Compliance North Star 

Whether you’re a leader in an acute care organization, or in a non-acute care market like home health, ASCs, labs, or behavioral health, these updates represent your new “North Star.”  

This blog offers a roadmap to navigating the four pillars of this modernized framework. 

• Pillar 1: The Board’s Mandatory Compliance Partner 
• Pillar 2: Catching Every Whisper in the “Any Modality” Net 
• Pillar 3: Technological Accountability and the IT Governance Mandate 
• Pillar 4: The Elevated (and Independent) Compliance Officer 

Pillar 1: The Board’s Mandatory Compliance Partner 

What does the OIG’s mandatory independent board compliance expert requirement mean for healthcare leadership? 

For years, boards could fulfill their oversight duties by simply reviewing a quarterly slide deck. Those days are over. The OIG now requires the appointment of an independent compliance expert with federal healthcare program experience to review program effectiveness and report findings directly to the board. 

An expert is only as effective as the data they have to work with. To be truly “audit-ready,” your organization needs a living, centralized record of every regulatory change and the specific actions taken in response. Without this “evidence engine,” an independent expert will spend hundreds of billable hours just trying to find the paper trail. That could create a massive financial liability for the board. 

Boards are also now mandated to formally respond to the expert’s findings in their annual reports. You can’t “file and forget” an audit anymore. The OIG is looking for a “culture of inquiry” where board members aren’t just receiving information but actively challenging it. 

Pillar 2: Catching Every Whisper in the “Any Modality” Net 

How has the OIG expanded the definition of a healthcare disclosure program beyond the traditional hotline? 

The OIG has finally caught up with how the modern healthcare workplace actually communicates. A “disclosure” is no longer defined by the phone number it was called into. Now it’s defined as any report made through any modality. 

The reality is, in a busy lab or ASC, a compliance concern rarely starts with a formal hotline call. It starts with an email to a supervisor, a quick Teams message between nurses, or an “off-the-cuff” comment in a hallway or breakroom. 

The Roadmap Action: If a billing concern is raised in a Microsoft Teams thread but never makes it into your formal compliance log, you are in violation of the new standards. 

• Modality Audit: You must ensure your intake log captures: 
• Digital Channels: Email, Slack, Microsoft Teams, Zoom chat, and other messaging platforms. 
• Interpersonal Channels: In-person “walk-ins” and verbal reports made to management or HR. 
• The Log Requirement: Every report, regardless of how it is received, must be tracked with its nature, status, and corrective action taken. 

Pillar 3: Technological Accountability and the IT Governance Mandate 

What are the specific OIG reporting requirements for Generative AI and Information Technology in the 2026 CIA framework? 

In perhaps the most significant update to the compliance landscape in decades, the OIG is mandating technological accountability. IT has gone from support service to a governance partner. 

Set a Place for the Mandatory IT Seat at the Table 

The modernized CIA framework requires that the Compliance Committee formally include IT expertise. The OIG recognizes that in a digital-first environment, governance is impossible without an understanding of the underlying infrastructure, data flows, and automated systems. 

The Roadmap Action: Organizations should update their Compliance Committee Charters to include a CTO, CISO, or equivalent technical lead. This individual is responsible for bridging the gap between regulatory mandates and digital execution.

Defining and Inventorying Generative AI as a Requirement 

The OIG has introduced a formal, rigorous definition of Generative AI for reporting purposes. The new definition focuses on foundation models and systems that “generate new content or inferred outputs” used in clinical, billing, or administrative decision-making. 

Your Generative AI Inventory must track: 

1. Life Cycle Use Cases: Identifying where AI is deployed, such as automated utilization reviews, draft patient communications, clinical note summarization, or coding/billing reconciliation. 
2. Deployment Status: Reporting whether a tool is in the “Pilot,” “Pre-deployment,” or “Production” phase. 
3. Data Provenance and Security: Documenting how Protected Health Information (PHI) is shielded from being used as training data for public or foundation models. 

The Risk of “Shadow AI” 

The OIG is particularly focused on “Shadow AI”, meaning automated tools implemented by individual departments without the Compliance Committee’s knowledge. Under the new reporting mandates, a marketing team using an AI bot to answer patient queries or a billing department using a third-party “coding assistant” without formal approval is now a reportable risk. 

By mandating these inventories, the OIG is forcing a shift from “trust” to “verification.” Compliance committees must document their review and approval of any AI tool before it impacts federal healthcare program billing or patient care. This creates a mandatory “accountability trail” that proves the organization is managing AI risks, such as algorithmic bias and “hallucinated” clinical data. 

Pillar 4: The Elevated (and Independent) Compliance Officer 

How is the OIG changing the independence and stature of the Compliance Officer role? 

The OIG is giving the Compliance Officer (CO) role real “teeth.” The new framework explicitly states that the CO must report directly to the CEO and cannot be subordinate to the General Counsel or the CFO. 

This change is about removing conflicts of interest. Legal and Finance have their own mandates, and Compliance must be free to evaluate them both. 

The Roadmap Action: 

• Direct Board Access: The CO must have direct, unfiltered access to the board. 
• Executive Sessions: Mandatory quarterly meetings with the board, including at least one portion in “executive session” without other senior management present. 
• Board Supervision: The board is now responsible for the supervision and performance evaluation of the CO, further decoupling the role from the CEO’s sole influence. 

Conclusion: Your Proactive CIA Readiness Checklist: Four Tactical Steps 

The OIG isn’t about making the job harder. They’re making it more technical and more transparent. To align with these modernized expectations before a regulatory knock at the door, prioritize these four tactical steps: 

1. Appoint an IT Lead to Compliance: Update your charter to include a technical expert who can oversee your AI and data governance. 
2. Conduct an AI Audit: Identify where automated tools are being used. Document what tools are being used, for what purpose, and how the data is being protected. 
3. Centralize Your “Any Modality” Intake: Move away from fragmented email folders. You need a single source of truth that can export a defensible log of every hallway conversation and digital message. 
4. Adopt the Gold Standard Early: Treat these new CIA mandates as a “Pre-Settlement Readiness Review.” Adopting these standards now proves to the OIG that your organization is committed to a culture of integrity, not just the appearance of one. 

Need some help putting together your “evidence engine” and a proactive CIA strategy? YouCompli takes acute and non-acute care organizations from chaos to compliance confidence. Reach out with your questions and challenges. 

Blog Glossary 

• General Compliance Program Guidance (GCPG): The OIG’s definitive framework for healthcare compliance.  
• Active Governance: A model where leadership and the board are directly involved in compliance effectiveness, moving beyond “check-the-box” reporting to formal responses and resource allocation. 
• Corporate Integrity Agreements (CIA): Binding five-year contract between healthcare entity and the HHS Office of Inspector General (OIG), imposed as part of a civil settlement to resolve allegations of fraud or abuse. 
• Shadow AI: The unauthorized or undocumented use of artificial intelligence tools within an organization without the review or approval of the Compliance Committee or IT leadership. 
• Generative AI: A category of technology utilizing foundation models to generate new content or inferred outputs used in clinical, administrative, or billing decision-making. 

Six More Resources 

Four Ways to Engage Leaders in a Culture of Compliance – Building positive, proactive relationships with leaders is crucial to a culture of compliance. Learn four approaches to engage leaders. 

10 Tips for Building a Compliance Culture in Healthcare – The tips explore how you can convince leaders that a strong compliance culture adds value to the organization. 

What to Look for in Regulatory Change Management Software for Healthcare Compliance – A modern regulatory change management (RCM) system does more than just notify you when regulatory changes occur. Learn what’s really possible today and why it matters. 

Your Board Committee Is Only as Effective as You Make It – Ten ways to engage your healthcare compliance board committee. 

How to Use AI for Systems Thinking in Compliance Processes – Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. 

Experts Weigh In: The Oversight Role of a Healthcare Board of Directors – Whether new to the field or a seasoned professional, get ideas on how support your board’s oversight responsibility for the compliance program. 

About the Author 

Jerry Shafran is the founder and CEO of YouCompli with years of experience in the healthcare compliance space.

He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages and sells software and content solutions that simplify complex work. His innovations help compliance professionals focus on their core priorities.  

AI Handbook for Compliance Pro’s

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post OIG Compliance North Star: Roadmap to the 2026 Modernized CIA Framework  first appeared on YouCompli.

Regulatory compliance in healthcare is complex and ever-changing. There’s a steady stream of new and updated federal and state regulations that organizations have to stay on top of. Also, from CMS updates to accreditation standards, managing compliance across multiple departments is a significant challenge.   

Enter the Regulatory Lifecycle Management Maturity Model (RL3M): a brand-new framework that helps healthcare organizations assess their readiness to handle regulatory changes.  

The model will help you evaluate where your organization stands in regulatory readiness, and classify you in one of five levels – Initial, Developing, Defined, Managed, or Optimized. It also will offer tips and best practices for meeting regulatory requirements at seven key stages of regulatory lifecycle management:  

• Identifying & Documenting Regulations  
• Assessing Relevance  
• Translating into Business Requirements  
• Communicating to Stakeholders  
• Executing Compliance Activities  
• Monitoring & Validating Activities  
• Demonstrating Compliance  

With the model, organizations will be in a position to reach higher maturity levels – and experience fewer compliance breaches, reduced financial penalties, and greater operational efficiency.  

Take the Self-Assessment below to get started with the RLM Maturity Model.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Why Healthcare Organizations Need an RL3M (RLM Maturity Model) to Stay Compliant  first appeared on YouCompli.

CEO Jerry Shafran has prepared a festive video to help us wrap up the year. We wish you a safe and happy Holidays and New Year! 

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.  

Download our Latest White Paper

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm.   

Sign up for our Weekly Newsletter

The post Recapping 2024 and Ringing In 2025  first appeared on YouCompli.

“I solve problems you don’t know you have – in ways you may not always understand.” –Unnamed Compliance Officer, in a recent meeting with me  

In my lengthy career in both insurance and healthcare, I’ve met literally hundreds of compliance professionals. No matter who they are, where they live, how much experience they have, or anything else, they’ve all felt the same way about their role within their organization. It’s summed up beautifully by the above quote.   

Generally speaking, compliance professionals feel undervalued in comparison to others around their organization. They also think their leaders and revenue cycle colleagues don’t really understand what they do. It’s sad but true: in a world where a lot of healthcare professionals think of compliance as the “department of no,” or “where good ideas go to die,” these phrases tend to become self-fulfilling prophecies.  

Of course, anyone who really understands compliance knows these statements couldn’t be further from the truth. So how do we reverse this thinking, and elevate the level of understanding and credit that compliance receives for the invaluable work it does?  

Conventional Thinking About Compliance  

It all starts with understanding the prevailing schools of thought among healthcare executives. Of course, healthcare leaders are fully capable of understanding the value of compliance – they just don’t. This is probably because of two reasons.  

First, leaders often observe that their organizations aren’t penalized by regulators or otherwise in trouble. As a result, they wonder why they need a compliance department – why support a function that doesn’t seem to have much to do? Of course, they fail to realize that it’s exactly because of compliance that their organization doesn’t have those problems!  

Second, healthcare organizations are hard to run successfully due to financial constraints, the recent pandemic, staffing shortages, and more. As a result, executives tend to spend most of their time and energy on disciplines and other “squeaky wheels” that are directly tied to revenue production. Compliance, unfortunately for us, tends to be deprioritized in favor of other pressing business issues.   

Ways to Prove Compliance’s Value  

Compliance pros and departments can prove their value to their colleagues and leaders in a variety of ways. They include:  

• Educating leaders and colleagues about the OIG’s Seven Fundamental Elements of an Effective Compliance Program. These have guided compliance pros for years, but they usually don’t mean much to others around the organization – especially executives. Compliance pros can show how these elements manifest in everyday operations and describe the consequences that could result if organizations neglect them.  
• Aligning more closely with revenue cycle colleagues. In the same way compliance pros educate others around the organization, they especially need to ensure revenue cycle understands the importance of compliance – and the tangible value it creates. Organizations are better off when these two functions work together to create positive compliance cultures.  
• Tie compliance’s work to non-revenue metrics that executives care deeply about – such as time and risk. Show how much time (and money) a compliance team saves the entire staff – and the executive team – because they handle issues and solve problems for them. Also, cite examples of similar organizations that might be having regulatory trouble. Add up the expenses and cycles they incur to resolve those situations and use that data to quantify the downside risk that exists. This also shows the competitive advantage you’re creating for your organization by operating properly from the beginning.  

The most successful compliance professionals find ways to prove the value they create. This is how they receive the mindshare and resources they need to do their work well and continue to deliver value to their organizations.  

An Example of Establishing Value  

Take Lisa Herota and her team at Vail Health in Colorado, for example. In 2019, Vail’s CEO challenged the compliance team to find and implement a solution to manage and ease the administrative burden of regulatory change management. More specifically, he wanted the team to more proactively stay compliant with the many regulatory changes it experienced without adding labor or burning out the staff it already had.   

Since implementing that solution, Lisa and team have seen a massive impact in a short time. The first time she presented reports that demonstrate and quantify her team’s handling of regulatory change to her board, they grasped the significance of what the department does and the impact it has. They credit the compliance team’s success as being a significant driver in the organization’s exponential growth in new service areas. They also are about to launch a board-level Audit and Compliance Committee to oversee and support the work that Lisa and her team do.   

Compliance’s value in a healthcare organization, just like any other operational function, derives from others understanding what it does. Executives and boards usually only hear about compliance when things go bad – which is exactly why they should invest in the proper compliance team and resources in the first place.   

Let’s use the tools of our trade to initiate a different discussion with our colleagues and show them what we really bring to the table. Let’s help them do what we do best: solve problems and mitigate risk.   

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.  

YouCompli can streamline your regulatory change management efforts to give you time back to collaborate with colleagues, connect with front-line staff, and help free you from reading and monitoring regulations. Take a look at our regulatory change management solution today.    

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Reversing Conventional Thinking About Compliance   first appeared on YouCompli.

Emphasize Education for Healthcare Cybersecurity Compliance  

Privacy can make or break an organization. For healthcare systems in particular, it’s essential to lock down data.   

Margaret Scavotto explains the two sides to privacy: the penalty side and the positive side.   

“On the penalty side, we have issues like ransomware, which is rampant,” Scavotto says.   

“In healthcare, we have to conduct a HIPAA security risk analysis as well as invest in cybersecurity so that we don’t lose access to data or have a breach. It’s the cost of doing business.” 

She says investing in cybersecurity is similar to the challenges of quantifying how Compliance reduces fines.   

“Yet the likelihood of getting hit by a ransomware attack is much higher than getting hit with an OIG settlement or fine,” Scavotto says.   

Beyond the penalty side, Scavotto says privacy can be a tool for elevating patient care.   

“It’s a huge opportunity for providers to focus on customer service and patient retention for two reasons,” Scavotto says. “Patients’ expectations of privacy exceed what HIPAA requires. And patients are complaining to the OCR – the Office for Civil Rights, the federal agency that enforces HIPAA – about their privacy rights being violated by providers much more frequently than they were 10 years ago.”   

She says that thinking about HIPAA only as a burdensome regulation is a missed opportunity.   

“HIPAA and privacy regulations are opportunities to focus on dignity in patient care,” Scavotto says. 

“Privacy issues are at the heart of customer service and patient retention. And it’s a meaningful topic for employees because every employee is a patient somewhere. Being part of an organization that elevates the patient privacy element is impactful.”   

Scavotto advises making education around HIPAA and privacy issues pervasive. She shares an example of a compliance officer who was contacted for guidance after a hospital system purchased 1,500 iPads for field staff without securing funds to encrypt the devices.   

While the compliance officer was able to help resolve the issue, the example highlights why compliance professionals must be visible and be at the table when decisions are made. It also underscores the value of liaison programs and operational compliance committees.   

As Ken Zeko notes, operational compliance committee meetings are the perfect venue for asking questions such as, who’s going to buy something new? Who’s looking at new vendors?   

Lisa Herota adds that privacy issues also highlight the need for ongoing education. She believes employees genuinely want to protect patients’ privacy and that the best privacy policies are the ones employees hear about on a regular basis. 

Emphasize Education  

“We engage employees via a Privacy & Compliance Corner in our organization’s weekly Monday Messages newsletter, for example,” Herota says. “And we partner with IT Security to email biweekly tips on keeping the organization safe – from cyberattacks and phishing – and protecting patient information.”  

She says providing tangible privacy tips that employees can implement in their daily workflows is most useful. And she encourages making educational campaigns fun. “Part of our HIPAA educational campaign was awarding Starbucks gift cards to the first employees who called the compliance hotline and correctly shared what the acronym stands for,” she says. “It raised awareness of HIPAA and of our compliance hotline.”  

“Cybersecurity is a never-ending battle in healthcare,” Herota adds. “It only takes one employee to click a link and let bad actors into our system, creating a domino effect of chaos.” 

She shares how her team responded to a cyber issue by creating a simulated phishing email platform as an educational tool. When she presented the platform for approval to executives, it included increasingly punitive sanctions if employees clicked a link, responded to an email, or opened an attachment.   

Executives asked for more aggressive sanctions, including immediate termination. They likened it to not allowing an employee to set a fire in the operating room more than once.   

Herota pushed back, explaining that employees first need education – whether it’s on preventing a fire or avoiding a phishing scam. They compromised on starting with a four-step escalation program.   

“After six months of having this policy in place, nobody has made it past the second ‘failure’ of clicking a link, responding to an email, or opening an attachment,” Herota reports. “It proves my point that education and training are effective.”  

Ken Zeko agrees with Herota’s approach. He advises compliance officers to avoid using “draconian must-terminate language” and to focus, instead, on having conversations. “There are often plausible reasons why an employee commits a compliance infraction,” Zeko says.   

In these situations, Zeko recommends explaining the extraneous circumstances and giving an employee a warning instead of terminating him or her.   

“If you’re able to coach an employee after the infraction, you may make that person your number-one compliance liaison for life,” Zeko says.  

Content for this article was reprinted from a YouCompli white paper published in February of 2023. In “The Opportunity for Compliance to Create Value for Healthcare Organizations,” compliance experts shared ways to earn recognition across your stakeholders as a value creator. 

The Opportunity for Compliance to Create Value for Healthcare Organizations – White Paper Download

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA

The post Ensuring Private Information Stays Private   first appeared on YouCompli.

How to create a strong culture and make a valuable impact

Compliance officers in healthcare organizations are responsible for building or strengthening culture. It’s a daunting task, especially if you lack support from the top or are new to the organization.   

The tips below explore how you can convince leaders that a strong compliance culture adds value to the organization. These best practices can help you establish a healthy compliance culture with effective training and measurement and, in turn, enable your organization to better manage and control risk.  

What is a strong culture of compliance in healthcare? 

A positive compliance culture enables healthcare organizations to effectively manage and control risk. Yet it may not look the same across every healthcare organization. 

It’s partly because compliance officers do different things in different settings, such as a cancer hospital versus a behavioral health organization. Defining culture may be more art than science, yet healthy cultures share several characteristics.  

Positive cultures that help organizations manage and control risk are created when compliance officers embrace metrics, build relationships, emphasize education, and connect their work to better patient care. As Jay Anstine often tells us, a culture of compliance is a commitment throughout all levels of an organization to do the right thing and do things right.   

10 Tips for Healthcare Compliance Leaders   

Prioritizing these activities can empower you to build a healthy compliance culture and help your whole organization more effectively manage and control risk. 

1. Build relationships 

Cultivating solid relationships across the organization is crucial to building a culture of compliance and to helping manage and control risk. It involves building relationships with executives and operational leaders as well as front-line staff. 

“One person doesn’t make or break the culture,” says Donnetta Horseman, chief compliance officer, Moffitt Cancer Center. “The CEO definitely has a huge impact on what the culture is but if you’ve cultivated relationships with leaders across the organization, you can still build a culture even without CEO support.” 

Invest in relationships with leaders by having regular touchpoints, so you’re not just reaching out if there’s an issue. For example, reach out to leaders when you have positive audit results, or ask what challenges they’re facing and how you can help.  

2. Lead with empathy  

Maeve O’Neill, national compliance, Circa Behavioral Healthcare Solutions, emphasizes the importance of leading with empathy. Her approach stems from her belief that people want to be compliant and do the right thing.  

“Assume that employees are doing their best with what they have, and lead with that,” says O’Neill. “If there’s an issue, it’s often because employees have not been given the right information, resources, or skills. Our job in compliance is to give employees the information, resources, skills, and support they need – not to assume they’re bad or lazy.” 

3. Anticipate resistance  

Resistance is to be expected when you change existing processes or policies to build culture. Recognize that the change management process is an ongoing effort; it takes time to get everyone’s buy-in.  

“To overcome resistance, communicate the why behind what you’re doing,” O’Neill advises. “Communicating and doing a lot of listening builds trust. If you’re changing policies or processes, explain why you have a better way to do it. Emphasize the importance of following the OIG’s seven elements and integrating them into daily workflows.”  

4. Know the business side 

To influence and shape culture, it’s critical to understand the organization’s strategic direction and serve as a business partner. Know how the business generates revenue and where risk resides, so you can help operational leaders to do the same. 

“If you want to connect with leadership or anybody in operations, you have to be engaged in their work,” explains Jay Anstine, compliance program director, Western Division, Banner Health. “And that means understanding how the organization makes money and how each department contributes. It’s about getting to know the business side of the environment, not just the compliance side. You need to be able to climb in the head of a business or operational leader and understand things from their perspective as you try to shape culture and find resolutions to issues. Shadowing staff and doing department walk-throughs can help show employees that compliance officers understand operations.” 

5. Engage front-line workers 

Embedding yourself into each operational area is a helpful way to influence front-line employees. Be part of each area’s initial orientation with staff, go to trainings, do mock surveys, and attend team meetings.  

The more visible you are, the more that colleagues see you and trust you as a partner. They’ll appreciate what you bring, and in turn, they’re more likely to bring issues to you.  

Also, rounding can be helpful for engaging front-line employees and for measuring their compliance awareness. 

“You can talk about compliance messaging if there’s a particular point you need to hit on – maybe a reminder to complete staff training or something HIPAA related,” Anstine says. “But spend the time being curious about their operations and getting to know them. Taking this approach is a sign of engagement and helps you connect with employees on a personal level.” 

“You can talk about compliance messaging if there’s a particular point you need to hit on – maybe a reminder to complete staff training or something HIPAA related, but spend the time being curious about their operations and getting to know them. Taking this approach is a sign of engagement and helps you connect with employees on a personal level.” – Jay Anstine, Compliance Program Director, Western Division, Banner Health

6. Emphasize education   

An example of ongoing training is Horseman’s manager-level training for Compliance. Her meetings involve sharing compliance resources and outlining which policies are most relevant to managers in their respective operational area.  

They discuss what it would look like if there’s an investigation involving one of their departments. It’s educational, plus it cultivates relationships and builds awareness of how Compliance partners with operational areas.

7. Establish a liaison program  

Implementing a compliance ambassador program, often called a liaison program, enables Compliance to partner with individuals outside the department to promote compliance organization-wide.    

In an earlier role, Horseman ran a 10-month liaison program, where managers nominated front-line employees. They met monthly with groups of 10-20 employees and talked about compliance topics, provided education, and explained various requirements. When the program concluded, participants were certified compliance champions.  

“They took the information they learned back to their departments, and functioned as liaisons for folks in their areas, if they had questions about compliance or issues to report,” Horseman says.  

It was a meaningful way to both amplify Compliance’s messaging and to identify compliance issues.  

8. Participate in Compliance Week 

Participating in Compliance Week engages the entire organization. Being part of a national event gives credibility to the compliance field, and it’s an opportunity to interact with employees outside of their day-to-day work.  

“We always have an in-person event at our bigger locations. It’s probably the most popular thing we do. We plan lots of activities, play games with prizes, and offer snacks.”  – Donetta Horseman

9. Use the OIG’s seven elements 

Building financial and other metrics – such as revenue reclaimed because of audits – into the culture helps the organization better manage and control risk. Prioritizing metrics is important even if you aren’t demonstrating a hard financial impact. 

O’Neill recommends using the OIG’s seven-elements framework as a checklist, particularly in behavioral health settings.  

“Start by assessing which of the elements you already have,” O’Neill advises. “Most behavioral health organizations find that they have the seven elements in some iteration. If you have all seven elements met – even if it’s minimally, as long as you have something in place for each of them – you have a good foundation for a compliance program. With the seven elements in place, you can build over time to create a strong compliance culture.”  

10. Connect Compliance to patient care 

Emphasizing how culture is interconnected with better patient care helps show Compliance’s impact on managing and controlling risk.  

O’Neill emphasizes with operational colleagues that her job isn’t to make them simply check off boxes on forms; it’s to help them streamline their operations and more effectively control risk.  

“The goal is giving everyone more time to focus on patient care and better serving patients,” O’Neill says. “In the end, it makes the organization more money and more profitable.”  

Manage and Control Risk

Earning recognition as a value creator and establishing a healthy culture can be challenging. Yet as these 10 tips show, you can successfully shape culture to help the larger organization better manage and control risk. 

For in-depth insights on how to establish a culture that helps the organization minimize risk and demonstrates how Compliance adds value, download our white paper.  

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post 10 Tips for Building a Compliance Culture in Healthcare first appeared on YouCompli.

How to use the SBAR Framework

The same tool nurses use to communicate about health emergencies – can help you secure investment in your compliance department.  

Healthcare compliance professionals who want to make a case for investing in a healthcare regulatory change management solution like YouCompli are using the SBAR framework: 

• Concisely explain the situation 
• Give pertinent background details 
• Explain your assessment 
• Make a recommendation  

When you’re competing for resources along with every other department in the organization, it’s critical to make a clear, concise and compelling case for investment in your work. That way people understand what you need and what value it adds to the organization. 

The SBAR framework helps the provider understand what is happening and what the team needs them to do. The framework was developed by Michael Leonard, MD, Physician Leader for Patient Safety, along with colleagues Doug Bonacum and Suzanne Graham at Kaiser Permanente of Colorado. While its primary use is in clinical cases, healthcare professionals across the organization are finding it useful for communicating with clinical leaders.  

Over the past few years, I’ve helped many of our clients demonstrate the value of investing in compliance with an SBAR. Maybe our application of the framework could help you. Here’s a brief summary of our approach: 

1. Situation 

Due to the nature and number of regulatory changes in healthcare, managing regulatory changes creates significant operational, financial, and reputational risks. 

Name your regulators  

Our system is regulated at the federal and state levels. Additionally, we are subject to regulatory guidance from our Medicare Administrative Contractor. 

Briefly describe your manual process  

This creates a scenario where regulations are changing almost continuously. These changes flow into our organization in a completely unstructured manner. 

2. Background  

Our organization is subject to regulation from more than ___ number of regulators.   

One of them, the U.S. Department of Health and Human Services (HHS) Office of the Inspector General (OIG), has mandated that all Providers must establish seven (7) elements of an effective compliance program.   

Currently, we do not have the ability to: 

• Name any of the seven elements your current compliance function is challenged to address. 

Not having a scalable, repeatable regulatory change management process puts us at risk of being unable to correctly perform all but __ number of the required elements. We can have a designated compliance officer and have open lines of communication. 

3. Assessment  

To effectively assess the issue, we need to review two different but equally important concepts. 

1. What is the cost associated with doing this work (properly) today? 

2. What are the risks/costs associated with not doing this work effectively today?  

The cost associated with doing this work (properly) today 

List the steps to complete this work today.  

Insert a worksheet of costs by a specified period, for example, quarterly. In this example we provided the number of regulatory changes the system dealt with in Q1 of 2022.  

Based on this assessment, the quarterly cost of completing the work is _$40,847.25_   

The risks and costs associated with not completing this work are more subjective.  They fall into three different types.  

1. Fines  
   Provide examples of fines that are similar to your organization’s size and scope 

2. Corporate Integrity Agreements 
   CIAs create significant costs and distractions for all parties of the organization involved.  
   For example: 
   Reporting requirements increase significantly  
   Required to hire an Independent Review Organization (IRO)  

3. Reputational 
   A good reputation is hard to build and easy to lose. For hospitals, the way the reputation is perceived by its stakeholders is important because the subject of the service is human health. 
   Within the populations we serve adherence to existing regulatory requirements is a forgone conclusion, we are expected to act with a consciousness of social responsibility.  

Based on the factors above it is my conclusion that our organization must focus on creating a more effective, more efficient means for managing compliance with regulatory changes.  

4. Recommendation  

To address this issue, we need to complete the following:  

Bullet out your recommendations for consulting, employees, and / or software  

Some examples:  

• Institute a standardized regulatory compliance process  
• Gain visibility into enterprise-wide regulatory compliance   
• Ensure that activities being undertaken to comply are what the law requires (accuracy) 
• Track compliance activities with regulations at the departmental level 
• Create the ability to demonstrate what we have done  

Include competitive research for solving your challenges a couple of ways 

Some examples 

• To avoid the need for additional FTEs an evaluation of existing technical solutions was undertaken   
• We engaged resources from various parts of our organization to undertake this assessment  
• There are three major vendors providing solutions in this area   
• Below is a competitive matrix of each companies offering   

Present a solution that is more competitive than the current risks combined with the current costs. 

For example 

Based on our analysis we recommend selecting _______ as our vendor of choice for this project. The major reasons for this choice are: 

Here are some of supporting bullets our clients use 

• YouCompli does the work for us. Their Expert Compliance Professionals read, analyze, and translate new regulations into business requirements. This operationalizes the regulation for us.  
• We can rely on what they send us. Before sending us the requirements, they are all reviewed by legal experts with an excellent reputation in healthcare regulation.
• The system is easy to use and learn.  

The Situation – Background-Assessment-Recommendation approach can help you clearly and precisely make the case for new investment in the compliance function. 

Creating your own SBAR   

The SBAR framework can help you position and sell solutions to your regulatory change management challenge and many other challenges. Our clients find that our one-two punch of regulatory analysis and a workflow tool that manages the implementation of regulatory changes helps them reduce risk in their organization, feel more confident, and partner more effectively with clinical and operational leaders.  The SBAR framework can help you make the case for a tool like YouCompli. 

We would love to help you learn more about how to adapt this tool to your department’s needs. We’re offering an SBAR workshop in early 2023. Please sign up for our updates to be notified when registration opens. 

The post Show the benefits of investing in your healthcare regulatory compliance program first appeared on YouCompli.

Build Relationships to Win the Hearts and Minds of Operational Leaders

Healthcare compliance officers know the value their work and regulatory change management bring to their organization. The challenge is quantifying that value and demonstrating it to leadership.

Being an effective influencer and using culturally impactful metrics can help tell Compliance’s story. With these skills and tools, you can demonstrate how Compliance makes an impact in five key areas: delivering an effective compliance program, reducing risk of fines, providing a better patient experience, protecting revenue, and ensuring private information stays private.

Establish yourself as a value creator

“The best compliance officers I know are viewed as strategic advisors or partners to leadership,” – Principal advisor with Hall Render Advisory Services, Ken Zeko, JD, CHC.

He recommends compliance officers be visible and build relationships to “win the hearts and minds” of operational heads and leaders.

Zeko says it’s critical for Compliance to be at the table when leaders are planning strategy. It’s also crucial to build your reputation as the “Department of Yes” by building strong relationships.

You can build relationships by adopting a sales mentality. Not by being extroverted, but by showing empathy and intellectual curiosity.

This means getting comfortable asking questions:

• How does this problem affect your department?
• What solutions have you already tried?
• Have you worked with others to try solving the problem?
• Asking questions positions you as a partner and a problem solver. In addition to asking more questions, developing “talk tracks” is helpful.

A talk track is a thoughtful, consistent approach to answering the types of questions you frequently receive. Include elements like metrics, regulatory rationale, and tools to solve the challenge. This can help remind operational heads and leaders of their role and the value Compliance delivers.

Five ways for Compliance to demonstrate value in a healthcare organization

1. Managing changing regulatory requirements   

We all know about the OIG’s guidance on effective compliance programs. Their seven elements are foundational to all our clients’ work – so much so, that we think of the seven elements as table stakes.

But just because they’re table stakes doesn’t mean you or your organization can look at them as a box-checking exercise. In fact, the work you are doing to deliver an effective compliance program can directly tie to value creation.

As you think about demonstrating the existence of the seven elements, think too about all the support you provide your colleagues in fulfilling their regulatory responsibilities. You can keep them aware of regulatory changes, you provide tools to adapt to the changes, and you help them demonstrate they took the proper steps. Doing all of this well is critical for your whole organization, and communicating it helps your colleagues understand the importance of doing the work.

Here is my favorite example of a hospital believing that an effective compliance department creates value: We work with a healthcare system in New York that is determined to move way up in the US News and World Report rankings of hospitals. They chose regulatory change management as one area to invest in to improve their standing overall. The hospital believes so much in this foundational work that they see it helping move the needle on significant strategic goals.

2. Reducing the risk of fines

Effective compliance programs reduce the risk of fines, but it’s tough to quantify avoiding government audits and investigations. Instead, focus on improving the organization’s culture to ensure that employees make appropriate decisions.

You can measure this by conducting a compliance audit or a claims review, and capturing the number of under-payments the organization has. Another option is to show how Compliance is moving the needle in shaping organizational culture.

You can conduct an employee survey to gauge the perception of leadership. Ask questions like: Do you believe leaders will do the right thing if they encounter a legal or regulatory problem?

Also, though not specific to fines, you can create value using metrics. A compelling measurement is tracking how many regulations come in over a period of time – such as a quarter or annually – that affect your organization. It’s a powerful metric because leaders often significantly underestimate how many regulations they need to comply with.

Other metrics can help tell Compliance’s story, such as key performances indicators (KPIs) that stem from the seven elements for compliance program effectiveness.

Zeko suggests using element-based KPIs to gauge if compliance activities are achieving results. Examples include the number of policies written and approved during a period of time – monthly or quarterly – and the number of audits conducted.  

Also useful are culturally impactful metrics, which help measure how Compliance shapes the organization’s culture. For example, measure the number of Compliance roadshow sessions completed or how many clinical roundings are attended by a compliance officer.

3. Providing a better patient experience

The increase in telehealth is one area that shows how Compliance contributes to providing better patient experiences. Telehealth use soared during the pandemic as new regulations were coming out at a ferocious pace.

Organizations that recognized the need for telehealth brought compliance officers in early to help navigate the changing documentation, coding, and confidentiality requirements. When compliance officers worked with operational leaders to drive telehealth strategy, their organizations were best positioned to support patients with virtual care amid the chaos of Covid.

4. Protecting revenue

The telehealth example also demonstrates how Compliance contributes to revenue performance. Organizations that embraced virtual care delivered better patient experiences and also drove stronger growth.

Another way some organizations save money is by using software tools to distinguish between higher-revenue prior-authorization codes and lower-revenue prior-authorization codes. If something changes related to a higher-revenue code, the software tool alerts the Revenue Cycle department to the changes. This proactive approach to regulatory change management is another example of how Compliance helps protect revenue.

5. Ensuring private information stays private

Some regulatory changes are as small as making a coding change for Revenue Cycle. Others, however, can almost be an industry unto themselves, like regulations resulting from the Health Insurance Portability and Accountability Act (HIPAA) and managing personal health information (PHI). A healthcare organization simply can’t function if it doesn’t have its data locked down properly. Much like having an effective compliance program, it is table stakes for an organization to operate. And yet, doing it right – from policy making to procedure drafting to training to management to monitoring changes – is incredibly difficult.

Zeko notes that in the early days of HIPAA, it was also hard to get management’s attention about privacy. The regulations lacked teeth, and it was tempting for everyone to stick to business as usual. Now, more than 20 years later, everyone understands the need for privacy. They need help staying current with the specifics and embedding privacy-first practices.

The servant leader mentality can help immensely here. Clinical and operational leaders know that they are responsible for the security of patient data. Ask what you can do to support them in this effort. Then, continue to demonstrate how you can provide tools and content to create a privacy-forward mindset.

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry has founded, managed, and sold software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.

How Compliance Creates Value for the Healthcare Organization

In November 2022, Jerry moderated a panel of compliance experts looking at the value Compliance and regulatory change management bring to healthcare organizations. Margaret Scavotto, JD, CHC, President, Management Performance Associates, Ken Zeko, JD, CHC, Principal Advisor, Hall Render Advisory Services and Lisa Herota, RHIA, CHC, CHPS, CCS, Senior Director of Compliance and Privacy, Vail Health shared the importance of selling the value of the Compliance function in your interactions with peers and organization leaders.  

The post Five ways to show how healthcare Compliance delivers value first appeared on YouCompli.

In the August issue of Compliance Today, I read a great interview with Donnetta Horseman. She spoke about her career in healthcare compliance.  

When asked about challenges in the industry today, Donnetta said two things that resonated strongly with me.  

1. “Demonstrating the value of the compliance program is definitely at the top of my list of challenges. We don’t generate revenue, and it is often hard to quantify the money we save the organization by avoiding fines and penalties or mitigating risk.” 

2. “Another challenge is staying abreast of the regulatory environment that applies to your organization.”  

This may surprise you, but these two challenges offer an opportunity to create significant value across the organization.  

Clinical and administrative healthcare leaders try to comply 

Dealing with regulatory challenges isn’t new to you. It is part of the job leading compliance to deal with complex regulatory changes and challenges.  

For your clinical and administrative colleagues, it is different. We know that you, like your clinical counterparts, strive to deliver value to your organization and improve patient outcomes. But the head of Pharmacy or Nursing thinks nonstop about improving patient outcomes. They didn’t choose a career in healthcare delivery to spend time with regulatory changes and complexity. 

And yet, in most healthcare organizations, the responsibility to comply with these new regulations falls to clinical and administrative employees. Their ambivalence or sense of overwhelm is understandable. The scale and pace of regulatory changes is staggering. Our team of Expert Compliance Professionals (ECPs) just reviewed a new CMS regulation related to lab improvements. It is 31 pages long, with three columns per page. 

A Process to comply with new or changing healthcare regulations 

To stay ahead of relevant regulations, your colleagues must: 

1. Monitor a series of regulators
2. Read new regs to gauge which department they apply to
3. Figure out what the new reg requires if it applies to your organization
4. Write any policy and/or procedural changes to adequately address the requirement
5. Distribute the changes to everyone in the organization affected by the changes
6. Ensure the changes are put into place and followed
7. Be able to prove the regulatory change is adequately addressed when asked 

Some hospitals have developed an internal process to support this effort. After five years of talking to healthcare compliance professionals, I can confidently tell you that every department head would say it’s not enough.  

This problem presents an opportunity to create value  

Western Maryland Health System (now part of a large national healthcare provider) was struggling with this exact challenge.  

Like many of you, their compliance department was one person. He turned to YouCompli to simplify and streamline the process of managing regulatory changes across the organization.  

Every department in the hospital heard the same value-proposition: “You will be able to comply with all new healthcare regulations without having to read them!” 

Each department will be notified if (and only if) a new regulatory requirement pertains to their particular department. Without reading it, they can quickly decide if the regulation applies to them. If it does, now they access procedures translated into easy-to-understand business requirements. With the solution, they distribute and track the tasks required for completion in a single system of record.  

 Think about telling the head of Revenue Cycle they don’t have to read any more regulations (including LCDs).  

Simplify the process to stay in compliance 

When there’s a new regulation, your organization must comply and continue to comply as regulations change. The organization is at much higher risk if regulatory change management is not managed effectively. And patient care and financial returns can suffer. 

Many healthcare organizations rely on automated feeds of regulatory content; this just isn’t enough. To create value, you need a repeatable, scalable process instead of a continuous stream of regulatory changes. Establishing a standard approach to implementation makes it easier to comply with new regulations and updates as they come in. Translating complex regulatory modifications or identifying a simple coding change will help your colleagues know what to do and when.  

Consider ways to automate, enhance, and track your change management process. Look at the internal processes your team executes to manage new or changed regulations. Can your colleagues outside of compliance effectively keep up with regulatory change currently? Can you help them remain focused on patient care?  

Solve the top industry challenges Donetta mentions: keeping up with changes and demonstrating value. With an effective regulatory change management process, you can simplify the process to share regulatory changes with each department. And tell them, in simple language, the requirements they must address to meet the rule.

Demonstrate the value

Healthcare compliance officers know the value their work and regulatory change management bring to their organization. The challenge is quantifying that value and demonstrating it to leadership. Read more about how compliance delivers value across healthcare organizations in “Five ways to show how healthcare Compliance delivers value“.

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry has founded, managed, and sold software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post How Compliance Delivers Value with Regulatory Change Management first appeared on YouCompli.