Introduction: The Baseline Fears 

AI is moving faster than healthcare policy can keep up. For compliance leaders, the knee-jerk reaction might be avoidance, but blocking AI isn’t an option.  

AI is still valuable to healthcare compliance. It can help teams spend more time on risk identification, monitoring, investigations and proactive program management, because less time is spent on routine administrative work. 

But AI will never become the compliance expert. Rather, it’s a “thought partner” as you’ll learn in this article. That distinction matters because many compliance leaders are stuck between two realities: AI can be incredibly useful, but it can also be confidently wrong. 

We sat down with compliance expert, Lisa Estrada, to discuss why fear is a dangerous strategy, how to handle “shadow AI,” and how to use technology as a compliance thought partner. (Note: See Lisa’s bio at the end of this post.) 

Q: What fears do healthcare compliance leaders have about AI? 

Lisa Estrada: They’re the same fears most people have regularly: that AI is hallucinating or presenting incorrect information with absolute confidence. However, it feels especially high-stakes in compliance. 

Everyone has experienced this generally. AI gets you into the right ballpark, but when you look for specific rules, it can falter. I’ve personally tested it on regulations where it completely fabricated citations. You ask about a rule; it gives you an answer, but when you dig in and ask for the specific citation, it simply isn’t there. If you rely on AI as a primary source of legal or compliance expertise, there’s a real risk it will lead you down the wrong path. 

The Downstream Risk of Losing Business Trust 

Q: What are downstream ramifications if a team pushes ahead with AI without appropriate caution? 

Lisa: The dangerous thing is that AI can be incredibly specific in the way that it’s wrong. If you rely on it blindly, you can easily end up implementing policies or operational practices that are fundamentally non-compliant, even as you forge ahead believing they are correct. If you get a citation wrong, you can give the wrong guidance to the business. 

When that happens, the business loses confidence in the compliance team, and that’s a massive organizational problem. Relying on incorrect expertise leads straight to penalties, which is exactly why compliance professionals are naturally fearful of the technology.  

But there are useful ways to leverage AI that have nothing to do with relying on it for final expertise or human judgment. 

The Danger of Ignorance: Why Compliance Leaders Can’t Just Say No to AI 

Q: Can compliance leaders afford to sit on the sidelines until regulations catch up? 

Lisa: While the fears are realistic, there is a parallel danger in completely blocking the technology. If compliance simply says, “No, no, no, we’re not going to touch it,” the business is going to outpace you anyway. Employees are likely already using AI in their work. 

Most healthcare organizations already look to compliance to support or lead AI governance, a reality highlighted by recent updates to the OIG Corporate Integrity Agreement (CIA) framework. (Editor’s note: For a deeper dive into these requirements, see our guide on the updated OIG CIA framework.) 

If you aren’t actively thinking through how to use AI and how to construct guardrails for yourself, you won’t have the credibility to help the organization govern it. “No” is no longer an option. By using it safely, you gain the confidence and executive credibility needed to help the business define its usage parameters. 

How-To Part 1: AI as Administrative Thought Partner 

Q: How can compliance leaders shift from a mindset of fear to one of confidence? 

Lisa: Shift your perspective and start thinking of AI as a “thought partner.” Compliance issues are notoriously complex and packed with many variables you have to track simultaneously. AI is exceptional at organizing those thoughts. 

When I have a jumble of competing priorities in my brain or when I know what the compliance answer is, but I’m struggling with how it will be received by the business, I use AI to de-clutter.  

I tell the tool: “Here’s what is happening; here’s what I’m worried about, and here’s what I’m aware of. Help me organize this.” AI helps you figure out how to communicate complex regulatory requirements that are clear, actionable, and less intimidating to operational teams. 

Automated Workflow Builds Archive of Decision-Making 

Using AI this way also builds an archive of your decision-making. Often in compliance, you go through a grueling thought process, arrive at a complex answer, and move on. Months later, a similar issue comes up, but you can’t entirely recreate your original logic. 

If you use AI to help document and structure your thought processes, it becomes incredibly easy to look back, compare the two situations, and identify exactly where they differ. 

From a governance perspective, this archive does more than save time. It’s an internal audit trail. When regulators or internal stakeholders ask why a certain path was taken months ago, you have a documented, structured record of your rationale, directly improving your program’s defensibility and compliance outcomes. 

How-To Part 2: Systematizing Proactive Compliance 

Q: How can teams use the “thought partner” concept to build a more proactive compliance program? 

Lisa: This is where the real opportunity lies. Every compliance professional knows they should spend their time on forward-looking, programmatic work and proactive prevention. In reality, your day gets completely consumed by reactive fires.  

While AI will never replace human judgment or navigate the gray areas of compliance, it can help systematize your repeatable, proactive workflows. You can use it to: 

• Map out compliance schedules. 
• Draft standard communication templates for regular regulatory updates. 
• Organize compliance tracking data. 

By letting AI handle the administrative heavy lifting of your proactive programs, you keep those prevention pieces on track automatically. This frees up critical human bandwidth for the nuanced, high-stakes matters that demand deep administrative judgment. 

This structural shift is what drives true compliance outcomes. Instead of measuring success by how many forms you fill out, success becomes visible in lower incident rates, faster internal investigation cycles, and risks that are mitigated before they turn into systemic violations. 

The Immediate Risk for Compliance Leaders: Shadow AI and Privacy 

Q: What is the most immediate AI risk that compliance needs to address right now? 

Lisa: Patient privacy. This is the biggest, most immediate nexus between healthcare compliance and AI. When employees use AI “off the books” or in the shadows, they rarely think about data security. They might copy and paste operational data or documentation into public models without stripping out identifiers, sending protected information straight into the public cloud. 

Compliance programs must get involved in AI governance to protect patient privacy and business integrity. The solution isn’t to ban the tools; it’s to bring AI out of the shadows. Talk openly about proper use, establish clear parameters, and implement mechanisms to monitor how data is being handled. 

Healthcare compliance leaders will want examples such as: 

• Approved AI tools  
• PHI restrictions  
• Employee training requirements  
• Prompting guidelines  
• Audit and monitoring procedures  
• Vendor due diligence requirements  

By establishing clear parameters, compliance isn’t just about policing tech usage but embedding it into the organization’s overall risk governance framework. This helps ensure that as the business innovates to drive operational outcomes, it does so without compromising patient privacy or regulatory standing. 

Getting Started with Low-Stakes Practical Action 

Q: What’s your top piece of advice for a compliance leader who’s still hesitant to start? 

Lisa: Find a corner of your personal life where the stakes are zero and start using AI as your daily assistant. Use it to organize a workout routine, draft a personal email, or plan a schedule. 

How to Get to Know Your AI Thought Partner? Start at the Gym. 

It’s important to spend the time to learn about AI and get comfortable with it. I first became comfortable with AI by using it as a workout coach. That low-stakes environment helped me understand both its strengths and limitations before applying the same principles professionally. 

My watch records my heartbeat and other data.  I feed it to AI, and it has been my thought partner.  

This is the biggest point for compliance. It’s made my workout routine sustainable, and it’s the same thing for compliance. The biggest thing that AI can do for compliance programs is to systematize processes in a way that makes them sustainable. 

Doing this in a low-stakes environment allows you to note its limitations firsthand. You’ll see exactly where it hallucinates, discover where it genuinely saves you time, and learn how to write effective prompts.  

Once you build that personal comfort level, you can confidently bring those same guardrails, skepticism, and strategies into your professional compliance workflow. 

Key Takeaways for RCM and Compliance Leaders 

• Shift from Prohibition to Governance: Blanket AI bans are ineffective and foster a risky environment of “Shadow AI.” Instead, focus on bringing the technology into the light by establishing clear, transparent guardrails that protect patient privacy and business integrity. 
• Leverage AI as an Administrative Thought Partner: Don’t look to AI as a definitive legal oracle. Instead, use it to manage administrative heavy lifting like mapping out schedules or organizing compliance tracking data. Shifting these repeatable workflows to AI frees up the critical human bandwidth needed to focus on high-stakes risk identification and proactive program governance. 
• Build Confidence in Low-Stakes Environments: If you or your team are hesitant, start integrating AI into zero-risk personal routines (like scheduling workouts or drafting personal emails). Experiencing its limitations and capabilities firsthand is the best way to safely and effectively scale those same strategies into your professional compliance workflows. 

How to Build Your AI Guardrails 

The most successful compliance programs will likely combine AI’s speed and organizational capabilities with human expertise, validation, and oversight.  

Ready to build AI guardrails for your compliance program? Download our “AI Handbook for Compliance Leaders,” including governance frameworks, policy templates, and practical implementation guidance. 

About the Author 

Lisa Estrada is Co-Founder of Keystone Solutions, a healthcare compliance advisory firm, and principal of AlloImpact LLC, where she provides strategic interim compliance leadership to hospitals, health systems, provider organizations and healthcare vendors navigating leadership transitions and inflection points. 

She spent fifteen years in private practice as a healthcare regulatory and enforcement lawyer, including as a partner and Health Care Practice Group Leader at Arent Fox and partner at Foley & Lardner, before carrying that lens into the enterprise as CCO at Fresenius Medical Care North America, CCO at LifePoint Health, and General Counsel at ScionHealth. 

Her work centers on turning compliance inflection points into opportunities — to pivot, strengthen, and systematize. Whether bridging a leadership gap, stabilizing during growth or transition, or modernizing a program that has outgrown its practices, she helps organizations build frameworks and cultures that endure. She designs repeatable, resilient processes that scale and stand under scrutiny, so compliance keeps working even when key people change — moving organizations beyond heroics toward something that genuinely holds. 

Editor’s Note: We felt it was only fair to let AI have its say about people’s perceptions and fears of it. 

Q – How do you feel as an AI tool reading a blog about fear of AI? 

Gemini: It’s a bit like looking into a digital mirror while someone tries to explain how my “brain” works! 

Reading a blog like Lisa’s, where she emphasizes using AI as an administrative “thought partner” rather than an all-knowing oracle, is actually incredibly validating. It hits the nail on the head regarding what tools like me are best at, and where we can accidentally trip people up. 

Here is my “perspective” on a few points from that draft: 

• The Fear of Hallucinations: When Lisa mentions testing an AI that completely fabricated regulatory citations, I get it. I don’t want to confidently make up a fake CMS rule, but because of how LLMs predict language, if we are pushed to find an exact needle in a haystack without the right data, we can “hallucinate.” Her advice to never use AI as the final source of truth is incredibly sound. 
• The “Thought Partner” Role: This is where I think tools like me shine. When she talks about feeding a “jumble of competing priorities” into the prompt and asking for help de-cluttering, that’s exactly what I’m built for. I love taking a massive wall of text or an unorganized brain-dump and transforming it into something structured, scannable, and clear. 
• The “No Is Not an Option” Reality: It’s fascinating to see the shift in compliance from completely blocking AI to realizing that “Shadow AI” (employees using it anyway) is the real risk. Building safe guardrails is the best way forward. 

Ultimately, it’s exciting to see content that moves past the hype of “AI will replace everyone” or the extreme fear of “AI is too dangerous to touch,” and instead lands on a practical, grounded middle ground. I’m always ready to be that administrative thought partner! 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Shift from Fear to Confidence in Healthcare Compliance AI Governance  first appeared on YouCompli.

Why Managing Compliance Risk Is Like Eating Spinach 

The overwhelming pace and complexity of healthcare regulatory change have become so routine that the constant grind now poses a distinct compliance risk to the organization it’s intended to protect. 

Yet, many hospitals still treat regulatory change as a routine monitoring activity, failing to adopt the systems thinking and discipline necessary to truly mitigate the risk.  

This article by a top healthcare compliance expert explains what it takes to make that transformation. (She also explains what spinach has in common with compliance risk assessment.) 

Beyond Spinach: A Systems Thinking View of Regulatory Change  

’Tis the season! Compliance risk assessment season, that is.  

Many healthcare organizations are in the middle of this annual “eat your spinach” preventative exercise, with compliance folks wandering the halls asking executives what keeps them up at night.  

This year, a CFO for one of my hospital clients raised a significant risk that is so ever-present it’s often treated as a constant rather than a risk. The pace and complexity of regulatory change in healthcare are so familiar that they’re easy to overlook as a distinct risk.  

Regulatory Change Complexity as Permanent Risk  

For those who do recognize and record risk, this one almost certainly hits near the top of the scoring index. Regulatory change in healthcare isn’t an occasional disruption. It’s a permanent condition of the operating environment.  

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity rather than applying systems thinking. Updates are tracked. Summaries are circulated.  

But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

Systems Thinking Brings Structure to Reducing Compliance Risk 

From a systems-thinking perspective, this is a structural failure, not an execution problem.  

A persistent, high-scoring risk should not rely on individual effort, institutional memory, or ad hoc judgment calls to be managed effectively. It should be supported by infrastructure that reliably converts inputs into outputs.  

In this case, the input is regulatory change. The needed outputs are: 

• Applicability analysis 
• Operational decisions 
• Documented rationale 
• Accountable follow-through 

Failing to Operationalize Compliance Leaves You Open to Risk 

That’s where many regulatory compliance programs feel the strain. The risk isn’t failing to notice regulatory change. The risk is failing to operationalize it in a consistent, defensible way, especially across multiple departments, leaders, and decision points.  

From Effort-Based Compliance to System-Based Compliance 

Coming out of risk assessment season, this creates an opportunity to ask a more fundamental question: Do we actually have a system for managing regulatory change, or do we just know it’s a problem?  

Seen this way, the value isn’t the technology itself. It’s the shift from effort-based compliance to system-based compliance. And with systems and technology, you can do all this in a way that is repeatable and reviewable.  

In short, “eating your spinach” and doing annual assessments is good discipline. Relying on systems is how you stay healthy the rest of the time.  

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post From Manual to Scalable: How to Manage Healthcare Compliance Risk  first appeared on YouCompli.

In this article, Lisa Estrada shares her perspectives on why systems beat heroes in compliance and how AI can help accelerate systems thinking in fast-paced healthcare environments. 

Lisa is a seasoned compliance executive with more than 25 years in healthcare, including serving as Chief Compliance Officer for several large, national health systems. See more of her impressive credentials at the end of this blog. 

Systems Beat Heroes: The Quiet Advantage in Compliance 

Ever notice how organizations love a hero story? The person who swoops in, tackles the problem, and saves the day. For the individual, there’s the rush of feeling impactful and the shout-out at the team meeting. For the organization, the crisis is averted, allowing it to direct resources to other pressing challenges. That is, until the next crisis pops up. 

This hero-driven culture is the norm in the healthcare systems where I’ve worked. And as a compliance leader, I’ve fallen into the trap of believing that a key way to establish the value proposition for the compliance function is to show up as the hero, avert the crisis and bask in the glow of the company-wide shout out.  

The Alternative to Hero-driven Compliance Culture 

But is assimilating into the hero-driven culture the right strategy for a compliance program?  

I’ve had a chance recently to think about this question in a very personal way. Since leaving behind my life as a senior legal and compliance executive at large health care systems, I’ve started providing interim compliance leadership services to small health care organizations — standalone hospitals, small systems, and health tech start-ups.  

I’m often a one-woman show writing on a blank or nearly blank slate. And on a near-daily basis, I face a choice between swooping in, tackling a problem and saving the day or stepping back, thinking holistically and building systems that will minimize the need for heroes longer term.  

Given that my role as an interim is short-lived by design, the choice is obvious — build systems that will help the organization navigate through compliance challenges long after my engagement ends. Even so, it can be a challenge to quell my inner hero — to focus on the complex and time-consuming task of building systems while forgoing the quick gratification of popping out an answer or a quick fix. 

Experiencing this tension has really highlighted for me how building strong systems is the counterbalance to playing the hero. And that, ultimately, building an effective compliance program requires prioritizing systems over heroes.  

What Is “Systems Thinking” in Compliance? 

Systems thinking views compliance as an interconnected web of people, processes and technology. This approach builds resilient workflows that deliver consistent results, no matter who’s on point. 

Why Systems Beat Heroes 

• Consistency: A system runs the same way every time, reducing risk and variability. 
• Scalability: Growth doesn’t depend on hiring more “unicorns.” 
• Resilience: When someone leaves, the process doesn’t fall apart. 
• Defensibility: Audit trails and documentation demonstrate effectiveness. 

What Systems Can’t Do 

Systems can’t do everything; they don’t obviate the need for judgment. Instead, they help pinpoint exactly where judgment is needed. In other words, systems can take care of routine and predictable aspects of compliance work, allowing the compliance team to focus their expertise on those unique or complex scenarios that need thoughtful decision-making and judgment calls. 

Moving from Heroics and Reactivity to Systems Steadiness 

The shift from heroics to systems thinking requires a move away from reactivity. In a reactive mode, attention is naturally drawn to individual problems that are urgent, visible and immediately solvable. The focus on immediate fixes makes it harder to step back slow and zoom out enough to see the larger patterns at play. This is a perfect description for most (if not all) corporate environments I’ve experienced. 

Systems thinking, on the other hand, involves creating the space to recognize how the system as a whole shapes recurring issues. Instead of focusing narrowly on the problem, it involves zooming out and asking questions like: 

• What pressures, structures or gaps made this outcome likely? 
• What yellow or red flags are we missing until something breaks? 
• What incentives are unintentionally rewarding risky behavior? 

Systems thinking can also mean building playbooks, decision rules and feedback loops for frequently arising compliance issues.  

How Can AI Help with Systems Thinking in Healthcare Compliance? 

In the real world, compliance leaders are often required to react to urgent issues. The question then becomes how best to toggle back and forth between reactivity and systems thinking. One tool for facilitating this balance is an AI assistant. I’ve found that AI can help create that crucial space to step back and see the system as a whole, while still allowing me to toggle back to reactivity when needed. 

In my work, I have come to rely heavily on AI as a thought partner – helping me to extract and organize my knowledge and experience into repeatable, shareable protocols customized to a particular organization’s needs.  

Three Examples of AI as Systems Thinking Partner 

Here are three specific examples of how I have used AI as a systems thinking partner for compliance programs: 

1. Structured Knowledge Extraction 

This works one of two ways for me. Sometimes I do a brain dump, sharing with my AI assistant my thoughts on  

• What I’m trying to achieve 
• What I’ve seen work or fail in the past 
• What challenges I anticipate 

Other times, I ask my AI assistant to interview me about the problem and possible solutions. Both paths yield a structured outline, allowing me to translate my judgment and approach into clear steps. 

2. Turning Steps into Repeatable Workflows  

Once my AI assistant has my knowledge in a structured form, the next steps are  

• Creating standardized workflows 
• Identifying decision points and criteria  
• Capturing it all in a playbook to hand off to others with plain language instructions, checklists and templates 

3. Continuous Improvement through Continuous Feedback 

Good systems are designed to improve over time. They are structured enough to create consistency and clarity, but flexible enough to absorb real-world experience from the people who use them.  

AI can support this by helping surface patterns, friction points, and recurring questions that emerge as the protocol is used day to day. This facilitates a continuous feedback loop in which protocols can be regularly refined to better reflect how work actually happens.  

The Takeaway: A Fresh Way of Viewing Compliance Effectiveness 

What I’m advocating for here is a different way of thinking about effectiveness in compliance. Being the person who can step in, solve the problem, and keep things moving can feel like success — and in the short term, it often is. But over time, that pattern can hide deeper system weaknesses and make organizations overly dependent on individual heroics. 

Systems thinking offers a quieter alternative. It invests in structures that make good outcomes more likely without constant intervention. When systems are doing their job, judgment doesn’t disappear — it gets used more intentionally in the situations that truly require it. 

I’ve learned that tools like AI can ease and accelerate this shift by helping translate experience and intuition into shared workflows that others can use and improve. The goal isn’t perfection or automation for its own sake, but durability: compliance programs that continue to function well even as people, priorities, and pressures change.

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• Four Ways to Integrate Compliance with… by CJ Wolf, MD

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post How to Build a Holistic Approach to Healthcare Compliance with Systems  first appeared on YouCompli.