This Q&A with compliance expert, Lisa Herota, RHIA, CHC, CHIAP, CHPS, CCS covers best practices for a data-savvy compliance leader. Learn about realistic compliance metrics and how to share them effectively. Read more about Lisa’s background and experience at the end of this blog. 

Question 1 – How do you define value in the context of healthcare compliance? What kinds of value can compliance create? 

Lisa Herota – Compliance has a positive impact on financial, clinical and operational outcomes when we manage compliance well overall, not just by avoiding penalties.  

We help the organization safeguard the mission and reputation by: 

• Protecting revenue  
• Enabling ethical growth 
• Maintaining patient safety 

We do this all while also making our leaders feel more confident. They can make informed decisions through a compliance mindset, versus just worrying about how we’re going to avoid a penalty. 

Q 2 – Can you share examples of how you’ve created value or seen others do it? 

LH – One approach I’m proud of is strengthening organizational trust and reputation by developing a culture of compliance. This happens through:  

• Rounding and being present in the organization 
• Doing trainings  
• Partnering with leaders, medical staff, employees and even patients 

I’ve taken compliance teams from being the department where ideas go to die or the “Department of No” to being seen as a function that engages and supports. We became a resource that leaders want to bring to the table at the beginning of projects and discussions as a support versus just somebody to call when things go wrong. 

Q 3 – How do you measure and quantify compliance value?  

LH – I love data. I preach data, data, data to all compliance leaders. There are lots of different metrics we don’t think about, but many times, we just look at how we avoid fines. 

Actually, compliance has a lot of data for leaders to study. We can:  

• Look at percent of applicable regulations implemented on time.  
• Look at number and severity of audit findings or corrective action plans implemented.  
• Trend reported issues and how quickly those issues were resolved.  

Compliance Metric: Tracking the Near Misses 

Something that compliance leaders don’t think about often enough are the near misses. We usually think about these situations in patient safety and quality. But many times, compliance can help with close calls, and we should track those.  

Compliance Metric: Financial Value from Correct Regulation Implementation 

Common examples of financial value derived from correctly implementing new regulations include: 

• Reductions in external legal expenses 
• Decrease in denials and claw backs or repayments 
• Additional revenue capture  

Compliance Metric: Operations Staff Hours Saved 

You can talk to your operational leaders about how their team workloads benefit, especially if you have good regulatory change management tools with reporting and dashboards. Many times, I’ve tracked the number of hours saved that operational leaders don’t have to spend reading through regulations to decipher and interpret them.  

Department heads save valuable time when we provide them with tools like policy templates, implementation information, and the interpretation of the regulation itself. So, the hours compliance saves other department leaders is a good metric, too. 

Hard for Compliance to Quantify: Harm Avoidance  

It’s difficult for compliance professionals to quantify how they help the organization avoid harm. It’s definitely easier for revenue-generating departments to show their value, because they can measure the revenue they drive.  

But compliance often concentrates on how we avoid fines, and it’s hard to prove we’ve truly avoided something when the attitude is “Maybe we wouldn’t have gotten that fine anyway, regardless of what we do or don’t do.” That’s why I focus on other metrics. 

Q 4 – Who needs to know about the value that compliance creates, and how do you communicate that? 

LH – That’s a great question. There are various levels across any health system or organization that need to know the value that compliance has created, but the way you report it is going to look different based on whom you’re talking to.  

Talking to the Board 

When I’m presenting to my board or board committees, I target risk mitigation trends, assuring them we’ve got this. I use heat maps that show risk rankings, prioritization and key regulatory risk areas. I use implementation rates or key issues identified and resolved. When I’m talking to my board, I highlight how compliance work aligns with the strategic priorities of the organization.  

Talking to the Executive Team 

But when I’m talking to my executive team, I might get a little more granular with how many reduced denials or repayments or how many claw backs we avoided. Also, that metric about saving frontline leaders’ time, because that affects their operational teams as well as alignment with patient safety, quality and patient experience goals. A key metric is showing executive leaders how compliance ties into all the other objectives that the organization is trying to accomplish.  

Talking to Operational Leaders and Frontline Teams 

It’s a very different story when I’m talking to operational leaders or frontline staff.  With them, I focus on how I’m helping them succeed:  

• Fewer surprises related to regulations that apply to them 
• Reduced fire drills from reactive implementations versus steady, methodical implementation of regulatory change. 
• With good policies, procedures and training 

With frontline staff, it’s all about what compliance does. Proving compliance value is about showing them how we:  

• Impact their day-to-day reality. 
• Make changes to protect them and their patients. 
• Help make their work easier and safer. 

Really, it’s all about how we help support them and affect their day-to-day work. 

Tie Compliance Work to Strategic Goals for Value Recognition 

To overcome compliance reporting roadblocks, I go back to tying compliance’s work directly to the organization’s strategic goals. Just connect what we do to what the organization is focused on. Show how what we do impacts quality, CMS, star ratings, financial stability, the growth of new service lines and innovation.  

We need to connect what we do to optimizing and streamlining those goals and processes. 

Q 5 – What feedback have you had about compliance metrics and value? 

LH – One of the stories I love to share is about the day I was presenting a regulatory change management dashboard to my board. The very first time, I showed them that over the course of a year, the compliance team had touched over 535 regulations. It was the height of Covid, and when I presented that dashboard, board members just sit back in their chairs almost with a collective sigh.  

And they said, with the data you present, we can see what’s happened to the organization. We’re not just hoping we’re compliant. Now we can prove it. We can show that the organization truly is operating in a compliant manner. That was one of my biggest takeaways from frontline leaders.  

Other feedback I’ve received includes: 

• “I feel like compliance is supporting and partnering with me, not just telling me no or being a barrier.” 
• “When we streamlined compliance tools, that really helped support compliance functions.” 
• “Compliance saves us time and work by not having to review, interpret and decipher complicated regulations.” 

Leaders feel confident knowing we’re not missing anything and that they’re being supported. 

Be a Confident, Data-Driven Compliance Leader 

Wouldn’t you like to feel the same way about your compliance program? Reach out and we’ll show you some of the compliance management tools mentioned in this blog. 

About the Author 

Lisa Herota is a seasoned healthcare executive with over two decades of experience leading high-impact initiatives in compliance, privacy and health information management (HIM). She brings a strategic, data-driven approach to safeguarding organizational integrity. 

Throughout her career, Lisa has held pivotal leadership roles at several medical systems. Her expertise spans the full spectrum of healthcare operations, from managing complex ICD-9 and CPT coding systems, to overseeing departmental budgets and navigating rigorous accreditation standards. 

Lisa is a recognized expert in regulatory change management and is passionate about transforming compliance from a “policing” function into a proactive business partner. She holds an impressive array of professional certifications that underscore her deep technical knowledge, including: 

• RHIA: Registered Health Information Administrator 
• CHC: Certified in Healthcare Compliance 
• CHIAP: Certified Healthcare Internal Audit Professional 
• CHPS: Certified in Healthcare Privacy and Security 
• CCS: Certified Coding Specialist 

Beyond her technical skills, Lisa is a dedicated advocate for building a culture of compliance. She leverages her background in research and data compilation to provide executive leadership with insights to make informed, ethical and growth-oriented decisions.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?  first appeared on YouCompli.

Three tips for partnering with Human Resources to show how Compliance adds value and shapes healthcare culture  

Partnering with Human Resources is key to demonstrating how Compliance adds value to healthcare organizations and shapes a strong culture. In short, integrating Compliance with HR processes builds trust that goes both ways.  

Incorporating compliance into the hiring process and aligning leadership competencies with organizational values are effective ways to ensure that companies bring in employees who feel it’s important to be ethical and compliant. It also demonstrates to employees – from their initial interaction with the healthcare system – that it’s an ethical and good place to work.   

My successful collaboration with HR has enabled my organization to show employees that compliance is important no matter what their role is. My efforts to shape the culture and show how Compliance adds value include three key activities: developing standard interview questions, building leadership competencies, and sticking your neck out.  

Integration Activity 1: Develop Standard Interview Questions   

In my organization, Compliance has always worked closely with HR on different fronts, from onboarding and new hire orientation to employee reports of issues and the conflict-of-interest questionnaire. My HR team initiated taking it to the next level by involving Compliance in the hiring, interview, and screening processes.   

Our partnership with HR impacts every level of the organization – from housekeeping to clinical staff and patient safety, all the way through finance, operations, revenue cycle, and leadership. It reflects our organization’s commitment to compliance and ethics and to hiring people who will uphold our mission, vision, and values.   

To clarify what I mean by partnering with HR, it doesn’t mean Compliance is included in every interview. It starts with working closely with HR to add compliance and ethics-related questions to interview templates.   

We started here because we wanted to demonstrate a culture of compliance from the very beginning. This felt like one of the best ways we could do it since employees make or break our culture.   

They either facilitate and perpetuate it, or they don’t. There’s no in-between, and that’s why getting the right employees in the door is so important.   

I partnered with my HR team to develop standard interview questions assessing an ethical and compliance focus. Our sample interview questions and follow-ups include:  

• What do you believe compromises ethics in the workplace? Follow-up: How do you handle situations where ethics have been or might be compromised?   
• Have you worked for a company that had a code of conduct? Did you have positive or negative experiences related to the code of conduct? Follow-up for a leadership role: Give an example of a situation involving one of your direct reports who violated or compromised the code of conduct and how you handled the situation.   
• How does being an ethical individual differ from being an ethical organization?  

As we developed the questions, we engaged with operational leaders to see how they would approach including compliance and ethics in their interview processes. It took us a few months to develop and review the questions, making sure we captured everything we wanted to from a leadership perspective.  

When the templates were finalized, HR shared them with leaders and encouraged them to use them.   

Every couple of years, we revisit and make sure the questions are still appropriate and that leadership feels they’re effective.  

Integration Activity 2: Build Leadership Competencies  

I mentioned earlier that partnering with HR doesn’t mean Compliance is at every interview. However, there’s an exception to this.  

It’s important for Compliance to be included in executive-level interviews to start building relationships. This also reinforces that the organization values compliance, expects ethical behavior, and supports leaders in these areas.  

Another way I reinforced this is by collaborating with HR to build leadership competencies. We incorporated the competencies into our organization’s merit increases and goal planning.   

We use an acronym for our leadership competencies:   

• Inclusive  
• Develop yourself and others  
• Have Emotional Intelligence  
• Be Accountable and Strategic  
• Your IDEAS are welcome.  

Connecting our incentive structure to the skills, behaviors, and attributes we want our leaders to demonstrate ensures that they’re aligned with the organization’s mission, vision, and values. It’s a meaningful way for Compliance to shape culture.  

But you must be willing to make the effort to put the mission, vision, and values at the heart of your work. Sometimes it means taking a risk and sticking your neck out.  

Integration Activity 3: Stick Your Neck Out  

Taking a risk may mean making the first move, especially if you don’t have a strong relationship with your organization’s HR leaders. Start by reaching out to them. If you have a connection within your HR team, leverage that.   

A good opening question to ask is: how can Compliance partner with HR to make the screening process better and add a focus on compliance?   

If you don’t have that relationship with HR, find operational leaders who you’re comfortable with and who want to change their own departments. Partner with them on shifting their leadership styles or incorporating compliance into their respective interview processes.   

Once you start shifting an operational area’s culture and influencing the processes, your HR team will notice the changes. And the operational leaders you partnered with can help champion the changes with HR.  

It’s all about putting the effort into building relationships and showing colleagues that Compliance is there to partner with them in all aspects of the business. Be visible within the organization and within the leadership team – even if it means getting outside of your comfort zone.  

To be successful as compliance professionals, we have to look at how we can shape the culture. It’s critical to get out of your office and engage with the rest of the organization.  

Ask how you can improve things. It doesn’t have to be a huge initiative. Just reach out and start asking questions, like what keeps you up at night?   

Ask how you can partner with operational leaders and be willing to do the work. Bring questions to the table as well as suggestions and solutions. That’s what true partnership looks like.  

My willingness to get into the trenches of operational leaders’ workflows and their problems has been the key to my success. Demonstrate that you’re here to help by asking how you can make things better for them. Show that Compliance isn’t the bad guy, and that we’re truly their partners.  

The secret to my success in reinforcing the value of Compliance’s work comes from partnering with HR. Developing standard interview questions, building leadership competencies, and sticking your neck out to establish strong relationships across the organization are crucial to demonstrating how Compliance delivers value. Focusing on these three areas can help you shape your organization’s culture and show employees that no matter what their role is, compliance is important.   

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Our in-house team works tirelessly to monitor US regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm.

Never Miss an Article!

Never miss an article from Lisa Herota. Sign up for YouCompli’s weekly email if you haven’t already.  

The opinions expressed in this blog are the author’s and do not represent the opinions of her employer.  Lisa Herota is the compliance and privacy officer for a Colorado-based nonprofit community health care system. She discussed her experience creating cultural change as a speaker on the HCCA webinar “Creating and Demonstrating the Value of Regulatory Compliance and Shaping a Culture of Compliance in Healthcare” on April 26, 2023.  

The post Integrating Compliance into Human Resources Processes    first appeared on YouCompli.

Five tips for creating cultural change and showing how healthcare Compliance adds value. 

Whether it’s “where good ideas go to die” or “the department of no,” compliance officers have likely heard negative descriptions of their department. 

I was motivated to change these misconceptions about Compliance in my current role as compliance and privacy officer. My team and I have worked hard to transition from the Department of No to the Department of Yes – With Guardrails. 

Our efforts to create cultural change and show how Compliance adds value include five key activities:  

1. Making the most of metrics
2. Being visible 
3. Providing education
4. Serving as a strategic partner
5. Facilitating Compliance liaisons

What is a Department of Yes for Healthcare Compliance?

In compliance, the law and regulations are the basis for everything we do. We must adhere to law and regulations while helping the organization do what it needs to. The good news is, the laws and regs are not trying to keep us from doing what we need to do.  

Most healthcare regulations focus on enabling hospital systems to keep patients safe, provide quality patient care, and reduce risk. So, part of changing the culture is reevaluating how Compliance approaches the asks from business and operational leaders.  

There have been very few times when a colleague has come to me and said, “We’d like to do this,” and I’ve had to say no.  

I start by acknowledging the effort that went into the proposal, and asking questions: What is the plan or program trying to accomplish? How can we safely merge it together with the relevant regulation?

Most times, I marry the two – the goal with the rule – and say, “We can do this in some form or fashion, and here are the guardrails.” When colleagues feel heard, they’re more willing to adhere to those guardrails because they understand that you’re partnering with them.  

My collaboration with the Legal department is another reason I have been successful in establishing a Department of Yes. Whether it’s in-house or external counsel, they often understand the gray areas better than compliance officers do.  

Partnering with legal counsel is invaluable for considering different approaches to program and policy proposals, finding the gray areas, and defining which guardrails to stick to. 

1. Make the Most of Healthcare Compliance Metrics  

CEOs and CFOs always want to know how Compliance impacts the bottom line. But it can be hard to show the value of Compliance because it’s tough to quantify in dollars. 

Even if you can’t show a hard financial impact, you can demonstrate how Compliance delivers value by prioritizing metrics. This enables leaders to make data-driven decisions. 

I created dashboards to highlight high-level compliance issues, such as the number of concerns reported via our hotline. Metrics like this are effective both in gauging awareness of Compliance among employees and in showing the impact we make across the organization.

The most compelling measurement is the number of regulations we monitor that affect our organization. I use YouCompli to generate a report showing we had touched, in some way or another, over 500 regulatory changes throughout the year. 

When I showed that summary to my board at the end of our fiscal year, I saw the looks on all of their faces. They had no idea of the extreme administrative burden of regulations! The summary clearly demonstrated how Compliance manages all the risk associated with regulatory changes across the organization.  

2. Be Visible to Healthcare Operations and C-suite Leaders 

When I started as compliance and privacy officer, I scheduled meetings with C-suite and operational leaders. I asked about their pain points and what keeps them up at night. And I explained that my team and I want to support them in accomplishing their day-to-day and strategic goals. 

These conversations raised Compliance’s visibility and had an immediate impact in changing the culture. Leaders realized Compliance didn’t have to be the department where ideas go to die anymore. Colleagues started coming to me with questions and ideas, asking for guidance before making big decisions. 

We also raised our visibility by rounding, and we started each of our roundings with questions like:

• Do you know about the compliance and privacy hotline?
• Do you know how to record an issue?  

We would get deer-in-the-headlights looks, so we pulled out the computer to walk them through everything. Rounding helps build relationships, and it’s also an educational opportunity. 

3.Provide Ongoing Healthcare Compliance Education 

Rounding 

While we’re rounding, we share hot topics on the Office of the Inspector General (OIG)’s list. We talk about common risks across the organization, and we end every rounding session by asking: How can Compliance support you? 

There isn’t a cookie-cutter approach to effective education. It requires being visible and talking with employees to understand their concerns and how Compliance can help them. 

I develop educational materials that target knowledge gaps. For example, after we round, my compliance director reaches out to that department leader and says, “These are the takeaways from our rounding. Can I come to your next department meeting?” 

Then we tailor a presentation to fill the knowledge gaps identified during the rounding. We also engage employees via a Privacy & Compliance Corner in our organization’s weekly Monday Messages newsletter. And we partner with IT Security to email biweekly tips on keeping the organization safe and protecting patient information. 

Healthcare Policy Writing 

Another educational opportunity comes with policy writing. We emphasize showing staff how the policies apply to the work they do daily. Most policies are legalistic and are hard to read. Our job is to make them easier to understand, so that clinical staff can focus on providing quality patient care rather than wasting time interpreting policies. 

Healthcare Compliance Education is Fun 

We have fun with education too. Part of our HIPAA educational campaign was awarding Starbucks gift cards to the first employees who called the compliance hotline and correctly shared what the acronym stands for. It raised awareness of HIPAA and our compliance hotline. 

Cybersecurity 

Cybersecurity is another hot topic and an educational opportunity. It’s a never-ending battle in healthcare; it only takes one employee to click a link and let bad actors into our system, creating a domino effect of chaos. 

When my organization was dealing with a cyber issue, my team worked with the IT Security team to implement a simulated phishing email platform as an educational tool. When I presented the platform for approval to executives, it included increasingly punitive sanctions if employees clicked a link, responded to an email, or opened an attachment.  

Yet executives asked for more aggressive sanctions, including immediate termination. They likened it to not allowing an employee to set a fire in the operating room more than once.  

I pushed back, explaining that employees first need education – whether it’s on preventing a fire or avoiding a phishing scam. The executive team and I compromised on starting with a four-step escalation program.  

After six months of having this policy in place, no employees have made it past the second “failure” of clicking a link, responding to an email, or opening an attachment. It proves my point that education and training are effective. 

4. Be a Strategic Partner 

It also underscores how being visible and providing education are integral to serving as a strategic partner. I take the conversations I have with staff and leaders to the CEO and offer my guidance on managing the issues identified. 

This positions Compliance as a strategic partner and a problem solver and shows how we deliver value. As my team and I strengthened relationships across the organizations, these conversations happened more and more. In turn, the CEO was regularly asking the executive team and operational leaders, “Have you run this by Lisa?”  

I saw a trickle-down effect: the more we built relationships and engaged colleagues, the more they started bringing us into their discussions. Being an effective strategic partner starts with simply asking questions.

5. Engage Liaisons  

No Compliance department ever has enough full-time employees to do everything on our own. For example, we use the OIG work plan as the basis for our risk assessments and risk matrix. But in a large organization, how do you assess every item in the OIG workbook?  

I reached out to the executive leadership team and asked to engage someone in each area to partner with us on monitoring, auditing, and reporting. Once we identified liaisons, my director met with them and educated them on our expectations. We shared tools, spreadsheets, and audit plans, and reinforced that Compliance is a point of contact and resource – someone they can bounce ideas off of.  

In our compliance meetings, our liaisons get a voice at the table. They report out and highlight what their teams are doing to drive compliance in their areas. It’s a way to engage liaisons and celebrate the contributions they make.  

Impactful, Interrelated, and Critical Tactics for Healthcare Compliance 

I’ve had great success reinforcing the value of the work Compliance does by facilitating Compliance liaisons, making the most of metrics, being visible, serving as a strategic partner to leaders, and providing ongoing education. As my story about the educational tool for phishing scams showed, these five tactics are impactful, interrelated, and critical for demonstrating how Compliance delivers value. If you want to shape your organization’s culture, focusing on these five areas will put you on the path to success.

Related: Read “Five ways to show how healthcare Compliance delivers value: Build relationships to win the hearts and minds of operational leaders” to learn how to employ empathy and intellectual curiosity. It will help remind operational leaders of their role and the value Compliance delivers.

Lisa Herota, RHIA, CHC, CHPS, CCS

The opinions expressed in this blog are the author’s and do not represent the opinions of her employer.  Lisa Herota is the senior director of compliance and privacy for a Colorado-based nonprofit community health care system. She discussed her experience creating cultural change as a speaker on the HCCA webinar “How Compliance Creates Value for the Healthcare Organization” on Nov. 29, 2022. 

Lisa holds a Master of Science in Health/Health Care Administration/Management – Informatics from Colorado Technical University, a Bachelor of Science in Health Information Administration from the University of Cincinnati, and Associate of Science degrees in both Health Information Technology from Santa Barbara City College and Biology from Yuba College.

“How Compliance Creates Value for the Healthcare Organization” – Download the white paper now.

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Transforming Compliance to a Department of Yes first appeared on YouCompli.