In this article, Lisa Estrada shares her perspectives on why systems beat heroes in compliance and how AI can help accelerate systems thinking in fast-paced healthcare environments. 

Lisa is a seasoned compliance executive with more than 25 years in healthcare, including serving as Chief Compliance Officer for several large, national health systems. See more of her impressive credentials at the end of this blog. 

Systems Beat Heroes: The Quiet Advantage in Compliance 

Ever notice how organizations love a hero story? The person who swoops in, tackles the problem, and saves the day. For the individual, there’s the rush of feeling impactful and the shout-out at the team meeting. For the organization, the crisis is averted, allowing it to direct resources to other pressing challenges. That is, until the next crisis pops up. 

This hero-driven culture is the norm in the healthcare systems where I’ve worked. And as a compliance leader, I’ve fallen into the trap of believing that a key way to establish the value proposition for the compliance function is to show up as the hero, avert the crisis and bask in the glow of the company-wide shout out.  

The Alternative to Hero-driven Compliance Culture 

But is assimilating into the hero-driven culture the right strategy for a compliance program?  

I’ve had a chance recently to think about this question in a very personal way. Since leaving behind my life as a senior legal and compliance executive at large health care systems, I’ve started providing interim compliance leadership services to small health care organizations — standalone hospitals, small systems, and health tech start-ups.  

I’m often a one-woman show writing on a blank or nearly blank slate. And on a near-daily basis, I face a choice between swooping in, tackling a problem and saving the day or stepping back, thinking holistically and building systems that will minimize the need for heroes longer term.  

Given that my role as an interim is short-lived by design, the choice is obvious — build systems that will help the organization navigate through compliance challenges long after my engagement ends. Even so, it can be a challenge to quell my inner hero — to focus on the complex and time-consuming task of building systems while forgoing the quick gratification of popping out an answer or a quick fix. 

Experiencing this tension has really highlighted for me how building strong systems is the counterbalance to playing the hero. And that, ultimately, building an effective compliance program requires prioritizing systems over heroes.  

What Is “Systems Thinking” in Compliance? 

Systems thinking views compliance as an interconnected web of people, processes and technology. This approach builds resilient workflows that deliver consistent results, no matter who’s on point. 

Why Systems Beat Heroes 

• Consistency: A system runs the same way every time, reducing risk and variability. 
• Scalability: Growth doesn’t depend on hiring more “unicorns.” 
• Resilience: When someone leaves, the process doesn’t fall apart. 
• Defensibility: Audit trails and documentation demonstrate effectiveness. 

What Systems Can’t Do 

Systems can’t do everything; they don’t obviate the need for judgment. Instead, they help pinpoint exactly where judgment is needed. In other words, systems can take care of routine and predictable aspects of compliance work, allowing the compliance team to focus their expertise on those unique or complex scenarios that need thoughtful decision-making and judgment calls. 

Moving from Heroics and Reactivity to Systems Steadiness 

The shift from heroics to systems thinking requires a move away from reactivity. In a reactive mode, attention is naturally drawn to individual problems that are urgent, visible and immediately solvable. The focus on immediate fixes makes it harder to step back slow and zoom out enough to see the larger patterns at play. This is a perfect description for most (if not all) corporate environments I’ve experienced. 

Systems thinking, on the other hand, involves creating the space to recognize how the system as a whole shapes recurring issues. Instead of focusing narrowly on the problem, it involves zooming out and asking questions like: 

• What pressures, structures or gaps made this outcome likely? 
• What yellow or red flags are we missing until something breaks? 
• What incentives are unintentionally rewarding risky behavior? 

Systems thinking can also mean building playbooks, decision rules and feedback loops for frequently arising compliance issues.  

How Can AI Help with Systems Thinking in Healthcare Compliance? 

In the real world, compliance leaders are often required to react to urgent issues. The question then becomes how best to toggle back and forth between reactivity and systems thinking. One tool for facilitating this balance is an AI assistant. I’ve found that AI can help create that crucial space to step back and see the system as a whole, while still allowing me to toggle back to reactivity when needed. 

In my work, I have come to rely heavily on AI as a thought partner – helping me to extract and organize my knowledge and experience into repeatable, shareable protocols customized to a particular organization’s needs.  

Three Examples of AI as Systems Thinking Partner 

Here are three specific examples of how I have used AI as a systems thinking partner for compliance programs: 

1. Structured Knowledge Extraction 

This works one of two ways for me. Sometimes I do a brain dump, sharing with my AI assistant my thoughts on  

• What I’m trying to achieve 
• What I’ve seen work or fail in the past 
• What challenges I anticipate 

Other times, I ask my AI assistant to interview me about the problem and possible solutions. Both paths yield a structured outline, allowing me to translate my judgment and approach into clear steps. 

2. Turning Steps into Repeatable Workflows  

Once my AI assistant has my knowledge in a structured form, the next steps are  

• Creating standardized workflows 
• Identifying decision points and criteria  
• Capturing it all in a playbook to hand off to others with plain language instructions, checklists and templates 

3. Continuous Improvement through Continuous Feedback 

Good systems are designed to improve over time. They are structured enough to create consistency and clarity, but flexible enough to absorb real-world experience from the people who use them.  

AI can support this by helping surface patterns, friction points, and recurring questions that emerge as the protocol is used day to day. This facilitates a continuous feedback loop in which protocols can be regularly refined to better reflect how work actually happens.  

The Takeaway: A Fresh Way of Viewing Compliance Effectiveness 

What I’m advocating for here is a different way of thinking about effectiveness in compliance. Being the person who can step in, solve the problem, and keep things moving can feel like success — and in the short term, it often is. But over time, that pattern can hide deeper system weaknesses and make organizations overly dependent on individual heroics. 

Systems thinking offers a quieter alternative. It invests in structures that make good outcomes more likely without constant intervention. When systems are doing their job, judgment doesn’t disappear — it gets used more intentionally in the situations that truly require it. 

I’ve learned that tools like AI can ease and accelerate this shift by helping translate experience and intuition into shared workflows that others can use and improve. The goal isn’t perfection or automation for its own sake, but durability: compliance programs that continue to function well even as people, priorities, and pressures change.

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post How to Build a Holistic Approach to Healthcare Compliance with Systems  first appeared on YouCompli.

Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. Compared with other business functions, compliance has been slower to embrace AI, especially in healthcare, where concerns about risk, regulation, and potential bleed-over into clinical decision-making have made organizations particularly cautious. 

Yet the opportunity is substantial, especially when it comes to systems thinking. 

Why Systems Thinking Matters in Compliance 

Effective compliance programs depend on systems thinking. Rather than viewing each request for guidance, investigation, or remediation as an isolated issue, savvy compliance teams look at how individual problems fit into larger patterns. 

One of the challenges in any business function is the tension between individual heroics and well-designed systems, and, ultimately, systems win every time. Many compliance officers have been conditioned to act like lifeguards, diving in to save departments from themselves. But this reactive approach consumes time and limits impact. You stay busy, but the organization doesn’t necessarily become more compliant. 

Shifting away from heroic interventions requires time, strategic thinking and structural planning, resources that compliance professionals rarely have in abundance. This is where AI becomes a powerful ally. 

How AI Helps Compliance Move from Reactive to Proactive 

The key to building proactive compliance is carving out the mental space to think more broadly about operational processes. AI doesn’t replace human expertise, but it can significantly accelerate the work. 

AI tools can analyze the countless issues compliance teams handle daily and help generate system-level recommendations. Think of AI as a partner that gets you to the 50- or 60-yard line, far enough to give you a strong foundation, but still requiring human judgment to complete the plan. 

Using AI to Organize Compliance Processes 

The first step is identifying patterns: 

• What repeatedly goes wrong? 
• What are the recurring themes? 
• Where are the inefficiencies or high-risk points? 

Once you see the trends, you can begin imagining the systems that will address them. AI excels at helping structure these ideas. 

A practical way to start is by giving your AI assistant raw input: 

• Here’s what is happening. 
• Here’s the environment. 
• Here are the recurring issues. 

Then you can prompt the AI with something like: 

 “I want to build a system to help identify and minimize these risks within a complicated environment. What elements should be included, and what considerations fall under each element?” 

The output becomes a foundation, a map of decision points and organizational steps you can refine. 

Supercharging Systems Thinking 

Compliance work is complex, and many officers get stuck not because they lack insight but because they lack time. AI helps break the gridlock by organizing information, highlighting key considerations, and suggesting frameworks. 

The AI provides structure; the compliance professional brings subject-matter expertise. In this collaborative process, the AI’s suggestions spark additional ideas and help you think more holistically. The result is a level of systems thinking that becomes far more accessible even in hectic environments. 

The Human-AI Partnership 

Despite its power, AI cannot replace an experienced compliance officer. It draws from online information and from what you feed it, but it cannot grasp organizational nuance, personalities, or culture. 

For example, an AI may outline a solid system, but only the compliance officer understands how a skeptical executive will respond. That’s where the human element comes in. You can ask the AI to help tailor communications or anticipate objections, but the strategic decision-making remains yours. 

Staying Focused with AI Frameworks 

One of the hidden challenges of compliance work is staying focused long enough to complete long-term system projects. Urgent tasks constantly pull attention away, and partially built frameworks can easily get lost for months. 

AI-created structures help maintain focus. They provide guardrails, the methodological anchors that keep the conversation and planning on track. Most of the framework can often be developed in a single sitting, creating a roadmap you can return to even if you’re pulled into other issues. 

Even with the limitations of some AI tools, especially free versions that cap conversation length, paid versions make it easier to resume discussions, refine ideas, and maintain continuity. 

A Faster Roadmap to a Roadmap 

Compliance professionals work hard and add value every day, but much of that value is short-term because they lack the time to build the long-term systems that create lasting change. 

AI solves this by offering a “faster roadmap to a roadmap.” It accelerates the groundwork: 

•  Defining the problem 
• Outlining the system  
• Highlighting the risks 
• Mapping the components 

That clarity frees the compliance officer to focus on the human side of adapting the system to the organization, navigating culture, and communicating effectively with leaders. 

With an AI-driven framework, compliance work becomes more disciplined, efficient, and proactive. Systems thinking becomes not only achievable, but sustainable. AI doesn’t replace the expertise of compliance professionals—it elevates it. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post How to Use AI for Systems Thinking in Compliance Processes  first appeared on YouCompli.

It’s the nature of our mission to stay on top of what’s happening in the world of healthcare compliance. And right now, that focus couldn’t be more important.  

These are unusual times, and Compliance is feeling the impact. The Medicare Fiscal Year 2026 Final Rules were expected to be late but came through on time. However, hospitals must still rush to analyze and respond with action plans in short order. CMS transmittals are also likely impacted by the government shutdown (more on that later). 

That leaves many hospital compliance teams unprepared and under-resourced to cope with fast-coming changes. The price of noncompliance, even under extenuating circumstances, is reimbursement risk. 

Two Areas Needing Compliance Attention: Final Rules and Transmittals 

• Final Rules – Legally binding federal regulations that establish new policies in particular areas of healthcare. 
• CMS Transmittals – Internal instructions for updating CMS operational manuals to reflect new or changed policies. 

Two Important CMS Timelines: Fiscal Year and Calendar Year 

The CMS guidance for healthcare comes with its own deadlines attached, and every year there are two important and separate timelines for fiscal year and calendar year Final Rules.  

In healthcare, fiscal year guidance typically has an October 1 effective date, and that Final Rule usually drops in August. This year, YouCompli analysts got through the fiscal year Final Rules incredibly quickly, because CMS cut a lot of the material in the preamble, and that allowed more efficient review and analysis. 

Effective Date of Calendar Year Final Rule Coming Up Fast 

As every seasoned compliance professional knows all too well, CMS puts out a handful of big, omnibus rules for different areas of health care on an annual basis. This time of the year brings us the final rules affecting outpatient costs and billing. These areas usually get addressed during the calendar year, and these calendar year communications started dropping this year on November 5. That gives an effective date of January 1 of the next year.  

It’s important to get these annual changes synthesized and implemented in a health care organization because they cover the entire year. Even when Rules drop at the usual time (and not during a government shutdown), the short time frame to the established effective date still puts pressure on providers to analyze and develop a compliance action plan. That’s where having a partner like YouCompli already breaking down these rules and translating them into actionable business requirements is essential.  

Transmittals Could Be Delayed and Affect Claims Processing 

On top of concerns about Final Rules delays, CMS transmittals ceased to come out on September 30. Transmittals are typically issued on a running basis as they come up. In a given month, you can have anywhere from 15 to 150 transmittals come out.  

A CMS transmittal is not the same as a Final Rule. They are two distinct types of guidance documents from the CMS. Transmittals are official documents to communicate new or changed policies, procedures, claims and other operational guidance to Medicare administrative contractors (MAC), regional offices, and healthcare providers. The communications update specific CMS program manuals, instructions, and other documentation to ensure consistent implementation of Medicare rules.  

MACs Also Risk Claims Backlog with Transmittal Delays 

Another job of a transmittal is to direct the MACs on what to do in processing claims. These third-party contractors are hired by CMS to administer claims, and they can get backlogged on their instructions and claims processing when transmittals run late.  

Any claims processing delays impact providers, so it’s important to keep an eye on when these transmittal communications come out, especially if it drags out for weeks. If MACs struggle with claims processing because they can’t keep up with the updates, providers lose money. 

Whether it be through time-related loss, because then they have to reissue claims with fixes and things of that nature, delays directly impact revenues. That’s not good at a time when health systems are already under the gun. 

Solution: Proactive Compliance to Know, Act and Verify 

If you’re a YouCompli customer, you wouldn’t have to scramble to prepare for last-minute changes, because we would handle it.  

If communications are ever delayed, creating a time crunch, let us act as your analysist team, grabbing communications as soon as they come out, and breaking it down for you. We capture the necessary data and deliver it, along with easily understandable business requirements.  

You’ll know what you need to do to comply, so when the next Final Rule or transmittal hits your inbox, you’re ready to run with updating procedures, training and other requirements.  

We suggest getting on board with us now, so when that time comes, you’re not struggling with these risks and delays.  

About the Author 

Nate Ward, J.D. is the Manager of Compliance and Content Development at YouCompli Software. He comes from a deep background in healthcare compliance and the legal field. Nate leads a team of experts who read regulations, analyze how they apply, and recommend action plans for healthcare compliance.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post How to Prepare for New CMS Final Rules and Transmittals  first appeared on YouCompli.

The HHS OIG recently issued its first Industry Segment-Specific Compliance Program Guidance, or ICPG, with many more expected.  This first ICPG covers Skilled Nursing Facilities and Nursing Facilities.  

Let’s review some of the highlights. 

1. Quality of Care and Quality of Life 

For decades, the OIG and other government enforcement agencies have emphasized the importance of the quality of care and quality of life for nursing facility residents.   

When a nursing facility submits a claim to Medicare or Medicaid for reimbursement, it certifies the services were provided in compliance with all applicable statutes, regulations, and rules. If a nursing facility does not provide care consistent with professional standards of quality, or in an environment that promotes quality of life, claims for reimbursement may be considered false.   

The ICPG provides the following examples of quality and related safety concerns that can lead to submission of false claims:  

• providing medically unnecessary or grossly substandard services 
• housing residents in unacceptable or dangerous living conditions 
• failing to provide residents with activities 
• failing to provide residents with needed psychiatric care 

2. Billing Requirements 

The ICPG states, “Ensuring compliance with Medicare and Medicaid billing requirements should be a core function of nursing facility compliance program operations.” 

The OIG expects nursing facilities to be proactive in their oversight of billing compliance. This includes conducting regular reviews to ensure billing and coding practices are current and accurate, as well as performing regular internal billing and coding audits. Even if an entity makes an isolated billing error, that entity still has an obligation to repay the overpayment to avoid False Claims Act liability. 

The ICPG specifically addresses the following risk areas associated with billing requirements: 

• SNF Prospective Payment System (PPS)  
• Value-Based Payment Models and Programs 
•  Medicare Advantage and Medicaid Managed Care  
• Medicare Part D  
• Medicare Health Plan Enrollment for Nursing Facility Residents 

Interestingly, the ICPG for nursing facilities also refers readers to a supplement on understanding reimbursement for nursing facilities, which can be viewed at https://oig.hhs.gov/documents/compliance/10039/nf-icpg-supplement.pdf. 

3. Anti-Kickback Risks 

The OIG’s General Compliance Program Guidance (GCPG) highlighted some of the risks associated with the Federal Anti-Kickback Statute (AKS) in the healthcare industry. The nursing facility ICPG provides many helpful and specific AKS risks to unique to nursing facilities. Among the specific risks highlighted by the OIG are: 

• Free (or Below Fair Market Value) Goods and Services  
• Discounts 
• Arrangements for Services and Supplies  
• Long-Term Care Pharmacy and Consultant Pharmacist Arrangements  
• Hospital Arrangements  
• Hospice Arrangements  
• Care Coordination and Value-Based Care Arrangements  
• Joint Ventures 

The ICPG emphasizes that all referral relationships call for vigilance under the Federal AKS. The discussions in the ICPG not only highlight several risk areas for nursing facilities under this law, but it also provides excellent recommendations for mitigating those risks. OIG also stresses that nursing facilities should scrutinize the listed risk areas as part of their risk assessment, internal review, and monitoring processes. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Breaking Down the OIG’s First Industry-Specific Guidance  first appeared on YouCompli.

CEO Jerry Shafran has prepared a festive video to help us wrap up the year. We wish you a safe and happy Holidays and New Year! 

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.  

Download our Latest White Paper

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm.   

Sign up for our Weekly Newsletter

The post Recapping 2024 and Ringing In 2025  first appeared on YouCompli.

According to the November 2023 General Compliance Program Guidance from the OIG, compliance oversight is within a Board of Directors’ (BOD) fiduciary duty of care and a “critical component of the Board’s compliance role.” Conversely, there is increased pressure from a variety of government agencies (SEC, OIG, DOJ) for boards to become active and engaged without becoming involved in operations.   Finding the right balance can be challenging. 

The board’s responsibility also includes understanding the organization’s risks. A strong process for identifying risk areas and managing the risk is one hallmark of an effective compliance program. Monitoring and auditing can pinpoint potential risk factors and the outcomes will either confirm effectiveness or identify deficiencies. The Board should ensure that the risk areas are consistently reviewed, and corrective action(s) are taken. It would be prudent for the Board to generally know or be informed of the trends in the industry that add gravity to the risk areas such as: 

• The use of data analytics and artificial intelligence, which has introduced both positive and negative consequences.  
• The complexity of laws and regulations, somewhat designed to combat fraud, can be a more lucrative form of crime.  
• The abundance of protected health information (PHI) and personal identifiable information (PII) retained in anything electronic. 
• The growth of cybersecurity data breaches, ransomware attacks, and phishing scams are costly to prevent but can be devasting when they occur. 

Everyone enterprise-wide is responsible for compliance, and the Board should encourage compliance accountability. The General Compliance Program Guidance issued by the OIG has become the topic of conversation within the compliance industry. I thought it would be interesting to obtain viewpoints from seasoned professionals in the compliance field on what they believe the BODs should consider now and in the future: 

• “The November 2023 OIG General Compliance Program Guidance document mentions compliance officers 146 times, the board 120 times and the general counsel once. The board should probably know how important the OIG thinks their compliance role is.”   

— Roy Snell, Co-Founder and Former CEO, HCCA/SCCE 

• “Compliance is more than a legalistic view of the DOJ Evaluation of Corporate Compliance Programs (ECCP) guidelines, DOJ Corporate Enforcement Policy (CEP) and the GCPC aggregation of ‘voluntary,’ ‘non-binding’ guidance. In the past many applied their inner lawyer approach to them, by hanging their hat on terms like ‘guidance,’ ‘voluntary,’ ‘non-binding,’ etc. Currently many missed the spirit of the OIG’s and DOJ’s intent for corporate and board fiduciary duties. Now they suffer the very real consequences of judgment when they have to explain how the Board or company did not consider them in their operation risks when under a review, self-report or settlement that is often raising the specter of a false claim. In the future you will not be able to ignore the spirit of the ‘four horsemen’ (ECCP, CEP, GCPC, and the Qui Tam’s sword under the False Claims Act ‘should have known/deliberate ignorance standard’) because you may be accused in judgment to have been informed of the compliance risks, knowingly ignored applying resources to them and being without the easy excuse from blinders of legalism to their requirements to you personally. Simply said, you would be a penny wise and a pound foolish to ignore them as actual requirements in the future.”  

– Brian Flood, Partner, Husch Blackwell 

• “Governance leaders need to be continuously ‘upping their game’ and expertise as regulators and other key stakeholders are increasing expectations and oversight of board performance. This includes ensuring we are looking 2-3 years ahead (same as we require of management) and being proactive in what skillsets are needed on the board to demonstrate we are meeting our fiduciary duty and have the scope and depth to ask the right questions of management. Additionally, for boards that are compensated, we need to ensure we have processes in place to both measure board effectiveness and individual performance, similar to how we measure and compensate CEOs and the C-suite.”  

–Jenny O’Brien, JD, MS, CHC, President and Principal at BlackBridge Advisors 

• “In the coming years we may see boards look to their Chief Compliance Officer (CCO) to not only provide reports around the status of the compliance program and compliance risk areas but to also serve as an advisor on a broader range of topics as part of an enterprise risk management strategy. CCOs should educate themselves and develop the skills they will need as boards lean into ensuring all risks are prioritized and managed as part of corporate decision-making processes.”  

– Cindy Matson, MBA, CHC, CHPC, Vice President, Compliance & Audit Services, Sanford Health 

• “I think a top priority for healthcare Boards of Directors is to ensure someone on the board has healthcare compliance expertise. Many healthcare boards already seek out individuals with specific areas of expertise such as financial, audit, clinical, patient safety, or some other subject matter expertise. Compliance should be added to that list. Some OIG corporate integrity agreements (CIAs) already require this. But for organizations who want to be forward-thinking instead of reactive when it comes to their compliance programs, they should proactively seek out individuals who have compliance expertise to serve on their board. Such an individual would be able to provide leadership and training in how a board should fulfill its compliance program oversight duties. Some of these duties might include engaging experts to perform periodic compliance program effectiveness reviews or approval of compliance risk assessments and annual work plans. Having someone on the board with compliance expertise would aid the board in asking the right questions of executive management and the compliance officer in regard to the compliance program.”  

– C.J. Wolf, MD, CPC, CPC-I 

• “The rapid proliferation of artificial intelligence (AI) software tools available to healthcare companies is outpacing existing regulatory frameworks, leading to both known and unknown compliance risks. Our company survey revealed that fewer than 11% of U.S. healthcare companies have an AI compliance policy or even a registry of AI-utilizing software. As the evolution of AI mirrors the fast-paced digital revolutions of the 1990s, boards of directors and management often lack a clear understanding of the associated risks. Proactive Board governance is essential to ensure that innovation is paired with rigorous oversight, in an effort to effectively mitigate future regulatory and reputational risks.”   

–Jim Rough, CFE, CHC, CCEP, President SunHawk Consulting, LLC 

• “Future Board compliance strategies rely completely on the Board understanding compliance risks and obligations. Compliance Officers should present training and reports in a manner that helps ensure Board members understand the compliance risk. Assume your organization made a self-disclosure to correct a billing issue which, if not remedied, could have been considered a false claim. Reporting the self-disclosure to the Board and providing some background on the issue is expected, but does the Board know or understand the reason the self-disclosure needed to be done versus just refunding the overpayment? Does the Board understand what the False Claims Act is and the implications of a False Claims action? Compliance Officers can better prepare the Board for future discussions about compliance strategies if the Board has received an annual refresher training on the core laws and regulations that impact the organization. To help emphasize the importance and to help guide the strategy discussion, use settlements or first-hand examples to show how the laws and regulations are being enforced or interpreted. This will help ensure compliance strategy discussions are built on a common understanding of the rules and risks.”  

–Darrell Contreras, JD, CHC-F, CHPC, CHRC, Chief Compliance Officer at Millennium Health 

• “As Compliance Programs continue to evolve and mature, Board’s commitment needs to foster a culture of integrity and be visible by the entire organization.”  

—Debbie Troklus, President, Troklus Compliance Consulting 

• “I think with the OIG’s updated General Compliance Program Guidance (GCPG), there will be an increased concern about private equity firms that are financially backing healthcare organizations. More specifically, private equity investments in healthcare can raise unique compliance challenges due to potential conflicts of interest, billing/coding, and fraud and abuse. To guard against this, I think healthcare boards will need to make sure due diligence is done before entering into any partnerships with private-equity backed firms. Also, ensuring the private equity-backed firm has a robust compliance program in place that integrates with the healthcare organization’s own compliance program. Lastly, making sure that typical compliance activities, such as auditing, monitoring, education, and training, include that relationship with a private equity-backed firm.”   

–Jay Anstine, President, Bluebird Healthlaw Partners 

• “I hope the top priority for any healthcare Board of Directors will be the well-being of their workforce and workplace! We need standardized best practices to prevent burnout, detect culture and correct toxic cultures if we want happy and healthy staff who are ethical and compliant to provide quality and safe care!”  

—Maeve O’Neill, MEd, LPC-S, CHC, CDTLF 

The role of a BODs is multi-faceted, and compliance is one program area of oversight responsibility. Regardless of whether it is paid or unpaid, serving can be both rewarding and daunting at the same time, especially if you want to do the job well and make a difference. It takes considerable time and effort to review and digest the web of information involved with decision-making, developing strategy and fulfilling oversight responsibilities.    

Whether you are new to the field or a seasoned professional, hopefully the viewpoints above offer insight that can influence your BOD’s understanding of their oversight responsibility for the compliance program. 

Shawn DeGroot, CHC-F, CCEP, CHRC, CHPC is president of Compliance Vitals, providing consulting services for clients in need of practical guidance in a complex healthcare regulatory environment.  She served on the faculty of the HCCA Privacy Academy and served five years on Board of Directors for St. Charles Health System, Bend, OR.  Shawn’s area of expertise is also Corporate Integrity Agreements to include experience in seven CIA’s with the first CIA pertaining to Stark and Anti-kickback.  She also is a past president of HCCA/SCCE and serves on an advisory group to the HCCA/SCCE Board of Directors. 

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management   

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software.  

Get the latest from healthcare compliance experts  

Never miss an article by Shawn DeGroot. Sign up for YouCompli’s weekly email if you haven’t already.   

The post Experts Weigh In: The Oversight Role of a Healthcare Board of Directors  first appeared on YouCompli.

I recently attended the 2024 Health Care Compliance Association (HCCA) Managed Care Conference, and it was great to attend sessions and network with professionals and exhibitors from across the country. If I received $1 for every time artificial intelligence (“AI”) was referenced, I might have the financial means to invest in one of the many AI products being pitched to the health care industry.  

There was a lot of sharing of ideas around how to respond to both the opportunities and challenges that AI brings to our organizations and industry. I can summarize these in three themes – the ABC’s, if you will, of integrating AI into your compliance strategy. 

1. (A)SSESS

Great organizational compliance programs feature a formal process to assess and prioritize risk. This must include AI, because it can impact every part of our business – from clinical care delivery, claims payment, and patient interactions to human resources, procurement, and accounting. That said, AI is the same as any other emerging risk facing our organizations.  

If not already part of your 2024 compliance plan, “AI Program Oversight Strategy” should be at the top of your list. Key focus areas to include as part of the program strategy include: 

• AI Inventory: Assess and capture current AI initiatives within the organization in preparation of building an intake process to capture and review future AI initiatives.  
• AI Governance Strategy: Work with key business partners to build an oversight structure to help ensure consistency and standardization as new AI is proposed and introduced into the organization.  
• AI Awareness: Integrate AI into annual education and training modules. This will ensure awareness about protecting data and safeguards required when using AI in a healthcare setting, as well as capture key state and federal regulatory considerations. 

 2. (B)UY-IN

As interest in and adoption of AI increases, the value proposition in adopting and articulating an enterprise-wide AI strategy increases. The ability to use AI to optimize innovation of care models, increase patient access, scale, grow services and market share, and reduce the cost of healthcare is exciting and transformative.  

As with any enterprise initiative, the following considerations should be at the top of the list: 

• Executive Champion: Building an AI culture starts at the top, which is why recommending that your organization identify an executive business leader and champion is essential. Who that should be will be unique to each organization and dependent upon their strategy. The compliance professional’s role will be to ensure they are one of the key stakeholders at the table. 
• Skillset/Expertise: You also need the right skillset within the organization and your compliance team to lead this work. Do you have the right mix of talent and expertise within your team to help you adapt to and support your organization’s strategy of optimizing AI to scale and grow? Hiring new people, or an inability to hire, can’t always be the answer. It’s our job as compliance professionals to continue to find different ways to work to support emerging risk areas.  

3. (C)OLLABORATION

Generative AI is impacting all areas of healthcare. As adoption increases, so can the risks. Be prepared for an oversight structure that includes new partnerships such as cloud vendors, external IT professionals, and other consulting firms. If not already at the table, be ready to deploy the same due diligence and compliance program oversight as part of your vendor oversight initiatives. 

Integrating an AI program oversight structure can be viewed in two ways: overwhelming and fragmented, or reframed into something as simple as “ABC.” By taking a practical approach to this complex topic, you will be viewed positively by your team and able to respond well to questions about AI risks from your business partners, the C-suite, and your Board of Directors. 

Jenny O’Brien, JD, MS, CHC serves on the advisory board for YouCompli. She is also president and principal at BlackBridge Advisors. She has been the chief compliance officer (CCO) at multiple companies, including UnitedHealthcare, as well as a state assistant attorney general and a partner at a law firm. She is a past president and board member of HCCA/SCCE, serves on the boards of Bon Secours Mercy Health System and St. Charles Health System, and the advisory board of Stellar Health. 

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management    

Our in-house team works tirelessly to monitor US regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software.  

Get the latest from healthcare compliance experts   

Never miss an article by Jenny O’Brien. Sign up for YouCompli’s weekly email if you haven’t already.    

The post The ABC’s of Integrating AI Into Your Compliance Strategy  first appeared on YouCompli.

The updated General Compliance Program Guidance (GCPG) from the Office of the Inspector General (OIG) is an extremely helpful reference with an easy-to-understand user’s guide. As Shawn DeGroot noted in her recent look at top takeaways from the document, “The GCPG should be used to establish a compliance program, clarify roles and responsibilities, identify risks, and align current policies and procedures with what should be done.” 
 
Compliance officers can make the most of the new GCPG to meet the requirements of the OIG’s seven elements in a relevant and meaningful way. Below are recommendations – with tips for each of the seven elements – on how the new GCPG can help you develop and maintain your organization’s compliance program.  

Element 1 (page 33): Written Policies and Procedure 

• An organization’s Code of Conduct, which reflects its mission, vision and goals, should be revised regularly. Each employee and board member should read and acknowledge the Code of Conduct, reflecting their attestation to act ethically and comply with federal and state laws and regulations. 
• Policies around billing, coding, marketing, quality of care, and physician and vendor arrangements should be reviewed regularly. This means they should be revised if necessary, and a system should be created and maintained with outdated or retired policies.  

Element 2 (page 37): Compliance Leadership and Oversight 

• Organizations should designate a compliance officer who reports to the Board of Directors and/or the CEO directly. This person should have the authority and resources necessary to implement an effective compliance program.  
• All organizations’ compliance committees should support the compliance officer in carrying out the compliance program objectives. The committee should meet no less than quarterly.  
• The Board of Directors should oversee compliance, as they have a fiduciary duty to understand compliance operations and organizational risks.  

Element 3 (page 46): Training and Education  

• Make clear the identity and role(s) of the compliance officer and the compliance committee. 
• Be sure to highlight ways that individuals can raise compliance concerns or questions. Support an environment of nonretaliation. 
• Organizations should have a system to monitor training and education completion by every employee, contractor, student, and volunteer. 

Element 4 (page 50): Effective Lines of Communication  

• Organizations should allow confidential or anonymous reporting of concerns. This could be done through a hotline number, a website, an email, or mail.  
• Organizations then should develop and maintain a disclosure log and reported concerns.  

Element 5 (page 53): Enforcing Standards – Consequences and Incentives 

• Ensure that consequences for noncompliance are well-known throughout the organization. To deter noncompliance, these consequences should be consistently applied and enforced.   
• Develop incentives, such as staff recognition, to promote and encourage participation in the organization’s compliance program.  

Element 6 (page 55): Risk Assessment, Auditing, and Monitoring 

• Utilize risk-assessment tools to identify, analyze, and appropriately respond to organizational risks.   
• Develop and implement an auditing and monitoring plan and calendar for due dates. These audits can be conducted by internal or external auditors.  

Element 7 (page 59): Responding to Detected Offenses and Developing Corrective Action Initiatives 

• Investigate alleged violations. Summarize the investigative process and investigation findings, and report it all to the compliance committee, CEO, and Board.  
• Report misconduct or noncompliance to the appropriate governmental agency, as required. For example, in accordance with HIPAA breach notification requirements.  

As healthcare delivery systems become more complex, compliance professionals need to develop and implement compliance programs that are robust enough to provide a good foundation yet flexible enough to allow for change. Mapping the OIG’s new GCPG document to the seven elements can help compliance officers start the new year from a place of strength. 

Denise Atwood, RN, JD, CPHRM has over 30 years of healthcare experience in compliance, risk management, quality, and clinical areas. She is also a published author and educator on risk, compliance, medical-legal, and ethics issues. She is currently the Chief Risk Officer and Associate General Counsel at a nonprofit, multispecialty provider group in Phoenix and Vice President of the company’s self-insurance captive.  

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management   

Our in-house team works tirelessly to monitor US regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm.

Get the latest from healthcare compliance experts  

Never miss an article by Denise Atwood. Sign up for YouCompli’s weekly email if you have not already.

The post How the OIG’s New General Compliance Program Guidance (GCPG) Addresses the Seven Elements   first appeared on YouCompli.

Last month, the Office of Inspector General (OIG) published a new, user-friendly, 91-page General Compliance Program Guidance (GCPG). It is meant to be a helpful reference for everyone in the health care industry about how to develop a compliance program, safeguard their organizations and ensure they operate according to all laws and regulations. Users are encouraged to use the electronic version, to allow access to hyperlinked definitions and resource documents.  

Previous versions are archived on the OIG website and will no longer be published in the Federal Register. Also, industry segment specific guidance (ICPGs) will be developed for sectors of federal health care programs.  

Throughout the GCPG, helpful revisions and clarity are provided to a few areas that have proven problematic over the years. Here are a few areas I think are especially noteworthy:  

• Arrangements (page 10): The GCPG provides a brief overview of pertinent laws and a list of “key questions” to assist with the determination of whether an arrangement violates the federal anti-kickback statute. 
• Exclusions (page 26): OIG recommends that any entity participating in the federal Medicaid program should check the state Medicaid program exclusion list for each applicable state. Each state has strengths, weaknesses, and a high degree of variation with the knowledge and access of exclusion databases, creating a cumbersome process to validate Medicaid exclusionary status.  
• HIPAA Privacy and Security Rules (page 30): In bold print, the OIG recommends that compliance with Privacy, Security and Breach Notification Rule requirements be included in ALL risk assessments. 
• Relevant Individual (page 36): The OIG wisely introduces this new term and includes employees, contractors, patients, customers, agency staff, medical staff, subcontractors, agents, and other key individuals as relevant. These people should at least receive new and/or revised policies and procedures before they are implemented. 
• Compliance Officer (page 38): The OIG clarifies that compliance officers “have sufficient stature within the entity to interact as an equal of other senior leaders of the entity.” The OIG does not provide a sample organizational chart or team structure, but it does position compliance officers as essential to the development and implementation of strategic initiatives. The OIG also writes: 

“The Compliance Officer’s primary responsibilities should include advising the CEO, board, and other senior leaders on compliance risks facing the entity, compliance risks related to strategic and operational decisions of the entity, and the operation of the entity’s compliance program.” 

• Relationship to Legal (page 39): The OIG attempts to settle a long-standing debate regarding the roles of compliance and legal. In organizations where compliance reports to legal, conflicts of interest exist and can create barriers that lead to timing and resource inefficiencies. Effective communication and collaboration between compliance and legal is the key to a successful outcome. The OIG writes:    

“The compliance officer should not lead or report to the entity’s legal or financial function, and should not provide the entity with legal or financial advice or supervise anyone who does.” 

• Compliance Committee (page 40): The OIG provides a detailed list of the Compliance Committee’s primary duties. This includes guidance on the members, roles direct responsibility for active participation. For the first time, the OIG suggests that an individual’s participation should be included in considerations about their overall performance and compensation. The OIG also provides a list of indicators for committee success – including that boards should oversee the Compliance Committee and receive regular reports on attendance by members.  
• Board Responsibilities (page 43): the OIG reiterates the need for the compliance officer to be sufficiently empowered commensurate with their responsibilities and in line with other senior leaders. A quote highlighted on page 44 states, “the board should also ensure that the compliance officer has direct and uninhibited access to the board at any time.” While this could create awkward situations for compliance officers and CEOs or other senior managers, this approach has become a best practice because it is effective and promotes transparency. 
• Training (page 46): The OIG recommends that compliance committees ensure training is available in several languages and in various formats. The training plan should be reviewed at least annually by the compliance committee to ensure the content is current and contains information on issues identified through auditing and monitoring. The OIG also suggests that organizations’ audiences can ask questions.  
• Effective Lines of Communication (page 50): The GCPG clarifies that compliance officers are responsible for reported concerns – but that issues may be referred to human resources, legal, or other departments. The OIG writes: “The compliance officer should remain involved in all health care compliance investigations in which counsel takes the lead.” This clarity is especially important for investigations. 

• Large and Small Entities (page 65): There is a specific section in the GCPG on adaptations for small and large entities.  

In small entities: 

• The compliance contact should not have any responsibility for the performance or supervision of legal. If possible, they should not be involved with billing, coding, or submission of claims. 
• In the absence of a hotline or formal disclosure, small entities should have policies and procedures to establish good-faith reporting of compliance issues and prohibit retaliation. 
• Regarding exclusions, an individual or entity or an employee with an invalid license can have a significant negative impact on a small entity. Monitoring compliance in this area should be performed to reduce risk for small entities. 

In large entities:   

• The OIG repeats the need for compliance officers to report directly to the board to send a message and establish the proper tone for all relevant individuals.  
• For the first time, the OIG says that exceptionally large organizations controlled by an international parent organization need to have sufficient information about applicable law. 

• Quality and Safety (page 76): In the last section of the GCPG, the OIG suggests that entities should incorporate quality and patient safety oversight into their compliance programs. Risks exist associated with financial incentives and discrimination against more costly patients. It says that compliance officers should include these areas in risk assessments. A new term introduced is “new entrants,” on page 78. The term references technology companies, new investors, and non-traditional service providers in health care settings that may not be aware of the health care industry regulations. To identify and prevent fraud and abuse risks in a complex health care environment, compliance officers should simply follow the money.   

As the compliance industry evolves, the OIG is right on track again. The new GCPG provides more useful tools that address multiple aspects of an effective compliance program. The GCPG should be used to establish a compliance program, clarify roles and responsibilities, identify risks, and align current policies and procedures with what should be done.   

Shawn DeGroot CHC-F, CCEP, CHRC, CCPC serves on the advisory board for YouCompli. She is also president of Compliance Vitals, providing consulting services for clients in need of practical guidance in a complex healthcare regulatory environment. Previously she served as president of the Health Care Compliance Association (HCCA) and the Society of Corporate Compliance and Ethics (SCCE).

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management   

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software.  

Get the latest from healthcare compliance experts 

Never miss an article from Shawn Y. DeGroot. Sign up for YouCompli’s weekly email if you haven’t already.

The post Key Takeaways from OIG’s New General Compliance Program Guidance (GCPG)  first appeared on YouCompli.