The HHS OIG recently released an audit report in which they concluded that for a recent one-year period, Medicare improperly paid physicians approximately $15.2 million for sacroiliac joint (SI) injections (see: https://oig.hhs.gov/reports/all/2026/medicare-improperly-paid-physicians-an-estimated-152-million-for-sacroiliac-joint-injections/).  

SI injections can help some patients improve their spinal mobility as well as relieve pain. Medicare covers these injections under certain conditions but not others. That’s where confusion can create painful compliance risks. 

Most Recent Audit in Series Related to Spinal Pain Management Services 

This was the most recent audit in a series of audits related to spinal pain management services which the OIG has been performing over many recent years.  

In prior audits of similar spinal services, the OIG found, for example, that Medicare improperly paid physicians for facet-joint interventions for more than 50 percent of sampled services that didn’t comply with one or more of the Medicare requirements:  

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-an-estimated-30-million-for-spinal-facet-joint-interventions/ 
• https://oig.hhs.gov/documents/audit/9596/A-09-20-03003-Complete%20Report.pdf 
• https://oig.hhs.gov/documents/audit/9602/A-09-20-03010-Complete%20Report.pdf  

They also reported finding improper payments associated with epidural steroid injections: 

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-for-epidural-steroid-injection-sessions/ 

Audits Continue in Therapeutic Spinal Pain 

In addition, last year, they published audit findings that said Medicare could have saved an estimated $17.7 Million if CMS oversight had prevented at-risk payments for anesthesia administered during spinal pain management procedures: 

• https://oig.hhs.gov/reports/all/2025/medicare-could-have-saved-an-estimated-177-million-if-cmss-oversight-had-prevented-at-risk-payments-for-anesthesia-administered-during-spinal-pain-management-procedures/  

Consequently, it should come as no surprise to healthcare compliance professionals that the audits in the therapeutic spinal pain space continue with the recent report about SI joint injections. 

Background on Crucial SI Joints 

The SI joints connect the lower portion of the spine to the pelvis. 

They support upper-body weight and play an important role in walking and changes in posture or position, such as moving from standing to sitting. These joints become painful for various reasons, including sacroiliac joint dysfunction, which occurs when the joint moves too much or too little, often due to injury, pregnancy or osteoarthritis.  

To improve movement and relieve lower back pain, a physician may administer an SI joint injection. A diagnostic injection is first used to determine whether the SI joint is the source of the pain. Significant immediate pain relief following the injection strongly suggests that the SI joint is responsible.  

(Image from page 2 of the OIG report) 

Once the SI joint is confirmed as the pain source, a therapeutic injection may be administered, with pain relief potentially lasting up to six months. 

How SI Joint Injections Are Covered 

Medicare Part B covers SI joint injections when medically reasonable and necessary. Five of seven Medicare Administrative Contractors (MACs) have local coverage determinations (LCDs) outlining requirements for  

• Pain indications 
• Imaging and pain assessment 
• Coverage limits  
• Diagnostic and therapeutic injections 

These LCDs limit coverage to two diagnostic and four therapeutic injection sessions within a rolling 12-month period, whether performed unilaterally or bilaterally.  

Billing and Coding for SI Joint Injection Procedures 

Each MAC also issued billing and coding guidance stating that physicians must add the “KX” modifier to each claim line for diagnostic injections to distinguish them from therapeutic injections. (Appendix C of the OIG Audit report summarizes the MACs, the states they cover, and the specific LCD number and LCD Reference article pertinent to their audit.) 

CPT code 27096 is used for injections made directly into the sacroiliac joint, while CPT code 64451 is used for injections targeting the nerves that innervate the sacroiliac joint. 

OIG Selects 100 Random Samples out of 186,000+ Procedural Sessions 

For the audit report, the OIG selected a random sample of 100 SI joint procedural sessions from a population of 186,842 sessions paid for by five MACs in a one-year period. They requested physicians’ supporting documentation to determine if the claims met Medicare requirements including LCD and LCD Reference Articles.   

Of the 100 sampled sessions, 28 complied with Medicare requirements, and 75 complied with Medicare billing guidance. However, the remaining 72 sessions didn’t comply with Medicare requirements, and 25 didn’t comply with Medicare billing guidance.  

Seventy-two sampled sessions didn’t comply with one or more of the requirements. The OIG report summarizes the noncompliant sessions by the type of noncompliance observed: 

(The total exceeds 72 sessions because 41 sessions had more than one deficiency.) 

Estimated Improper Payments of $15.2 Million in Sample Universe 

OIG then extrapolated their findings across the entire population of 186,842 sessions and calculated overpayments to determine their estimated improper payment amount of $15.2 million for the universe of sessions sampled for the one-year period. 

OIG found that although CMS had systems to identify some billing errors, it didn’t provide enough additional oversight or education to help physicians understand and follow Medicare requirements. CMS relied on MACs to educate physicians, but this wasn’t sufficient.  

As a result, some physicians may not have fully understood the requirements and billing rules. Physicians with billing errors said that more frequent and consistent training would have helped them understand the rules and avoid future errors. 

Other Improper Payments Assumed, Potentially Pushing Total Higher 

As mentioned, the sample universe of SI joint procedural sessions was limited to the five of the seven MACs that had issued LCDs. The other two MACs that didn’t have LCDs paid physicians $12.3 million for sacroiliac joint injection sessions. That accounts for approximately 36 percent of total Medicare payments for sacroiliac joint injections nationwide.   

Since these sessions were excluded from the audit, OIG wrote that this set of payments to physicians may also include improper payments. If true, the estimated $15.2 million in improper payments could potentially be higher. 

Four Areas of Noncompliance in SI Joint Injection Procedures 

Below are four categories of noncompliance and indications of unmet requirements: 

1 – Indications of Pain Requirements Not Met 

• At least three positive findings with provocative maneuvers 
• Low back pain below the L5 vertebra without radiculopathy 
• Low back pain that persists despite a minimum of four weeks of conservative therapies 
• Clinical findings and imaging studies that do not suggest any other diagnosed or obvious cause of the lumbosacral pain such as tumor and fracture 
• Low back pain for at least three months 
• Moderate to severe low back pain primarily experienced over the anatomical location of the sacroiliac joints between the upper level of the iliac crests and the gluteal fold 

2 – Imaging and Pain Assessments Requirements Not Met 

• The sacroiliac joint primary pain level must be measured prior to the injection at the beginning of the session. 
• The post procedure pain level must be measured at the end of the session. 
• The injections must be performed under computed tomography (CT) or fluoroscopy image guidance with contrast unless the patient has a documented contrast allergy so that ultrasound guidance without contrast may be considered. 

3 – Diagnostic or Therapeutic Sacroiliac Joint Injections Requirements Not Met 

• A diagnostic injection must have provided a minimum of 75 percent relief of primary pain before a therapeutic injection is administered 
• A subsequent therapeutic injection is not reasonable and necessary when the prior therapeutic injection did not result in at least 50 percent consistent pain relief or functional improvement for at least three months 

4 – Limitation of Coverage Requirements Not Met 

• Administer other musculoskeletal injections in the lumbosacral spine during the same session as sacroiliac joint injections 
• Perform multiple injections (e.g., epidural steroid injections, facet-joint injections, and trigger point injections) during the same session as sacroiliac joint injections and during the period when the physician is evaluating whether the injection reduced pain (i.e., efficacy assessment period) 

The Audit Details Smart Compliance Professionals Look For 

Like most medical claims’ audits, the “devil is in the details”. To avoid problems, wise compliance professionals will: 

1. Monitor the most recent LCDs from their MAC 
2. Maintain a process to review the LCDs and implement processes to ensure compliance 
3. Perform records audits for both coding and medical necessity  

Some coders might have the requisite medical knowledge to audit for medical necessity. However, it usually requires a clinical background as well as an understanding of Medicare billing requirements such as LCDs. 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Here are other resources to check out next: 

How to Avoid False Claims Related to Medical Necessity 

This expert blog gives compliance readers actionable steps to avoid civil monetary penalties and False Claims Act scrutiny resulting from documented medical necessity failures. 

Physician Coding and Billing Errors Enforcement: Compliance 

Get more context on enforcement actions stemming from unbundling, modifier misuse, and improper billing during same-day procedures. 

Know the Compliance Risk for Certain Anesthesia Services 

Learn about another recent OIG audit targeting spinal injection procedures and associated anesthesia/sedation coverage limitations. 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

The linked article specifically discusses how MAC LCDs define medical necessity (such as requiring four weeks of conservative therapy prior to approving spinal injections)

The post Don’t Let Pain Injections Cause Regulatory Compliance Pain  first appeared on YouCompli.

A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.

Compliance risks associated with medical necessity happen when providers fail to show clinical evidence that a service is essential for a patient’s health. This often leads to legal, financial and operational consequences. 

This article uses a specific example to explore the implications of medical necessity for healthcare systems. 

Recent False Claims Act Complaint Hinges on Medical Necessity  

Recently we wrote an introductory article discussing in general terms the compliance risks associated with medical necessity. That was first in a series on medical necessity. Now this article introduces a specific example.   

In this case, the U.S Department of Justice (DOJ) filed a False Claims Act complaint against a hospital group and three long-term care hospitals. They allege the False Claims Act was violated because some of the care provided (for which the hospital was reimbursed) wasn’t medically necessary. 

Three Ways Medical Necessity Impacts Performance 

Medical necessity remains a serious compliance risk for providers, including hospitals and health systems. It impacts these organizations in several significant ways: 

• Performance and Efficiency 
• Financial and Compliance Risk 
• Patient Outcomes and Quality 

1. Performance and Efficiency 

Administrative Burden: Research shows that “medical necessity” serves as a primary tool for allocating resources, but varying definitions across payers create administrative churn. Studies indicate that managing these requirements increases the revenue cycle workload, leading to delayed payments and reduced efficiency. 

Operational Streamlining: Conversely, some evidence suggests that when medical necessity is effectively operationalized (e.g., integrated into EHRs), it can increase the speed of diagnosis by eliminating redundant or non-essential tests.  

2. Financial and Compliance Risk 

Denial Management: A major area of study involves “medical necessity” as a driver of claim denials. Research by organizations like AAPC indicates that failure to validate medical necessity can lead to revenue loss, recoupments, and payer audits. 

Regulatory Exposure: Inadequate documentation of medical necessity is a leading cause of False Claims Act allegations, representing a high-stakes legal and compliance risk for health systems.  

3. Patient Outcomes and Quality 

Care Appropriateness: Studies suggest that medical necessity standards help align clinical care with evidence-based guidelines, which can improve patient safety by reducing exposure to unnecessary, potentially harmful procedures. 

Equity and Access: Research into determinants of health system performance warns that restrictive criteria can limit access to essential care for vulnerable populations if based on cost-containment instead of individual patient needs.  

Allege Longer Stays to Increase Medicare Reimbursement 

The example covered here reflects some of these negative impacts. In this False Claims case, the DOJ alleges that the hospitals held patients in the hospital longer than medically necessary in order to increase Medicare reimbursement.  

Long-term care hospitals (LTCHs) provide inpatient services for patients whose medically complex conditions require long hospital stays and programs of care. Medicare reimburses LTCHs based, in part, on a patient’s length of stay.   

By allegedly delaying discharge of certain patients, even when their course of treatment had been completed or when they could have been transferred to a lower level of care, the hospital received higher payments than they should have. 

The DOJ did not discover this issue on their own. The lawsuit was originally filed by a former employee of one of the hospitals through the qui tam or whistleblower provisions of the False Claims Act.  

How Internal Concerns Become Full-Blown Investigations 

Though allegations of medically unnecessary care may be a common reason such lawsuits are filed, understanding the details of a specific case is important.  

It can help compliance professionals see how concerns, potentially first reported internally, can develop into full blown investigations or additional complaints being filed with the court by the DOJ, as in this example. 

Manipulating Qualifying Patient Stays for Higher Reimbursement 

In the complaint, the DOJ alleges that the defendants illegally inflated their Medicare payments by holding patients who were ready for discharge until they reached a certain threshold date that, once reached, would trigger increased reimbursement.  

Certain Medicare patients who meet an average length of stay over the twenty-five days that LTCHs must maintain are referred to as a Qualifying Patient. The Government claimed the defendants also inappropriately held Qualifying Patients long enough to meet the 25-day average length of stay requirement to maintain their LTCH status and be paid at the higher LTCH rate.  

In the court document filed by the DOJ, it’s alleged that one executive told her employees, “No one is leaving early. We lose money.” Unfortunately, this wasn’t the only example of their alleged poorly handled medical necessity determinations. 

Ignored Alternatives Could Have Been Fraction of the Cost 

According to the complaint, many of these patients could have been discharged earlier and received care at home or in a nursing facility for a fraction of the cost to Medicare.   

The complaint also states that when employees raised concerns about the practices to one of its executives, the executive dismissed them, noting they would make money even if Medicare denied some medically unnecessary claims.  

Compliance Responsible for Appropriate Processes 

Compliance programs should ensure that appropriate processes exist to confirm the appropriate clinical criteria are met when it comes to admission and discharge actions.  According to the government, LTCHs specifically must have a documented process that: 

“screens patients prior to admission for appropriateness of admission to a long-term care hospital, validates within 48 hours of admission that patients meet admission criteria for long-term care hospitals, regularly evaluates patients throughout their stay for continuation of care in a long-term care hospital, and assesses the available discharge options when patients no longer meet such continued stay criteria.” 

The government states that in 2017, CMS observed that LTCHs appeared to be improperly holding patients beyond the key time threshold to obtain the full payment, which resulted in potentially improper delays in patient discharges other than solely for medical reasons.  

As a result, in fiscal year 2018, CMS revised the payment methodology to reduce LTCHs’ financial incentive to delay patient discharges until after the threshold. 

Example of Inappropriate Intent to Maximize Revenue 

The DOJ’s complaint contains statements that appear to imply they have emails or other documentation that show the intent to delay discharge. For example, an executive allegedly emailed a broad group of staff to praise them for getting “patients discharged on their correct discharge day to maximize our revenue.”   

Reportedly, the same executive also developed a bonus plan for a case manager in 2018 that required her to discharge 90 percent of patients on the “ideal discharge date” to receive a bonus. The ideal discharge date was a date calculated in a way (and reported on a dashboard) to lengthen the stay to meet higher reimbursement goals. 

Of course, the claims asserted in the complaint filed by the DOJ are allegations only.  However, most of the time the DOJ is not going to file a complaint if they do not believe they have or will obtain the evidence they need to either pursue the case further in court or lead to a mutually agreed upon financial settlement. 

Requirements for Medical Necessity Determinations 

Medical necessity determinations tend to be circumstance-specific. Auditing and monitoring for medical necessity will also typically require the involvement of a professional with clinical training or background.   

At times, it may be appropriate (if there are no conflicts of interest) to have a medical director from the organization be involved in such determinations. At other times, it may be a better idea to seek independent expertise from someone outside your organization. 

Learn from Examples of Medical Necessity Problems 

Watch for the next article in this series when we take another deep dive into an example of medical necessity in healthcare. In the meantime, browse these curated selections. 

Find More Advice and Ideas in These Related Articles 

• Introductory Article: Understanding Medical Necessity Compliance Risks The first post in this series, covering the foundational definitions and general compliance risks healthcare providers face today. 
• The False Claims Act: A Guide for Healthcare Leaders A deeper look into how inadequate documentation can trigger False Claims Act allegations and the resulting legal stakes for health systems. 
• Strategies for Reducing Claim Denials and Revenue Loss Practical insights into how medical necessity acts as a driver for claim denials and how to improve your revenue cycle workload. 
• Aligning Clinical Care with Evidence-Based Guidelines Learn how to leverage medical necessity standards to improve patient safety and ensure care appropriateness across your organization. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Compliance Risk Is Driven by Medical Necessity Problems  first appeared on YouCompli.

In this article, Lisa Estrada shares her perspectives on why systems beat heroes in compliance and how AI can help accelerate systems thinking in fast-paced healthcare environments. 

Lisa is a seasoned compliance executive with more than 25 years in healthcare, including serving as Chief Compliance Officer for several large, national health systems. See more of her impressive credentials at the end of this blog. 

Systems Beat Heroes: The Quiet Advantage in Compliance 

Ever notice how organizations love a hero story? The person who swoops in, tackles the problem, and saves the day. For the individual, there’s the rush of feeling impactful and the shout-out at the team meeting. For the organization, the crisis is averted, allowing it to direct resources to other pressing challenges. That is, until the next crisis pops up. 

This hero-driven culture is the norm in the healthcare systems where I’ve worked. And as a compliance leader, I’ve fallen into the trap of believing that a key way to establish the value proposition for the compliance function is to show up as the hero, avert the crisis and bask in the glow of the company-wide shout out.  

The Alternative to Hero-driven Compliance Culture 

But is assimilating into the hero-driven culture the right strategy for a compliance program?  

I’ve had a chance recently to think about this question in a very personal way. Since leaving behind my life as a senior legal and compliance executive at large health care systems, I’ve started providing interim compliance leadership services to small health care organizations — standalone hospitals, small systems, and health tech start-ups.  

I’m often a one-woman show writing on a blank or nearly blank slate. And on a near-daily basis, I face a choice between swooping in, tackling a problem and saving the day or stepping back, thinking holistically and building systems that will minimize the need for heroes longer term.  

Given that my role as an interim is short-lived by design, the choice is obvious — build systems that will help the organization navigate through compliance challenges long after my engagement ends. Even so, it can be a challenge to quell my inner hero — to focus on the complex and time-consuming task of building systems while forgoing the quick gratification of popping out an answer or a quick fix. 

Experiencing this tension has really highlighted for me how building strong systems is the counterbalance to playing the hero. And that, ultimately, building an effective compliance program requires prioritizing systems over heroes.  

What Is “Systems Thinking” in Compliance? 

Systems thinking views compliance as an interconnected web of people, processes and technology. This approach builds resilient workflows that deliver consistent results, no matter who’s on point. 

Why Systems Beat Heroes 

• Consistency: A system runs the same way every time, reducing risk and variability. 
• Scalability: Growth doesn’t depend on hiring more “unicorns.” 
• Resilience: When someone leaves, the process doesn’t fall apart. 
• Defensibility: Audit trails and documentation demonstrate effectiveness. 

What Systems Can’t Do 

Systems can’t do everything; they don’t obviate the need for judgment. Instead, they help pinpoint exactly where judgment is needed. In other words, systems can take care of routine and predictable aspects of compliance work, allowing the compliance team to focus their expertise on those unique or complex scenarios that need thoughtful decision-making and judgment calls. 

Moving from Heroics and Reactivity to Systems Steadiness 

The shift from heroics to systems thinking requires a move away from reactivity. In a reactive mode, attention is naturally drawn to individual problems that are urgent, visible and immediately solvable. The focus on immediate fixes makes it harder to step back slow and zoom out enough to see the larger patterns at play. This is a perfect description for most (if not all) corporate environments I’ve experienced. 

Systems thinking, on the other hand, involves creating the space to recognize how the system as a whole shapes recurring issues. Instead of focusing narrowly on the problem, it involves zooming out and asking questions like: 

• What pressures, structures or gaps made this outcome likely? 
• What yellow or red flags are we missing until something breaks? 
• What incentives are unintentionally rewarding risky behavior? 

Systems thinking can also mean building playbooks, decision rules and feedback loops for frequently arising compliance issues.  

How Can AI Help with Systems Thinking in Healthcare Compliance? 

In the real world, compliance leaders are often required to react to urgent issues. The question then becomes how best to toggle back and forth between reactivity and systems thinking. One tool for facilitating this balance is an AI assistant. I’ve found that AI can help create that crucial space to step back and see the system as a whole, while still allowing me to toggle back to reactivity when needed. 

In my work, I have come to rely heavily on AI as a thought partner – helping me to extract and organize my knowledge and experience into repeatable, shareable protocols customized to a particular organization’s needs.  

Three Examples of AI as Systems Thinking Partner 

Here are three specific examples of how I have used AI as a systems thinking partner for compliance programs: 

1. Structured Knowledge Extraction 

This works one of two ways for me. Sometimes I do a brain dump, sharing with my AI assistant my thoughts on  

• What I’m trying to achieve 
• What I’ve seen work or fail in the past 
• What challenges I anticipate 

Other times, I ask my AI assistant to interview me about the problem and possible solutions. Both paths yield a structured outline, allowing me to translate my judgment and approach into clear steps. 

2. Turning Steps into Repeatable Workflows  

Once my AI assistant has my knowledge in a structured form, the next steps are  

• Creating standardized workflows 
• Identifying decision points and criteria  
• Capturing it all in a playbook to hand off to others with plain language instructions, checklists and templates 

3. Continuous Improvement through Continuous Feedback 

Good systems are designed to improve over time. They are structured enough to create consistency and clarity, but flexible enough to absorb real-world experience from the people who use them.  

AI can support this by helping surface patterns, friction points, and recurring questions that emerge as the protocol is used day to day. This facilitates a continuous feedback loop in which protocols can be regularly refined to better reflect how work actually happens.  

The Takeaway: A Fresh Way of Viewing Compliance Effectiveness 

What I’m advocating for here is a different way of thinking about effectiveness in compliance. Being the person who can step in, solve the problem, and keep things moving can feel like success — and in the short term, it often is. But over time, that pattern can hide deeper system weaknesses and make organizations overly dependent on individual heroics. 

Systems thinking offers a quieter alternative. It invests in structures that make good outcomes more likely without constant intervention. When systems are doing their job, judgment doesn’t disappear — it gets used more intentionally in the situations that truly require it. 

I’ve learned that tools like AI can ease and accelerate this shift by helping translate experience and intuition into shared workflows that others can use and improve. The goal isn’t perfection or automation for its own sake, but durability: compliance programs that continue to function well even as people, priorities, and pressures change.

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post How to Build a Holistic Approach to Healthcare Compliance with Systems  first appeared on YouCompli.

Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. Compared with other business functions, compliance has been slower to embrace AI, especially in healthcare, where concerns about risk, regulation, and potential bleed-over into clinical decision-making have made organizations particularly cautious. 

Yet the opportunity is substantial, especially when it comes to systems thinking. 

Why Systems Thinking Matters in Compliance 

Effective compliance programs depend on systems thinking. Rather than viewing each request for guidance, investigation, or remediation as an isolated issue, savvy compliance teams look at how individual problems fit into larger patterns. 

One of the challenges in any business function is the tension between individual heroics and well-designed systems, and, ultimately, systems win every time. Many compliance officers have been conditioned to act like lifeguards, diving in to save departments from themselves. But this reactive approach consumes time and limits impact. You stay busy, but the organization doesn’t necessarily become more compliant. 

Shifting away from heroic interventions requires time, strategic thinking and structural planning, resources that compliance professionals rarely have in abundance. This is where AI becomes a powerful ally. 

How AI Helps Compliance Move from Reactive to Proactive 

The key to building proactive compliance is carving out the mental space to think more broadly about operational processes. AI doesn’t replace human expertise, but it can significantly accelerate the work. 

AI tools can analyze the countless issues compliance teams handle daily and help generate system-level recommendations. Think of AI as a partner that gets you to the 50- or 60-yard line, far enough to give you a strong foundation, but still requiring human judgment to complete the plan. 

Using AI to Organize Compliance Processes 

The first step is identifying patterns: 

• What repeatedly goes wrong? 
• What are the recurring themes? 
• Where are the inefficiencies or high-risk points? 

Once you see the trends, you can begin imagining the systems that will address them. AI excels at helping structure these ideas. 

A practical way to start is by giving your AI assistant raw input: 

• Here’s what is happening. 
• Here’s the environment. 
• Here are the recurring issues. 

Then you can prompt the AI with something like: 

 “I want to build a system to help identify and minimize these risks within a complicated environment. What elements should be included, and what considerations fall under each element?” 

The output becomes a foundation, a map of decision points and organizational steps you can refine. 

Supercharging Systems Thinking 

Compliance work is complex, and many officers get stuck not because they lack insight but because they lack time. AI helps break the gridlock by organizing information, highlighting key considerations, and suggesting frameworks. 

The AI provides structure; the compliance professional brings subject-matter expertise. In this collaborative process, the AI’s suggestions spark additional ideas and help you think more holistically. The result is a level of systems thinking that becomes far more accessible even in hectic environments. 

The Human-AI Partnership 

Despite its power, AI cannot replace an experienced compliance officer. It draws from online information and from what you feed it, but it cannot grasp organizational nuance, personalities, or culture. 

For example, an AI may outline a solid system, but only the compliance officer understands how a skeptical executive will respond. That’s where the human element comes in. You can ask the AI to help tailor communications or anticipate objections, but the strategic decision-making remains yours. 

Staying Focused with AI Frameworks 

One of the hidden challenges of compliance work is staying focused long enough to complete long-term system projects. Urgent tasks constantly pull attention away, and partially built frameworks can easily get lost for months. 

AI-created structures help maintain focus. They provide guardrails, the methodological anchors that keep the conversation and planning on track. Most of the framework can often be developed in a single sitting, creating a roadmap you can return to even if you’re pulled into other issues. 

Even with the limitations of some AI tools, especially free versions that cap conversation length, paid versions make it easier to resume discussions, refine ideas, and maintain continuity. 

A Faster Roadmap to a Roadmap 

Compliance professionals work hard and add value every day, but much of that value is short-term because they lack the time to build the long-term systems that create lasting change. 

AI solves this by offering a “faster roadmap to a roadmap.” It accelerates the groundwork: 

•  Defining the problem 
• Outlining the system  
• Highlighting the risks 
• Mapping the components 

That clarity frees the compliance officer to focus on the human side of adapting the system to the organization, navigating culture, and communicating effectively with leaders. 

With an AI-driven framework, compliance work becomes more disciplined, efficient, and proactive. Systems thinking becomes not only achievable, but sustainable. AI doesn’t replace the expertise of compliance professionals—it elevates it. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post How to Use AI for Systems Thinking in Compliance Processes  first appeared on YouCompli.

It’s the nature of our mission to stay on top of what’s happening in the world of healthcare compliance. And right now, that focus couldn’t be more important.  

These are unusual times, and Compliance is feeling the impact. The Medicare Fiscal Year 2026 Final Rules were expected to be late but came through on time. However, hospitals must still rush to analyze and respond with action plans in short order. CMS transmittals are also likely impacted by the government shutdown (more on that later). 

That leaves many hospital compliance teams unprepared and under-resourced to cope with fast-coming changes. The price of noncompliance, even under extenuating circumstances, is reimbursement risk. 

Two Areas Needing Compliance Attention: Final Rules and Transmittals 

• Final Rules – Legally binding federal regulations that establish new policies in particular areas of healthcare. 
• CMS Transmittals – Internal instructions for updating CMS operational manuals to reflect new or changed policies. 

Two Important CMS Timelines: Fiscal Year and Calendar Year 

The CMS guidance for healthcare comes with its own deadlines attached, and every year there are two important and separate timelines for fiscal year and calendar year Final Rules.  

In healthcare, fiscal year guidance typically has an October 1 effective date, and that Final Rule usually drops in August. This year, YouCompli analysts got through the fiscal year Final Rules incredibly quickly, because CMS cut a lot of the material in the preamble, and that allowed more efficient review and analysis. 

Effective Date of Calendar Year Final Rule Coming Up Fast 

As every seasoned compliance professional knows all too well, CMS puts out a handful of big, omnibus rules for different areas of health care on an annual basis. This time of the year brings us the final rules affecting outpatient costs and billing. These areas usually get addressed during the calendar year, and these calendar year communications started dropping this year on November 5. That gives an effective date of January 1 of the next year.  

It’s important to get these annual changes synthesized and implemented in a health care organization because they cover the entire year. Even when Rules drop at the usual time (and not during a government shutdown), the short time frame to the established effective date still puts pressure on providers to analyze and develop a compliance action plan. That’s where having a partner like YouCompli already breaking down these rules and translating them into actionable business requirements is essential.  

Transmittals Could Be Delayed and Affect Claims Processing 

On top of concerns about Final Rules delays, CMS transmittals ceased to come out on September 30. Transmittals are typically issued on a running basis as they come up. In a given month, you can have anywhere from 15 to 150 transmittals come out.  

A CMS transmittal is not the same as a Final Rule. They are two distinct types of guidance documents from the CMS. Transmittals are official documents to communicate new or changed policies, procedures, claims and other operational guidance to Medicare administrative contractors (MAC), regional offices, and healthcare providers. The communications update specific CMS program manuals, instructions, and other documentation to ensure consistent implementation of Medicare rules.  

MACs Also Risk Claims Backlog with Transmittal Delays 

Another job of a transmittal is to direct the MACs on what to do in processing claims. These third-party contractors are hired by CMS to administer claims, and they can get backlogged on their instructions and claims processing when transmittals run late.  

Any claims processing delays impact providers, so it’s important to keep an eye on when these transmittal communications come out, especially if it drags out for weeks. If MACs struggle with claims processing because they can’t keep up with the updates, providers lose money. 

Whether it be through time-related loss, because then they have to reissue claims with fixes and things of that nature, delays directly impact revenues. That’s not good at a time when health systems are already under the gun. 

Solution: Proactive Compliance to Know, Act and Verify 

If you’re a YouCompli customer, you wouldn’t have to scramble to prepare for last-minute changes, because we would handle it.  

If communications are ever delayed, creating a time crunch, let us act as your analysist team, grabbing communications as soon as they come out, and breaking it down for you. We capture the necessary data and deliver it, along with easily understandable business requirements.  

You’ll know what you need to do to comply, so when the next Final Rule or transmittal hits your inbox, you’re ready to run with updating procedures, training and other requirements.  

We suggest getting on board with us now, so when that time comes, you’re not struggling with these risks and delays.  

About the Author 

Nate Ward, J.D. is the Manager of Compliance and Content Development at YouCompli Software. He comes from a deep background in healthcare compliance and the legal field. Nate leads a team of experts who read regulations, analyze how they apply, and recommend action plans for healthcare compliance.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post How to Prepare for New CMS Final Rules and Transmittals  first appeared on YouCompli.

The HHS OIG recently issued its first Industry Segment-Specific Compliance Program Guidance, or ICPG, with many more expected.  This first ICPG covers Skilled Nursing Facilities and Nursing Facilities.  

Let’s review some of the highlights. 

1. Quality of Care and Quality of Life 

For decades, the OIG and other government enforcement agencies have emphasized the importance of the quality of care and quality of life for nursing facility residents.   

When a nursing facility submits a claim to Medicare or Medicaid for reimbursement, it certifies the services were provided in compliance with all applicable statutes, regulations, and rules. If a nursing facility does not provide care consistent with professional standards of quality, or in an environment that promotes quality of life, claims for reimbursement may be considered false.   

The ICPG provides the following examples of quality and related safety concerns that can lead to submission of false claims:  

• providing medically unnecessary or grossly substandard services 
• housing residents in unacceptable or dangerous living conditions 
• failing to provide residents with activities 
• failing to provide residents with needed psychiatric care 

2. Billing Requirements 

The ICPG states, “Ensuring compliance with Medicare and Medicaid billing requirements should be a core function of nursing facility compliance program operations.” 

The OIG expects nursing facilities to be proactive in their oversight of billing compliance. This includes conducting regular reviews to ensure billing and coding practices are current and accurate, as well as performing regular internal billing and coding audits. Even if an entity makes an isolated billing error, that entity still has an obligation to repay the overpayment to avoid False Claims Act liability. 

The ICPG specifically addresses the following risk areas associated with billing requirements: 

• SNF Prospective Payment System (PPS)  
• Value-Based Payment Models and Programs 
•  Medicare Advantage and Medicaid Managed Care  
• Medicare Part D  
• Medicare Health Plan Enrollment for Nursing Facility Residents 

Interestingly, the ICPG for nursing facilities also refers readers to a supplement on understanding reimbursement for nursing facilities, which can be viewed at https://oig.hhs.gov/documents/compliance/10039/nf-icpg-supplement.pdf. 

3. Anti-Kickback Risks 

The OIG’s General Compliance Program Guidance (GCPG) highlighted some of the risks associated with the Federal Anti-Kickback Statute (AKS) in the healthcare industry. The nursing facility ICPG provides many helpful and specific AKS risks to unique to nursing facilities. Among the specific risks highlighted by the OIG are: 

• Free (or Below Fair Market Value) Goods and Services  
• Discounts 
• Arrangements for Services and Supplies  
• Long-Term Care Pharmacy and Consultant Pharmacist Arrangements  
• Hospital Arrangements  
• Hospice Arrangements  
• Care Coordination and Value-Based Care Arrangements  
• Joint Ventures 

The ICPG emphasizes that all referral relationships call for vigilance under the Federal AKS. The discussions in the ICPG not only highlight several risk areas for nursing facilities under this law, but it also provides excellent recommendations for mitigating those risks. OIG also stresses that nursing facilities should scrutinize the listed risk areas as part of their risk assessment, internal review, and monitoring processes. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Breaking Down the OIG’s First Industry-Specific Guidance  first appeared on YouCompli.

CEO Jerry Shafran has prepared a festive video to help us wrap up the year. We wish you a safe and happy Holidays and New Year! 

Jerry Shafran

Jerry Shafran is the founder and CEO of YouCompli. He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages, and sells software and content solutions that simplify complex work. His innovations enable professionals to focus on their core business priorities.  

Download our Latest White Paper

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm.   

Sign up for our Weekly Newsletter

The post Recapping 2024 and Ringing In 2025  first appeared on YouCompli.

According to the November 2023 General Compliance Program Guidance from the OIG, compliance oversight is within a Board of Directors’ (BOD) fiduciary duty of care and a “critical component of the Board’s compliance role.” Conversely, there is increased pressure from a variety of government agencies (SEC, OIG, DOJ) for boards to become active and engaged without becoming involved in operations.   Finding the right balance can be challenging. 

The board’s responsibility also includes understanding the organization’s risks. A strong process for identifying risk areas and managing the risk is one hallmark of an effective compliance program. Monitoring and auditing can pinpoint potential risk factors and the outcomes will either confirm effectiveness or identify deficiencies. The Board should ensure that the risk areas are consistently reviewed, and corrective action(s) are taken. It would be prudent for the Board to generally know or be informed of the trends in the industry that add gravity to the risk areas such as: 

• The use of data analytics and artificial intelligence, which has introduced both positive and negative consequences.  
• The complexity of laws and regulations, somewhat designed to combat fraud, can be a more lucrative form of crime.  
• The abundance of protected health information (PHI) and personal identifiable information (PII) retained in anything electronic. 
• The growth of cybersecurity data breaches, ransomware attacks, and phishing scams are costly to prevent but can be devasting when they occur. 

Everyone enterprise-wide is responsible for compliance, and the Board should encourage compliance accountability. The General Compliance Program Guidance issued by the OIG has become the topic of conversation within the compliance industry. I thought it would be interesting to obtain viewpoints from seasoned professionals in the compliance field on what they believe the BODs should consider now and in the future: 

• “The November 2023 OIG General Compliance Program Guidance document mentions compliance officers 146 times, the board 120 times and the general counsel once. The board should probably know how important the OIG thinks their compliance role is.”   

— Roy Snell, Co-Founder and Former CEO, HCCA/SCCE 

• “Compliance is more than a legalistic view of the DOJ Evaluation of Corporate Compliance Programs (ECCP) guidelines, DOJ Corporate Enforcement Policy (CEP) and the GCPC aggregation of ‘voluntary,’ ‘non-binding’ guidance. In the past many applied their inner lawyer approach to them, by hanging their hat on terms like ‘guidance,’ ‘voluntary,’ ‘non-binding,’ etc. Currently many missed the spirit of the OIG’s and DOJ’s intent for corporate and board fiduciary duties. Now they suffer the very real consequences of judgment when they have to explain how the Board or company did not consider them in their operation risks when under a review, self-report or settlement that is often raising the specter of a false claim. In the future you will not be able to ignore the spirit of the ‘four horsemen’ (ECCP, CEP, GCPC, and the Qui Tam’s sword under the False Claims Act ‘should have known/deliberate ignorance standard’) because you may be accused in judgment to have been informed of the compliance risks, knowingly ignored applying resources to them and being without the easy excuse from blinders of legalism to their requirements to you personally. Simply said, you would be a penny wise and a pound foolish to ignore them as actual requirements in the future.”  

– Brian Flood, Partner, Husch Blackwell 

• “Governance leaders need to be continuously ‘upping their game’ and expertise as regulators and other key stakeholders are increasing expectations and oversight of board performance. This includes ensuring we are looking 2-3 years ahead (same as we require of management) and being proactive in what skillsets are needed on the board to demonstrate we are meeting our fiduciary duty and have the scope and depth to ask the right questions of management. Additionally, for boards that are compensated, we need to ensure we have processes in place to both measure board effectiveness and individual performance, similar to how we measure and compensate CEOs and the C-suite.”  

–Jenny O’Brien, JD, MS, CHC, President and Principal at BlackBridge Advisors 

• “In the coming years we may see boards look to their Chief Compliance Officer (CCO) to not only provide reports around the status of the compliance program and compliance risk areas but to also serve as an advisor on a broader range of topics as part of an enterprise risk management strategy. CCOs should educate themselves and develop the skills they will need as boards lean into ensuring all risks are prioritized and managed as part of corporate decision-making processes.”  

– Cindy Matson, MBA, CHC, CHPC, Vice President, Compliance & Audit Services, Sanford Health 

• “I think a top priority for healthcare Boards of Directors is to ensure someone on the board has healthcare compliance expertise. Many healthcare boards already seek out individuals with specific areas of expertise such as financial, audit, clinical, patient safety, or some other subject matter expertise. Compliance should be added to that list. Some OIG corporate integrity agreements (CIAs) already require this. But for organizations who want to be forward-thinking instead of reactive when it comes to their compliance programs, they should proactively seek out individuals who have compliance expertise to serve on their board. Such an individual would be able to provide leadership and training in how a board should fulfill its compliance program oversight duties. Some of these duties might include engaging experts to perform periodic compliance program effectiveness reviews or approval of compliance risk assessments and annual work plans. Having someone on the board with compliance expertise would aid the board in asking the right questions of executive management and the compliance officer in regard to the compliance program.”  

– C.J. Wolf, MD, CPC, CPC-I 

• “The rapid proliferation of artificial intelligence (AI) software tools available to healthcare companies is outpacing existing regulatory frameworks, leading to both known and unknown compliance risks. Our company survey revealed that fewer than 11% of U.S. healthcare companies have an AI compliance policy or even a registry of AI-utilizing software. As the evolution of AI mirrors the fast-paced digital revolutions of the 1990s, boards of directors and management often lack a clear understanding of the associated risks. Proactive Board governance is essential to ensure that innovation is paired with rigorous oversight, in an effort to effectively mitigate future regulatory and reputational risks.”   

–Jim Rough, CFE, CHC, CCEP, President SunHawk Consulting, LLC 

• “Future Board compliance strategies rely completely on the Board understanding compliance risks and obligations. Compliance Officers should present training and reports in a manner that helps ensure Board members understand the compliance risk. Assume your organization made a self-disclosure to correct a billing issue which, if not remedied, could have been considered a false claim. Reporting the self-disclosure to the Board and providing some background on the issue is expected, but does the Board know or understand the reason the self-disclosure needed to be done versus just refunding the overpayment? Does the Board understand what the False Claims Act is and the implications of a False Claims action? Compliance Officers can better prepare the Board for future discussions about compliance strategies if the Board has received an annual refresher training on the core laws and regulations that impact the organization. To help emphasize the importance and to help guide the strategy discussion, use settlements or first-hand examples to show how the laws and regulations are being enforced or interpreted. This will help ensure compliance strategy discussions are built on a common understanding of the rules and risks.”  

–Darrell Contreras, JD, CHC-F, CHPC, CHRC, Chief Compliance Officer at Millennium Health 

• “As Compliance Programs continue to evolve and mature, Board’s commitment needs to foster a culture of integrity and be visible by the entire organization.”  

—Debbie Troklus, President, Troklus Compliance Consulting 

• “I think with the OIG’s updated General Compliance Program Guidance (GCPG), there will be an increased concern about private equity firms that are financially backing healthcare organizations. More specifically, private equity investments in healthcare can raise unique compliance challenges due to potential conflicts of interest, billing/coding, and fraud and abuse. To guard against this, I think healthcare boards will need to make sure due diligence is done before entering into any partnerships with private-equity backed firms. Also, ensuring the private equity-backed firm has a robust compliance program in place that integrates with the healthcare organization’s own compliance program. Lastly, making sure that typical compliance activities, such as auditing, monitoring, education, and training, include that relationship with a private equity-backed firm.”   

–Jay Anstine, President, Bluebird Healthlaw Partners 

• “I hope the top priority for any healthcare Board of Directors will be the well-being of their workforce and workplace! We need standardized best practices to prevent burnout, detect culture and correct toxic cultures if we want happy and healthy staff who are ethical and compliant to provide quality and safe care!”  

—Maeve O’Neill, MEd, LPC-S, CHC, CDTLF 

The role of a BODs is multi-faceted, and compliance is one program area of oversight responsibility. Regardless of whether it is paid or unpaid, serving can be both rewarding and daunting at the same time, especially if you want to do the job well and make a difference. It takes considerable time and effort to review and digest the web of information involved with decision-making, developing strategy and fulfilling oversight responsibilities.    

Whether you are new to the field or a seasoned professional, hopefully the viewpoints above offer insight that can influence your BOD’s understanding of their oversight responsibility for the compliance program. 

Shawn DeGroot, CHC-F, CCEP, CHRC, CHPC is president of Compliance Vitals, providing consulting services for clients in need of practical guidance in a complex healthcare regulatory environment.  She served on the faculty of the HCCA Privacy Academy and served five years on Board of Directors for St. Charles Health System, Bend, OR.  Shawn’s area of expertise is also Corporate Integrity Agreements to include experience in seven CIA’s with the first CIA pertaining to Stark and Anti-kickback.  She also is a past president of HCCA/SCCE and serves on an advisory group to the HCCA/SCCE Board of Directors. 

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management   

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software.  

Get the latest from healthcare compliance experts  

Never miss an article by Shawn DeGroot. Sign up for YouCompli’s weekly email if you haven’t already.   

The post Experts Weigh In: The Oversight Role of a Healthcare Board of Directors  first appeared on YouCompli.