Many compliance leaders struggle with the question of what their role in AI governance is. Lisa Estrada, JD, believes an organization’s compliance officer shouldn’t agree to be the sole organizational owner of AI governance. Rather, they should be making sure the right people are governing it together.  

In this blog, she explains what healthcare compliance leaders should know to effectively help their organizations build and operate robust AI governance frameworks.  

QUICK TAKE

Compliance should help coordinate AI governance, not serve as its sole owner. Start by identifying where AI is being used, establishing clear accountability across departments, and applying risk assessment and ongoing monitoring.

Compliance Programs and AI Governance: What’s Similar? 

Compliance programs have always been about paying attention to what can go off the rails before it does. 

AI governance is the same. Organizations need to be thinking in a systematic way about: 

• Where could this go wrong? 
• Who would get hurt? 
• How would we know? 
• What do we do about it? 

Assurance Is a Common Requirement  

“An assurance framework gives boards and management teams confidence grounded in evidence that controls exist and work as intended,” Estrada explained. “It’s not a policy. It’s the ongoing cycle of identifying the risk, assigning an owner, testing the control, reporting the results to leadership, and fixing what you find.” 

That model, which typically includes risk assessments and monitoring plans, is very familiar to compliance officers. It’s exactly how most compliance programs are structured. And, according to Estrada, the same model can be applied to AI governance. 

“Compliance officers know how to build and maintain assurance frameworks; they know how to conduct risk assessments and develop monitoring plans,” Estrada said. “This makes them an obvious choice when boards and organizational leaders ask for assurances around how AI is being used.” 

How Are Compliance Programs and AI Governance Different? 

Estrada noted important distinctions between the risks managed by typical compliance programs and those presented by AI: 

Speed and scale of change. AI can change things quickly, and its risks can scale across an organization just as rapidly. Something that used to take months to spread can now hit every claim overnight. As a result, an annual risk assessment, the common standard for compliance programs, is probably inadequate in the world of AI. 

Probabilistic, not deterministic. Healthcare compliance programs are rule- or standards-based. The same facts get the same answer, so a point-in-time audit tells you something lasting. By contrast, AI is probabilistic. Passing a test once doesn’t mean it will pass the next time. For confident governance, AI monitoring must be continuous, not point-in-time. 

Opacity: Compliance programs run on root cause analysis. When we find a problem, we don’t just fix it. We dig in to figure out why it happened. With AI, we often can’t get there alone. We can see the output was wrong, but was it the data, the model, a vendor update, or how someone used it? Compliance can’t answer that. Neither can data science on its own. It may take the data people, the clinicians, the vendor, and the people using the tool every day to find answers. That’s why AI governance must be multidisciplinary. It’s how you get to root cause. 

Who Should Own AI Governance in Healthcare? 

Next Steps for Compliance Leaders 

Estrada shared three important tactics to help compliance leaders get their arms around AI governance in healthcare. 

1. Learn the language. 

“Seek out AI educational opportunities,” Estrada says. “AI has its own vocabulary and concepts, and if you don’t know them, you can’t be effective in the conversation.” 

Estrada recently earned the Artificial Intelligence Governance Professional (AIGP) certification available through the International Association of Privacy Professionals (IAPP). It’s a resource that compliance leaders can invest in to build necessary AI governance and strategy skills. 

The training focuses on: 

• Foundations of artificial intelligence governance 
• How laws, standards, and frameworks apply to AI (such as EU AI Act) 
• How to govern AI development 
• How to govern AI deployment 

About a third of the exam involves scenario-based questions tied to applied judgment in real-world case studies. 

2. Take Action. Drive Action. Lead Action. 

Compliance doesn’t have to own AI governance. But it does have to make sure the right people are governing it together. Depending on the organization, that might include 

• Operations 
• Clinical (in healthcare) 
• Information Technology and Security 
• Legal and Regulatory 
• Operations 
• Risk Management 
• Internal Audit 

“Act as a convener,” Estrada says. “Don’t wait to be asked and don’t try to own it alone.” 

3. Start with an AI inventory 

“You can’t assess or monitor risks you can’t see,” she explained. 

Take inventory of: 

• Where AI is already being used 
• For what purpose 
• By whom 
• With what data 
• Through which vendors 

“Then get the right people in the room and bring the assurance framework, because that’s what compliance officers know better than anyone.” 

Compliance Must Deal with AI Boom 

AI governance is no longer an issue compliance leaders can watch from the sidelines. The question is how quickly and how effectively they will engage. These practical steps can help leaders prepare their teams, bring the right functions together, and give their organizations confidence in how AI is being used and governed. 

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.  

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.   

Ready for More? 

Here’s another resource to guide good AI governance strategies for your healthcare organization: “Compliance Leader’s Guide to Getting Started with AI.” Cut through the hype and confidently implement AI with proven strategies. This clear, tactical guide will help you save time, reduce risk, and future-proof your compliance processes. 

Download to learn: 

• Five Practical Ways to Use AI in Compliance Work 
• Six Critical Considerations When Adopting AI for Healthcare Compliance 
• Five Things to Know to Leverage AI for Process Improvement 

The post AI Governance in Healthcare: What Compliance Leaders Should Know first appeared on YouCompli.

New compliance professionals benefit from a variety of resources to ramp up their knowledge and value. If you’re new to the healthcare compliance field (or know someone who is), save and share this article 

Getting Started for Early-Career Compliance Professionals 

The 20+ foundational resources that follow were curated from the YouCompli resource library. This set is tailored specifically for early-career compliance professionals. Start reading for ideas to build your: 

• Leadership skills 
• Operational credibility 
• Cross-departmental influence 

Read Expert-Sourced Content Designed for Professional Development 

Written for (and sometimes directly by) healthcare compliance executives, the information is practical and easy to understand. 

The articles focus on a variety of important topics: 

• Communication and Professional Growth for New Leaders 
• Operational and Audit Fundamentals for Building Compliance Expertise 
• Technology and Strategic Planning for Regulatory Change Management 
• Compliance Program Building and Oversight 
• Video Hub: Expert Guidance for Healthcare Compliance Professionals 
• Downloadable Tip Sheets for Quick Ideas and Actions 
   

Pick where you need help most today and dive in. (A few resources fall into multiple categories, so you get double the return when you read them.) 

Communication and Professional Growth for New Leaders 

From soft skills to dollar signs, these articles cover areas that sometimes get neglected in more formal compliance leader training. These expert resources cover aspects of compliance communications you might not find anywhere else. Learn about the persuasive communication skills that are the secret superpowers behind strong compliance leaders.  

Aggressive vs Assertive Communication: What New Healthcare Compliance Officers Need to Know  

Get advice tailored for new leaders on building authority and articulating compliance risks without creating unnecessary friction. New compliance executive can learn how to speak with authority and assertiveness without damaging cross-departmental relationships.  

This article covers:  

• Key differences between two common communication styles  
• How assertive communication benefits the compliance program  
• Strategies to help you master this skillset 

Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Being aware of how we do our own work is paramount for an effective compliance program and incorporating self-awareness into your healthcare compliance program can enhance its effectiveness. For example, it improves your ability to empathize with the challenges operational leaders face when adjusting a process to meet a regulatory requirement. To help build awareness, explore these 18 actionable tips for compliance officers. 

Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  

For effective healthcare compliance leaders, financial literacy isn’t optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  Explains key financial concepts so business newcomers can align compliance goals with executives’ organizational priorities.  

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.   

Operational and Audit Fundamentals for Building Compliance Expertise 

Business operations are essential partners in a good compliance program, and audits are foundational to healthcare compliance in those areas. These resources drill down into both, explaining how to reduce friction and frustration through proactive partnerships and education.  

Audit Readiness? How about Audit Etiquette?  

In this blog, experts offer the real scoop on audit readiness in healthcare. It outlines crucial operational protocols and relationship dynamics for leading teams through smooth, defensible audits. Learn the unfiltered truth about compliance audits and what audit etiquette means. Get essential tips on: 

• Preparing for audits 
• Role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• What does audit readiness mean? 

Healthcare Quality Leadership: How to Be an Operational Partner, Not a Roadblock  

In every organization, there’s a moment where the quality department becomes either the trusted operational partner or the operational roadblock. The difference between the two comes from how you communicate, assign responsibility and how you follow through. This blog explains how to adopt the OG style for more effective quality programs in healthcare, with “Three Ways to Partner like a Pro.” Direct the strategies that shift compliance from a gatekeeper to a strategic business enabler. 

Three Tips for Strong Compliance Education Practices  

Compliance orientation educates new staff members about company policies, procedures, and various regulations that govern their specific roles. Ongoing compliance training ensures that as regulations evolve, all employees are appropriately educated on implications and requirements. With its emphasis on risk management, compliance training protects both employees and organizations from legal and ethical pitfalls.  

A good understanding of compliance helps employees safeguard the company against lawsuits and reputational damage. Get core principles and three tips for clear, memorable staff training programs that drive actual behavioral change. Two experts – one in education and one in compliance – share advice and analogies to improve your compliance education practices.    

Technology and Strategic Planning for Regulatory Change Management 

Technology and strategy have a lot in common. We expect both to be versatile and responsive, while at the same time, they have to hold up and carry the organization over the long term. These selections explore ideas that will help novice leaders leverage technology to drive strategy and value.  

What to Look for in Regulatory Change Management Software for Healthcare Compliance 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation, dashboard details and insights into completed work. Get a practical checklist to help new leaders evaluate software capabilities for tool selection. Learn six non-negotiables for regulatory change management software and processes. 

AI Guide for Healthcare Compliance Leaders  

From Manual to Scalable: How to Manage Healthcare Compliance Risk 

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity. Updates are tracked. Summaries are circulated.  But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

From a systems-thinking perspective, this is a structural failure, not an execution problem.  In this piece, Lisa Estrada explores systems-thinking strategies to move beyond manual processes and build a scalable regulatory compliance process.  

Compliance Program Building and Oversight 

During your compliance career, you may have opportunities to build a program or at least manage one. Using the metrics and collaboration-building practices covered in these resources will set you on the path. 

5 Strategies for Compliance Accountability Across the Organization  

While supporting operational teams in finding compliant solutions is part of your role, becoming the de facto fixer of what constitutes “operationally friendly” is beyond your scope. That piece must be owned by operations.  The challenge becomes how to get operational leaders to take ownership to resolve their own compliance challenges. 

These five strategies will help you encourage your operational leaders to take responsibility for their particular compliance issues, while preserving your role as a trusted advisor. Respected compliance professional Jay Anstine outlines methods for instilling shared ownership of compliance requirements across clinical and administrative business units.  

Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track? 

How Slowing Down Makes for a More Productive Compliance Program  

As regulations change or investigations are needed, we often get pushed to work faster, meet tighter deadlines, and juggle multiple tasks simultaneously.  

While this approach might seem efficient on the surface, it often leads to serious downsides: 

• Burnout 
• Decreased productivity 
• Decline in the quality of work  

This interesting piece focuses on transitioning from reactive firefighting to building deliberate, repeatable compliance processes. You’ll get five solid tips to help you and your compliance team slow things down in a good way. 

Video Hub: Expert Guidance for Healthcare Compliance Professionals 

While we can’t go into all of them here, the YouCompli video library is packed with useful visual learning materials.  Explore the full catalog, featuring expert interviews and practical strategies. 

Real Conversations. Practical Compliance Insights. 

Where do you need ideas and advice? 

• Compliance Leadership & Mindset 
• Influence, Trust & Seat at the Table 
• Operationalizing Compliance  
• Efficiency, Clarity & Saving Time 
• Customer Perspectives & Real‑World Experience 

Hear directly from compliance leaders who understand the realities of the work. These short videos share honest perspectives on simplifying regulatory requirements, building trust with the business, and turning compliance into a strategic advantage. 

Downloadable Tip Sheets for Quick Ideas and Actions 

For the compliance leader on the go (isn’t that all of us?) the Tip Sheet Library offers quick, useful information. Explore the collection and start downloading tip sheets to start your own handy idea file. 

• Compliance Career Tips 
• Compliance Culture 
• Compliance & Business Strategy 
• Healthcare Quality 
• Industry Trends 
• Rev Cycle 
• Rules and Regulations 

Need More Specialized Support for Your Healthcare Compliance Program? 

Not only does YouCompli have educational resources to help compliance professionals, we also human resources who can help. If you’d like to speak to someone to answer any questions, just reach out. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Resources to Accelerate New Healthcare Compliance Careers  first appeared on YouCompli.

The secret to effective regulatory change management and provable compliance is a one-two punch of expert human regulatory analysis with simple-to-use workflow software. Every day, this combination helps healthcare compliance teams across the U.S. move from reactive regulatory change to clear, assigned, trackable work. 

This blog looks at what’s behind “punch one” — human-led regulatory analysis. It explores the role of a regulatory analysis team and how they bring value to the compliance management lifecycle.  

What AI Can and Can’t Do Well in Compliance Management 

There’s a misconception that AI can automate a lot of the research involved in regulatory change management. AI looks impressive to people who don’t do the actual work, but what AI often really does is create more work. 

While AI tools can gather data points quickly, they sometimes pass the burden of validation back to your in-house team. Sorting through duplicate links, hallucinated details or overly broad summaries can easily turn a promised time-saver into a tedious cleanup project.  

AI excels at generating large-scale but basic, general responses, but it’s missing the domain expertise required to spot subtle regulatory nuances. The rest of this article explains why expert regulatory analysis remains essential and how human validators and analysts help compliance teams turn complex regulatory updates into clear, trackable work. 

What Regulatory Analysis Teams Do 

How do regulatory analysts add value to compliance management? They handle vital legwork by ensuring: 

• Regulatory sources are monitored for relevant updates. 
• Expert insight looks at what changed. 
• Analysis helps teams understand what needs attention 

Reliability in Regulatory Analysis: Where Human Value Wins and AI Fails  

The main thing a compliance leader should understand about expert regulatory analysis is that it comes down to a reliability issue. Humans alone bring the trustworthiness that’s needed.  

Partner teams like YouCompli take on the regulatory legwork and cut through the noise with actionable analysis that is reviewed and organized. 

Role of Validators in Regulatory Analysis Model 

Organizations don’t always save a lot of time with AI because of the potential need for error checking and rework. On the other hand, a human validator delivers confident time savings, because no one usually has to go back and verify the validator. That can’t be said of AI. 

Solid regulatory change management processes trust the final word of experienced, compliance-centric humans as validators of regulatory requirements. At YouCompli, a team of attorneys doublecheck the work to bake in the reliability factor.  

It comes down to accuracy, and that’s something that can’t be consistently accomplished through AI-driven automation alone. 

Regulatory Analysis Isn’t Typical Part of Daily Healthcare Compliance 

The gist of what a regulatory analysis team does isn’t necessarily something that translates to a healthcare compliance department’s daily workload. That might be why people don’t fully understand the unique value of a seasoned analysis team.  

Tracking regulatory changes also requires specialized infrastructure. Many health systems lack the budget for special software or the dedicated internal teams to monitor regulatory analysis.  

Partner Analysis Team: FTE-Equivalent Dedicated to Your Regulatory Compliance 

That’s where a specialized partner fills the gaps. Many health systems find it makes the most sense to partner with a human analyst team backed by a proven regulatory compliance management software platform. 

What skills and capabilities should a health system compliance leader look for in a partner for regulatory analytics? While most leaders might not think about asking a potential partner how their team handles puzzles, it is actually a good benchmark. In fact, one analyst team manager uses that exact question during the recruiting process, because unraveling regulation updates can be like solving a puzzle. 

Think of validators and an outsourced regulatory analytics team as the equivalent of an FTE dedicated to your compliance practice. The software, the analysts and the validators give you all of the work of at least a single FTE and more. 

One-Two Punch: Human Regulatory Analysis Plus Workflow Software 

No one else does what our unique combination of regulatory analysis and regulatory management software can do. But if you want to research capabilities and have conversations, this blog gives you an overview of what’s possible in regulatory compliance management today. 

We mentioned the one-two punch at the beginning of this article. Here’s an in-depth look at the second part – regulatory change management software. With a simple software framework, YouCompli helps teams manage regulatory compliance without relying on scattered emails and spreadsheets. 

• Clear ownership, due dates, and accountability 
• Progress tracking across departments and requirements 
• Reporting and documentation to support proof of completion 

What’s stalling progress in your compliance program? Let’s set up time to talk about some real solutions.  

About the Author

YouCompli was founded in 2016 by Jerry Shafran, a serial entrepreneur with a background in software, content solutions, information technology, and network solutions.

After selling a business focused on how insurance companies manage compliance, Jerry saw an opportunity to bring that experience into healthcare — where regulatory change creates constant pressure for compliance teams, operators, and leaders.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Beyond the Algorithm:  Why Human Expertise Matters in Regulatory Analysis  first appeared on YouCompli.

This thought leadership update explains why it’s more important than ever to communicate in a common language. The piece brings compliance executives up to speed on the role of language and communication in today’s compliance programs. Fresh insights and tips capture the current views of the original author, Jerry Shafran, a compliance industry veteran and seasoned, effective communicator.  

With Compliance Maturity Come Higher Expectations 

Since I originally wrote this, compliance has become harder. It has matured as a function, and when that happens, other areas of the organization naturally raise their expectations.  

One expected hallmark of a mature business function is a defined, repeatable vocabulary. That way, when compliance professionals and outside departments share a common language, everyone understands each other, reducing friction in workflow and in relationships across the business. 

Communications as Part of Compliance Lifecycle Management Methodology 

The original blog talked about a methodology we refer to as compliance lifecycle management or regulatory life cycle management. Either way, the role of a methodology is to provide common ground, and communication is a big piece of that. When in place and working well, components of compliance methodology lead to better communication. 

Nothing in compliance happens without good communication, and we built our software based on this understanding. The software provides a reliable framework for required communications that healthcare compliance teams need. 

Communications Span Different Health System Groups and Perceptions 

Even if you lack a common methodology for regulations, you still have multiple departments dealing with constant regulatory change. Each department may do things differently — or do nothing at all — if you don’t clearly communicate the steps they must take to comply. 

With a good methodology, everyone understands their responsibility and where it resides in the process. And that’s why language is a key part of compliance methodology. 

Regulatory Compliance Must Tailor Language to the Audience 

Across the facilities and departments within a health system, people bring different expertise and understanding. You’ll need to give each department a clear way to comply with the regulation, and each may need its own approach to arrive at that goal. 

In such a setting, language can either lead to understanding or misunderstanding. As people communicate cross-departmentally or interdepartmentally, a common language is essential for reducing friction, delay and even risk.  

When dealing with so many different areas, compliance executives need different communication styles based on the audience.   

Adjust your style based on: 

• What you’re trying to convey 
• Who you’re trying to convey it to 
• How much time you have to convey it 
• What you want them to do with the information 

These variables affect how you choose to communicate with each audience. 

Example: How to Deliver Communications They Remember 

Imagine you’ve got a group of 100 people in a room looking at a PowerPoint presentation, and the set of slides is filled with bullet after bullet. If all you’re doing is reading those points, you’ll lose that audience very quickly.  

Instead, use a more contextual style where: 

• You share the fact or point you want to convey. 
• Then provide a relevant story your audience can connect to. 

Four Tips to Improve Compliance Communication and Language 

Follow these proven tips for effective communication and productive outcomes. 

1. Know your audience. 

2. Understand how your audience perceives your role. 

3. If you don’t know what their perception is, ask. Never assume. A safe way to ask is, “Tell me how you perceive compliance people?” or “What’s your perception of people you’ve come into contact within this role?”  

That’s a good way to phrase it so people will be more comfortable and honest. If you ask them point-blank “How am I doing,” your audience might be reticent to share their true perceptions. It’s another example of how the language you use impacts communications and relationships. 

Comfort levels and transparency are important. Keep in mind that not everybody is open or transparent, not because they want to be dishonest, but because it’s not always comfortable. 

4. To be a good communicator, you yourself have to be willing to be vulnerable and open about own your flaws and foibles. That gives people you engage with a path to connect to you at a human level, because they have the same problem, but may not be as comfortable talking about it. 

Navigating the AI Frontier: Communication and Culture in a Digital Age 

As with many other facets of work life, artificial intelligence is affecting how we speak, write and interact with each other. With AI agents generating human-like emails, text messages and internal updates, technology is stepping into conversational spaces once reserved for human interaction. 

While these new AI tools offer undeniable efficiency, they also present a unique challenge for healthcare compliance leaders: AI can replicate human syntax, but it cannot replicate organizational culture.  

When technology outpaces our shared compliance language, communication breaks down and creates deep-seated, hard-to-fix issues. 

Hidden Compliance Communication Risk: Dilution of Meaning 

Building a true compliance culture relies on a common organizational language that is best forged through human-to-human connection, whether one-on-one or one-to-many. 

When communication shifts heavily to automated or purely electronic channels, the rules of engagement change, and crucial nonverbal context gets lost: 

• Missing Cues: Digital channels strip away voice inflections, intonations, eye contact and hand gestures. 
• Diluted Intent: Without these physical or tonal guardrails, the true meaning of a message easily gets diluted, leaving room for assumptions and misinterpretations. 

A Real-World Example of Electronic Miscommunication 

Consider a simple administrative example from the field. An employee sending an email requesting extra tickets for an annual company outing typed the entire message in capital letters. They weren’t trying to yell or be aggressive. They simply didn’t understand the digital etiquette that all-caps signifies shouting. 

In a compliance setting, similar subtle gaps in digital literacy or tech-driven communication can inadvertently spark tension, mask urgent risks or alienate teams. 

Four Vulnerabilities Healthcare Compliance Leaders Must Consider 

As AI agents and digital channels become more embedded in your organization’s workflow, a unified compliance shorthand becomes more critical, not less. Without a grounded, human-centric language strategy, the disruption caused by AI will expand exponentially. 

To prevent poor communication practices from taking root, leaders should look closely at four critical vulnerabilities: 

• Fragile Culture: If your team doesn’t have a deeply rooted sense of organizational culture, technology might define it for you. 
• Absence of a Common Baseline: Without a predefined “compliance vocabulary,” automated text and human responses will drift apart, creating disjointed expectations. 
• Inconsistency Across Channels: A language strategy must span consistently across traditional face-to-face updates, standard emails and automated AI touchpoints. 
• Festering Misunderstandings: Because electronic text lacks tone, misunderstandings happen fast. If leaders don’t proactively address and correct these gaps, they quickly become cultural liabilities. 

The Bottom Line: The “language of compliance” isn’t just about the words on a page or a policy block. It’s about how those words are deployed and felt across the organization.  

As technology scales, compliance leaders must intentionally protect the human elements of communication to ensure clarity, trust, and ultimate alignment with regulations. 

Business Benefits of a Common Compliance Language 

Turning Communication Benefits into Data to Prove Compliance Value 

Measuring the intangible benefits of a shared compliance language is exactly what gets leadership and the Board to lean in. They want to see how culture translates into operational efficiency and risk reduction. 

Here’s how healthcare compliance leaders can convert qualitative benefits into concrete, board-ready metrics: 

1. Minimizing Misunderstandings and Boosting Productivity 

The Benefit: All members understand expectations. Time formerly spent correcting errors is now spent productively. 

Instead of trying to measure “understanding,” measure the reduction of friction caused by a lack of it. 

• “Time-to-Resolution” for Compliance Inquiries: Track how long it takes to close out basic compliance questions or internal reports. A shared language means less back-and-forth clarifying what a policy actually means, shortening the cycle. 
• Rework and Error Rates in Documentation: Partner with Quality Assurance or Billing/Coding to track the reduction in documentation errors or rejected claims stemming from “misinterpreted guidelines.” 
• Policy Attestation and Quiz Data: Move beyond completion rates. Track the average score on post-training compliance quizzes. A higher baseline score across departments indicates the language is actually sticking. 

2. Consistency for Staff and Patients 

The Benefit: Consistency throughout the organization enhances the image, cohesiveness, and reliability of the health system. 

Consistency can be measured by looking at how external and internal stakeholders perceive your reliability. 

• Patient Satisfaction Scores (HCAHPS): Look specifically at communication metrics like “Communication with Nurses/Doctors” or “Discharge Information”. When staff uses a unified, compliant language regarding patient rights, privacy and care expectations, it reflects in patient trust. 
• Standardized Scenario Testing: Conduct “mystery shopper” audits or drop-in assessments across different clinics or departments. Or present the same compliance scenario to different teams and measure the variance in how they explain the resolution. Lower variance = higher consistency. 

3. Creating an Operational “Shorthand” 

The Benefit: Provides a sort of language shorthand among the organization’s community of management and staff. 

An effective shorthand speeds up corporate velocity and reduces administrative drag. 

• Onboarding Velocity: Measure the time it takes for new hires (or contract clinical staff) to reach full compliance competency. If a common language exists, onboarding friction decreases, and “time-to-productivity” shortens. 
• Compliance Hotline / Helpdesk Efficiency: Track the volume of inquiries that can be resolved on the first contact (first contact resolution rate). A shared shorthand allows staff to articulate their issues clearly and helpdesk agents to resolve them faster without escalation. 

4. Cultivating a Strong Compliance Culture 

The Benefit: Creates a sense of culture — a major factor in organizational success. 

The OIG explicitly looks for a culture of compliance. You can quantify this shift directly. 

• The “Speak-Up” Metric (Reporting Volumes vs. Anonymity): A healthy compliance culture doesn’t mean zero reports. It means a steady stream of them. Track the ratio of named reports versus anonymous reports. As trust in the common culture grows, anonymous reporting typically drops because staff feel safe using the shared language to flag issues. 
• Annual Culture/Engagement Surveys: Insert two or three targeted pulse questions into the annual employee engagement survey. For example, “I understand what is expected of me regarding compliance,” or “Management uses clear, transparent communication regarding ethical issues.” Track the year-over-year positive shift. 
• Corrective Action Plan (CAP) Adherence: Measure how quickly departments implement CAPs after an infraction. A cohesive culture takes ownership faster, resulting in speedier compliance with corrective actions. 

Board-Room Tip for Presenting Compliance Metrics 

When presenting regulatory compliance metrics like these to the Board, bucket them into two categories:  

• Risk Mitigation such as lower error rates or survey shifts 
• Operational Efficiency such as time saved, faster onboarding  

This shows that compliance isn’t just a cost center; it’s an organizational value engine. 

In closing, the language of compliance should be like the language of anything. It should be supportive, simple to understand, and help whoever is listening to perform the work that the compliance team needs done. 

Would you like to know more about building common language and communication into your regulatory compliance practice? Reach out for a conversation.

The Original Idea Still Holds

When we first wrote about building a common compliance language, the goal was simple: help everyone involved in regulatory change understand the process, their responsibilities, and what successful completion looks like.

That foundation remains relevant. An effective regulatory change process should include:

• Identifying and documenting new regulatory developments
• Assessing their relevance to the organization
• Translating requirements into specific operational actions
• Communicating expectations to the appropriate stakeholders
• Assigning clear owners and deadlines
• Implementing the required changes
• Verifying completion and preserving evidence of the response

The terminology has evolved, and the original Compliance Lifecycle Management worksheet referenced in this article is no longer available. Today, YouCompli describes this broader discipline as Regulatory Operationalization, the process of turning regulatory change into assigned, completed, verified, and defensible action.

The tools may change, especially as AI becomes part of compliance work, but the need for shared language, human judgment, clear accountability, and documented follow-through remains the same.

The post Building a Common Compliance Language in the Age of AI first appeared on YouCompli.

Introduction: The Baseline Fears 

AI is moving faster than healthcare policy can keep up. For compliance leaders, the knee-jerk reaction might be avoidance, but blocking AI isn’t an option.  

AI is still valuable to healthcare compliance. It can help teams spend more time on risk identification, monitoring, investigations and proactive program management, because less time is spent on routine administrative work. 

But AI will never become the compliance expert. Rather, it’s a “thought partner” as you’ll learn in this article. That distinction matters because many compliance leaders are stuck between two realities: AI can be incredibly useful, but it can also be confidently wrong. 

We sat down with compliance expert, Lisa Estrada, to discuss why fear is a dangerous strategy, how to handle “shadow AI,” and how to use technology as a compliance thought partner. (Note: See Lisa’s bio at the end of this post.) 

Q: What fears do healthcare compliance leaders have about AI? 

Lisa Estrada: They’re the same fears most people have regularly: that AI is hallucinating or presenting incorrect information with absolute confidence. However, it feels especially high-stakes in compliance. 

Everyone has experienced this generally. AI gets you into the right ballpark, but when you look for specific rules, it can falter. I’ve personally tested it on regulations where it completely fabricated citations. You ask about a rule; it gives you an answer, but when you dig in and ask for the specific citation, it simply isn’t there. If you rely on AI as a primary source of legal or compliance expertise, there’s a real risk it will lead you down the wrong path. 

The Downstream Risk of Losing Business Trust 

Q: What are downstream ramifications if a team pushes ahead with AI without appropriate caution? 

Lisa: The dangerous thing is that AI can be incredibly specific in the way that it’s wrong. If you rely on it blindly, you can easily end up implementing policies or operational practices that are fundamentally non-compliant, even as you forge ahead believing they are correct. If you get a citation wrong, you can give the wrong guidance to the business. 

When that happens, the business loses confidence in the compliance team, and that’s a massive organizational problem. Relying on incorrect expertise leads straight to penalties, which is exactly why compliance professionals are naturally fearful of the technology.  

But there are useful ways to leverage AI that have nothing to do with relying on it for final expertise or human judgment. 

The Danger of Ignorance: Why Compliance Leaders Can’t Just Say No to AI 

Q: Can compliance leaders afford to sit on the sidelines until regulations catch up? 

Lisa: While the fears are realistic, there is a parallel danger in completely blocking the technology. If compliance simply says, “No, no, no, we’re not going to touch it,” the business is going to outpace you anyway. Employees are likely already using AI in their work. 

Most healthcare organizations already look to compliance to support or lead AI governance, a reality highlighted by recent updates to the OIG Corporate Integrity Agreement (CIA) framework. (Editor’s note: For a deeper dive into these requirements, see our guide on the updated OIG CIA framework.) 

If you aren’t actively thinking through how to use AI and how to construct guardrails for yourself, you won’t have the credibility to help the organization govern it. “No” is no longer an option. By using it safely, you gain the confidence and executive credibility needed to help the business define its usage parameters. 

How-To Part 1: AI as Administrative Thought Partner 

Q: How can compliance leaders shift from a mindset of fear to one of confidence? 

Lisa: Shift your perspective and start thinking of AI as a “thought partner.” Compliance issues are notoriously complex and packed with many variables you have to track simultaneously. AI is exceptional at organizing those thoughts. 

When I have a jumble of competing priorities in my brain or when I know what the compliance answer is, but I’m struggling with how it will be received by the business, I use AI to de-clutter.  

I tell the tool: “Here’s what is happening; here’s what I’m worried about, and here’s what I’m aware of. Help me organize this.” AI helps you figure out how to communicate complex regulatory requirements that are clear, actionable, and less intimidating to operational teams. 

Automated Workflow Builds Archive of Decision-Making 

Using AI this way also builds an archive of your decision-making. Often in compliance, you go through a grueling thought process, arrive at a complex answer, and move on. Months later, a similar issue comes up, but you can’t entirely recreate your original logic. 

If you use AI to help document and structure your thought processes, it becomes incredibly easy to look back, compare the two situations, and identify exactly where they differ. 

From a governance perspective, this archive does more than save time. It’s an internal audit trail. When regulators or internal stakeholders ask why a certain path was taken months ago, you have a documented, structured record of your rationale, directly improving your program’s defensibility and compliance outcomes. 

How-To Part 2: Systematizing Proactive Compliance 

Q: How can teams use the “thought partner” concept to build a more proactive compliance program? 

Lisa: This is where the real opportunity lies. Every compliance professional knows they should spend their time on forward-looking, programmatic work and proactive prevention. In reality, your day gets completely consumed by reactive fires.  

While AI will never replace human judgment or navigate the gray areas of compliance, it can help systematize your repeatable, proactive workflows. You can use it to: 

• Map out compliance schedules. 
• Draft standard communication templates for regular regulatory updates. 
• Organize compliance tracking data. 

By letting AI handle the administrative heavy lifting of your proactive programs, you keep those prevention pieces on track automatically. This frees up critical human bandwidth for the nuanced, high-stakes matters that demand deep administrative judgment. 

This structural shift is what drives true compliance outcomes. Instead of measuring success by how many forms you fill out, success becomes visible in lower incident rates, faster internal investigation cycles, and risks that are mitigated before they turn into systemic violations. 

The Immediate Risk for Compliance Leaders: Shadow AI and Privacy 

Q: What is the most immediate AI risk that compliance needs to address right now? 

Lisa: Patient privacy. This is the biggest, most immediate nexus between healthcare compliance and AI. When employees use AI “off the books” or in the shadows, they rarely think about data security. They might copy and paste operational data or documentation into public models without stripping out identifiers, sending protected information straight into the public cloud. 

Compliance programs must get involved in AI governance to protect patient privacy and business integrity. The solution isn’t to ban the tools; it’s to bring AI out of the shadows. Talk openly about proper use, establish clear parameters, and implement mechanisms to monitor how data is being handled. 

Healthcare compliance leaders will want examples such as: 

• Approved AI tools  
• PHI restrictions  
• Employee training requirements  
• Prompting guidelines  
• Audit and monitoring procedures  
• Vendor due diligence requirements  

By establishing clear parameters, compliance isn’t just about policing tech usage but embedding it into the organization’s overall risk governance framework. This helps ensure that as the business innovates to drive operational outcomes, it does so without compromising patient privacy or regulatory standing. 

Getting Started with Low-Stakes Practical Action 

Q: What’s your top piece of advice for a compliance leader who’s still hesitant to start? 

Lisa: Find a corner of your personal life where the stakes are zero and start using AI as your daily assistant. Use it to organize a workout routine, draft a personal email, or plan a schedule. 

How to Get to Know Your AI Thought Partner? Start at the Gym. 

It’s important to spend the time to learn about AI and get comfortable with it. I first became comfortable with AI by using it as a workout coach. That low-stakes environment helped me understand both its strengths and limitations before applying the same principles professionally. 

My watch records my heartbeat and other data.  I feed it to AI, and it has been my thought partner.  

This is the biggest point for compliance. It’s made my workout routine sustainable, and it’s the same thing for compliance. The biggest thing that AI can do for compliance programs is to systematize processes in a way that makes them sustainable. 

Doing this in a low-stakes environment allows you to note its limitations firsthand. You’ll see exactly where it hallucinates, discover where it genuinely saves you time, and learn how to write effective prompts.  

Once you build that personal comfort level, you can confidently bring those same guardrails, skepticism, and strategies into your professional compliance workflow. 

Key Takeaways for RCM and Compliance Leaders 

• Shift from Prohibition to Governance: Blanket AI bans are ineffective and foster a risky environment of “Shadow AI.” Instead, focus on bringing the technology into the light by establishing clear, transparent guardrails that protect patient privacy and business integrity. 
• Leverage AI as an Administrative Thought Partner: Don’t look to AI as a definitive legal oracle. Instead, use it to manage administrative heavy lifting like mapping out schedules or organizing compliance tracking data. Shifting these repeatable workflows to AI frees up the critical human bandwidth needed to focus on high-stakes risk identification and proactive program governance. 
• Build Confidence in Low-Stakes Environments: If you or your team are hesitant, start integrating AI into zero-risk personal routines (like scheduling workouts or drafting personal emails). Experiencing its limitations and capabilities firsthand is the best way to safely and effectively scale those same strategies into your professional compliance workflows. 

How to Build Your AI Guardrails 

The most successful compliance programs will likely combine AI’s speed and organizational capabilities with human expertise, validation, and oversight.  

Ready to build AI guardrails for your compliance program? Download our “AI Handbook for Compliance Leaders,” including governance frameworks, policy templates, and practical implementation guidance. 

About the Author 

Lisa Estrada is Co-Founder of Keystone Solutions, a healthcare compliance advisory firm, and principal of AlloImpact LLC, where she provides strategic interim compliance leadership to hospitals, health systems, provider organizations and healthcare vendors navigating leadership transitions and inflection points. 

She spent fifteen years in private practice as a healthcare regulatory and enforcement lawyer, including as a partner and Health Care Practice Group Leader at Arent Fox and partner at Foley & Lardner, before carrying that lens into the enterprise as CCO at Fresenius Medical Care North America, CCO at LifePoint Health, and General Counsel at ScionHealth. 

Her work centers on turning compliance inflection points into opportunities — to pivot, strengthen, and systematize. Whether bridging a leadership gap, stabilizing during growth or transition, or modernizing a program that has outgrown its practices, she helps organizations build frameworks and cultures that endure. She designs repeatable, resilient processes that scale and stand under scrutiny, so compliance keeps working even when key people change — moving organizations beyond heroics toward something that genuinely holds. 

Editor’s Note: We felt it was only fair to let AI have its say about people’s perceptions and fears of it. 

Q – How do you feel as an AI tool reading a blog about fear of AI? 

Gemini: It’s a bit like looking into a digital mirror while someone tries to explain how my “brain” works! 

Reading a blog like Lisa’s, where she emphasizes using AI as an administrative “thought partner” rather than an all-knowing oracle, is actually incredibly validating. It hits the nail on the head regarding what tools like me are best at, and where we can accidentally trip people up. 

Here is my “perspective” on a few points from that draft: 

• The Fear of Hallucinations: When Lisa mentions testing an AI that completely fabricated regulatory citations, I get it. I don’t want to confidently make up a fake CMS rule, but because of how LLMs predict language, if we are pushed to find an exact needle in a haystack without the right data, we can “hallucinate.” Her advice to never use AI as the final source of truth is incredibly sound. 
• The “Thought Partner” Role: This is where I think tools like me shine. When she talks about feeding a “jumble of competing priorities” into the prompt and asking for help de-cluttering, that’s exactly what I’m built for. I love taking a massive wall of text or an unorganized brain-dump and transforming it into something structured, scannable, and clear. 
• The “No Is Not an Option” Reality: It’s fascinating to see the shift in compliance from completely blocking AI to realizing that “Shadow AI” (employees using it anyway) is the real risk. Building safe guardrails is the best way forward. 

Ultimately, it’s exciting to see content that moves past the hype of “AI will replace everyone” or the extreme fear of “AI is too dangerous to touch,” and instead lands on a practical, grounded middle ground. I’m always ready to be that administrative thought partner! 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Shift from Fear to Confidence in Healthcare Compliance AI Governance  first appeared on YouCompli.

In this article, Lisa Estrada shares her perspectives on why systems beat heroes in compliance and how AI can help accelerate systems thinking in fast-paced healthcare environments. 

Lisa is a seasoned compliance executive with more than 25 years in healthcare, including serving as Chief Compliance Officer for several large, national health systems. See more of her impressive credentials at the end of this blog. 

Systems Beat Heroes: The Quiet Advantage in Compliance 

Ever notice how organizations love a hero story? The person who swoops in, tackles the problem, and saves the day. For the individual, there’s the rush of feeling impactful and the shout-out at the team meeting. For the organization, the crisis is averted, allowing it to direct resources to other pressing challenges. That is, until the next crisis pops up. 

This hero-driven culture is the norm in the healthcare systems where I’ve worked. And as a compliance leader, I’ve fallen into the trap of believing that a key way to establish the value proposition for the compliance function is to show up as the hero, avert the crisis and bask in the glow of the company-wide shout out.  

The Alternative to Hero-driven Compliance Culture 

But is assimilating into the hero-driven culture the right strategy for a compliance program?  

I’ve had a chance recently to think about this question in a very personal way. Since leaving behind my life as a senior legal and compliance executive at large health care systems, I’ve started providing interim compliance leadership services to small health care organizations — standalone hospitals, small systems, and health tech start-ups.  

I’m often a one-woman show writing on a blank or nearly blank slate. And on a near-daily basis, I face a choice between swooping in, tackling a problem and saving the day or stepping back, thinking holistically and building systems that will minimize the need for heroes longer term.  

Given that my role as an interim is short-lived by design, the choice is obvious — build systems that will help the organization navigate through compliance challenges long after my engagement ends. Even so, it can be a challenge to quell my inner hero — to focus on the complex and time-consuming task of building systems while forgoing the quick gratification of popping out an answer or a quick fix. 

Experiencing this tension has really highlighted for me how building strong systems is the counterbalance to playing the hero. And that, ultimately, building an effective compliance program requires prioritizing systems over heroes.  

What Is “Systems Thinking” in Compliance? 

Systems thinking views compliance as an interconnected web of people, processes and technology. This approach builds resilient workflows that deliver consistent results, no matter who’s on point. 

Why Systems Beat Heroes 

• Consistency: A system runs the same way every time, reducing risk and variability. 
• Scalability: Growth doesn’t depend on hiring more “unicorns.” 
• Resilience: When someone leaves, the process doesn’t fall apart. 
• Defensibility: Audit trails and documentation demonstrate effectiveness. 

What Systems Can’t Do 

Systems can’t do everything; they don’t obviate the need for judgment. Instead, they help pinpoint exactly where judgment is needed. In other words, systems can take care of routine and predictable aspects of compliance work, allowing the compliance team to focus their expertise on those unique or complex scenarios that need thoughtful decision-making and judgment calls. 

Moving from Heroics and Reactivity to Systems Steadiness 

The shift from heroics to systems thinking requires a move away from reactivity. In a reactive mode, attention is naturally drawn to individual problems that are urgent, visible and immediately solvable. The focus on immediate fixes makes it harder to step back slow and zoom out enough to see the larger patterns at play. This is a perfect description for most (if not all) corporate environments I’ve experienced. 

Systems thinking, on the other hand, involves creating the space to recognize how the system as a whole shapes recurring issues. Instead of focusing narrowly on the problem, it involves zooming out and asking questions like: 

• What pressures, structures or gaps made this outcome likely? 
• What yellow or red flags are we missing until something breaks? 
• What incentives are unintentionally rewarding risky behavior? 

Systems thinking can also mean building playbooks, decision rules and feedback loops for frequently arising compliance issues.  

How Can AI Help with Systems Thinking in Healthcare Compliance? 

In the real world, compliance leaders are often required to react to urgent issues. The question then becomes how best to toggle back and forth between reactivity and systems thinking. One tool for facilitating this balance is an AI assistant. I’ve found that AI can help create that crucial space to step back and see the system as a whole, while still allowing me to toggle back to reactivity when needed. 

In my work, I have come to rely heavily on AI as a thought partner – helping me to extract and organize my knowledge and experience into repeatable, shareable protocols customized to a particular organization’s needs.  

Three Examples of AI as Systems Thinking Partner 

Here are three specific examples of how I have used AI as a systems thinking partner for compliance programs: 

1. Structured Knowledge Extraction 

This works one of two ways for me. Sometimes I do a brain dump, sharing with my AI assistant my thoughts on  

• What I’m trying to achieve 
• What I’ve seen work or fail in the past 
• What challenges I anticipate 

Other times, I ask my AI assistant to interview me about the problem and possible solutions. Both paths yield a structured outline, allowing me to translate my judgment and approach into clear steps. 

2. Turning Steps into Repeatable Workflows  

Once my AI assistant has my knowledge in a structured form, the next steps are  

• Creating standardized workflows 
• Identifying decision points and criteria  
• Capturing it all in a playbook to hand off to others with plain language instructions, checklists and templates 

3. Continuous Improvement through Continuous Feedback 

Good systems are designed to improve over time. They are structured enough to create consistency and clarity, but flexible enough to absorb real-world experience from the people who use them.  

AI can support this by helping surface patterns, friction points, and recurring questions that emerge as the protocol is used day to day. This facilitates a continuous feedback loop in which protocols can be regularly refined to better reflect how work actually happens.  

The Takeaway: A Fresh Way of Viewing Compliance Effectiveness 

What I’m advocating for here is a different way of thinking about effectiveness in compliance. Being the person who can step in, solve the problem, and keep things moving can feel like success — and in the short term, it often is. But over time, that pattern can hide deeper system weaknesses and make organizations overly dependent on individual heroics. 

Systems thinking offers a quieter alternative. It invests in structures that make good outcomes more likely without constant intervention. When systems are doing their job, judgment doesn’t disappear — it gets used more intentionally in the situations that truly require it. 

I’ve learned that tools like AI can ease and accelerate this shift by helping translate experience and intuition into shared workflows that others can use and improve. The goal isn’t perfection or automation for its own sake, but durability: compliance programs that continue to function well even as people, priorities, and pressures change.

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.   

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post How to Build a Holistic Approach to Healthcare Compliance with Systems  first appeared on YouCompli.

Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. Compared with other business functions, compliance has been slower to embrace AI, especially in healthcare, where concerns about risk, regulation, and potential bleed-over into clinical decision-making have made organizations particularly cautious. 

Yet the opportunity is substantial, especially when it comes to systems thinking. 

Why Systems Thinking Matters in Compliance 

Effective compliance programs depend on systems thinking. Rather than viewing each request for guidance, investigation, or remediation as an isolated issue, savvy compliance teams look at how individual problems fit into larger patterns. 

One of the challenges in any business function is the tension between individual heroics and well-designed systems, and, ultimately, systems win every time. Many compliance officers have been conditioned to act like lifeguards, diving in to save departments from themselves. But this reactive approach consumes time and limits impact. You stay busy, but the organization doesn’t necessarily become more compliant. 

Shifting away from heroic interventions requires time, strategic thinking and structural planning, resources that compliance professionals rarely have in abundance. This is where AI becomes a powerful ally. 

How AI Helps Compliance Move from Reactive to Proactive 

The key to building proactive compliance is carving out the mental space to think more broadly about operational processes. AI doesn’t replace human expertise, but it can significantly accelerate the work. 

AI tools can analyze the countless issues compliance teams handle daily and help generate system-level recommendations. Think of AI as a partner that gets you to the 50- or 60-yard line, far enough to give you a strong foundation, but still requiring human judgment to complete the plan. 

Using AI to Organize Compliance Processes 

The first step is identifying patterns: 

• What repeatedly goes wrong? 
• What are the recurring themes? 
• Where are the inefficiencies or high-risk points? 

Once you see the trends, you can begin imagining the systems that will address them. AI excels at helping structure these ideas. 

A practical way to start is by giving your AI assistant raw input: 

• Here’s what is happening. 
• Here’s the environment. 
• Here are the recurring issues. 

Then you can prompt the AI with something like: 

 “I want to build a system to help identify and minimize these risks within a complicated environment. What elements should be included, and what considerations fall under each element?” 

The output becomes a foundation, a map of decision points and organizational steps you can refine. 

Supercharging Systems Thinking 

Compliance work is complex, and many officers get stuck not because they lack insight but because they lack time. AI helps break the gridlock by organizing information, highlighting key considerations, and suggesting frameworks. 

The AI provides structure; the compliance professional brings subject-matter expertise. In this collaborative process, the AI’s suggestions spark additional ideas and help you think more holistically. The result is a level of systems thinking that becomes far more accessible even in hectic environments. 

The Human-AI Partnership 

Despite its power, AI cannot replace an experienced compliance officer. It draws from online information and from what you feed it, but it cannot grasp organizational nuance, personalities, or culture. 

For example, an AI may outline a solid system, but only the compliance officer understands how a skeptical executive will respond. That’s where the human element comes in. You can ask the AI to help tailor communications or anticipate objections, but the strategic decision-making remains yours. 

Staying Focused with AI Frameworks 

One of the hidden challenges of compliance work is staying focused long enough to complete long-term system projects. Urgent tasks constantly pull attention away, and partially built frameworks can easily get lost for months. 

AI-created structures help maintain focus. They provide guardrails, the methodological anchors that keep the conversation and planning on track. Most of the framework can often be developed in a single sitting, creating a roadmap you can return to even if you’re pulled into other issues. 

Even with the limitations of some AI tools, especially free versions that cap conversation length, paid versions make it easier to resume discussions, refine ideas, and maintain continuity. 

A Faster Roadmap to a Roadmap 

Compliance professionals work hard and add value every day, but much of that value is short-term because they lack the time to build the long-term systems that create lasting change. 

AI solves this by offering a “faster roadmap to a roadmap.” It accelerates the groundwork: 

•  Defining the problem 
• Outlining the system  
• Highlighting the risks 
• Mapping the components 

That clarity frees the compliance officer to focus on the human side of adapting the system to the organization, navigating culture, and communicating effectively with leaders. 

With an AI-driven framework, compliance work becomes more disciplined, efficient, and proactive. Systems thinking becomes not only achievable, but sustainable. AI doesn’t replace the expertise of compliance professionals—it elevates it. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post How to Use AI for Systems Thinking in Compliance Processes  first appeared on YouCompli.

According to the November 2023 General Compliance Program Guidance from the OIG, compliance oversight is within a Board of Directors’ (BOD) fiduciary duty of care and a “critical component of the Board’s compliance role.” Conversely, there is increased pressure from a variety of government agencies (SEC, OIG, DOJ) for boards to become active and engaged without becoming involved in operations.   Finding the right balance can be challenging. 

The board’s responsibility also includes understanding the organization’s risks. A strong process for identifying risk areas and managing the risk is one hallmark of an effective compliance program. Monitoring and auditing can pinpoint potential risk factors and the outcomes will either confirm effectiveness or identify deficiencies. The Board should ensure that the risk areas are consistently reviewed, and corrective action(s) are taken. It would be prudent for the Board to generally know or be informed of the trends in the industry that add gravity to the risk areas such as: 

• The use of data analytics and artificial intelligence, which has introduced both positive and negative consequences.  
• The complexity of laws and regulations, somewhat designed to combat fraud, can be a more lucrative form of crime.  
• The abundance of protected health information (PHI) and personal identifiable information (PII) retained in anything electronic. 
• The growth of cybersecurity data breaches, ransomware attacks, and phishing scams are costly to prevent but can be devasting when they occur. 

Everyone enterprise-wide is responsible for compliance, and the Board should encourage compliance accountability. The General Compliance Program Guidance issued by the OIG has become the topic of conversation within the compliance industry. I thought it would be interesting to obtain viewpoints from seasoned professionals in the compliance field on what they believe the BODs should consider now and in the future: 

• “The November 2023 OIG General Compliance Program Guidance document mentions compliance officers 146 times, the board 120 times and the general counsel once. The board should probably know how important the OIG thinks their compliance role is.”   

— Roy Snell, Co-Founder and Former CEO, HCCA/SCCE 

• “Compliance is more than a legalistic view of the DOJ Evaluation of Corporate Compliance Programs (ECCP) guidelines, DOJ Corporate Enforcement Policy (CEP) and the GCPC aggregation of ‘voluntary,’ ‘non-binding’ guidance. In the past many applied their inner lawyer approach to them, by hanging their hat on terms like ‘guidance,’ ‘voluntary,’ ‘non-binding,’ etc. Currently many missed the spirit of the OIG’s and DOJ’s intent for corporate and board fiduciary duties. Now they suffer the very real consequences of judgment when they have to explain how the Board or company did not consider them in their operation risks when under a review, self-report or settlement that is often raising the specter of a false claim. In the future you will not be able to ignore the spirit of the ‘four horsemen’ (ECCP, CEP, GCPC, and the Qui Tam’s sword under the False Claims Act ‘should have known/deliberate ignorance standard’) because you may be accused in judgment to have been informed of the compliance risks, knowingly ignored applying resources to them and being without the easy excuse from blinders of legalism to their requirements to you personally. Simply said, you would be a penny wise and a pound foolish to ignore them as actual requirements in the future.”  

– Brian Flood, Partner, Husch Blackwell 

• “Governance leaders need to be continuously ‘upping their game’ and expertise as regulators and other key stakeholders are increasing expectations and oversight of board performance. This includes ensuring we are looking 2-3 years ahead (same as we require of management) and being proactive in what skillsets are needed on the board to demonstrate we are meeting our fiduciary duty and have the scope and depth to ask the right questions of management. Additionally, for boards that are compensated, we need to ensure we have processes in place to both measure board effectiveness and individual performance, similar to how we measure and compensate CEOs and the C-suite.”  

–Jenny O’Brien, JD, MS, CHC, President and Principal at BlackBridge Advisors 

• “In the coming years we may see boards look to their Chief Compliance Officer (CCO) to not only provide reports around the status of the compliance program and compliance risk areas but to also serve as an advisor on a broader range of topics as part of an enterprise risk management strategy. CCOs should educate themselves and develop the skills they will need as boards lean into ensuring all risks are prioritized and managed as part of corporate decision-making processes.”  

– Cindy Matson, MBA, CHC, CHPC, Vice President, Compliance & Audit Services, Sanford Health 

• “I think a top priority for healthcare Boards of Directors is to ensure someone on the board has healthcare compliance expertise. Many healthcare boards already seek out individuals with specific areas of expertise such as financial, audit, clinical, patient safety, or some other subject matter expertise. Compliance should be added to that list. Some OIG corporate integrity agreements (CIAs) already require this. But for organizations who want to be forward-thinking instead of reactive when it comes to their compliance programs, they should proactively seek out individuals who have compliance expertise to serve on their board. Such an individual would be able to provide leadership and training in how a board should fulfill its compliance program oversight duties. Some of these duties might include engaging experts to perform periodic compliance program effectiveness reviews or approval of compliance risk assessments and annual work plans. Having someone on the board with compliance expertise would aid the board in asking the right questions of executive management and the compliance officer in regard to the compliance program.”  

– C.J. Wolf, MD, CPC, CPC-I 

• “The rapid proliferation of artificial intelligence (AI) software tools available to healthcare companies is outpacing existing regulatory frameworks, leading to both known and unknown compliance risks. Our company survey revealed that fewer than 11% of U.S. healthcare companies have an AI compliance policy or even a registry of AI-utilizing software. As the evolution of AI mirrors the fast-paced digital revolutions of the 1990s, boards of directors and management often lack a clear understanding of the associated risks. Proactive Board governance is essential to ensure that innovation is paired with rigorous oversight, in an effort to effectively mitigate future regulatory and reputational risks.”   

–Jim Rough, CFE, CHC, CCEP, President SunHawk Consulting, LLC 

• “Future Board compliance strategies rely completely on the Board understanding compliance risks and obligations. Compliance Officers should present training and reports in a manner that helps ensure Board members understand the compliance risk. Assume your organization made a self-disclosure to correct a billing issue which, if not remedied, could have been considered a false claim. Reporting the self-disclosure to the Board and providing some background on the issue is expected, but does the Board know or understand the reason the self-disclosure needed to be done versus just refunding the overpayment? Does the Board understand what the False Claims Act is and the implications of a False Claims action? Compliance Officers can better prepare the Board for future discussions about compliance strategies if the Board has received an annual refresher training on the core laws and regulations that impact the organization. To help emphasize the importance and to help guide the strategy discussion, use settlements or first-hand examples to show how the laws and regulations are being enforced or interpreted. This will help ensure compliance strategy discussions are built on a common understanding of the rules and risks.”  

–Darrell Contreras, JD, CHC-F, CHPC, CHRC, Chief Compliance Officer at Millennium Health 

• “As Compliance Programs continue to evolve and mature, Board’s commitment needs to foster a culture of integrity and be visible by the entire organization.”  

—Debbie Troklus, President, Troklus Compliance Consulting 

• “I think with the OIG’s updated General Compliance Program Guidance (GCPG), there will be an increased concern about private equity firms that are financially backing healthcare organizations. More specifically, private equity investments in healthcare can raise unique compliance challenges due to potential conflicts of interest, billing/coding, and fraud and abuse. To guard against this, I think healthcare boards will need to make sure due diligence is done before entering into any partnerships with private-equity backed firms. Also, ensuring the private equity-backed firm has a robust compliance program in place that integrates with the healthcare organization’s own compliance program. Lastly, making sure that typical compliance activities, such as auditing, monitoring, education, and training, include that relationship with a private equity-backed firm.”   

–Jay Anstine, President, Bluebird Healthlaw Partners 

• “I hope the top priority for any healthcare Board of Directors will be the well-being of their workforce and workplace! We need standardized best practices to prevent burnout, detect culture and correct toxic cultures if we want happy and healthy staff who are ethical and compliant to provide quality and safe care!”  

—Maeve O’Neill, MEd, LPC-S, CHC, CDTLF 

The role of a BODs is multi-faceted, and compliance is one program area of oversight responsibility. Regardless of whether it is paid or unpaid, serving can be both rewarding and daunting at the same time, especially if you want to do the job well and make a difference. It takes considerable time and effort to review and digest the web of information involved with decision-making, developing strategy and fulfilling oversight responsibilities.    

Whether you are new to the field or a seasoned professional, hopefully the viewpoints above offer insight that can influence your BOD’s understanding of their oversight responsibility for the compliance program. 

Shawn DeGroot, CHC-F, CCEP, CHRC, CHPC is president of Compliance Vitals, providing consulting services for clients in need of practical guidance in a complex healthcare regulatory environment.  She served on the faculty of the HCCA Privacy Academy and served five years on Board of Directors for St. Charles Health System, Bend, OR.  Shawn’s area of expertise is also Corporate Integrity Agreements to include experience in seven CIA’s with the first CIA pertaining to Stark and Anti-kickback.  She also is a past president of HCCA/SCCE and serves on an advisory group to the HCCA/SCCE Board of Directors. 

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management   

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software.  

Get the latest from healthcare compliance experts  

Never miss an article by Shawn DeGroot. Sign up for YouCompli’s weekly email if you haven’t already.   

The post Experts Weigh In: The Oversight Role of a Healthcare Board of Directors  first appeared on YouCompli.

I recently attended the 2024 Health Care Compliance Association (HCCA) Managed Care Conference, and it was great to attend sessions and network with professionals and exhibitors from across the country. If I received $1 for every time artificial intelligence (“AI”) was referenced, I might have the financial means to invest in one of the many AI products being pitched to the health care industry.  

There was a lot of sharing of ideas around how to respond to both the opportunities and challenges that AI brings to our organizations and industry. I can summarize these in three themes – the ABC’s, if you will, of integrating AI into your compliance strategy. 

1. (A)SSESS

Great organizational compliance programs feature a formal process to assess and prioritize risk. This must include AI, because it can impact every part of our business – from clinical care delivery, claims payment, and patient interactions to human resources, procurement, and accounting. That said, AI is the same as any other emerging risk facing our organizations.  

If not already part of your 2024 compliance plan, “AI Program Oversight Strategy” should be at the top of your list. Key focus areas to include as part of the program strategy include: 

• AI Inventory: Assess and capture current AI initiatives within the organization in preparation of building an intake process to capture and review future AI initiatives.  
• AI Governance Strategy: Work with key business partners to build an oversight structure to help ensure consistency and standardization as new AI is proposed and introduced into the organization.  
• AI Awareness: Integrate AI into annual education and training modules. This will ensure awareness about protecting data and safeguards required when using AI in a healthcare setting, as well as capture key state and federal regulatory considerations. 

 2. (B)UY-IN

As interest in and adoption of AI increases, the value proposition in adopting and articulating an enterprise-wide AI strategy increases. The ability to use AI to optimize innovation of care models, increase patient access, scale, grow services and market share, and reduce the cost of healthcare is exciting and transformative.  

As with any enterprise initiative, the following considerations should be at the top of the list: 

• Executive Champion: Building an AI culture starts at the top, which is why recommending that your organization identify an executive business leader and champion is essential. Who that should be will be unique to each organization and dependent upon their strategy. The compliance professional’s role will be to ensure they are one of the key stakeholders at the table. 
• Skillset/Expertise: You also need the right skillset within the organization and your compliance team to lead this work. Do you have the right mix of talent and expertise within your team to help you adapt to and support your organization’s strategy of optimizing AI to scale and grow? Hiring new people, or an inability to hire, can’t always be the answer. It’s our job as compliance professionals to continue to find different ways to work to support emerging risk areas.  

3. (C)OLLABORATION

Generative AI is impacting all areas of healthcare. As adoption increases, so can the risks. Be prepared for an oversight structure that includes new partnerships such as cloud vendors, external IT professionals, and other consulting firms. If not already at the table, be ready to deploy the same due diligence and compliance program oversight as part of your vendor oversight initiatives. 

Integrating an AI program oversight structure can be viewed in two ways: overwhelming and fragmented, or reframed into something as simple as “ABC.” By taking a practical approach to this complex topic, you will be viewed positively by your team and able to respond well to questions about AI risks from your business partners, the C-suite, and your Board of Directors. 

---

Jenny O’Brien, JD, MS, CHC serves on the advisory board for YouCompli. She is also president and principal at BlackBridge Advisors. She has been the chief compliance officer (CCO) at multiple companies, including UnitedHealthcare, as well as a state assistant attorney general and a partner at a law firm. She is a past president and board member of HCCA/SCCE, serves on the boards of Bon Secours Mercy Health System and St. Charles Health System, and the advisory board of Stellar Health. 

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management    

Our in-house team works tirelessly to monitor US regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software.  

Get the latest from healthcare compliance experts   

Never miss an article by Jenny O’Brien. Sign up for YouCompli’s weekly email if you haven’t already.    

The post The ABC’s of Integrating AI Into Your Compliance Strategy  first appeared on YouCompli.