Ensuring medical necessity for services or supplies isn’t just about getting paid. It’s a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders. 

This is the first article in a series on medical necessity — an area that many compliance programs struggle with. In this piece, we explain the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems. 

Impact of Denial Rates and Medical Necessity on Payer Costs  

Data suggests that medical necessity is becoming a primary way for payers to manage costs, making it even more worthy of leadership attention. The “State of Claims 2025” Report found that 54% of providers agree claim denials are increasing faster than they can appeal. 

A data accuracy gap also contributes to the problem. Roughly 41% of healthcare organizations report at least 1 in 10 claims is denied, often due to “bad data” at intake or lack of clinical justification. 

All of this creates further justification for the need to better understand medical necessity from a compliance standpoint. 

Role of Clinician Review in Determining Medical Necessity 

Medical necessity isn’t an easy compliance risk to tackle, especially when OIG recommendations bump up against front-line reality. Sometimes, clinicians view medical necessity as their bailiwick.   

Of course, their expertise is the basis for medical decision making. Generally speaking, clinicians are making their decisions based on what they believe is medically necessary. They are the clinically trained professionals and should know when something is medically necessary or not, right?  

However, from a compliance standpoint, medical necessity often really means “covered” by a third-party payor. If something is considered “not medically necessary,” it may actually mean it does not meet payor coverage requirements. 

OIG on Clinical Review of Medical Necessity in Claims Audits 

In their General Compliance Program Guidance document (GCPG), the Department of Health and Human Services (HHS) Office of Inspector General (OIG) emphasized the importance of ensuring claims submitted to government payors are medically necessary. 

Specifically, they note:  

“Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Considerations for Compliance Risks in NCD and LCD 

Other entities have also emphasized medical necessity as coverage criteria. For example, Medicare publishes National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs). These are, in essence, coverage criteria for a specific service.  

Though generally accepted medical guidelines or medical practice may suggest a certain treatment plan is appropriate, the LCD might not cover the service for a particular condition or diagnosis or might not allow the service at a particular cadence or frequency. 

Example: Meeting LCDs for Pain Injection Procedures 

LCDs addressing pain injection procedures are a good example of this. A Medicare LCD might state that before Medicare considers a spinal injection “medically necessary” (think “covered”), the patient needs to have failed four months of conservative therapy (e.g., lifestyle changes, physical therapy, etc.)   

Or the LCD might state a total of four injections in a twelve-month period is the maximum number of injections they will allow. Additionally, an LCD might require that a patient has a certain condition (represented by an ICD-10 or diagnosis code i.e., diagnosis code) before considering a service covered.   

There is potential compliance risk in all these areas if coverage criteria are not met and documented in the medical record or if codes are reported to ensure coverage, but the medical record does not support the diagnosis code reported. 

Overlap with Patient Safety 

Medical necessity can also overlap with patient safety issues. If a physician exaggerates the severity of a condition to make it look like the services should be covered, a patient could undergo a procedure that was not appropriate or medically necessary to perform in the first place.  

This raises patient safety issues for subjecting a patient to certain risks when the service does not appropriately meet clinical standards or indications for performance. 

How Medical Necessity Compliance Is Enforced 

The government utilizes various tools for enforcing medical necessity compliance.  These include the False Claims Act (FCA), typically used by the U.S. Department of Justice (DOJ), and the Civil Monetary Penalties Law (CMPL) utilized by the OIG. 

The DOJ can investigate allegations of medically unnecessary services when credible information is brought to its attention by whistleblowers (qui tam relators). A qui tam relator is a private individual or entity who files a lawsuit on behalf of the government under the FCA against companies or individuals committing fraud. Or the DOJ can investigate on their own, typically because of data analytics they proactively perform. 

How OIG Pursues Financial Penalties and Program Exclusion 

The OIG is authorized to pursue monetary penalties and exclusion through a variety of civil authorities, most notably the CMPL. Under the CMPL, OIG can seek assessments in lieu of damages, Civil Monetary Penalties (CMP), and exclusion from participation in federal health care programs.   

According to the OIG, one example of conduct that could lead to CMP liability is presenting a claim for a pattern of medical or other items or services that a person knows or should know are not medically necessary. 

Medical Necessity Risk Tied to Clinical Services 

There isn’t a one-size-fits-all risk profile when it comes to medical necessity. Each organization’s risk is going to be tied to the clinical services it offers or orders. Organizations and their compliance programs should undertake risk assessments tailored to their particular situation.  

Via the GCPG document, the OIG recommends that when conducting risk assessments, organizations should “ensure that medical necessity, patient safety, and other quality compliance issues are included in the risk universe.” 

Download Tip Sheet

Coming Articles: Details of Recent Enforcement Actions 

In subsequent articles in this series, we’ll take a closer look at the details of recent enforcement actions involving allegations that submitted claims lacked medical necessity. This information will help compliance leaders stay on top of situations and reduce risks in their own organizations.  

About the Author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 27 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Medical Necessity: A Guide for Healthcare Compliance Leaders  first appeared on YouCompli.

For years healthcare leaders have been faced with demonstrating their value and answering the question, “How is compliance doing?” Getting the answers typically involves a scattered, manual process of pulling data from multiple sources, departments, and teams, then going through the process of aggregating that data to pull important, need-to-know information. By the time that step is complete, often the information is already out of date. 

Compliance Confidence with Real-Time Data. Now You Have Answers. 

We knew there was a better way, and who better to partner with than our existing clients? With our expertise and their input, we developed the new YouCompli Analytics Dashboard, now a standard tool within YouCompli Software for all clients.  

This blog explains what the YouCompli Analytics Dashboard is and how it helps compliance leaders demonstrate the immense value they bring to an organization through their ability to monitor and oversee regulatory work in real time. 

Problem: Accessing Important Compliance Metrics and Data 

Compliance leaders need to monitor and oversee regulatory work throughout the organization, and that can be very challenging. Many organizations lack the time and resources to quickly access regulatory information that may be scattered across an organization and then roll it up into a reportable and actionable result. 

The Solution: Real-Time Metrics and Transparency 

The YouCompli Analytics Dashboard takes regulatory changes and immediately provides you with information on key performance indicators (KPIs) when it comes to compliance. These KPIs are simple to access.  

Just identify the date range of information you want to review and let YouCompli take it from there. You’ll be provided with real-time, on-demand information on all the need-to-know metrics when it comes to implementing and complying with new and updated regulations.  

Task Status: Summary of current task status (e.g., accepted, assigned, in progress, completed) of task due dates within the selected date range. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Instead of pulling multiple reports in YouCompli to filter, sort, and manipulate to showcase the regulatory work, now by entering a date range, we’ll do all the hard work for you.  

• Want to know how long it takes you to comply with new regulatory requirements? YouCompli will tell you!  
• Want to know exactly what hasn’t been done yet? See the total amount and then click the number to have the list of overdue requirements at that moment.  
• Doing great? See your overall requirement and task completion rates immediately on how your organization is doing from 0% – 100% to get right to the work that needs to get done or celebrate your accomplishments for a job well done.  

Benchmark data, set goals, and have real-time information to measure improvements against previous performance. 

YouCompli Analytics Dashboard = Operational Accountability 

The YouCompli Analytics Dashboard brings transparency to all departments to evaluate where compliance activities are timely and complete. It also allows you to identify gaps in regulatory oversight and accountability and ensures you’re able to quickly address them. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Requirement Status: Summary of current status (e.g., accepted, assigned, in progress, completed) of requirements effective during the selected date range. 

The YouCompli Analytics Dashboard brings to light regulatory compliance activities and how the work is distributed across an organization. It gives insight into: 

The value of regulatory change management software. 

• How many regulations did our organization review? 
• How many regulatory changes have we completed? 
• How many regulatory changes have yet to be done, and … 
• Does this pose potential risk of penalties, fines, investigations or reputation? 
• How are we doing overall? 

YouCompli Analytics Dashboard = Everything You Need to Know 

Nothing comes close to the YouCompli Analytics Dashboard when it comes to quickly and easily monitoring and overseeing the state of regulatory compliance. Whether you’re looking for high-level information for boards and senior leadership teams or more detailed information for compliance committee or department-level teams, the YouCompli Analytics Dashboard provides all the need-to-know information.  

Requirement Completion Rate: Percentage of requirements effective within the selected date range that have been completed. 

Task Completion Rate: Percentage of tasks completed for requirements effective within the selected date range.  

YouCompli Analytics Dashboard Overview 

The YouCompli Analytics Dashboard provides your organization with the following information: 

• Requirement and Task Completion Rates 
• Average Number of Days to Complete Regulatory Requirements and Tasks 
• Requirements Completed with Missing Important Information (Relevance) 
• Total Requirements and Tasks Overdue  
• Total Volume of Regulatory Requirements Published/Assigned in YouCompli  
• List of All Requirements and Tasks Completed 
• Regulatory Requirement and Task Status (Assigned, Accepted, In Progress and Completed  
• Regulatory Requirement Heat Map: Top 5 Departments with Overdue Regulatory Requirements 
• Open Regulatory Requirements Across All Departments 
• Software Utilization Monitoring (Software User Activity and Requirement Completions) 

Example: Values link to detailed reports showing all contributing data. 

What the Data Means: 

Average Days to Requirement Completion: Average number of days between requirement published date and requirement completion date for requirements effective within selected date range.   

Average Dates to Task Completion: Average number of days between the task assigned date and the task completion date for tasks associated with requirements effective during the selected date range.   

Total Requirements Completed, Relevance Unknown: Total number of requirements completed within the selected date range, but relevance status was not answered.  

Total Requirements Overdue: The total count of incomplete requirements past their effective date within the selected timeframe.  

Total Tasks Overdue: Total number of tasks not completed and past their due date within the selected date range. 

YouCompli Analytics Dashboard Demonstrates Your Compliance Value 

The YouCompli Analytics Dashboard is standard part of the YouCompli software and is just one of the ways our client success team works for clients every day. We take feedback and opportunities to continuously improve for the valued clients we serve every day. Want to learn more? Let’s start a conversation. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Healthcare Compliance KPIs: Real-Time Data Dashboards  first appeared on YouCompli.

For healthcare compliance leaders, financial literacy is not optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  

To identify anomalies or potential regulatory “red flags,” compliance officers must move beyond a high-level view of healthcare finance and understand how clinical operations translate into financial entries. 

What does a compliance leader need to understand? Things like: 

• Budgeting and capital planning 
• Internal controls and risk 
• Grant and research compliance  
• Key performance indicators (KPIs) 
• Communication between CFO and compliance officer 

Familiarity with the 14 steps of the revenue cycle is also valuable for mitigating risks associated with reimbursements and 340B compliance. (This topic is covered later in the blog.) 

Where Do Healthcare Compliance and Finance Intersect? 

Regulatory compliance and healthcare finance overlap in multiple ways. Compliance-related areas with a financial angle include: 

• Medicare, Medicaid reimbursement 
• 340B drug pricing 
• Stark Law and anti-kickback statutes 
• Charity care 
• Financial assistance requirements  

What Should Compliance Leaders Understand About Financial Statements? 

To build fiscal literacy, let’s start with some foundational concepts – financial statements. Compliance officers should have a basic understanding of these types of statements: 

1. Balance Sheet 
2. Income Statement 
3. Cash Flow Statement 

1. The Balance Sheet: Assessing Financial Integrity Through a “Snapshot” 

The balance sheet provides a snapshot of an organization’s financial health at a specific point in time, detailing its assets, liabilities and equity. 

Why Compliance Should Care: Monitoring the balance sheet helps ensure that assets are properly recorded, and that liabilities like these are appropriately disclosed: 

• Potential legal settlements 
• Debt obligations 
• Medicare overpayments 

2. The Income Statement: Monitoring Operational Risk Over Time 

Unlike the balance sheet snapshot, the income statement tracks revenue and expenses over a specific period, such as a month or a fiscal year. The income statement puts a focus on total revenue and expenses, and the difference between them, while distinguishing between operating and non-operating items. Those two concepts are compared in the chart below. 

In an income statement, it’s important to distinguish between accrual-basis accounting (matching revenue to period it was earned) and cash-basis accounting (recording transactions only when money changes hands). 

Why Compliance Should Care: By comparing current monthly performance against previous years, compliance officers can spot outliers in revenue or sudden spikes in expenses that could indicate billing errors, “upcoding,” or improper financial arrangements under the Stark Law. 

3. The Cash Flow Statement: Ensuring Operational Sustainability 

The cash flow statement tracks the actual movement of cash into and out of the organization, categorized by: 

• Operating activities 
• Investing activities 
• Financing activities 

Why Compliance Should Care: Understanding cash flow is vital for making sure the organization has liquidity to maintain compliance standards even during times of financial strain. A significant discrepancy between reported net income and actual cash flow can signal deep-seated issues with revenue cycle integrity.  

Revenue Cycle as Regulatory Roadmap 

For a prepared healthcare compliance leader, the revenue cycle isn’t just a financial process; it’s a regulatory roadmap. From initial patient interaction to final collection, each step presents a unique set of compliance risks that can lead to audits, fines or loss of reimbursement if not managed with understanding. 

What Compliance “Trapdoors” to Watch for in the Revenue Cycle 

The revenue cycle is full of complexity, largely fueled by the impact of different hospital types (PPS, critical access, disproportionate share, and tribal hospitals) on Medicare and Medicaid rates. 

While the full revenue cycle has 14 distinct stages, compliance officers should pay particular attention to these “trapdoors” where financial operations must meet strict federal regulations: 

• Front-End Integrity (Scheduling and Registration): Accuracy is paramount to ensure Medicare and Medicaid reimbursements aren’t jeopardized by incorrect patient data or lack of prior authorization. 
• Clinical Documentation and Coding: This is a high-density risk area. Compliance must make sure that coding reflects the actual services provided to avoid allegations of “upcoding” or “unbundling,” which can trigger False Claims Act investigations. 
• 340B Drug Pricing Program: If an organization participates in 340B, the revenue cycle needs rigorous internal audits to establish compliance with drug diversion and duplicate discount prohibitions. The stakes will be even higher if the program undergoes potential changes regarding payment models. 
• Billing and Claims Submission: Errors in this stage directly impact the Clean Claim Rate. More importantly, consistent billing errors for federal healthcare programs can lead to significant liability under Anti-Kickback Statutes or the Stark Law if improper financial relationships are found. 

Monitoring Denial Management at Back End of Revenue Cycle 

A robust compliance program monitors the back end of the revenue cycle as closely as the front. Analyzing denials can reveal systemic issues in documentation or billing practices that, if left unaddressed, represent both financial loss and compliance vulnerability. 

What KPIs Should Compliance Watch as Part of Financial Oversight? 

For a healthcare compliance officer, financial data is more than just a reporting requirement. It’s a proactive tool for risk assessment. By monitoring specific KPIs, compliance teams can move from reactive auditing to strategic oversight and identify operational stressors before they escalate into violations. 

The “Big Four” Financial KPIs for Compliance Officers 

Comprehensive financial oversight should track these four metrics: 

• Operating Margin: This measures whether the organization’s core clinical mission is profitable after all operating and overhead costs are paid. A shrinking margin often leads to “cutting corners” in staffing or documentation, which directly increases compliance risk. 
• Days Cash on Hand: This indicates liquidity. How many days can an organization operate using its current cash reserves if all revenue stopped? Higher liquidity provides the financial “breathing room” to maintain compliance and quality standards even during economic downturns. 
• Clean Claim Rate (CCR): A high CCR (ideally 95% or higher) indicates that claims are being submitted without errors the first time. A low rate is a red flag for systemic billing or documentation errors that could trigger federal audits under the False Claims Act. 
• Payer Mix: It’s critical to understand the percentage of revenue coming from Medicare, Medicaid and private insurance. In many healthcare models, Medicare functions as a “break-even” payer, while Medicaid reimbursements often fall below the actual cost of care, placing additional pressure on revenue integrity. 

What to Know about Budgeting and Internal Controls 

Compliance officers should also distinguish between the Operating Budget (daily/annual clinical operations) and the Capital Budget (typically reserved for long-term investments or items over $10,000). 

To prevent fraud and ensure financial integrity, a compliance program must enforce strict segregation of duties. This assures that no single individual has control over all aspects of a financial transaction, serving as a primary defense against embezzlement and improper financial reporting. 

Using the SBAR Tool to Structure CFO and Compliance Communication 

The most effective healthcare compliance programs are those where the Chief Compliance Officer (CCO) and Chief Financial Officer (CFO) operate as strategic partners.  

However, communicating complex compliance risks in a way that aligns with financial priorities requires a structured approach. This is where the SBAR tool (Situation, Background, Assessment, Recommendation) becomes invaluable for justifying financial decisions and resource allocation. (Download a helpful SBAR template at the end of this article)

Four-Step Method for Financial Advocacy 

Use this four-step method to present compliance needs to your finance team: 

• Situation: Clearly state the immediate financial or regulatory issue.  
  Example: “We have identified a 15% discrepancy in our 340B drug pricing audits.” 

• Background: Provide the necessary context and data.  
  Example: Current Medicare reimbursement rates for these drugs are subject to strict transparency requirements. 
   
• Assessment: Offer your professional analysis of the risk.  
  Example: Failure to rectify this documentation gap poses a significant risk to operating margin and regulatory standing and could trigger a federal audit. 
   
• Recommendation: Propose a specific, data-backed solution.  
  Example: “I recommend an immediate investment in automated tracking software as part of the next capital budget cycle.” 

How Compliance Can Secure a “Seat at the Table” 

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  

Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.  

Ready to drive more compliance value? Reach out to see how YouCompli can help.  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  first appeared on YouCompli.

This Q&A with compliance expert, Lisa Herota, RHIA, CHC, CHIAP, CHPS, CCS covers best practices for a data-savvy compliance leader. Learn about realistic compliance metrics and how to share them effectively. Read more about Lisa’s background and experience at the end of this blog. 

Question 1 – How do you define value in the context of healthcare compliance? What kinds of value can compliance create? 

Lisa Herota – Compliance has a positive impact on financial, clinical and operational outcomes when we manage compliance well overall, not just by avoiding penalties.  

We help the organization safeguard the mission and reputation by: 

• Protecting revenue  
• Enabling ethical growth 
• Maintaining patient safety 

We do this all while also making our leaders feel more confident. They can make informed decisions through a compliance mindset, versus just worrying about how we’re going to avoid a penalty. 

Q 2 – Can you share examples of how you’ve created value or seen others do it? 

LH – One approach I’m proud of is strengthening organizational trust and reputation by developing a culture of compliance. This happens through:  

• Rounding and being present in the organization 
• Doing trainings  
• Partnering with leaders, medical staff, employees and even patients 

I’ve taken compliance teams from being the department where ideas go to die or the “Department of No” to being seen as a function that engages and supports. We became a resource that leaders want to bring to the table at the beginning of projects and discussions as a support versus just somebody to call when things go wrong. 

Q 3 – How do you measure and quantify compliance value?  

LH – I love data. I preach data, data, data to all compliance leaders. There are lots of different metrics we don’t think about, but many times, we just look at how we avoid fines. 

Actually, compliance has a lot of data for leaders to study. We can:  

• Look at percent of applicable regulations implemented on time.  
• Look at number and severity of audit findings or corrective action plans implemented.  
• Trend reported issues and how quickly those issues were resolved.  

Compliance Metric: Tracking the Near Misses 

Something that compliance leaders don’t think about often enough are the near misses. We usually think about these situations in patient safety and quality. But many times, compliance can help with close calls, and we should track those.  

Compliance Metric: Financial Value from Correct Regulation Implementation 

Common examples of financial value derived from correctly implementing new regulations include: 

• Reductions in external legal expenses 
• Decrease in denials and claw backs or repayments 
• Additional revenue capture  

Compliance Metric: Operations Staff Hours Saved 

You can talk to your operational leaders about how their team workloads benefit, especially if you have good regulatory change management tools with reporting and dashboards. Many times, I’ve tracked the number of hours saved that operational leaders don’t have to spend reading through regulations to decipher and interpret them.  

Department heads save valuable time when we provide them with tools like policy templates, implementation information, and the interpretation of the regulation itself. So, the hours compliance saves other department leaders is a good metric, too. 

Hard for Compliance to Quantify: Harm Avoidance  

It’s difficult for compliance professionals to quantify how they help the organization avoid harm. It’s definitely easier for revenue-generating departments to show their value, because they can measure the revenue they drive.  

But compliance often concentrates on how we avoid fines, and it’s hard to prove we’ve truly avoided something when the attitude is “Maybe we wouldn’t have gotten that fine anyway, regardless of what we do or don’t do.” That’s why I focus on other metrics. 

Q 4 – Who needs to know about the value that compliance creates, and how do you communicate that? 

LH – That’s a great question. There are various levels across any health system or organization that need to know the value that compliance has created, but the way you report it is going to look different based on whom you’re talking to.  

Talking to the Board 

When I’m presenting to my board or board committees, I target risk mitigation trends, assuring them we’ve got this. I use heat maps that show risk rankings, prioritization and key regulatory risk areas. I use implementation rates or key issues identified and resolved. When I’m talking to my board, I highlight how compliance work aligns with the strategic priorities of the organization.  

Talking to the Executive Team 

But when I’m talking to my executive team, I might get a little more granular with how many reduced denials or repayments or how many claw backs we avoided. Also, that metric about saving frontline leaders’ time, because that affects their operational teams as well as alignment with patient safety, quality and patient experience goals. A key metric is showing executive leaders how compliance ties into all the other objectives that the organization is trying to accomplish.  

Talking to Operational Leaders and Frontline Teams 

It’s a very different story when I’m talking to operational leaders or frontline staff.  With them, I focus on how I’m helping them succeed:  

• Fewer surprises related to regulations that apply to them 
• Reduced fire drills from reactive implementations versus steady, methodical implementation of regulatory change. 
• With good policies, procedures and training 

With frontline staff, it’s all about what compliance does. Proving compliance value is about showing them how we:  

• Impact their day-to-day reality. 
• Make changes to protect them and their patients. 
• Help make their work easier and safer. 

Really, it’s all about how we help support them and affect their day-to-day work. 

Tie Compliance Work to Strategic Goals for Value Recognition 

To overcome compliance reporting roadblocks, I go back to tying compliance’s work directly to the organization’s strategic goals. Just connect what we do to what the organization is focused on. Show how what we do impacts quality, CMS, star ratings, financial stability, the growth of new service lines and innovation.  

We need to connect what we do to optimizing and streamlining those goals and processes. 

Q 5 – What feedback have you had about compliance metrics and value? 

LH – One of the stories I love to share is about the day I was presenting a regulatory change management dashboard to my board. The very first time, I showed them that over the course of a year, the compliance team had touched over 535 regulations. It was the height of Covid, and when I presented that dashboard, board members just sit back in their chairs almost with a collective sigh.  

And they said, with the data you present, we can see what’s happened to the organization. We’re not just hoping we’re compliant. Now we can prove it. We can show that the organization truly is operating in a compliant manner. That was one of my biggest takeaways from frontline leaders.  

Other feedback I’ve received includes: 

• “I feel like compliance is supporting and partnering with me, not just telling me no or being a barrier.” 
• “When we streamlined compliance tools, that really helped support compliance functions.” 
• “Compliance saves us time and work by not having to review, interpret and decipher complicated regulations.” 

Leaders feel confident knowing we’re not missing anything and that they’re being supported. 

Be a Confident, Data-Driven Compliance Leader 

Wouldn’t you like to feel the same way about your compliance program? Reach out and we’ll show you some of the compliance management tools mentioned in this blog. 

About the Author 

Lisa Herota is a seasoned healthcare executive with over two decades of experience leading high-impact initiatives in compliance, privacy and health information management (HIM). She brings a strategic, data-driven approach to safeguarding organizational integrity. 

Throughout her career, Lisa has held pivotal leadership roles at several medical systems. Her expertise spans the full spectrum of healthcare operations, from managing complex ICD-9 and CPT coding systems, to overseeing departmental budgets and navigating rigorous accreditation standards. 

Lisa is a recognized expert in regulatory change management and is passionate about transforming compliance from a “policing” function into a proactive business partner. She holds an impressive array of professional certifications that underscore her deep technical knowledge, including: 

• RHIA: Registered Health Information Administrator 
• CHC: Certified in Healthcare Compliance 
• CHIAP: Certified Healthcare Internal Audit Professional 
• CHPS: Certified in Healthcare Privacy and Security 
• CCS: Certified Coding Specialist 

Beyond her technical skills, Lisa is a dedicated advocate for building a culture of compliance. She leverages her background in research and data compilation to provide executive leadership with insights to make informed, ethical and growth-oriented decisions.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?  first appeared on YouCompli.

It’s the nature of our mission to stay on top of what’s happening in the world of healthcare compliance. And right now, that focus couldn’t be more important.  

These are unusual times, and Compliance is feeling the impact. The Medicare Fiscal Year 2026 Final Rules were expected to be late but came through on time. However, hospitals must still rush to analyze and respond with action plans in short order. CMS transmittals are also likely impacted by the government shutdown (more on that later). 

That leaves many hospital compliance teams unprepared and under-resourced to cope with fast-coming changes. The price of noncompliance, even under extenuating circumstances, is reimbursement risk. 

Two Areas Needing Compliance Attention: Final Rules and Transmittals 

• Final Rules – Legally binding federal regulations that establish new policies in particular areas of healthcare. 
• CMS Transmittals – Internal instructions for updating CMS operational manuals to reflect new or changed policies. 

Two Important CMS Timelines: Fiscal Year and Calendar Year 

The CMS guidance for healthcare comes with its own deadlines attached, and every year there are two important and separate timelines for fiscal year and calendar year Final Rules.  

In healthcare, fiscal year guidance typically has an October 1 effective date, and that Final Rule usually drops in August. This year, YouCompli analysts got through the fiscal year Final Rules incredibly quickly, because CMS cut a lot of the material in the preamble, and that allowed more efficient review and analysis. 

Effective Date of Calendar Year Final Rule Coming Up Fast 

As every seasoned compliance professional knows all too well, CMS puts out a handful of big, omnibus rules for different areas of health care on an annual basis. This time of the year brings us the final rules affecting outpatient costs and billing. These areas usually get addressed during the calendar year, and these calendar year communications started dropping this year on November 5. That gives an effective date of January 1 of the next year.  

It’s important to get these annual changes synthesized and implemented in a health care organization because they cover the entire year. Even when Rules drop at the usual time (and not during a government shutdown), the short time frame to the established effective date still puts pressure on providers to analyze and develop a compliance action plan. That’s where having a partner like YouCompli already breaking down these rules and translating them into actionable business requirements is essential.  

Transmittals Could Be Delayed and Affect Claims Processing 

On top of concerns about Final Rules delays, CMS transmittals ceased to come out on September 30. Transmittals are typically issued on a running basis as they come up. In a given month, you can have anywhere from 15 to 150 transmittals come out.  

A CMS transmittal is not the same as a Final Rule. They are two distinct types of guidance documents from the CMS. Transmittals are official documents to communicate new or changed policies, procedures, claims and other operational guidance to Medicare administrative contractors (MAC), regional offices, and healthcare providers. The communications update specific CMS program manuals, instructions, and other documentation to ensure consistent implementation of Medicare rules.  

MACs Also Risk Claims Backlog with Transmittal Delays 

Another job of a transmittal is to direct the MACs on what to do in processing claims. These third-party contractors are hired by CMS to administer claims, and they can get backlogged on their instructions and claims processing when transmittals run late.  

Any claims processing delays impact providers, so it’s important to keep an eye on when these transmittal communications come out, especially if it drags out for weeks. If MACs struggle with claims processing because they can’t keep up with the updates, providers lose money. 

Whether it be through time-related loss, because then they have to reissue claims with fixes and things of that nature, delays directly impact revenues. That’s not good at a time when health systems are already under the gun. 

Solution: Proactive Compliance to Know, Act and Verify 

If you’re a YouCompli customer, you wouldn’t have to scramble to prepare for last-minute changes, because we would handle it.  

If communications are ever delayed, creating a time crunch, let us act as your analysist team, grabbing communications as soon as they come out, and breaking it down for you. We capture the necessary data and deliver it, along with easily understandable business requirements.  

You’ll know what you need to do to comply, so when the next Final Rule or transmittal hits your inbox, you’re ready to run with updating procedures, training and other requirements.  

We suggest getting on board with us now, so when that time comes, you’re not struggling with these risks and delays.  

About the Author 

Nate Ward, J.D. is the Manager of Compliance and Content Development at YouCompli Software. He comes from a deep background in healthcare compliance and the legal field. Nate leads a team of experts who read regulations, analyze how they apply, and recommend action plans for healthcare compliance.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post How to Prepare for New CMS Final Rules and Transmittals  first appeared on YouCompli.

In this blog, experts offer the real scoop on audit readiness in healthcare. Learn the unfiltered truth about compliance audits and what audit etiquette means. Get essential tips on preparing for audits, the role of healthcare compliance auditors, and what to do (and what not do) during an audit.  

What Does Audit Readiness Mean? 

Let’s say a regulator shows up at your door tomorrow. What’s the first thing your team scrambles to find? Is it evidence of task completion? Maybe a list of applicable regs? Updated policies? How about proof of communication to stakeholders? We saw a post this week asking for a current audit preparedness playbook because so many organizations think they’re ready, until they aren’t. 

Raw Truth about Compliance Audits 

Here’s the raw, unfiltered truth; no organization is ever ready for an external auditor or inspector. Ever. If you were, no one would panic when the FDA shows up at the door unannounced, or the state shows up in your lobby. “The state showed up the other day, and I knew why they were coming so I wasn’t unprepared.”  

The truth is you do your best, and you also expect the worst because they’re an auditor or inspector. Duh. It’s what they do.  

It’s like when you hear a funny rattle in your car. You take it to the mechanic. You know he’s gonna find SOMETHING. That’s his job. If you didn’t hear the rattle, you wouldn’t have taken it to him. You’re just hoping it is a minor repair rather than a total overhaul. Same with your audit, your auditor, and the rattle in your compliance practices. 

What to Know About the Healthcare Compliance Auditor 

Auditing is a formal, independent way to investigate regulatory compliance of a system or process within an organization. In accordance with regulations or industry best practices, an auditor assesses the adherence, adequacy and absence of certain processes.  

What a Healthcare Compliance Auditor Does 

• Identifies errors, omissions and irregularities.  
• Investigates the intent of possible wrongdoings. 
• Provides information regarding auditing procedures.  
• Submits reports to investigating authorities. 

Okay, A Compliance Audit Is Scheduled – What to Do? 

Once you know an audit is coming, use these five steps to prepare your organization. 

1. Make sure you can have as many of your team members available for the audit as possible, in case the auditor wants to schedule interviews with them.  
2. Provide a few date options for the auditor to choose from. A regulatory body like CAP, CLIA or FDA does not have to give warning of an audit and can arrive unannounced, but most audits are not unannounced. You have time to prep. Use it.  
3. Ask for an audit agenda as soon as you can. Review it.  
4. Alert the team that an audit will occur. This allows time to prepare any project-specific documents that may not be complete.  
5. About a week out from the audit, do a facility walkthrough to make sure there is nothing out of place. Do it two days out and then the day before. Yes, this much. You have people in your office. They move things.  

Once you have these steps under control, preparation becomes a case of do’s and don’ts. In other words, audit etiquette. 

What Is Audit Etiquette? Best Practices for Compliance Behavior 

Audit etiquette covers all the best practices required to facilitate smooth external audits. These vary slightly based on the health system’s existing compliance processes and experience facilitating them.  

In most cases though, following these techniques for what to do and what to avoid will drive positive, less stressful outcomes.  

What to Do in a Compliance Audit 

• Do listen to an auditor’s question and think before responding.  
• Do answer only the question that is asked. Stop talking.  
• Do ask for clarification if you don’t understand the question.  
• Do answer only those questions relative to your job.  
• Do be honest and pleasant. 
• Do treat the auditor with respect and courtesy at all times.  
• Do dress in business casual attire. 
• Do prepare to talk to the auditor and anticipate questions. 
• Do have quality obtain copies of taped conversations. 
• Do provide well-ordered, clear documents. 
• Do understand your policies and procedures. 
• Do keep computers locked when away. 
• Do close security-controlled doors. 
• Do keep paperwork organized and out of sight when possible. 
• Do escort the auditor at all times while on the premises. 

What Not to Do in a Compliance Audit 

Don’t guess. Say you don’t know or that you need to consult an SOP or defer to someone who is more suitable to answer the question. If you want to consult an SOP, describe the procedure in general terms with the auditor and then walk them through the details. Just saying “I have to consult my SOP” gives the impression that you aren’t trained. 

Here are other things NOT to do in an audit:  

• Don’t try to answer for someone else. 
• Don’t answer for another department or specialty. 
• Don’t offer additional information. Again, stop talking.  
• Don’t elaborate – answer only what is asked. 
• Don’t use hedge words (examples: I think, usually, normally). 
• Don’t guess when asked a question. 
• Don’t sign anything without legal approval.  
• Don’t argue with the auditor or inspection. Clarify anything the auditor misunderstood.  
• Don’t be rude or disrespectful to the auditor. 
• Don’t huddle. 
• Don’t panic. 
• Don’t lie. 

Practice Compliance Audit Etiquette with Confidence 

Regulatory bodies will give a report prior to leaving the audit. Ensure you engage with the necessary teams to give sufficient responses and have a plan for any noted observations. The observations and responses in a report will generally be the first items looked at in the next audit. Make sure you stay on top of these action plans and complete the items you have committed to. 

Also remember that auditors may be experts or novices based on the type and scope of the audit being performed. Do not assume you are the smartest person in the room when communicating with an auditor. Understand that the inherent authority of the auditor is dictated by the interested party they are advising. Their ability to influence a decision (that may have a significant impact on your organization) is the foundation of a desired outcome for you. That’s one reason why we recommend practicing good audit etiquette. 

More Resources about Compliance and Audit Readiness 

• Three Strategies to Align Compliance with Revenue Cycle 
• Audit Expectations and Challenges 
• Healthcare Audit? Stay Ready. Don’t Get Ready. 
• How to Use TPE Plans for Compliance Auditing and Monitoring 

John R. Nocero, Ph.D., and Andrea L. Bordonaro, MAT, blog on LinkedIn as “The Q-Kids,” discussing everything related to clinical research education, inspiration, and professional connection. 

Andrea has taught first grade in Willoughby, Ohio for 27 years in the same classroom that she attended school as a child. She earned a Bachelor of Science in elementary education with a minor in language arts from John Carroll University and a Master’s Degree in the Art of Teaching and Education from Marygrove College. 

John builds and fixes quality departments, while currently thriving as the Administrator & Director of Quality, Risk Management and Compliance at River Vista, a behavioral hospital in Columbus, Ohio.

---

The Q-Kids – John R Nocero and Andrea L Bordonaro – are experts at everything quality, regulatory, education training and compliance and love sharing their knowledge on YouCompli.

Follow them on LinkedIn – for more quality content or send them a message – they’d love to hear from you.

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Audit Readiness? How about Audit Etiquette?  first appeared on YouCompli.

A conflict of interest (COI) in healthcare occurs when a person or organization involved in medical decision-making, such as a doctor, researcher or healthcare administrator, has a secondary interest (financial, professional or personal) that could compromise or influence their objectivity and clinical judgment.  

This secondary interest has the potential to affect decisions about diagnosis, treatment, or research in a way that’s not aligned with the best interests of the patient or public health.  

Key Components of a Conflict of Interest 

Key elements of a conflict of interest include: 

• Financial ties, such as relationships with pharmaceutical companies or medical device manufacturers 
• Personal or professional relationships that can bias medical decision making 
• Institutional interests that influence financial or strategic decisions 

Why COI Must Be Addressed 

The identification and mitigation of COI in healthcare is critically important because they directly affect the quality of patient care, the integrity of medical research, and the overall trust in healthcare systems.  

Here’s why it’s essential to avoid conflicts of interest: 

1. Protect Patient Health and Safety 

When a healthcare provider has financial or personal incentives that conflict with the patient’s best interests, it could lead to recommendations for unnecessary treatments or suboptimal care. This can directly harm patients, either through unnecessary side effects, prolonged treatments, or missed opportunities for better outcomes.   

Patients trust healthcare providers to make decisions based on their health needs, not on external incentives. If a physician is influenced by financial or personal gain, it undermines this trust and can result in patient harm. 

2. Ensure Clinical Objectivity and Best Practices with Evidence-Based Decisions 

In healthcare, clinical decisions should be grounded in the best available scientific evidence. COI can distort clinical judgment, leading to decisions based on profit motives or personal interests, rather than sound evidence or best practices. 

When decisions are made objectively, based on the best evidence and clinical standards, it ensures optimal outcomes for patients and trust in the system. 

3. Reducing Healthcare Costs by Avoiding Unnecessary Procedures 

COI can lead to overutilization of tests, procedures and treatments that are not medically necessary, inflating healthcare costs for individuals and insurance systems. Unnecessary treatments contribute to the rising cost of healthcare and can create financial burdens on patients, insurers and the healthcare system as a whole.  

Mitigating COI can lower costs by ensuring that treatments are based on necessity and effectiveness, not financial incentives. 

4. Preventing Fraud and Abuse in Healthcare Through Ethical Integrity 

COI can open the door to fraudulent practices, such as billing for unnecessary services, overprescribing medications, or manipulating patient data for personal gain.  

Addressing COIs protects the integrity of the healthcare system, ensuring that resources are used appropriately and that the system is not exploited for financial gain. 

Impact of Conflicts of Interest on Healthcare Systems 

Role of Compliance Officer in COI Management 

The compliance officer helps ensure transparency, ethical decision-making, and accountability, thereby protecting patients and maintaining system integrity. The compliance officer’s role in mitigating COI risk involves: 

Monitoring: Ensuring healthcare professionals and organizations disclose any potential COI, particularly financial or personal interests, that could influence decisions. 

Policy Enforcement: Implementing and enforcing clear COI policies and procedures, including guidelines for recusal or divestment when conflicts arise. 

Education and Training: Providing ongoing education to staff about identifying and managing COI to maintain ethical standards.  

Auditing and Reporting: Regularly auditing practices for compliance with COI regulations and reporting any violations to ensure corrective actions. 

An Unfortunate Example of a Deliberate COI 

In 2015, Dr. Farid Fata was sentenced to 45 years in a federal prison by U.S. District Judge Paul Borman. Dr. Fata, who had built an empire of upscale cancer clinics, intentionally misdiagnosed patients and illegally billed Medicare for the treatment.  

He grossly over-treated, under-treated, and misdiagnosed hundreds of patients by telling them they had cancer when they did not. He administered too much or improper treatment to others who did have cancer and continued to give chemotherapy to terminal patients who no longer needed it.  

Over $34M in Billings from Fraudulent Treatments 

About 550 patients have been identified as victims, with 34.7 million in billings to patients and insurance companies, and 17.6 million paid for work Dr. Fata admitted was unnecessary. Prosecutors say Dr. Fata was notorious for treating all his patients personally and keeping other medical professionals away.

The U.S. Attorney’s office said Dr. Fata, “is the most egregious fraudster in the history of the country, measured not only by the millions of dollars he stole but by the harm he inflicted on his victims.”   

This case is one of the most extreme, but it highlights a powerful conflict of interest where financial incentives result in harmful over-treatment of patients. Financial pressure or incentives, whether directly or indirectly tied to volume of procedures, can lead some physicians to recommend unnecessary treatments. These actions exploit the trust of patients, who rely on the expertise of their doctors for decisions that can affect their health, safety, and financial well-being.¹

Conflicts Embedded in Medical Guidelines and Standards 

A unique and mind-blowing aspect of COI in healthcare that few people realize is how deeply conflicts can be embedded in medical guidelines and “evidence-based” standards themselves, shaping the very definition of disease and thresholds for treatment in ways that drive profit more than health. 

When a physician prescribes a statin or a glucose-lowering drug, it feels like a purely clinical decision. But that decision is based on guidelines often crafted by panels with financial ties to drug manufacturers. Even physicians who believe they’re making objective decisions may be following protocols shaped behind the scenes by corporate influence. 

Medical guidelines—the foundation of diagnosis and treatment—are often written by experts who have financial ties to pharmaceutical or device companies whose products benefit from more liberal definitions of disease.   

The assumption is that practitioners and patients need guidance for medical decision making. But in many cases, it’s the interests of pharmaceutical and medical device companies subtly shaping the physician’s practice by influencing how diseases are defined. It seems like medicine is in control, but often, industry tailors the rules of the game through guideline panels, research funding and educational influence. 

Workforce Awareness Needed to Reduce COI 

Members of a healthcare organization’s workforce need to understand what constitutes a Conflict of Interest. COI occur when personal, financial, or professional interests interfere with objective decision-making that affects patient care, research, or organizational integrity.  

The workforce also needs to be aware of disclosure requirements, because they must disclose any potential COI to the compliance officer or management, especially financial relationships with outside entities. Workforce members have an ethical responsibility to prioritize patient welfare, transparency and integrity over external interests in all decisions. 

How Employees Should Respond to COI Suspicions 

If an employee suspects a COI might be an issue, they should promptly report suspicions to the compliance officer, management or through confidential reporting channels. If they are uncertain, the workforce member can seek advice on whether a situation constitutes a COI and how to proceed. This ensures accountability and maintains ethical standards in the organization. 

A solid conflict of interest mitigation process is crucial for a healthcare organization because it ensures patient safety, maintains ethical decision-making, prevents financial exploitation, and preserves public trust. Without it, the integrity of care is compromised, risks to patient health increase, and the organization’s reputation and legal standing are jeopardized. 

1. https://www.justice.gov/archives/opa/pr/detroit-area-doctor-sentenced-45-years-prison-providing-medically-unnecessary-chemotherapy  ︎

Susan is a healthcare compliance leader with over four decades working in a variety of administrative and managerial capacities, including strategic planning, regulatory oversight, revenue cycle risk mitigation, denial and appeal management, privacy and information security, healthcare advocacy, clinical department leadership, provider practice administration, risk management, and quality outcomes.  Currently, Susan provides compliance and privacy consulting services to a variety of healthcare organizations, including program implementation, policy and procedure development, compliance and privacy training, and regulatory oversight administration.  

Susan is a Certified Internal Auditor (CIA), Certified Healthcare Compliance (CHC), Certified Professional Coder (CPC) and holds a Certification in Risk Management (CRMA).  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA
• Four Ways to Integrate Compliance with… by CJ Wolf, MD

The post Mitigating Conflicts of Interest that Drive Profit Over Health  first appeared on YouCompli.

Healthcare compliance/accreditation professional Amy Laufmann, MBA, has held a variety of quality and compliance roles for over ten years in multiple settings. Currently the Client Success Manager at YouCompli, she works with healthcare organizations across the country every day, from single-state healthcare systems to systems spanning nationwide. She shares her experience not only having worked in the field, but also the knowledge and insight gained from supporting organizations using the YouCompli compliance software to manage regulatory compliance changes in their organizations. 

Let’s Talk Regulatory Change Management and Compliance Software

In this expert interview, Amy shares insight surrounding compliance management software (like YouCompli) and examples of what it takes for organizations to be successful.

Question: What are the advantages of using compliance software?

Amy Laufmann: Compliance software allows for automation number one, and then accountability.

As far as automation is concerned, the software offloads manual tasks from compliance teams. Essentially, automation skips the manual process of fighting through all the noise and duplications to find out what regulations apply and then delivers it directly to the department accountable for completing the work.

It brings you quickly and directly to the point of starting the compliance work that needs to be done in response to regulatory changes.

YouCompli helps compliance teams start at that point, as they are alerted to regulatory changes that impact their organization. They also get information on what needs to be done to share directly with the impacted departments.

Q: How Do You Know if You’re Catching All the Right Regs?

AL: I remember working at an organization where we had just hired a new Chief Compliance Officer, who was meeting with our team. He asked how our team ensures that we’re monitoring all applicable federal and state rules, and updated accreditation standards.

The team was silent, because despite our best efforts, the process of listserv notifications and the endless newsletters and different compliance organizations did leave concern that something could easily be missed. I’m not going to lie… despite my best efforts, the thought of “What did I miss?” really did surface occasionally.

It’s important to note that software automation eliminates the challenge of simply finding all the rules and regulations that organizations need to be aware of before even getting started doing the work.

Special Care Needed for State Regulatory Changes

Additionally, state regulatory changes are not always the easiest to monitor, track and implement. Often, hospital associations and government relations departments help get important bills on the radar of compliance teams.

However, government websites or other legislative tracking web applications are essentially online libraries. Their results often include bills both passed or not, supported or opposed, and it can be very cumbersome to translate that information into where bills are in the process, which are passed, failed, signed by the governor, etc.

If you know what you’re looking for, great. If you need to find out what should be on your radar, you can very easily miss something and have difficulty finding what you need, especially for those things that may be a bit more obscure, like healthcare transportation.

How Compliance Software Provides Closed-Loop Accountability

That brings me to the second advantage, accountability. Compliance software provides accountability for those folks responsible for implementing the regulatory change and clearly identifying what work has been done in order to comply.

Compliance software has tools built within it to manage that workflow. It can alert staff when they’re assigned work related to regulatory changes, as well as those who need to monitor that work when it’s been done.

Compliance is all about closing the loop and documenting what’s been done, and compliance software automates this process through workflow to ensure the loop gets closed.

Q: It sounds like compliance teams could use help. What features should organizations look for in a compliance management tool?

AL: Compliance management software must include all the regulators you care about. It has to include both federal and state rules and regulations and centralize that information to ensure it funnels into your organization from one source. If I’m going to invest in a compliance solution, it must eliminate the need for me to care about any other noise when it comes to monitoring regulatory changes.

In addition to one source of truth, the ability to have workflow is crucial, as compliance work is typically a very manual process of spreadsheets, tracking, notes and emails scattered across many different places in an organization.

Compliance software should include workflow that allows compliance teams to assign tasks, provide information, and track regulatory work. It should maintain that information within reach of not only compliance teams, but other stakeholders like managers and directors who may want oversight on work impacting their teams, as well as completion status.

Guidance About Compliance Reporting Tools

Lastly, compliance management tools should include the ability to report on the state of compliance work within an organization. What if you could see on-demand and in real time all regulatory work assigned, in progress and complete without having to pull information from multiple spreadsheets, departments, forms, etc.

Compliance software should allow your organization to identify the department, date ranges, status type, or even users and the associated regulatory work.

Reporting within compliance software can help you:

• Identify the state of assigned, in progress, overdue, and completed regulatory work.
• Spot bottlenecks where compliance work is not progressing.
• Are there users, departments, or types of regulations that are going unaddressed?
• Spot departments or individuals who address compliance work in a timely manner and keep their impacted areas in compliance with regulatory changes.
• Who deserves recognition and kudos for getting the work done?
• Facilitate communication and credibility for compliance teams as experts on the state of compliance within their organizations.

Recap: What to Look for in Compliance Management Software

In summary, compliance management software should provide:

• Single source of information to ensure your organization is reviewing all necessary regulatory changes, that is, all the regulatory information your organization needs to know.
• Workflow automation to assign, monitor and complete regulatory work.
• Centralized database to store all information and documentation to implement regulatory changes.
• On-demand reporting to observe all regulatory work, current state and departmental impact for both high-level teams like leadership, as well as detail-level reporting to monitor work assignments by department, user or effective dates.

Compliance Management Goal: Eliminate as Much Risk as Possible – And Software Helps

Healthcare organizations and the compliance teams within them won’t often come out and say it, but 100% compliance 100% of the time just isn’t possible. It is nearly impossible to be ahead of the regulatory change game all of the time and have everyone in an organization compliant with every rule and regulation on the books.

If that were the case, things like billing errors, overpayments, self-disclosures, ADRs and plans of correction would cease to exist.

The point is to eliminate as many potential areas of compliance risk as possible. Compliance software lends itself very well to getting the high value/high risk/high impact regulatory work addressed but still doesn’t let regulatory changes less likely to cause reputational damage or severe financial penalties fall off the radar. It ensures that when capacity and resources are available, those changes too are addressed.

Compliance software like YouCompli provides a valuable, comprehensive picture of the landscape in your organization.

Q: How fast can you go live with compliance software in an organization?

AL: This is a question I get asked all the time, and if I’m honest, I have a love-hate relationship with it. First, let me say if an organization were to purchase YouCompli, ultimately, I could have the software live and sending you notifications of all regulatory changes the same day your desired regulators, jurisdictions and users are identified.

The challenge here is not how quickly we can flip the switch and provide the software to you. It’s really identifying the organization’s goals in using the software in order to either support or improve upon them when we turn on the software.

Launching compliance software within healthcare organizations can be as simple or as complicated as they wish it to be. My job is to help organizations understand how the software works to support and improve their regulatory change management processes.

Four Requirements for Quick, Successful Regulatory Software Roll Out

A lot of the success or failure of this process has to do with a few common themes within a timeframe that’s realistic for the health system.

• Strong support from leadership and communication from senior leaders clearly outlining expectations and processes for utilizing compliance management software.
• Compliance teams have good manual processes in place and want to optimize their efficiency and eliminate time spent on manual work.
• Organizations have clear roles and expectations for responsibility in completing regulatory work in existing structures.
• Compliance is viewed as a part of operations but needs a framework of standard processes and automation to support their efforts.

Integrate with Existing Compliance Processes or Start from Scratch?

When You Have Processes

When organizations have a good foundation to manage work related to regulatory changes, compliance software can almost immediately support that process and make it much less time-intensive by automating all manual parts of the existing framework.

When You Need Processes

For organizations needing compliance software to support a new process or to build a framework for ensuring regulatory work is completed, the software is still quite simple to implement. We provide a framework outlining the process, steps involved and required information, so your organization has an outline for success from day one.

Q: What Do You Need to Roll Out Compliance Software?

AL: Implementation and roll out depend on an organization’s ability to provide the following information:

• Jurisdictions and Regulators: What federal regulators, MACs, and state jurisdictions apply to your organization? (YouCompli provides a list for your organization to select/include in your system.)
• Regulatory Assignments: What do you want the workflow process to look like?
  • Centralized Assignments: All regulatory changes are funneled through compliance teams for review before assigning task work to impacted departments.
  • Decentralized Assignments: All regulatory changes are funneled directly to identified department leaders who are responsible for managing and completing regulatory work specific to their department. (YouCompli provides a “regulatory rolodex” for you to identify department-level, automated assignments.)
• Software Administrator and General User Training Sessions:
  • YouCompli administer training typically consists of one 45- to 60-minute session for leaders who will use the software to manage and oversee regulatory work.
  • YouCompli general user training sessions include a 30-minute overview of how to use the software to complete any assigned regulatory work.

Q: What Should You Know about Software Training and Ease of Use?

AL: Ease of use and training are worth noting because ultimately everyone wants the software to be used.

Speaking of the YouCompli solution specifically, the software is easy-to-use and provides step-by-step instructions guiding users through the process of completing assigned work. It includes on-demand training videos directly linked to those steps, as well as responsive and proactive support not only during implementation, but throughout your time using the YouCompli software.

This support comes directly from our team of industry experts who provide credible, reliable and actionable information. The support crew includes people who’ve worked directly within healthcare compliance, as well as attorneys.

So, when I’m asked how quickly can we go live with YouCompli, the answer is as fast as you’d like. However, to set your organization up for success, I most often recommend identifying a timeline that aligns with ensuring your software is well-utilized and that you get the most value from configuring it.

Q: Do healthcare organizations need to be concerned about privacy and security with compliance tools?

AL: YouCompli specifically is a cloud-based software that enables organizations with web access to use standard username and password access. The software lets organizations easily assign and manage user roles and provides the ability to control what those different roles have access to in the solution.

We also set up Security Assertion Markup Language (SAML) which allows the software to authenticate users on an organization’s network and bypass password entry entirely.

The compliance software is not HIPAA-compliant and should not be used to store protected health or confidential information. This is something you will always want to check for any software your organization evaluates.

Most importantly, you want to ensure that the security and privacy that a compliance tool does or does not provide is clearly communicated to all users.

Q: Any Additional Thoughts to Share?

AL: Healthcare compliance is complex. It touches every department within a healthcare system, but it is often an underdeveloped program. I think despite all of the advancements in technology, tools and applications, finding software that actually works for healthcare compliance teams is difficult, and the value of finding a great one is underrated for this particular field.

I currently work for YouCompli, and of course I’m going to be promoting that solution, but I think it’s important to note that I’m only a YouCompli Client Success Manager because first I was a YouCompli client.

My passion for improving access to technology and tools to support regulatory compliance teams and helping them get the most value and support when using software is why I’m here.

I’ve worked at health systems using YouCompli, and I’ve worked at health systems for quite some time without YouCompli. I’ve experienced first-hand the vastly significant difference it made for compliance teams and the organizations they serve, and I can’t imagine working directly in compliance without it ever again.

Q: Ready to Take the Next Step Towards Confident Compliance?

With so many capabilities and benefits, what’s holding you back from learning more about compliance management software and confident compliance? Here are other resources you might want to look at.

White Paper: Empowering Compliance Officers to Drive Better Health and Business Outcomes – How effective regulatory change management practices help healthcare organizations mitigate risk

White Paper: The Opportunity for Compliance to Create Value for Healthcare Organizations – Best practices for demonstrating how compliance makes an impact

White Paper: Doubling Your Impact: Demonstrating Compliance’s Value and Shaping Culture – Best practices for proving your value in five key areas.

Amy Laufmann is client success manager at YouCompli. She has 10+ years of experience in healthcare compliance and operations, and is passionate about helping healthcare organizations operate better and deliver better patient outcomes.  

Take Free RL3M Assessment (Regulatory Lifecycle Management Maturity Model)

RL3M Assessment

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA
• Four Ways to Integrate Compliance with… by CJ Wolf, MD

The post Expert Advice: Compliance Software Q&A with a Compliance Professional  first appeared on YouCompli.

The Nurse Who Slipped Through: A Tale of Missed Screenings and Million-Dollar Consequences 

ABC Health, a mid-sized midwestern provider, was thriving. With a regional flagship hospital, six outpatient clinics, a home health division, and a solid reputation for quality care, the CEO had just signed a five-year partnership with a major insurance network.  

There didn’t seem to be any cause for worry. The compliance officer insisted they ran exclusion screenings every quarter—plenty often, the executive claimed. 

Tech Failure Leads to “Minor” Exclusion Screening Lag 

But in Q3, the exclusion screening software glitched. It missed a monthly sync. Then a second. By the third missed month, the compliance officer dismissed it as “a minor lag,” promising the HR department everything would be rerun soon. 

Unfortunately, even a seemingly small glitch can have major consequences for healthcare compliance. 

ABC Health hired a new nurse in October. Her references checked out. She had a glowing record of employment. However, as it turns out, two years ago, she was convicted of Medicaid fraud while working under a different name in the southwest. She was on the OIG Exclusion List under her maiden name. 

But no one screened her for her maiden name at any time. 

Billings Accrue for Excluded Individual Over 11 Months 

The nurse worked at ABC Health for eleven months. In that time, she administered care to over 200 Medicare patients. ABC Health billed CMS more than $1.2 million for services in which she had direct or indirect involvement. 

In August of the following year, a whistleblower complaint hit the OIG hotline. An old colleague recognized the nurse’s face on ABC Health’s website. An investigation followed swiftly. The OIG cross-checked full names and dates of birth, matched alias records, and confirmed: ABC Health had employed an excluded individual. 

A Perfect Storm of Compliance Failure 

What followed was a perfect storm: 

• CMS demanded full repayment of $1.2 million in federal reimbursements. 
• Civil monetary penalties were levied—$20,000 for each false claim filed involving the excluded nurse. 
• The DOJ initiated False Claims Act proceedings, arguing gross negligence in compliance. 
• The state Medicaid program joined the fray, adding $400,000 in additional penalties. 

As this example shows, the fines, penalties, and reputational damage from exclusion failures are significant.  

Exclusion Screening as Compliance Practice and Risk Protection 

The OIG has the authority to exclude individuals and entities from federally funded healthcare programs pursuant to the Social Security Act and maintains a list of all currently excluded individuals and entities called the List of Excluded Individuals/Entities (LEIE). Anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties (CMP).  

Exclusion screening is critically important for healthcare provider organizations because failing to do it properly can result in severe legal, financial and reputational damage.  

Here are five reasons why you should take a look at your exclusion screening practices: 

1. It’s a Legal Requirement. 

Federal law prohibits payment by Medicare, Medicaid or other federal healthcare programs for any item or service furnished by an excluded individual or entity. This includes not just direct patient care but indirect services (e.g., billing, transportation, administrative work). 

2. Non-Compliance = Massive Penalties 

If your organization hires or contracts with an excluded individual, you must repay all related federal reimbursements. Plus, you could face: 

• Civil Monetary Penalties (CMPs) — up to $20,000 per item/service 
• False Claims Act liability 
• Exclusion from federal healthcare programs, particularly Medicare and Medicaid 

3. Exclusions Are Not Always Obvious. 

Individuals can be excluded under different names, maiden names or aliases. Not all exclusions stem from obvious crimes. Some involve license issues, fraud or administrative findings. 

4. Exclusions Can Happen at Any Time. 

A person not excluded today could be excluded tomorrow. That’s why ongoing, monthly screening is so essential, not just one-time checks during hiring. 

5. It Protects Patients and Upholds Trust. 

Exclusion screening helps prevent unqualified or unethical individuals from delivering care. It’s a cornerstone of patient safety and organizational integrity. 

Regular exclusion screening isn’t just good compliance practice. It’s a regulatory safeguard that protects your organization from fraud, fines and harm to organizational credibility and business integrity. 

So, What Happened at ABC Health? 

The ABC Health board fired the compliance officer; the CEO resigned, and ABC Health declared bankruptcy within six months. The company’s name became a case study in compliance seminars across the country.  

And in a final twist, what happened to the nurse? She vanished before investigators could issue a subpoena. Her exclusion had never expired.  

Moral of the Story: In healthcare compliance, skipping or delaying exclusion screening isn’t just an oversight—it’s a significant risk with high-stake consequences. 

How to Avoid Exclusion Screening Problems 

How can problems like these be avoided? One way is better tracking and management of compliance processes using a tool like YouCompli. Know what the responsibilities are and verify when they are completed. Then confidently manage ongoing compliance processes to avoid situations like what happened to ABC Health.  

Reference Material:   

• U.S. Department of Health & Human Services. Office of Inspector General. Exclusions Program.   
• Background Information.  https://oig.hhs.gov/exclusions/background.asp  
• Exclusions FAQs.  https://oig.hhs.gov/faqs/exclusions-faq/  
• The HIPAA Journal. “What are the HHS OIG Background Check Requirements?”  https://www.hipaajournal.com/hhs-oig-background-check-requirements/  
• U.S. Department of Health & Human Services. Office of Inspector General. Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs. (May 8, 2013).  https://oig.hhs.gov/exclusions/files/sab-05092013.pdf  

Susan is a healthcare compliance leader with over four decades working in a variety of administrative and managerial capacities, including strategic planning, regulatory oversight, revenue cycle risk mitigation, denial and appeal management, privacy and information security, healthcare advocacy, clinical department leadership, provider practice administration, risk management, and quality outcomes.  Currently, Susan provides compliance and privacy consulting services to a variety of healthcare organizations, including program implementation, policy and procedure development, compliance and privacy training, and regulatory oversight administration.  

Susan is a Certified Internal Auditor (CIA), Certified Healthcare Compliance (CHC), Certified Professional Coder (CPC) and holds a Certification in Risk Management (CRMA).  

Download our Latest White Paper

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Our in-house team works tirelessly to monitor U.S. regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm.   

Sign up for our Weekly Newsletter

The post Exclusion Screening Failure Causes Compliance Nightmare  first appeared on YouCompli.