A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.

What Healthcare Compliance Teams Want from Regulatory Change Management Software

by Amy Laufmann, MBA

What do healthcare compliance teams actually value in regulatory change management software?

Each year, YouCompli asks clients to evaluate the software, regulatory content, and support they rely on to manage regulatory change. This year’s annual client satisfaction survey received responses from 30.68% of recipients, providing direct insight into what’s working, where teams see opportunities for improvement, and what they expect from the technology supporting their compliance programs.

We spoke with YouCompli Client Success leader Amy Laufmann, who manages the survey process, about what clients told us and how their feedback influences product development, training, support, and future innovation.

Client Survey Snapshot

Direct feedback from healthcare compliance leaders

30.68% annual survey response rate

01

Software & Workflow Dashboards, reporting, functionality, and day-to-day workflow

02

Service & Training Support, responsiveness, implementation, and user education

03

Regulatory Content Information and tools for operationalizing regulatory change

The feedback covered individual feature requests, but several broader themes emerged. Together, they provide a useful picture of what healthcare compliance leaders expect from the technology, information, and support surrounding regulatory change management.

What We Heard

Five priorities consistently surfaced in client feedback

01

Simpler workflows

Teams want unnecessary steps removed and task-level work streamlined without losing accountability or documentation.

02

Useful real-time analytics

Compliance leaders want meaningful metrics available directly from the work already happening inside their workflows.

03

Responsive support & training

Effective technology still requires support that identifies knowledge gaps and helps individual users work confidently.

04

Relevant regulatory content

Teams value more than software functionality. They also need reliable information that helps them understand and implement change.

05

Flexibility for different health systems

No two organizations use compliance technology exactly the same way. Workflows, access, assignments, and reporting need to support different organizational structures and operating models.

Client Success Q&A

Client Feedback, Product Innovation, and Support

Q

What do you hope to learn from YouCompli clients?

Amy Laufmann

We want to gain detailed insight into how clients assess the overall value that the software provides to their organizations. Client satisfaction survey questions are broken down into three categories:

• Software features and functionality (dashboard, reports, workflow)
• Client service (support, training, responsiveness)
• Regulatory content (information and tools to implement regulatory changes)

Q

How has capturing client input evolved?

Amy Laufmann

When we began building the client success program, our outreach focused on engagement, relationship building, and resource sharing. Last year, we shifted toward gathering insights and identifying additional content that could help clients.

This year, the focus is on value and satisfaction: What’s working? What isn’t? Both positive and critical feedback are useful. When clients who use the full solution suggest ways to make it even better, that gives us valuable direction.

Q

Who received surveys in healthcare systems?

Amy Laufmann

Surveys were sent to compliance executives and leaders most directly responsible for administering the software within the health system, not to everyone receiving work through the solution.

The only clients who wouldn’t receive the annual survey are those who aren’t fully implemented yet. If they haven’t finished implementing the software, it doesn’t make sense to ask them to evaluate a full year of use. Instead, we gather feedback during onboarding and send an onboarding satisfaction survey once implementation is complete.

Q

What themes came out of the responses this year?

Amy Laufmann

We do get granular feedback, like “adjust this particular piece of the software,” but we also see themes specific to improvement in the workflow functionality . This aligns with some of the new builds and user-facing workflow processes that our development team currently has planned in our product roadmap.

Q

How does feedback become action?

Amy Laufmann

Part of our comprehensive engagement process is not only sending out client satisfaction surveys, but also carefully reviewing each individual response.

Keeping Clients in the Loop: How YouCompli Communicates Back

• Concerns are specifically addressed with either follow-up questions or requests to meet.
• If a response relates to something currently planned or actively being worked on, we provide details of where we are in the improvement process.
• If the request is something we're just not able to do, we also identify that and provide the reasons and context as to why.
• Once progress is made or a change is completed, clients receive updates along the way so they can understand how their feedback is being addressed and appreciated.

When people see their suggestions turn into reality, that builds trust.

Q

How does feedback influence future innovation in regulatory change management?

Amy Laufmann

We get some of our most valuable feedback directly from clients. For example, we've identified requirement workflow functionality that could benefit from streamlining. It will eliminate steps that aren't necessary in certain workflows related to managing task-level work.

Prior to the satisfaction surveys, some of the most significant software improvements began as informal, direct feedback. Ad hoc feedback specific to reporting drove updates to our ready-to-run reports.

We listen to clients wherever we get a chance, but now the surveys capture it in black and white.

Partnering with Client Input on Analytics Development

Updating reporting was a big improvement, but during this survey follow-up, we learned clients were looking for additional metrics accessible in real-time.

The improved analytics capability was a direct result of feedback from a client who actually partnered with us on the development. We shared initial examples of what we’d built, and they gave input throughout that project before we went live last year.

Now we take data that's already in the workflow and report it to compliance leaders in a more valuable way. When we say YouCompli was developed by compliance professionals for compliance professionals, it’s completely true.

This year, the theme is more about finetuning the solution because there isn't significant functionality that the software doesn't already have. The foundation is solid, and clients are getting more specific in identifying further efficiencies they would like to see.

Q

What other value comes from conducting the survey?

Amy Laufmann

Uncovering Hidden Training Needs for Successful Compliance Teams

Sometimes we work with clients that seem to be doing well and using the software effectively, but their success hides a problem. Maybe one member on that team doesn't really get how to use the solution but is hesitant to share that.

The survey can uncover problems that clients may not feel comfortable raising in a meeting or direct email. In one instance, the feedback was, “I know I’ve been shown how to do this before, but I just don’t remember.” That response prompted us to offer additional support.

We identify a training opportunity with the client, but there's more to it than that. We want to identify opportunities to improve support, add to training materials, and identify any gaps that these questions may shine a light on.

Solving Utilization Mysteries

No two clients use YouCompli software the same way. Some integrate the solution into every department. Others limit access to a small group tasked with sharing information and resources. Some fully utilize the workflow to automate work assignments, while others choose not to.

These differences make it difficult to apply a one-size-fits-all approach when evaluating software utilization. It’s important to measure not only how a client uses the software, but also whether the available workflows, content, and support meet the client’s needs.

Q

Any other thoughts on the benefits of engaging with clients through their feedback?

Amy Laufmann

Hearing directly from clients puts us in the best position to continue delivering what really helps their organization, staff and patients. By identifying what’s working well along with opportunities to improve, we aim to be a partner focused on helping health systems get maximum value for their compliance programs.

My overall assessment is that, because we’ve made improvements from year to year, our clients’ expectations continue to rise—and our goal is always to rise with them.

What This Means When Evaluating Regulatory Change Management Software

Taken together, the feedback suggests healthcare compliance teams are looking for more than software that simply delivers regulatory updates. They value workflows that fit real operational processes, useful reporting and analytics, relevant regulatory content, responsive support and training, and enough flexibility to support different organizational structures and ways of working.

For compliance leaders evaluating regulatory change management software, that means looking beyond a feature checklist. Consider how effectively a solution helps your team understand what changed, determine what matters to your organization, manage the resulting work, and verify that required actions were completed.

Software Evaluation

Evaluating regulatory change management software?

See what healthcare compliance teams should consider when comparing solutions, from regulatory content and workflow capabilities to reporting, accountability, and support.

What to Look for in RCM Software See How YouCompli Works

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

YouCompli

Healthcare Compliance Insights

Stay ahead of healthcare regulatory change

Get practical compliance insights, regulatory change guidance, and new YouCompli resources delivered to your inbox.

Regulatory change Compliance strategy Practical resources

Useful guidance for healthcare compliance professionals. No inbox overload.

Join the newsletter

New compliance insights and resources, sent directly to you.

The post What Healthcare Compliance Teams Want from Regulatory Change Management Software first appeared on YouCompli.

The secret to effective regulatory change management and provable compliance is a one-two punch of expert human regulatory analysis with simple-to-use workflow software. Every day, this combination helps healthcare compliance teams across the U.S. move from reactive regulatory change to clear, assigned, trackable work. 

This blog looks at what’s behind “punch one” — human-led regulatory analysis. It explores the role of a regulatory analysis team and how they bring value to the compliance management lifecycle.  

What AI Can and Can’t Do Well in Compliance Management 

There’s a misconception that AI can automate a lot of the research involved in regulatory change management. AI looks impressive to people who don’t do the actual work, but what AI often really does is create more work. 

While AI tools can gather data points quickly, they sometimes pass the burden of validation back to your in-house team. Sorting through duplicate links, hallucinated details or overly broad summaries can easily turn a promised time-saver into a tedious cleanup project.  

AI excels at generating large-scale but basic, general responses, but it’s missing the domain expertise required to spot subtle regulatory nuances. The rest of this article explains why expert regulatory analysis remains essential and how human validators and analysts help compliance teams turn complex regulatory updates into clear, trackable work. 

What Regulatory Analysis Teams Do 

How do regulatory analysts add value to compliance management? They handle vital legwork by ensuring: 

• Regulatory sources are monitored for relevant updates. 
• Expert insight looks at what changed. 
• Analysis helps teams understand what needs attention 

Reliability in Regulatory Analysis: Where Human Value Wins and AI Fails  

The main thing a compliance leader should understand about expert regulatory analysis is that it comes down to a reliability issue. Humans alone bring the trustworthiness that’s needed.  

Partner teams like YouCompli take on the regulatory legwork and cut through the noise with actionable analysis that is reviewed and organized. 

Role of Validators in Regulatory Analysis Model 

Organizations don’t always save a lot of time with AI because of the potential need for error checking and rework. On the other hand, a human validator delivers confident time savings, because no one usually has to go back and verify the validator. That can’t be said of AI. 

Solid regulatory change management processes trust the final word of experienced, compliance-centric humans as validators of regulatory requirements. At YouCompli, a team of attorneys doublecheck the work to bake in the reliability factor.  

It comes down to accuracy, and that’s something that can’t be consistently accomplished through AI-driven automation alone. 

Regulatory Analysis Isn’t Typical Part of Daily Healthcare Compliance 

The gist of what a regulatory analysis team does isn’t necessarily something that translates to a healthcare compliance department’s daily workload. That might be why people don’t fully understand the unique value of a seasoned analysis team.  

Tracking regulatory changes also requires specialized infrastructure. Many health systems lack the budget for special software or the dedicated internal teams to monitor regulatory analysis.  

Partner Analysis Team: FTE-Equivalent Dedicated to Your Regulatory Compliance 

That’s where a specialized partner fills the gaps. Many health systems find it makes the most sense to partner with a human analyst team backed by a proven regulatory compliance management software platform. 

What skills and capabilities should a health system compliance leader look for in a partner for regulatory analytics? While most leaders might not think about asking a potential partner how their team handles puzzles, it is actually a good benchmark. In fact, one analyst team manager uses that exact question during the recruiting process, because unraveling regulation updates can be like solving a puzzle. 

Think of validators and an outsourced regulatory analytics team as the equivalent of an FTE dedicated to your compliance practice. The software, the analysts and the validators give you all of the work of at least a single FTE and more. 

One-Two Punch: Human Regulatory Analysis Plus Workflow Software 

No one else does what our unique combination of regulatory analysis and regulatory management software can do. But if you want to research capabilities and have conversations, this blog gives you an overview of what’s possible in regulatory compliance management today. 

We mentioned the one-two punch at the beginning of this article. Here’s an in-depth look at the second part – regulatory change management software. With a simple software framework, YouCompli helps teams manage regulatory compliance without relying on scattered emails and spreadsheets. 

• Clear ownership, due dates, and accountability 
• Progress tracking across departments and requirements 
• Reporting and documentation to support proof of completion 

What’s stalling progress in your compliance program? Let’s set up time to talk about some real solutions.  

About the Author

YouCompli was founded in 2016 by Jerry Shafran, a serial entrepreneur with a background in software, content solutions, information technology, and network solutions.

After selling a business focused on how insurance companies manage compliance, Jerry saw an opportunity to bring that experience into healthcare — where regulatory change creates constant pressure for compliance teams, operators, and leaders.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Beyond the Algorithm:  Why Human Expertise Matters in Regulatory Analysis  first appeared on YouCompli.

Healthcare compliance teams do a lot of work that never fits neatly into a single report.

They monitor regulatory changes. They coordinate with departments. They investigate issues. They respond to concerns. They train staff. They track corrective actions. They prepare updates for leadership. They answer questions from auditors, boards, regulators, and internal stakeholders.

But when someone eventually asks, “Can you prove it?” activity alone is not enough.

Documentation is what connects the work to the proof.

For healthcare compliance leaders, documentation should no longer be treated as an administrative afterthought or a last-minute scramble before a board meeting, audit, or investigation. It should operate as a strategic asset: a defensible system of record that shows what happened, who owned it, what changed, and how the outcome was verified.

That is the core idea behind prove-it compliance.

Why compliance documentation needs to prove more than activity

Good documentation does more than show that a task was completed. It helps compliance leaders answer the questions that matter when internal leadership, board members, state examiners, or federal agencies want to understand how an issue was handled.

A defensible record should help answer:

• How did this issue occur?
• What steps did we take to resolve it?
• What steps did we take to prevent future occurrences?

That level of documentation matters because compliance work is often reviewed after the fact. A concern may start as an internal report, an audit finding, a hotline issue, a privacy incident, a regulatory change, or a billing concern. Later, that same issue may need to be explained to a board committee, a state agency, the Office for Civil Rights, or another oversight body.

In that moment, the organization needs more than memory. It needs objective evidence.

A strong system of record reduces the stress of those moments because the compliance team is not scrambling to recreate the story. The story is already documented.

For teams managing a high volume of regulatory updates, this is also where regulatory change management becomes more than awareness. The work needs to move from “we saw the regulation” to “we reviewed it, assigned it, acted on it, verified it, and can show the record.”

Who needs compliance proof?

Different audiences need different levels of documentation.

Compliance leadership needs to see the work. That means granular data on intake, analysis, implementation status, ownership, follow-up, and completion across departments. This helps show whether the compliance function can manage high volumes of change and issue resolution.

Boards and compliance committees need to see the value. They usually do not need every log entry or operational detail. They need high-level summaries, trends, dashboards, and Problem-Solution-Proof narratives that show how compliance protects the organization.

Federal and state government reviewers need to see the process. They may need documentation that tracks a regulation, issue, or requirement from initial notice to final operational proof. This is where defensibility matters most.

A strong system of record should support all three audiences without forcing the compliance team to rebuild the story each time. That is also why healthcare compliance reporting should do more than summarize activity. It should help teams monitor risk, track ownership, and show what has been reviewed, assigned, completed, and verified.

The problem with scattered documentation

Most healthcare compliance leaders already understand that documentation is important. The challenge is usually not awareness. It is execution.

Documentation gaps often happen because compliance work is reactive. Fire drills, urgent requests, audits, investigations, and unexpected issues interrupt routine logging. Teams may also struggle with unclear ownership. If nobody knows who is responsible for documenting the who, what, when, and outcome, records become inconsistent or incomplete.

Another common challenge is the optimism trap. Teams may underestimate how long education, monitoring, corrective action, and documentation will actually take. A timeline that looks reasonable in April may become unrealistic by June if staffing changes, operational demands, or competing priorities interfere.

Resource scarcity creates another barrier. When teams rely on spreadsheets, shared drives, emails, personal folders, or disconnected tracking systems, documentation becomes harder to maintain and harder to retrieve.

The result is a familiar pattern: compliance teams do the work, but the proof is scattered.

That same issue shows up in broader regulatory change management. As YouCompli has covered in From Manual to Scalable: How to Manage Healthcare Compliance Risk, the pace and complexity of healthcare regulatory change can become a risk of its own when teams do not have systems that help them manage it.

What a defensible system of record should include

A true system of record is more than a folder on a drive.

It should function as a single source of truth for compliance documentation. That means the organization can find the right records, verify who did what and when, understand which version of a requirement or policy was used, and show how the work connects to oversight expectations.

At minimum, a defensible system of record should support:

• Retrievability: Can the team find a specific record from three years ago in under ten minutes?
• Version control: Is everyone working from the current version of the requirement, policy, or process?
• Audit readiness: Can the team move from searching for proof to presenting proof?
• Workflow accountability: Is it clear who owned each step and when action was taken?
• Documentation integrity: Can the record show objective evidence, not just a subjective summary?

This is especially important when documentation needs to support regulatory obligations, board reporting, state audit readiness, False Claims Act concerns, privacy investigations, billing issues, or corrective action follow-through.

For teams thinking through the structure of their compliance program, YouCompli’s article on how the OIG’s General Compliance Program Guidance addresses the Seven Elements is a useful related read.

How to structure compliance documentation for defensibility

It is not just what the team documents. It is how the documentation is structured.

To stand up to external scrutiny, documentation should go beyond a simple “yes” or “no.” It should create a clear trail that another person can understand later, even if the original owner has moved roles or left the organization.

A few practical standards help.

Every record should include audit-ready details such as date, time, owner, approver, relevant metadata, and objective evidence. If a policy change connects to training, monitoring, or corrective action, those related records should be cross-referenced. The documentation should tell the whole story from issue identification to resolution.

Compliance teams should also avoid subjective conclusions that are not supported by facts. A strong record should focus on what was observed, what requirement or regulation was cited, what decision was made, what action was taken, and what evidence supports the outcome.

One useful test is the ten-minute rule: can a specific record be retrieved and explained in under ten minutes?

If not, the documentation may exist, but it may not be defensible in a practical sense.

For more on how audit readiness requires a proactive posture, see YouCompli’s article, With Compliance Audits, The Best Defense is a Good Offense.

The operational toolkit behind prove-it compliance

Once the system of record exists, compliance teams need the daily tools that keep it useful.

A few core logs and plans often create the backbone of defensible documentation:

Compliance work plan: Shows planned initiatives, resource allocation, and progress against organizational and departmental goals.

Audit and monitoring plans: Show systematic checking, proactive issue detection, and corrective action follow-through.

Education and training plan: Shows what training was provided, who attended, and what expectations were communicated to impacted workforce members.

Investigation and disclosure log: Shows how issues were identified, investigated, resolved, and disclosed to regulators when appropriate.

The key is to make documentation a natural byproduct of the workflow, not an extra task that happens weeks later from memory.

For example, an investigation log should be updated at each stage of an inquiry. Waiting until the end increases the risk that context, decisions, and details will be lost.

Moving from activity reporting to impact reporting

Once a system of record is working well, compliance leaders can do more than prove that activity happened. They can show outcomes and value.

That requires moving from activity metrics to impact metrics.

Instead of reporting only how many tasks were completed, compliance teams can show whether the compliance engine is reliable, whether risk is being reduced, and whether compliance is embedded into daily operations.

Examples include:

Operational health: Timeliness of regulatory intake and task completion rates. This helps prove reliability by showing that the compliance process is consistent and predictable.

Risk reduction: Trends in identified gaps, audit findings, and closure rates. This helps prove protection by showing that the program is finding and fixing issues before they become bigger liabilities.

Engagement and culture: Training completion, hotline volume, policy acknowledgement, and advisory requests. This helps prove culture by showing that compliance is integrated into the daily work of the organization.

This is also where the Problem-Solution-Proof model becomes useful.

For more on reporting compliance value, see Healthcare Compliance KPIs: Real-Time Data Dashboards and YouCompli’s Healthcare Compliance Reporting and Verification page.

Using the Problem-Solution-Proof framework

Board and senior leadership reporting should not be a long list of compliance activities. It should tell a clear story.

The Problem-Solution-Proof framework helps compliance leaders frame that story:

Problem: What specific regulatory challenge, operational risk, issue, or gap required action?

Solution: What did the organization do in response?

Proof: What objective evidence shows that the action was completed and had the intended effect?

For example:

Problem: New state-level False Claims Act requirements.

Solution: Implemented a new verification workflow and staff training.

Proof: 100% training completion and zero documentation gaps found in an internal audit.

This kind of reporting helps leadership see not just what compliance did, but what changed because of the work.

How mature documentation helps compliance evolve

A mature system of record does more than store documentation. It helps compliance leaders spot trends.

If one department consistently misses documentation deadlines, that is not just a tracking issue. It is a roadmap for targeted improvement. If a recurring policy issue keeps appearing, the problem may not be staff effort. It may be that the policy is confusing, difficult to apply, or not supported by enough training.

By documenting and reviewing these patterns, compliance teams can move from reactive oversight to proactive leadership.

That is the shift from documentation as storage to documentation as intelligence.

When technology becomes necessary

Manual habits are often the starting point for compliance documentation. But as regulatory change volume grows, manual systems can become difficult to maintain.

Spreadsheets, shared folders, inboxes, and disconnected tracking systems may work for a small number of issues. But they often create problems when teams need consistent workflows, objective evidence, assignment tracking, audit trails, reporting, and centralized retrieval.

When evaluating software to support regulatory change management documentation, compliance teams should look for capabilities that:

• Act as a centralized repository
• Automate audit trails
• Reduce time and resource burdens through workflow automation
• Show who did what and when
• Preserve documentation integrity
• Support defensibility for state audits, False Claims Act concerns, and federal oversight
• Function as more than a filing system

The goal is not simply to digitize documentation. The goal is to make the compliance program more accountable, searchable, reportable, and defensible.

For a deeper software evaluation framework, see What to Look for in Regulatory Change Management Software for Healthcare Compliance. You can also review How YouCompli Works to see how regulatory change can move through a repeatable process: know what changed, decide what matters, manage the work, and verify completion.

The prove-it moment

Effective documentation is more than a regulatory requirement. It is the bridge between compliance activity and organizational safety.

When documentation is scattered, compliance teams are forced to reconstruct the proof later. When documentation is structured, searchable, and tied to workflow, the organization is better prepared for board reporting, audits, investigations, and leadership conversations.

That preparation matters when the prove-it moment arrives.

The strongest compliance documentation does not just show that work happened. It shows that the organization took the issue seriously, assigned ownership, acted on the requirement, verified the outcome, and preserved the proof.

That is the difference between activity and defensibility.

Want to see how your documentation process holds up?

Take the Prove-It Compliance Readiness Check to evaluate whether your current process supports retrievability, accountability, defensibility, and leadership-ready reporting.

Take the Readiness Check

You can also download the full Prove-It Compliance Playbook for a more detailed framework on building a defensible system of record for healthcare compliance documentation.

The post How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof first appeared on YouCompli.

With the release of the CIA changes within the General Compliance Program Guidance (GCPG), the OIG has officially moved the goal posts. This isn’t just a new set of rules for organizations under investigation. 

The May 2026 update to the Corporate Integrity Agreement (CIA) framework signals a definitive shift from passive reporting to active governance. Compliance is no longer an administrative sub-function. It’s now a board-level strategic imperative. 

The OIG’s Modernized CIA: Your New Compliance North Star 

Whether you’re a leader in an acute care organization, or in a non-acute care market like home health, ASCs, labs, or behavioral health, these updates represent your new “North Star.”  

This blog offers a roadmap to navigating the four pillars of this modernized framework. 

• Pillar 1: The Board’s Mandatory Compliance Partner 
• Pillar 2: Catching Every Whisper in the “Any Modality” Net 
• Pillar 3: Technological Accountability and the IT Governance Mandate 
• Pillar 4: The Elevated (and Independent) Compliance Officer 

Pillar 1: The Board’s Mandatory Compliance Partner 

What does the OIG’s mandatory independent board compliance expert requirement mean for healthcare leadership? 

For years, boards could fulfill their oversight duties by simply reviewing a quarterly slide deck. Those days are over. The OIG now requires the appointment of an independent compliance expert with federal healthcare program experience to review program effectiveness and report findings directly to the board. 

An expert is only as effective as the data they have to work with. To be truly “audit-ready,” your organization needs a living, centralized record of every regulatory change and the specific actions taken in response. Without this “evidence engine,” an independent expert will spend hundreds of billable hours just trying to find the paper trail. That could create a massive financial liability for the board. 

Boards are also now mandated to formally respond to the expert’s findings in their annual reports. You can’t “file and forget” an audit anymore. The OIG is looking for a “culture of inquiry” where board members aren’t just receiving information but actively challenging it. 

Pillar 2: Catching Every Whisper in the “Any Modality” Net 

How has the OIG expanded the definition of a healthcare disclosure program beyond the traditional hotline? 

The OIG has finally caught up with how the modern healthcare workplace actually communicates. A “disclosure” is no longer defined by the phone number it was called into. Now it’s defined as any report made through any modality. 

The reality is, in a busy lab or ASC, a compliance concern rarely starts with a formal hotline call. It starts with an email to a supervisor, a quick Teams message between nurses, or an “off-the-cuff” comment in a hallway or breakroom. 

The Roadmap Action: If a billing concern is raised in a Microsoft Teams thread but never makes it into your formal compliance log, you are in violation of the new standards. 

• Modality Audit: You must ensure your intake log captures: 
• Digital Channels: Email, Slack, Microsoft Teams, Zoom chat, and other messaging platforms. 
• Interpersonal Channels: In-person “walk-ins” and verbal reports made to management or HR. 
• The Log Requirement: Every report, regardless of how it is received, must be tracked with its nature, status, and corrective action taken. 

Pillar 3: Technological Accountability and the IT Governance Mandate 

What are the specific OIG reporting requirements for Generative AI and Information Technology in the 2026 CIA framework? 

In perhaps the most significant update to the compliance landscape in decades, the OIG is mandating technological accountability. IT has gone from support service to a governance partner. 

Set a Place for the Mandatory IT Seat at the Table 

The modernized CIA framework requires that the Compliance Committee formally include IT expertise. The OIG recognizes that in a digital-first environment, governance is impossible without an understanding of the underlying infrastructure, data flows, and automated systems. 

The Roadmap Action: Organizations should update their Compliance Committee Charters to include a CTO, CISO, or equivalent technical lead. This individual is responsible for bridging the gap between regulatory mandates and digital execution.

Defining and Inventorying Generative AI as a Requirement 

The OIG has introduced a formal, rigorous definition of Generative AI for reporting purposes. The new definition focuses on foundation models and systems that “generate new content or inferred outputs” used in clinical, billing, or administrative decision-making. 

Your Generative AI Inventory must track: 

1. Life Cycle Use Cases: Identifying where AI is deployed, such as automated utilization reviews, draft patient communications, clinical note summarization, or coding/billing reconciliation. 
2. Deployment Status: Reporting whether a tool is in the “Pilot,” “Pre-deployment,” or “Production” phase. 
3. Data Provenance and Security: Documenting how Protected Health Information (PHI) is shielded from being used as training data for public or foundation models. 

The Risk of “Shadow AI” 

The OIG is particularly focused on “Shadow AI”, meaning automated tools implemented by individual departments without the Compliance Committee’s knowledge. Under the new reporting mandates, a marketing team using an AI bot to answer patient queries or a billing department using a third-party “coding assistant” without formal approval is now a reportable risk. 

By mandating these inventories, the OIG is forcing a shift from “trust” to “verification.” Compliance committees must document their review and approval of any AI tool before it impacts federal healthcare program billing or patient care. This creates a mandatory “accountability trail” that proves the organization is managing AI risks, such as algorithmic bias and “hallucinated” clinical data. 

Pillar 4: The Elevated (and Independent) Compliance Officer 

How is the OIG changing the independence and stature of the Compliance Officer role? 

The OIG is giving the Compliance Officer (CO) role real “teeth.” The new framework explicitly states that the CO must report directly to the CEO and cannot be subordinate to the General Counsel or the CFO. 

This change is about removing conflicts of interest. Legal and Finance have their own mandates, and Compliance must be free to evaluate them both. 

The Roadmap Action: 

• Direct Board Access: The CO must have direct, unfiltered access to the board. 
• Executive Sessions: Mandatory quarterly meetings with the board, including at least one portion in “executive session” without other senior management present. 
• Board Supervision: The board is now responsible for the supervision and performance evaluation of the CO, further decoupling the role from the CEO’s sole influence. 

Conclusion: Your Proactive CIA Readiness Checklist: Four Tactical Steps 

The OIG isn’t about making the job harder. They’re making it more technical and more transparent. To align with these modernized expectations before a regulatory knock at the door, prioritize these four tactical steps: 

1. Appoint an IT Lead to Compliance: Update your charter to include a technical expert who can oversee your AI and data governance. 
2. Conduct an AI Audit: Identify where automated tools are being used. Document what tools are being used, for what purpose, and how the data is being protected. 
3. Centralize Your “Any Modality” Intake: Move away from fragmented email folders. You need a single source of truth that can export a defensible log of every hallway conversation and digital message. 
4. Adopt the Gold Standard Early: Treat these new CIA mandates as a “Pre-Settlement Readiness Review.” Adopting these standards now proves to the OIG that your organization is committed to a culture of integrity, not just the appearance of one. 

Need some help putting together your “evidence engine” and a proactive CIA strategy? YouCompli takes acute and non-acute care organizations from chaos to compliance confidence. Reach out with your questions and challenges. 

Blog Glossary 

• General Compliance Program Guidance (GCPG): The OIG’s definitive framework for healthcare compliance.  
• Active Governance: A model where leadership and the board are directly involved in compliance effectiveness, moving beyond “check-the-box” reporting to formal responses and resource allocation. 
• Corporate Integrity Agreements (CIA): Binding five-year contract between healthcare entity and the HHS Office of Inspector General (OIG), imposed as part of a civil settlement to resolve allegations of fraud or abuse. 
• Shadow AI: The unauthorized or undocumented use of artificial intelligence tools within an organization without the review or approval of the Compliance Committee or IT leadership. 
• Generative AI: A category of technology utilizing foundation models to generate new content or inferred outputs used in clinical, administrative, or billing decision-making. 

Six More Resources 

Four Ways to Engage Leaders in a Culture of Compliance – Building positive, proactive relationships with leaders is crucial to a culture of compliance. Learn four approaches to engage leaders. 

10 Tips for Building a Compliance Culture in Healthcare – The tips explore how you can convince leaders that a strong compliance culture adds value to the organization. 

What to Look for in Regulatory Change Management Software for Healthcare Compliance – A modern regulatory change management (RCM) system does more than just notify you when regulatory changes occur. Learn what’s really possible today and why it matters. 

Your Board Committee Is Only as Effective as You Make It – Ten ways to engage your healthcare compliance board committee. 

How to Use AI for Systems Thinking in Compliance Processes – Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. 

Experts Weigh In: The Oversight Role of a Healthcare Board of Directors – Whether new to the field or a seasoned professional, get ideas on how support your board’s oversight responsibility for the compliance program. 

About the Author 

Jerry Shafran is the founder and CEO of YouCompli with years of experience in the healthcare compliance space.

He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages and sells software and content solutions that simplify complex work. His innovations help compliance professionals focus on their core priorities.  

AI Handbook for Compliance Pro’s

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post OIG Compliance North Star: Roadmap to the 2026 Modernized CIA Framework  first appeared on YouCompli.

Healthcare compliance leadership requires choosing between the “hard” of stagnation and the “hard” of growth. This post by John R. Nocero and Andrea L. Bordonaro explores how to move beyond basic regulatory tasks toward strategic Revenue Integrity and Operational Excellence. 

Regulatory compliance leadership isn’t for the faint of heart. Every day, leaders in our field face a fundamental choice that dictates the future of their organizations and their careers. It’s a choice between two distinct types of “hard.” 

One path leads to a plateau of administrative burden, while the other leads to a breakthrough in operational excellence. To move the needle on key compliance metrics, you must decide which challenges you’re willing to embrace. 

The Big Job of Regulatory Change Management 

Regulatory change rarely lives in one department. It touches:  

• Compliance  
• Revenue cycle  
• Legal 
• Clinical operations  
• IT 
• Quality 

Someone must translate regulatory language into operational tasks that those teams can execute. That translation step is where many organizations struggle. Well, guess what? You’re the translation step. 

Someone must translate regulatory language into operational tasks that those teams can execute. That translation step is where many organizations struggle. Well, guess what? You’re the translation step. 

Pick the Hard Work and Then Do It 

The compliance professional’s goal is to move metrics. Period. Whether it’s an outcome of no findings during a state inspection, ensuring everyone is signed off on education and training modules, or the weekly operational numbers posted for the entire organization to see, it’s your responsibility You know the work needs to happen. The challenge is getting the organization aligned around it. And that’s hard. 

Your organization’s leaders trust you to handle it, and they probably see you as capable of doing more. This visibility is an advantage, especially if you want to move up in the organization. But be aware, because corporate and everyone else is watching, looking for cracks in the armor or making you out as the target.  

Our advice? Choose your hard. Here’s how.  

Choose Your Hard: Two Options  

We all want an easier professional life. Less stress from daily meetings. More happiness from the validation of receiving praise from a job well done. Fewer complications from multiple people coming to your door every day to solve problems that aren’t yours.  

Here’s the truth nobody likes to admit: There’s no easy path. There’s only a choice between hard options. So, choose wisely.  

As we see it, you have two options: 

Option 1: Keep Doing What You’re Doing: The Administrative Burden of Stagnation 

This isn’t difficult. You’re basically choosing to do the same things you’ve been doing in the same manner. Keep leading the daily morning compliance meeting in the same style. Keep walking through the units waving and shimmying around but not really being authoritative or looking for issues. Talking to employees but not finding anything out, just basically wasting time. 

And please, avoid the hard conversations around people constantly interrupting you with their problems instead of doing what you get paid to do.  

This is hard, but not for the reason you think. This is hard because, well, we know you, you’re busy, but not productive. You are seen, but you aren’t really doing anything. You think you’re managing, but you’re really just walking around. 

You Get Credit for Moving the Needle, Not for Inertia 

You also think you should be promoted and moved up for doing what you’re supposed to do.  

Here’s the hard truth. You don’t get credit for the things you’re supposed to do. If you’re supposed to lead orientation, write policies, make presentations, all that is in your job description. It’s a basic function of your job. You’re not getting additional credit for that. You get credit for moving the needle, not stagnation.  

This version will feel easy in the moment. But over time, it becomes a cycle. Anxiety creeps in. Stress builds quietly. Communication gets messy. You start telling yourself little lies to stay comfortable. You get moments of happiness, but they don’t last because they’re built on escape, not stability. 

When a compliance department functions as a separate silo rather than a strategic partner, the friction is constant. You’re working hard, but you are not working toward a breakthrough. You are merely surviving the administrative weight of healthcare regulations. 

Option 2: Face Challenges Head-on: The Discipline of Operationalizing Compliance 

The alternative is the “hard” of growth. This involves the difficult work of Revenue Cycle Management (RCM) integration, fostering cross-functional alignment, and ensuring that compliance is viewed as a driver of healthcare quality and patient safety. 

It takes discipline to move beyond the checklist and into this strategy. It’s “hard” because it requires changing the culture of an organization, but it’s the only path that leads to: 

• Sustainable Revenue Integrity: Moving from reactive auditing to proactive prevention.
• Enhanced Patient Safety: Aligning regulatory requirements with frontline clinical care. 
• Professional Authority: Establishing compliance as a core pillar of the leadership team. 

Cut the noise. Reduce the dopamine overload. Sit with discomfort instead of running from it. Say the hard things. Build better habits. Run different meetings. If your boss is giving you a directive that you have to go and talk to the director of nursing and get his or her staff to carry out a particular order, don’t walk up to them and go “Hey, boss, wants you to do this” and tell them exactly the same order that was told to you. That’s not changing. That’s parroting.  

You need to do that a bit differently, such as “boss wants your team to do XYZ. Do you know how to do this? Does your team know how to do this? What are the gaps? What can I do for you right now?” 

The Hard Path Is Uncomfortable but Pays Off Over Time 

See the difference? It’s subtle, but effective. Basketball fans can think of it as the difference between telling your basketball team to run the triangle offense and perfecting the triple-post with all your front court repeatedly until it’s second nature, creating multiple scoring options based on defensive reactions. When you repeatedly do the hard thing, it pays off over the long term. 

This hard path is uncomfortable, and at first, it feels worse, not better. It’s hard to sit in the discomfort. But over time, something starts to change. Your brain slows down. Your emotions stabilize. You stop needing constant stimulation just to feel okay.  

And one day somewhere down the line, you realize: You’re not chasing happiness anymore or trying to be the part. You don’t need to wear a three-piece suit to the corporate board meeting. You can wear a Roman Reigns OTC crewneck. You don’t have to pretend to be the part. You are the part. And you are just experiencing it. 

Choosing the Tough Option Compounds the Benefits 

The tricky part about Option 2 is that it doesn’t feel like it’s working at first. That’s where most people quit. Option 2 is harder. But it compounds. It’s the difference between escaping your life and actually building one you don’t need to escape from.  

Be a long gamer because taking the “easy” path now often becomes the hardest life later. And the hard path now? That’s the one that sets you free. 

Andrea has taught first grade in Willoughby, Ohio for 27 years in the same classroom that she attended school as a child. She earned a Bachelor of Science in elementary education with a minor in language arts from John Carroll University and a Master’s Degree in the Art of Teaching and Education from Marygrove College. 

John builds and fixes quality departments, while currently thriving as the Administrator & Director of Quality, Risk Management and Compliance at River Vista, a behavioral hospital in Columbus, Ohio.

---

The Q-Kids – John R Nocero and Andrea L Bordonaro – are experts at everything quality, regulatory, education training and compliance and love sharing their knowledge on YouCompli.

Follow them on LinkedIn – for more quality content or send them a message – they’d love to hear from you.

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post The Compliance Leadership Paradox: Why You Must Choose Your Hard  first appeared on YouCompli.

Six Capabilities Needed to Drive Scalable Change Management  

For healthcare compliance leaders, the challenge isn’t just lack of information. It’s a lack of time. 

When a new regulation or update is enacted, the clock starts ticking toward its inevitable effective date and another compliance deadline. Regulatory change management is a moving target with constant deadlines and uncertain task status. 

Without the right tools and systems, all that many compliance leaders can hope for is a link to a government website buried in your inbox from a listserv, or a lengthy regulation that needs reviewed to get started. 

That’s why a modern regulatory change management (RCM) system should do more than just notify you when regulatory changes occur.  

To be truly useful, RCM software needs to transform complex regulations into actionable tasks that clinical and administrative teams can execute without needing law degrees or spending a lot of time extracting all the need-to-implement details.  

Beyond the Regulation: 6 Non-Negotiables for Regulatory Change Management Software 

The shift from uncertainty and static reading material to active management and confident compliance is critical for any modern healthcare system. 

If you’re evaluating a regulatory change management (RCM) solution, look for these six essential capabilities to move your team from “reading” to “doing.” 

Top Requirements for Regulatory Change Management Processes: 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

2. Efficient Relevance Identification and Assessment Saves Time 

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

4. Workflow Accountability and Oversight for Defensible Audit Trail  

5. Proactive Notification and Escalation Reduce Manual Steps 

6. On-Demand Analytics and Reporting for Actionable Data 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

Many compliance solutions just offer a link to a government website. That’s not enough for healthcare teams that are already stretched and overworked. Asking a pharmacy director or a head of nursing to read a hundred-page statute on drug pedigree requirements isn’t a sustainable compliance strategy. 

Can It Do the Heavy Lifting? 

A true regulatory change management solution does the heavy lifting for you. A best-in-class solution provides not only the source regulations, but analysis for those regulatory changes relevant to your organization or department.  

This analysis serves as a bridge between the legal language of the regulators and the daily operations of the hospital. Model procedures outline updated provisions of regulatory changes, that is – the requirements, in an operational way.  

From “Legalese” to “Actionable” 

For instance, if a new rule regarding patient privacy in telehealth is released, your software shouldn’t just notify you of the change. The tool should provide a comprehensive overview of what’s included in those changes for you to operationalize. The overview provides all the need-to-know information combined with workflow to assign work and track that it gets done.  

By clearly presenting these tasks, the system reduces the cognitive load on your department heads and ensures nothing is overlooked in the transition from “legalese” to “actionable.” When your team knows exactly what they need to do, the risk of non-compliance drops significantly. 

2. Efficient Relevance Identification and Assessment Saves Time 

Not every regulatory change applies to every organization. Identifying if a regulation or part of one that applies to your organization can take time, resources, and effort to read and see if, how and what applies. A regulatory change management solution should facilitate identification of what’s relevant. Then you can put a quick focus on regulatory changes that specifically impact your organization.  

Capabilities That Reduce Effort Spent Reading Regulations 

Regulation Relevance Check: Your software should guide you through a relevance check and allow you to quickly (within a minute or less), identify if a regulation is relevant or not. 

The “Don’t Know” Button: If a user is unsure of how to answer a question to determine relevance, the software should provide the ability to assign questions to additional staff who have information needed to answer yes or no. Look for a workflow solution that allows you to reach out if you’re unsure of the answer. 

Once the subject matter expert provides their response, you decide if the requirement is relevant as assisted by the question tips. These walk you through the relevance decision-making process.  

The workflow process ends at Step One for requirements that aren’t relevant. It progresses to task assignment and review only for the regulatory work your organization actually needs to get done.  

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

In a busy health system, the person doing the work isn’t always the person who needs to verify that it was done. That creates blind spots and broken workflows. 

Regulatory change management (RCM) software avoids this by allowing you to: 

• Automate Assignments by Department: Assign requirements based on staff department (e.g., pharmacy, radiology, professional fee revenue cycle). 

• Differentiate Roles: Software distinguishes between an Assignee (the person doing the work) and a Monitor (the person providing oversight/cc’d). 

• Set Audit Trails: Every comment and status change should be time-stamped with the username to ensure a defensible record for future audits. 

RCM software reflects your organization’s reality through distinct user roles and automated workflows to them. These roles define who has the hands-on responsibility and who has oversight responsibility, creating a clear chain of command. 

The Role of the Monitor 

The monitor role is an essential feature of modern change management software. Think of this as a structured “cc” function. A department director might need to see that a change is occurring without being the one to upload proof of completion. This keeps leadership informed and accountable without cluttering their daily task lists.  

For instance, a Chief Nursing Officer might want to monitor the progress of a new patient safety protocol across multiple departments without being responsible for each individual task. This separation of duties is a hallmark of a mature compliance program. 

Smart Duplication for Scalable Efficiency 

Also look for “smart duplication” in regulatory change software. For example, if you manage five different hospitals, you shouldn’t have to manually create five identical tasks. An “Assign to All” feature lets you create unique, trackable requirements for each location simultaneously.  

Each hospital administrator receives their own task, but the corporate compliance office can see the progress of all five locations in a single view.  

This maintains centralized oversight while ensuring local accountability. This feature is particularly useful for large health systems that need consistency across dozens of locations and departments while allowing for local execution. 

4. Workflow Accountability and Oversight for Defensible Audit Trail 

The saying goes that if it wasn’t documented, it didn’t happen, and sometimes that applies to healthcare audits. An effective audit trail should be able to reconstruct the entire decision-making process for any given regulation. 

Your software shouldn’t just track completion status. It should capture the entire story of your compliance efforts, providing a clear path for auditors to follow.  

Centralized Commenting Backs Up Workflow Decisions 

Centralized commenting is a key part of a defensible audit trail. Compliance leaders can move away from fragmented check-in emails and internal chat threads. Instead, all discussions regarding a specific regulation live inside a dedicated task workspace.  

This creates a time-stamped, unalterable record of: 

• Who made decisions 
• What questions were asked 
• When work was completed 

If an auditor asks why a certain policy was changed six months ago, you can provide the exact thread of discussion that led to that decision. This level of transparency builds trust with regulators and simplifies the audit process. 

5. Proactive Notification and Escalation Reduce Manual Steps 

Compliance shouldn’t be a surprise. Proactive notification and escalation ensure that deadlines are known and met. A good compliance management system sends automated reminders well before an effective date passes.  

If a task remains untouched as a deadline approaches, the software should trigger a proactive escalation to supervisors. This ensures potential gaps are addressed before they become regulatory violations.  

Automated escalations remove the need for compliance officers to manually follow up with department heads, saving time and reducing friction between departments.  

Proactive Notifications Improve Efficiency 

A static dashboard is where compliance tasks go to die. Instead, look for a dynamic, proactive system that pushes information to your team. With email integration, direct links from an email notification take users straight to their requirement and task workspace in the software. 

6. On-Demand Analytics and Reporting for Actionable Data 

The Analytics Dashboard is designed for what healthcare compliance leaders need to see: 

• What’s overdue?  
• Where do I need to focus?  
• What do we need to do? 

With one click, see everything happening in the workflow, then export important information into spreadsheets or slides for sharing or presenting.  

The outcomes of using a dashboard to manage compliance workflow are: 

• Efficient, reliable access to real-time, high-quality data 
• Simplicity and ease of use save time 
• Visibility and transparency lead to peace of mind 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation for details of dashboard information and insights into completed work. 

Next Steps in Your Software Journey: Look for a Partner, Not a PDF Repository 

When evaluating software vendors, ask if the solution actually helps you do the work or does it just give you more things to read. The right regulatory change management software doesn’t stop at sending notifications of regulatory changes. Instead, it actively manages your workload.  

By prioritizing expert analysis, intelligent relevance filtering, and clear role definitions, a good software tool can move your compliance department from an underappreciated burden to a streamlined operational partner.  

A truly effective solution empowers your staff and provides peace of mind to executive leadership. The goal is a culture of compliance where every team member knows exactly what is expected of them and has the tools to achieve it. We share that goal. Reach out if you’d like to know what regulatory change management software can do for you. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post What to Look for in Regulatory Change Management Software for Healthcare Compliance  first appeared on YouCompli.

For years healthcare leaders have been faced with demonstrating their value and answering the question, “How is compliance doing?” Getting the answers typically involves a scattered, manual process of pulling data from multiple sources, departments, and teams, then going through the process of aggregating that data to pull important, need-to-know information. By the time that step is complete, often the information is already out of date. 

Compliance Confidence with Real-Time Data. Now You Have Answers. 

We knew there was a better way, and who better to partner with than our existing clients? With our expertise and their input, we developed the new YouCompli Analytics Dashboard, now a standard tool within YouCompli Software for all clients.  

This blog explains what the YouCompli Analytics Dashboard is and how it helps compliance leaders demonstrate the immense value they bring to an organization through their ability to monitor and oversee regulatory work in real time. 

Problem: Accessing Important Compliance Metrics and Data 

Compliance leaders need to monitor and oversee regulatory work throughout the organization, and that can be very challenging. Many organizations lack the time and resources to quickly access regulatory information that may be scattered across an organization and then roll it up into a reportable and actionable result. 

The Solution: Real-Time Metrics and Transparency 

The YouCompli Analytics Dashboard takes regulatory changes and immediately provides you with information on key performance indicators (KPIs) when it comes to compliance. These KPIs are simple to access.  

Just identify the date range of information you want to review and let YouCompli take it from there. You’ll be provided with real-time, on-demand information on all the need-to-know metrics when it comes to implementing and complying with new and updated regulations.  

Task Status: Summary of current task status (e.g., accepted, assigned, in progress, completed) of task due dates within the selected date range. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Instead of pulling multiple reports in YouCompli to filter, sort, and manipulate to showcase the regulatory work, now by entering a date range, we’ll do all the hard work for you.  

• Want to know how long it takes you to comply with new regulatory requirements? YouCompli will tell you!  
• Want to know exactly what hasn’t been done yet? See the total amount and then click the number to have the list of overdue requirements at that moment.  
• Doing great? See your overall requirement and task completion rates immediately on how your organization is doing from 0% – 100% to get right to the work that needs to get done or celebrate your accomplishments for a job well done.  

Benchmark data, set goals, and have real-time information to measure improvements against previous performance. 

YouCompli Analytics Dashboard = Operational Accountability 

The YouCompli Analytics Dashboard brings transparency to all departments to evaluate where compliance activities are timely and complete. It also allows you to identify gaps in regulatory oversight and accountability and ensures you’re able to quickly address them. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Requirement Status: Summary of current status (e.g., accepted, assigned, in progress, completed) of requirements effective during the selected date range. 

The YouCompli Analytics Dashboard brings to light regulatory compliance activities and how the work is distributed across an organization. It gives insight into: 

The value of regulatory change management software. 

• How many regulations did our organization review? 
• How many regulatory changes have we completed? 
• How many regulatory changes have yet to be done, and … 
• Does this pose potential risk of penalties, fines, investigations or reputation? 
• How are we doing overall? 

YouCompli Analytics Dashboard = Everything You Need to Know 

Nothing comes close to the YouCompli Analytics Dashboard when it comes to quickly and easily monitoring and overseeing the state of regulatory compliance. Whether you’re looking for high-level information for boards and senior leadership teams or more detailed information for compliance committee or department-level teams, the YouCompli Analytics Dashboard provides all the need-to-know information.  

Requirement Completion Rate: Percentage of requirements effective within the selected date range that have been completed. 

Task Completion Rate: Percentage of tasks completed for requirements effective within the selected date range.  

YouCompli Analytics Dashboard Overview 

The YouCompli Analytics Dashboard provides your organization with the following information: 

• Requirement and Task Completion Rates 
• Average Number of Days to Complete Regulatory Requirements and Tasks 
• Requirements Completed with Missing Important Information (Relevance) 
• Total Requirements and Tasks Overdue  
• Total Volume of Regulatory Requirements Published/Assigned in YouCompli  
• List of All Requirements and Tasks Completed 
• Regulatory Requirement and Task Status (Assigned, Accepted, In Progress and Completed  
• Regulatory Requirement Heat Map: Top 5 Departments with Overdue Regulatory Requirements 
• Open Regulatory Requirements Across All Departments 
• Software Utilization Monitoring (Software User Activity and Requirement Completions) 

Example: Values link to detailed reports showing all contributing data. 

What the Data Means: 

Average Days to Requirement Completion: Average number of days between requirement published date and requirement completion date for requirements effective within selected date range.   

Average Dates to Task Completion: Average number of days between the task assigned date and the task completion date for tasks associated with requirements effective during the selected date range.   

Total Requirements Completed, Relevance Unknown: Total number of requirements completed within the selected date range, but relevance status was not answered.  

Total Requirements Overdue: The total count of incomplete requirements past their effective date within the selected timeframe.  

Total Tasks Overdue: Total number of tasks not completed and past their due date within the selected date range. 

YouCompli Analytics Dashboard Demonstrates Your Compliance Value 

The YouCompli Analytics Dashboard is standard part of the YouCompli software and is just one of the ways our client success team works for clients every day. We take feedback and opportunities to continuously improve for the valued clients we serve every day. Want to learn more? Let’s start a conversation. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Healthcare Compliance KPIs: Real-Time Data Dashboards  first appeared on YouCompli.

This Q&A with compliance expert, Lisa Herota, RHIA, CHC, CHIAP, CHPS, CCS covers best practices for a data-savvy compliance leader. Learn about realistic compliance metrics and how to share them effectively. Read more about Lisa’s background and experience at the end of this blog. 

Question 1 – How do you define value in the context of healthcare compliance? What kinds of value can compliance create? 

Lisa Herota – Compliance has a positive impact on financial, clinical and operational outcomes when we manage compliance well overall, not just by avoiding penalties.  

We help the organization safeguard the mission and reputation by: 

• Protecting revenue  
• Enabling ethical growth 
• Maintaining patient safety 

We do this all while also making our leaders feel more confident. They can make informed decisions through a compliance mindset, versus just worrying about how we’re going to avoid a penalty. 

Q 2 – Can you share examples of how you’ve created value or seen others do it? 

LH – One approach I’m proud of is strengthening organizational trust and reputation by developing a culture of compliance. This happens through:  

• Rounding and being present in the organization 
• Doing trainings  
• Partnering with leaders, medical staff, employees and even patients 

I’ve taken compliance teams from being the department where ideas go to die or the “Department of No” to being seen as a function that engages and supports. We became a resource that leaders want to bring to the table at the beginning of projects and discussions as a support versus just somebody to call when things go wrong. 

Q 3 – How do you measure and quantify compliance value?  

LH – I love data. I preach data, data, data to all compliance leaders. There are lots of different metrics we don’t think about, but many times, we just look at how we avoid fines. 

Actually, compliance has a lot of data for leaders to study. We can:  

• Look at percent of applicable regulations implemented on time.  
• Look at number and severity of audit findings or corrective action plans implemented.  
• Trend reported issues and how quickly those issues were resolved.  

Compliance Metric: Tracking the Near Misses 

Something that compliance leaders don’t think about often enough are the near misses. We usually think about these situations in patient safety and quality. But many times, compliance can help with close calls, and we should track those.  

Compliance Metric: Financial Value from Correct Regulation Implementation 

Common examples of financial value derived from correctly implementing new regulations include: 

• Reductions in external legal expenses 
• Decrease in denials and claw backs or repayments 
• Additional revenue capture  

Compliance Metric: Operations Staff Hours Saved 

You can talk to your operational leaders about how their team workloads benefit, especially if you have good regulatory change management tools with reporting and dashboards. Many times, I’ve tracked the number of hours saved that operational leaders don’t have to spend reading through regulations to decipher and interpret them.  

Department heads save valuable time when we provide them with tools like policy templates, implementation information, and the interpretation of the regulation itself. So, the hours compliance saves other department leaders is a good metric, too. 

Hard for Compliance to Quantify: Harm Avoidance  

It’s difficult for compliance professionals to quantify how they help the organization avoid harm. It’s definitely easier for revenue-generating departments to show their value, because they can measure the revenue they drive.  

But compliance often concentrates on how we avoid fines, and it’s hard to prove we’ve truly avoided something when the attitude is “Maybe we wouldn’t have gotten that fine anyway, regardless of what we do or don’t do.” That’s why I focus on other metrics. 

Q 4 – Who needs to know about the value that compliance creates, and how do you communicate that? 

LH – That’s a great question. There are various levels across any health system or organization that need to know the value that compliance has created, but the way you report it is going to look different based on whom you’re talking to.  

Talking to the Board 

When I’m presenting to my board or board committees, I target risk mitigation trends, assuring them we’ve got this. I use heat maps that show risk rankings, prioritization and key regulatory risk areas. I use implementation rates or key issues identified and resolved. When I’m talking to my board, I highlight how compliance work aligns with the strategic priorities of the organization.  

Talking to the Executive Team 

But when I’m talking to my executive team, I might get a little more granular with how many reduced denials or repayments or how many claw backs we avoided. Also, that metric about saving frontline leaders’ time, because that affects their operational teams as well as alignment with patient safety, quality and patient experience goals. A key metric is showing executive leaders how compliance ties into all the other objectives that the organization is trying to accomplish.  

Talking to Operational Leaders and Frontline Teams 

It’s a very different story when I’m talking to operational leaders or frontline staff.  With them, I focus on how I’m helping them succeed:  

• Fewer surprises related to regulations that apply to them 
• Reduced fire drills from reactive implementations versus steady, methodical implementation of regulatory change. 
• With good policies, procedures and training 

With frontline staff, it’s all about what compliance does. Proving compliance value is about showing them how we:  

• Impact their day-to-day reality. 
• Make changes to protect them and their patients. 
• Help make their work easier and safer. 

Really, it’s all about how we help support them and affect their day-to-day work. 

Tie Compliance Work to Strategic Goals for Value Recognition 

To overcome compliance reporting roadblocks, I go back to tying compliance’s work directly to the organization’s strategic goals. Just connect what we do to what the organization is focused on. Show how what we do impacts quality, CMS, star ratings, financial stability, the growth of new service lines and innovation.  

We need to connect what we do to optimizing and streamlining those goals and processes. 

Q 5 – What feedback have you had about compliance metrics and value? 

LH – One of the stories I love to share is about the day I was presenting a regulatory change management dashboard to my board. The very first time, I showed them that over the course of a year, the compliance team had touched over 535 regulations. It was the height of Covid, and when I presented that dashboard, board members just sit back in their chairs almost with a collective sigh.  

And they said, with the data you present, we can see what’s happened to the organization. We’re not just hoping we’re compliant. Now we can prove it. We can show that the organization truly is operating in a compliant manner. That was one of my biggest takeaways from frontline leaders.  

Other feedback I’ve received includes: 

• “I feel like compliance is supporting and partnering with me, not just telling me no or being a barrier.” 
• “When we streamlined compliance tools, that really helped support compliance functions.” 
• “Compliance saves us time and work by not having to review, interpret and decipher complicated regulations.” 

Leaders feel confident knowing we’re not missing anything and that they’re being supported. 

Be a Confident, Data-Driven Compliance Leader 

Wouldn’t you like to feel the same way about your compliance program? Reach out and we’ll show you some of the compliance management tools mentioned in this blog. 

About the Author 

Lisa Herota is a seasoned healthcare executive with over two decades of experience leading high-impact initiatives in compliance, privacy and health information management (HIM). She brings a strategic, data-driven approach to safeguarding organizational integrity. 

Throughout her career, Lisa has held pivotal leadership roles at several medical systems. Her expertise spans the full spectrum of healthcare operations, from managing complex ICD-9 and CPT coding systems, to overseeing departmental budgets and navigating rigorous accreditation standards. 

Lisa is a recognized expert in regulatory change management and is passionate about transforming compliance from a “policing” function into a proactive business partner. She holds an impressive array of professional certifications that underscore her deep technical knowledge, including: 

• RHIA: Registered Health Information Administrator 
• CHC: Certified in Healthcare Compliance 
• CHIAP: Certified Healthcare Internal Audit Professional 
• CHPS: Certified in Healthcare Privacy and Security 
• CCS: Certified Coding Specialist 

Beyond her technical skills, Lisa is a dedicated advocate for building a culture of compliance. She leverages her background in research and data compilation to provide executive leadership with insights to make informed, ethical and growth-oriented decisions.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?  first appeared on YouCompli.