Are you keeping up on your reading from the FY 2027 hospital inpatient prospective payment system (IPPS) Final Rule? True, it is close to 900 pages of Federal Register fine print, (https://www.govinfo.gov/content/pkg/FR-2026-08-04/pdf/2026-15833.pdf ) but there are four areas that prepared compliance professionals should be aware of. This blog takes you through the highlights of those important sections. 

What Does the Final Rule Mean for Your Organization? 

This release updates Medicare payment rates and policies for acute care and long-term care hospitals, with some starting as soon as January 1, 2027, so it’s definitely time to start paying close attention. 

1: Expansion of Comprehensive Care for Joint Replacement (CJR) Model 

The original CJR Model ran from April 2016 through December 2024 and according to CMS, it produced the needed results. The most recent evaluation of performance years six and seven (2021-2023) showed that the CJR Model produced an estimated $112.7 million in net savings while maintaining quality of care. 

Now, the CMS Innovation Center is expanding the model nationally, including in U.S. Territories, starting January 1, 2028. The expanded model, called CJR-X, will focus on improving care and reducing spending for Medicare beneficiaries undergoing lower extremity joint replacement (LEJR) procedures.  

CJR-X Mandatory Requirements for Some Acute Care Hospitals 

Participating hospitals will be held accountable for spending and quality of care during an inpatient stay or hospital outpatient procedure and for the 90 days following hospital discharge.  With some exceptions, the CJR–X Model will be mandatory for acute care hospitals paid under IPPS and Outpatient Prospective Payment Systems (OPPS).  

Multiple Modifications to CJR Model 

CJR–X also includes modifications to the CJR Model. The Final Rule confirms multiple policies for CJR-X.  These include: 

• January 1, 2028 start date 
• Acute care hospitals as participant and accountable entity 
• LEJR as the episode of care 
• Five quality measures and a composite quality score (CQS) to assess quality performance  
• Regional risk-adjusted target prices that include capped normalization and trend factors 
• Pricing-specific policies for certain hospitals, such as low-volume and safety net hospitals 
• Provider and beneficiary overlap permitted with most models 
• Allows participant hospitals to have financial arrangements 
• Waives certain Medicare program requirements 
• Permits beneficiary-identifiable and regional aggregated data sharing 
• Options for Alternative Payment Model (APM) participation  

Though compliance professionals aren’t likely to be named the implementation lead of these efforts at their hospital, they should still be aware of how these changes will affect reimbursement, quality reporting and allowances for financial arrangements. 

To learn more now and in the future about the CJR-X Model, stay tuned at https://www.cms.gov/priorities/innovation/innovation-models/cjr-x 

2: Organ Acquisition Costs 

Compliance professionals working in or with organizations providing organ acquisition services need to be aware of these changes and ensure policies, procedures and any auditing activity is adjusted accordingly. 

• The Final Rule outlines payment policies for organ acquisition and reasonable cost, as well as reimbursement appeals for Independent Organ Procurement Organizations (IOPOs) and Histocompatibility Laboratories (HCLs).   
• The Final Rule solidifies the proposal to clarify and codify certain longstanding policies on allowable costs under Medicare’s reasonable cost principles for all provider types, including public education for organ procurement organizations.  
• Additionally, it finalizes the proposal to clarify and codify Medicare’s longstanding policies for allocating overhead costs across all provider types.  
• Lastly, the final rule codifies the CMS administrator’s discretionary review of reimbursement appeals for IOPOs and HCLs.  

As HHS OIG states in their General Program Compliance Guidance, “One of the best ways to identify fraud and abuse risks is to follow the money.” Understanding the flow of money related to organ acquisition is one of those areas to add to the list for “following the money.” 

3. Quality, Quality, Quality. 

Quality of care is another area that the HHS OIG has been shining a light on for compliance professionals in recent years. Though it’s unlikely compliance professionals will take over quality of care programs in hospitals, OIG expects tight partnerships. Also expected is a general understanding by compliance departments of the work that hospitals’ quality of care teams perform. 

Specifically, OIG said, “Entities should incorporate quality and patient safety oversight into their compliance programs. Integrating quality and patient safety oversight into compliance processes can alert the entity of quality and patient safety concerns and enable the entity to mitigate risk of patient harm.” 

Quality Reporting and Compliance Impact 

The IPPS Final Rule has a lot to say about quality reporting. Although compliance professionals aren’t on the front line for some changes, they should ensure quality teams are aware and have a plan to address any potential impact.  

Quality-related highlights include: 

1. Adoption of three new measures: 

• Excess Days in Acute Care After Hospitalization for Diabetes measure beginning with the FY 2029 payment determination 
• Hospital Harm-Postoperative Venous Thromboembolism electronic clinical quality measure (eCQM) beginning with the FY 2030 payment determination 
• Advance Care Planning eCQM beginning with the FY 2030 payment determination 

2. Removal of three measures, beginning with FY 2030 payment determination:  

• Venous Thromboembolism Prophylaxis eCQM 
• Intensive Care Unit Venous Thromboembolism Prophylaxis eCQM 
• Discharged on Antithrombotic Therapy eCQM 

3. Modifications to three measures beginning with the FY 2028 payment determination. All are related to Excess Days in Acute Care after Hospitalization for: 

• Acute Myocardial Infarction 
• Heart Failure 
• Pneumonia 

4. Five modified mortality measures beginning with the FY 2028 payment determination.  Each relates to the Hospital 30-Day, All-Cause, Risk-Standardized Mortality Rate following: 

• Acute Myocardial Infarction Hospitalization  
• Heart Failure Hospitalization 
• Pneumonia Hospitalization  
• Chronic Obstructive Pulmonary Disease Hospitalization  
• Coronary Artery Bypass Graft Surgery  

4: Promoting Interoperability of Certified Electronic Health Record Technology 

The Medicare Promoting Interoperability Program encourages eligible hospitals and critical access hospitals to adopt, implement, upgrade and demonstrate meaningful use of certified electronic health record technology (CEHRT). 

In this Final Rule, CMS confirmed policies to: 

• Remove and revise certain criteria to align with proposals made by the Office of the National Coordinator for Health IT 
• Remove certain attestations  
• Delay removal of the following two measures: (i) Support Electronic Referral Loops by Sending Health Information and (ii) Support Electronic Referral Loops by Receiving and Reconciling Health Information  
• Modify the Electronic Prior Authorization measure as an optional bonus measure for the EHR reporting period in CY 2027 and mandatory beginning with the EHR reporting period in CY 2028 
• Add the Unique Device Identifiers for Implantable Medical Devices measure  
• Adopt two new eCQMs beginning with the FY 2030 payment determination in alignment with the Hospital Inpatient Quality Reporting Program 
• Remove three eCQMs beginning with the FY 2030 payment determination in alignment with the Hospital Inpatient Quality Reporting Program  

Build Business Knowledge to Anticipate Non-Compliance Risks 

Most compliance professionals are unlikely to be the assigned project lead on any of these announcements within their individual hospitals. But good compliance professionals need to understand their organization’s business lines and operations to anticipate where non-compliance could most likely occur. 

For those working with or for hospitals, the Hospital IPPS Final Rule is always a good place to review upcoming changes to hospital reimbursement, government policies and data reporting requirements.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Stay Informed on Medical Necessity and More 

Read other blogs by Dr. CJ Wolf on YouCompli to stay current on information compliance leaders need. He covers these and other topics:  

• Regulatory and Enforcement Updates: Breaks down OIG Work Plan priorities, CMS policy updates, and healthcare regulatory changes. 
• Compliance Auditing and Risk: Offers practical advice on risk assessments, internal auditing, and building effective compliance programs. 
• Billing and Documentation Integrity: Examines compliance strategy related to coding integrity, medical necessity, and operational oversight. 

Here are a couple of articles to get you started. 

Don’t Let Pain Injections Cause Regulatory Compliance Pain 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.   

Four Areas of Noncompliance in SI Joint Injection Procedures  

Below are four categories of noncompliance and indications of unmet requirements: How SI Joint Injections Are Covered 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

Ensuring medical necessity for services or supplies is a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders.  

This piece explains the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Four Things to Know About the FY 2027 IPPS Final Rule  first appeared on YouCompli.

The HHS OIG recently released an audit report in which they concluded that for a recent one-year period, Medicare improperly paid physicians approximately $15.2 million for sacroiliac joint (SI) injections (see: https://oig.hhs.gov/reports/all/2026/medicare-improperly-paid-physicians-an-estimated-152-million-for-sacroiliac-joint-injections/).  

SI injections can help some patients improve their spinal mobility as well as relieve pain. Medicare covers these injections under certain conditions but not others. That’s where confusion can create painful compliance risks. 

Most Recent Audit in Series Related to Spinal Pain Management Services 

This was the most recent audit in a series of audits related to spinal pain management services which the OIG has been performing over many recent years.  

In prior audits of similar spinal services, the OIG found, for example, that Medicare improperly paid physicians for facet-joint interventions for more than 50 percent of sampled services that didn’t comply with one or more of the Medicare requirements:  

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-an-estimated-30-million-for-spinal-facet-joint-interventions/ 
• https://oig.hhs.gov/documents/audit/9596/A-09-20-03003-Complete%20Report.pdf 
• https://oig.hhs.gov/documents/audit/9602/A-09-20-03010-Complete%20Report.pdf  

They also reported finding improper payments associated with epidural steroid injections: 

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-for-epidural-steroid-injection-sessions/ 

Audits Continue in Therapeutic Spinal Pain 

In addition, last year, they published audit findings that said Medicare could have saved an estimated $17.7 Million if CMS oversight had prevented at-risk payments for anesthesia administered during spinal pain management procedures: 

• https://oig.hhs.gov/reports/all/2025/medicare-could-have-saved-an-estimated-177-million-if-cmss-oversight-had-prevented-at-risk-payments-for-anesthesia-administered-during-spinal-pain-management-procedures/  

Consequently, it should come as no surprise to healthcare compliance professionals that the audits in the therapeutic spinal pain space continue with the recent report about SI joint injections. 

Background on Crucial SI Joints 

The SI joints connect the lower portion of the spine to the pelvis. 

They support upper-body weight and play an important role in walking and changes in posture or position, such as moving from standing to sitting. These joints become painful for various reasons, including sacroiliac joint dysfunction, which occurs when the joint moves too much or too little, often due to injury, pregnancy or osteoarthritis.  

To improve movement and relieve lower back pain, a physician may administer an SI joint injection. A diagnostic injection is first used to determine whether the SI joint is the source of the pain. Significant immediate pain relief following the injection strongly suggests that the SI joint is responsible.  

(Image from page 2 of the OIG report) 

Once the SI joint is confirmed as the pain source, a therapeutic injection may be administered, with pain relief potentially lasting up to six months. 

How SI Joint Injections Are Covered 

Medicare Part B covers SI joint injections when medically reasonable and necessary. Five of seven Medicare Administrative Contractors (MACs) have local coverage determinations (LCDs) outlining requirements for  

• Pain indications 
• Imaging and pain assessment 
• Coverage limits  
• Diagnostic and therapeutic injections 

These LCDs limit coverage to two diagnostic and four therapeutic injection sessions within a rolling 12-month period, whether performed unilaterally or bilaterally.  

Billing and Coding for SI Joint Injection Procedures 

Each MAC also issued billing and coding guidance stating that physicians must add the “KX” modifier to each claim line for diagnostic injections to distinguish them from therapeutic injections. (Appendix C of the OIG Audit report summarizes the MACs, the states they cover, and the specific LCD number and LCD Reference article pertinent to their audit.) 

CPT code 27096 is used for injections made directly into the sacroiliac joint, while CPT code 64451 is used for injections targeting the nerves that innervate the sacroiliac joint. 

OIG Selects 100 Random Samples out of 186,000+ Procedural Sessions 

For the audit report, the OIG selected a random sample of 100 SI joint procedural sessions from a population of 186,842 sessions paid for by five MACs in a one-year period. They requested physicians’ supporting documentation to determine if the claims met Medicare requirements including LCD and LCD Reference Articles.   

Of the 100 sampled sessions, 28 complied with Medicare requirements, and 75 complied with Medicare billing guidance. However, the remaining 72 sessions didn’t comply with Medicare requirements, and 25 didn’t comply with Medicare billing guidance.  

Seventy-two sampled sessions didn’t comply with one or more of the requirements. The OIG report summarizes the noncompliant sessions by the type of noncompliance observed: 

(The total exceeds 72 sessions because 41 sessions had more than one deficiency.) 

Estimated Improper Payments of $15.2 Million in Sample Universe 

OIG then extrapolated their findings across the entire population of 186,842 sessions and calculated overpayments to determine their estimated improper payment amount of $15.2 million for the universe of sessions sampled for the one-year period. 

OIG found that although CMS had systems to identify some billing errors, it didn’t provide enough additional oversight or education to help physicians understand and follow Medicare requirements. CMS relied on MACs to educate physicians, but this wasn’t sufficient.  

As a result, some physicians may not have fully understood the requirements and billing rules. Physicians with billing errors said that more frequent and consistent training would have helped them understand the rules and avoid future errors. 

Other Improper Payments Assumed, Potentially Pushing Total Higher 

As mentioned, the sample universe of SI joint procedural sessions was limited to the five of the seven MACs that had issued LCDs. The other two MACs that didn’t have LCDs paid physicians $12.3 million for sacroiliac joint injection sessions. That accounts for approximately 36 percent of total Medicare payments for sacroiliac joint injections nationwide.   

Since these sessions were excluded from the audit, OIG wrote that this set of payments to physicians may also include improper payments. If true, the estimated $15.2 million in improper payments could potentially be higher. 

Four Areas of Noncompliance in SI Joint Injection Procedures 

Below are four categories of noncompliance and indications of unmet requirements: 

1 – Indications of Pain Requirements Not Met 

• At least three positive findings with provocative maneuvers 
• Low back pain below the L5 vertebra without radiculopathy 
• Low back pain that persists despite a minimum of four weeks of conservative therapies 
• Clinical findings and imaging studies that do not suggest any other diagnosed or obvious cause of the lumbosacral pain such as tumor and fracture 
• Low back pain for at least three months 
• Moderate to severe low back pain primarily experienced over the anatomical location of the sacroiliac joints between the upper level of the iliac crests and the gluteal fold 

2 – Imaging and Pain Assessments Requirements Not Met 

• The sacroiliac joint primary pain level must be measured prior to the injection at the beginning of the session. 
• The post procedure pain level must be measured at the end of the session. 
• The injections must be performed under computed tomography (CT) or fluoroscopy image guidance with contrast unless the patient has a documented contrast allergy so that ultrasound guidance without contrast may be considered. 

3 – Diagnostic or Therapeutic Sacroiliac Joint Injections Requirements Not Met 

• A diagnostic injection must have provided a minimum of 75 percent relief of primary pain before a therapeutic injection is administered 
• A subsequent therapeutic injection is not reasonable and necessary when the prior therapeutic injection did not result in at least 50 percent consistent pain relief or functional improvement for at least three months 

4 – Limitation of Coverage Requirements Not Met 

• Administer other musculoskeletal injections in the lumbosacral spine during the same session as sacroiliac joint injections 
• Perform multiple injections (e.g., epidural steroid injections, facet-joint injections, and trigger point injections) during the same session as sacroiliac joint injections and during the period when the physician is evaluating whether the injection reduced pain (i.e., efficacy assessment period) 

The Audit Details Smart Compliance Professionals Look For 

Like most medical claims’ audits, the “devil is in the details”. To avoid problems, wise compliance professionals will: 

1. Monitor the most recent LCDs from their MAC 
2. Maintain a process to review the LCDs and implement processes to ensure compliance 
3. Perform records audits for both coding and medical necessity  

Some coders might have the requisite medical knowledge to audit for medical necessity. However, it usually requires a clinical background as well as an understanding of Medicare billing requirements such as LCDs. 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Here are other resources to check out next: 

How to Avoid False Claims Related to Medical Necessity 

This expert blog gives compliance readers actionable steps to avoid civil monetary penalties and False Claims Act scrutiny resulting from documented medical necessity failures. 

Physician Coding and Billing Errors Enforcement: Compliance 

Get more context on enforcement actions stemming from unbundling, modifier misuse, and improper billing during same-day procedures. 

Know the Compliance Risk for Certain Anesthesia Services 

Learn about another recent OIG audit targeting spinal injection procedures and associated anesthesia/sedation coverage limitations. 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

The linked article specifically discusses how MAC LCDs define medical necessity (such as requiring four weeks of conservative therapy prior to approving spinal injections)

The post Don’t Let Pain Injections Cause Regulatory Compliance Pain  first appeared on YouCompli.

About the Medical Necessity Series 

This is the third in our series of articles on medical necessity. In the first, we described the compliance risks associated with submission of claims for medically unnecessary services.   

In the second, we highlighted a case where an organization of long-term care hospitals were alleged to have violated the Federal False Claims Act (FCA) for holding patients in the hospital longer than medically necessary to increase reimbursement from Medicare. 

In this next article, we spotlight another recent example of a healthcare provider entity agreeing to pay a six-figure sum to resolve allegations of submission of claims for medically unnecessary services¹.  This time, the providers consisted of three affiliated skilled nursing facilities (SNF) that were alleged to have submitted claims for medically unnecessary rehabilitation services.   

False Claims Act Metrics Make Significance Clear 

The Department of Justice has reported that False Claims Act settlements and judgments reached $6.8 billion in Fiscal Year 2025. Over $5.7 billion of that total was derived entirely from the healthcare sector. Most of these healthcare recoveries stem from whistleblower lawsuits targeting corporate billing schemes, upcoding, and medically unnecessary services. 

Case Involves SNF Reimbursement Dispute Over Therapy Services 

For the period in question, skilled nursing facilities (SNFs) were reimbursed for therapy services based on a patient’s resource utilization group (RUG). The RUG was determined by the amount of services the patient received, such as: 

•  Physical therapy 
• Occupational therapy  
• Speech pathology services 

In short, the more services provided, the higher the reimbursement.  However, as discussed in our two prior articles, if the services don’t meet medical necessity requirements, they should not have been performed or billed in the first place. 

Whistleblower Lawsuit Triggers Investigation 

As is frequently the case, these allegations were first brought forth through a qui tam, or whistleblower, lawsuit. The whistleblower, or relator, claimed the defendants implemented a five-pronged scheme to fraudulently bill for unnecessary “Ultra High Rehab,” (the most intensive therapy provided by SNFs) and to keep patients in Ultra High Rehab for longer than necessary. 

The five prongs of the alleged scheme were: 

1. Pressure to perform excessive, unnecessary services: The organization’s leadership exerted pressure on therapy staff to administer excessive Ultra High Rehab and to do so for longer than necessary.   

This pressure was exerted not only by administrators who oversaw SNF operations, but also by regional directors of operations who managed the facility administrators. Such pressure was also exerted by directors of rehab (DOR) who managed therapists at each facility, and regional managers who directly managed the DORs.  

In other words, management, from top to bottom, spoke to therapists and staff in one voice: increase Ultra High Rehab, regardless of patient need. 

2. Financial vs. medical reasons to provide care:  Instead of letting therapists determine the appropriate level of therapy needed based on their professional evaluation, leadership insisted that each patient’s level of therapy be at least in part determined by whether the patient qualified for lucrative Medicare Part A benefits. 

3. Care for functional patients: The organizations pressured therapists to continue providing therapy to patients who were fully functional and in no way required intensive therapy. A scheme called “Bridge to Success” was employed which mandated an additional week of Ultra High Rehab be tacked on even after patients were ready for discharge. 

4. Too sick for care: The organizations pressured therapists to provide therapy to patients who were too sick to benefit from therapy and even to patients who were actually harmed by it.  

Since therapy minutes were dictated by management and not assigned based on the professional opinion of evaluating therapists, patients ended up receiving more therapy than they could tolerate, including instances where therapy was forced on patients about to pass away. 

5. Maximizing minutes: The focus on maximizing therapy minutes to hit therapy goals also resulted in leadership encouraging an array of fraudulent billing practices. 

This included: 

• Billing non-therapeutic minutes as therapy  
• Allowing therapists to bill for therapy without actually providing it 
• Encouraging therapists to bill evaluation sessions as therapy. 

Widespread Occurrences Involve $14.6+ Billion in Alleged Intended Losses 

Federal enforcement actions emphasize the commonality of these practices. The 2025 National Health Care Fraud Takedown alone resulted in criminal charges against 324 defendants nationwide, involving over $14.6 billion in alleged intended losses tied to fraudulent billing and medical necessity abuses. 

The most compelling argument for compliance leaders is that medical necessity fraud carries dual liability: 

• Financial Risk: Organizations face mandatory treble damages (three times the government’s actual loss) plus steep statutory penalties for every individual false claim submitted. 
• Human Risk: Unlike administrative billing errors, medical necessity fraud directly compromises patient care. Overutilization exposes vulnerable patients to unnecessary, exhausting or potentially harmful procedures simply to satisfy corporate revenue targets. 

Three Takeaways from Medical Necessity Cases 

Much can be learned from the themes of these allegations, even if your organization isn’t an SNF or doesn’t provide therapy services. Medical necessity requirements are common across most healthcare organizations. 

Key lessons from this case include: 

1. Decisions about billing for medical care provided need to be based on clinical and regulatory requirements, especially coverage requirements from Medicare and Medicaid, for example.   Such requirements often include statutes about: 

• Medicare coverage 
• Medicare manuals 
• National Coverage Determinations  
• Regional Medicare Administrative Contractors’ Local Coverage Determinations (LCD)  

2. Regular, focused compliance coding and billing audits may identify aberrant practices. This is especially true for services whose corresponding medical documentation doesn’t support compliance with coding or billing rules.   
    
   For example, Medicare reimbursement rules state that routine, non-skilled services aren’t separately reimbursable. In this case, it was alleged that one therapy assistant was coached to include in therapy minutes the time it took him to arrive at a patient’s room starting with the moment he left the therapy department. 
    

3. Use data analytics to identify outliers. Most whistleblower cases alleging medically unnecessary services are brought by an individual with knowledge from inside the organization. Many times, the individual is a physician, nurse or other clinician with medical expertise.   
    
   This case was different. It was filed by a private analytics firm using publicly available data. Though rare, these cases do exist. If a private firm using public data could find the alleged aberrations, one would hope the organization’s own compliance professionals would be able to find similar aberrations if given the resources to look.  Additionally, the government is using data analytics to identify cases they want to pursue as well. 

Apply These Takeaways to Your Own Regulatory Compliance Program 

False Claims Act allegations alleging a lack of medical necessity can take many forms. The kind of service or type of provider may also vary, but these key themes appear in many cases. The astute compliance professional will learn from them and apply the principles to the operations and services provided at their own healthcare organization. 

The claims resolved by the settlement are allegations only, and there has been no determination of liability. 

The post Lessons from the Frontlines: A Case Study in Medical Necessity Enforcement  first appeared on YouCompli.

Description: Elevate your audit strategy. Access 7 top educational resources designed to help healthcare compliance leaders navigate complex commercial and federal reviews.  

Trying to get a better handle on audit readiness? Good move. To save you some time, we’ve curated this audit-related content specifically for healthcare compliance professionals. The overview compilation gives you a quick look at the useful advice in each resource, so you can dive right into where you need help the most.  

If you haven’t thought about audit readiness lately, it’s probably time to put some focus on it. However, we know compliance life moves fast, and you can’t always get to some of the important things proactively. 

Compliance leaders get exhausted by resource scarcity, manual tracking fatigue, and escalating payer audits. According to the Barnes & Thornburg Compliance Outlook Report, 56% of healthcare compliance and risk leaders anticipate even greater regulatory challenges ahead, with over half struggling to secure the resources needed to keep up.  

So yeah, a proactive audit strategy could be a good idea. 

Healthcare Compliance Audits: 7 Essential Resources for Leaders 

Given that, it’s not surprising that continuous readiness is becoming the new standard for healthcare compliance leaders when it comes to audits. 

This collection is about shifting the conversation from “surviving the next audit” to “building a defensible, tech-forward compliance data engine”. 

These resources will quickly get you headed down a good path, with their abundant advice and useful tips from compliance professionals for compliance professionals. Many of them come with their own downloadable tip sheets. 

Think of the collection as the start of your “audit preparedness playbook.” 

Resource 1 – With Compliance Audits, The Best Defense is a Good Offense  

Is your organization defensible against a compliance audit? Do you have a game plan in place to avoid penalties and other losses? 

Traditional point-in-time random sampling simply fails to catch systemic gaps that audits can reveal. 

How this resource helps: 

With this blog, learn how to prepare your compliance program for the win. Using sports training analogies, the authors present a better way to handle ongoing inspections and audits in healthcare systems. 

The fast-break transition offense the authors suggest is inspired by the 1990 UNLV Running Rebels basketball team. Get their unique advice on how to go offense following a regulatory compliance audit or inspection, so you’re well-prepared for the next one. 

It takes practice. By reinforcing these principles and working on conditioning and decision making, teams can create more scoring opportunities. Just as a prepared team can force the defense into difficult situations, a well-prepared compliance team can “force” the auditor into zero-findings and more quality inspections.   

Resource 2 – Audit Readiness? How about Audit Etiquette?  

When a regulator shows up, what’s the first thing your team scrambles to find? 

• Is it evidence of task completion?  
• Maybe a list of applicable regs or updated policies?  
• How about proof of communication to stakeholders? 

In addition to documentation, how your team behaves during an audit also affects the outcome. 

How this resource helps: 

Learn the unfiltered truth about compliance audits and “audit etiquette” — the proper behavior for responding to an audit. 

Get expert tips on: 

• What audit readiness means 
• The role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• Audit etiquette best practices 

Perception is reality. If you look like you know what you’re doing, respond promptly, and treat the auditors with respect, you can generally minimize any damage. With the advice in this blog, you won’t just look ready; you’ll be ready – and calm.  

Follow these practices and display confident compliance audit behavior. 

Resource 3 – Healthcare Audit? Stay Ready. Don’t Get Ready.  

Compliance audit in Quality? Many quality teams think they’re ready, until they aren’t.  

In healthcare quality departments, audit readiness is no different than in any other area. Follow a defined process, then optimize as necessary so it works for your organization and patients.  

It’s not hard, but people still panic because an auditor can shut them down. 

However, if you have a proactive process in place to minimize the damage, you don’t have to worry.  

How this resource helps: 

This resource shares the pre-audit steps you need for proactive compliance readiness in Quality. It’s jammed with advice from the first word to the last. 

• During the Compliance Audit 
• Post-Audit Follow-Up Practices 
• Be Proactive: Prepare for Your Next Compliance Audit  

Resource 4 – How to Use TPE Plans for Compliance Auditing and Monitoring  

When doing periodic risk assessments, compliance professionals often use the OIG Work Plan or DOJ enforcement actions to determine how to deploy time and resources on auditing and monitoring. 

Another helpful tool is the list of services that Medicare Administrative Contractors (MACs) include in their Target, Probe and Educate (TPE) plans.  According to CMS, the goal of TPE is to accelerate improvement and let MACs work with providers to correct specific errors. 

How this resource helps: 

As this expert-written piece explains, TPE information can be a good resource for compliance leaders when designing proactive audit plans.  

This blog looks at how TPE plans are applied to specific areas of non-compliance that MACs observe. Use them to create your own checklists for cleaner compliance audits and proactive monitoring.  

Resource 5 – Six key steps to reduce the impact of telehealth audits 

Did you know telehealth is almost as old as the telephone itself? 

In 1879, just three years after Bell patented the telephone, an article in The Lancet first described the telehealth concept and its use.  

And a law that’s even older than the telephone still triggers telehealth audits today.  

The 1863 False Claims Act was enacted to keep profiteering contractors from defrauding the Union army. Today, it can trigger serious problems for modern telehealth practitioners.  

How this resource helps: 

Today we know the best way to cope with audits is to avoid the need for them in the first place. This article shares six proactive steps to take to reduce the impact of telehealth audits.  

It includes advice on how to: 

• Know what you’re up against.  
• Inventory your waivers.  
• Check your records.  
• Audit your process.  
• Fix what’s broken.  
• Rebill and repay.  

Patient demand for telehealth isn’t going away. Neither are the costs of noncompliance with telehealth regulations.  

By proactively partnering with colleagues in relevant departments, your compliance team can lead the efforts to identify and fix issues before they become major problems. That way, you can provide the telehealth services patients want in compliance with what the regulations demand. 

Resource 6 – 5 Payer Audit Errors Every Hospital Must Avoid 

From large hospitals to solo practitioners, at some point most providers will experience a commercial payer audit from CMS, OCR or some other agency. Their scrutiny reveals errors and violations, which in turn trigger hefty penalties. In fact, commercial payer audits have jumped 2.2 times over a single year, increasing the total sum at risk for hospital systems by 30%.  

Even more challenging, payers are moving heavily toward pre-payment audits. These can hold up payments and squeeze monthly cash flow.  

External payer audits don’t have to be such a nightmare.  

How this resource helps: 

The key to surviving an external audit with the least pain is to avoid the five payer audit errors outlined in this blog. 

1. Late responses 
2. Wrong documentation 
3. Billing the wrong codes 
4. No self-audit 
5. No legal help 

By staying prepared and vigilant, your next payer audit experience can be more streamlined and less stressful. 

Resource 7 – Audit Expectations and Challenges 

When it comes to providing best-in-class healthcare, stress comes with the territory. Unrelenting demands drain resources across the organization, including some not directly involved with patient care.  

One demand that turns daily routines upside down, and compounds stress levels is an audit. A compliance audit can be conducted internally by hospital committees or externally, often by government-approved contractors. 

Internal Audit – Seeks to determine provider’s financial and operational controls, and that related policies and procedures meet compliance and risk management needs. 

External Audits – Several federal agencies including CMS, OIG, OCR and others are the primary drivers of audits of regulations and compliance costs across hospitals. Responding to multiple external audits increases administrative costs, and funds could be bound up in lengthy appeals. 

How this resource helps: 

Study this overview to familiarize yourself with the basic workings and typical costs associated with audits. For example, external audits are conservatively estimated at $100 per hour, but the manual drain goes deeper:. Standard program reviews require 300 to 346 hours of direct manual labor per plan, taking skilled leaders away from higher-level risk mitigation. 

The Tech-Driven Path to a Proactive Audit Strategy 

You have plenty of insightful and helpful resources to review here. But as you look through them, keep this reality check in mind: 40% of compliance teams still rely on spreadsheets and text documents to track internal reviews. 

The future belongs to compliance leaders who lean into automated tools, allowing their teams to complete risk assessments far faster than manual methods and catch errors before federal or commercial auditors flag them. 

If you’re ready to leave the spreadsheets behind, or just have questions about setting up your proactive audit framework, we’re always here to talk. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Master Healthcare Compliance Audits: Learn from 7 Expert Resources  first appeared on YouCompli.

Ensuring medical necessity for services or supplies isn’t just about getting paid. It’s a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders. 

This is the first article in a series on medical necessity — an area that many compliance programs struggle with. In this piece, we explain the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems. 

Impact of Denial Rates and Medical Necessity on Payer Costs  

Data suggests that medical necessity is becoming a primary way for payers to manage costs, making it even more worthy of leadership attention. The “State of Claims 2025” Report found that 54% of providers agree claim denials are increasing faster than they can appeal. 

A data accuracy gap also contributes to the problem. Roughly 41% of healthcare organizations report at least 1 in 10 claims is denied, often due to “bad data” at intake or lack of clinical justification. 

All of this creates further justification for the need to better understand medical necessity from a compliance standpoint. 

Role of Clinician Review in Determining Medical Necessity 

Medical necessity isn’t an easy compliance risk to tackle, especially when OIG recommendations bump up against front-line reality. Sometimes, clinicians view medical necessity as their bailiwick.   

Of course, their expertise is the basis for medical decision making. Generally speaking, clinicians are making their decisions based on what they believe is medically necessary. They are the clinically trained professionals and should know when something is medically necessary or not, right?  

However, from a compliance standpoint, medical necessity often really means “covered” by a third-party payor. If something is considered “not medically necessary,” it may actually mean it does not meet payor coverage requirements. 

OIG on Clinical Review of Medical Necessity in Claims Audits 

In their General Compliance Program Guidance document (GCPG), the Department of Health and Human Services (HHS) Office of Inspector General (OIG) emphasized the importance of ensuring claims submitted to government payors are medically necessary. 

Specifically, they note:  

“Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Considerations for Compliance Risks in NCD and LCD 

Other entities have also emphasized medical necessity as coverage criteria. For example, Medicare publishes National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs). These are, in essence, coverage criteria for a specific service.  

Though generally accepted medical guidelines or medical practice may suggest a certain treatment plan is appropriate, the LCD might not cover the service for a particular condition or diagnosis or might not allow the service at a particular cadence or frequency. 

Example: Meeting LCDs for Pain Injection Procedures 

LCDs addressing pain injection procedures are a good example of this. A Medicare LCD might state that before Medicare considers a spinal injection “medically necessary” (think “covered”), the patient needs to have failed four months of conservative therapy (e.g., lifestyle changes, physical therapy, etc.)   

Or the LCD might state a total of four injections in a twelve-month period is the maximum number of injections they will allow. Additionally, an LCD might require that a patient has a certain condition (represented by an ICD-10 or diagnosis code i.e., diagnosis code) before considering a service covered.   

There is potential compliance risk in all these areas if coverage criteria are not met and documented in the medical record or if codes are reported to ensure coverage, but the medical record does not support the diagnosis code reported. 

Overlap with Patient Safety 

Medical necessity can also overlap with patient safety issues. If a physician exaggerates the severity of a condition to make it look like the services should be covered, a patient could undergo a procedure that was not appropriate or medically necessary to perform in the first place.  

This raises patient safety issues for subjecting a patient to certain risks when the service does not appropriately meet clinical standards or indications for performance. 

How Medical Necessity Compliance Is Enforced 

The government utilizes various tools for enforcing medical necessity compliance.  These include the False Claims Act (FCA), typically used by the U.S. Department of Justice (DOJ), and the Civil Monetary Penalties Law (CMPL) utilized by the OIG. 

The DOJ can investigate allegations of medically unnecessary services when credible information is brought to its attention by whistleblowers (qui tam relators). A qui tam relator is a private individual or entity who files a lawsuit on behalf of the government under the FCA against companies or individuals committing fraud. Or the DOJ can investigate on their own, typically because of data analytics they proactively perform. 

How OIG Pursues Financial Penalties and Program Exclusion 

The OIG is authorized to pursue monetary penalties and exclusion through a variety of civil authorities, most notably the CMPL. Under the CMPL, OIG can seek assessments in lieu of damages, Civil Monetary Penalties (CMP), and exclusion from participation in federal health care programs.   

According to the OIG, one example of conduct that could lead to CMP liability is presenting a claim for a pattern of medical or other items or services that a person knows or should know are not medically necessary. 

Medical Necessity Risk Tied to Clinical Services 

There isn’t a one-size-fits-all risk profile when it comes to medical necessity. Each organization’s risk is going to be tied to the clinical services it offers or orders. Organizations and their compliance programs should undertake risk assessments tailored to their particular situation.  

Via the GCPG document, the OIG recommends that when conducting risk assessments, organizations should “ensure that medical necessity, patient safety, and other quality compliance issues are included in the risk universe.” 

Download Tip Sheet

Coming Articles: Details of Recent Enforcement Actions 

In subsequent articles in this series, we’ll take a closer look at the details of recent enforcement actions involving allegations that submitted claims lacked medical necessity. This information will help compliance leaders stay on top of situations and reduce risks in their own organizations.  

Read Part Two Here

About the Author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 27 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Medical Necessity: A Guide for Healthcare Compliance Leaders  first appeared on YouCompli.

For healthcare compliance leaders, financial literacy is not optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  

To identify anomalies or potential regulatory “red flags,” compliance officers must move beyond a high-level view of healthcare finance and understand how clinical operations translate into financial entries. 

What does a compliance leader need to understand? Things like: 

• Budgeting and capital planning 
• Internal controls and risk 
• Grant and research compliance  
• Key performance indicators (KPIs) 
• Communication between CFO and compliance officer 

Familiarity with the 14 steps of the revenue cycle is also valuable for mitigating risks associated with reimbursements and 340B compliance. (This topic is covered later in the blog.) 

Where Do Healthcare Compliance and Finance Intersect? 

Regulatory compliance and healthcare finance overlap in multiple ways. Compliance-related areas with a financial angle include: 

• Medicare, Medicaid reimbursement 
• 340B drug pricing 
• Stark Law and anti-kickback statutes 
• Charity care 
• Financial assistance requirements  

What Should Compliance Leaders Understand About Financial Statements? 

To build fiscal literacy, let’s start with some foundational concepts – financial statements. Compliance officers should have a basic understanding of these types of statements: 

1. Balance Sheet 
2. Income Statement 
3. Cash Flow Statement 

1. The Balance Sheet: Assessing Financial Integrity Through a “Snapshot” 

The balance sheet provides a snapshot of an organization’s financial health at a specific point in time, detailing its assets, liabilities and equity. 

Why Compliance Should Care: Monitoring the balance sheet helps ensure that assets are properly recorded, and that liabilities like these are appropriately disclosed: 

• Potential legal settlements 
• Debt obligations 
• Medicare overpayments 

2. The Income Statement: Monitoring Operational Risk Over Time 

Unlike the balance sheet snapshot, the income statement tracks revenue and expenses over a specific period, such as a month or a fiscal year. The income statement puts a focus on total revenue and expenses, and the difference between them, while distinguishing between operating and non-operating items. Those two concepts are compared in the chart below. 

In an income statement, it’s important to distinguish between accrual-basis accounting (matching revenue to period it was earned) and cash-basis accounting (recording transactions only when money changes hands). 

Why Compliance Should Care: By comparing current monthly performance against previous years, compliance officers can spot outliers in revenue or sudden spikes in expenses that could indicate billing errors, “upcoding,” or improper financial arrangements under the Stark Law. 

3. The Cash Flow Statement: Ensuring Operational Sustainability 

The cash flow statement tracks the actual movement of cash into and out of the organization, categorized by: 

• Operating activities 
• Investing activities 
• Financing activities 

Why Compliance Should Care: Understanding cash flow is vital for making sure the organization has liquidity to maintain compliance standards even during times of financial strain. A significant discrepancy between reported net income and actual cash flow can signal deep-seated issues with revenue cycle integrity.  

Revenue Cycle as Regulatory Roadmap 

For a prepared healthcare compliance leader, the revenue cycle isn’t just a financial process; it’s a regulatory roadmap. From initial patient interaction to final collection, each step presents a unique set of compliance risks that can lead to audits, fines or loss of reimbursement if not managed with understanding. 

What Compliance “Trapdoors” to Watch for in the Revenue Cycle 

The revenue cycle is full of complexity, largely fueled by the impact of different hospital types (PPS, critical access, disproportionate share, and tribal hospitals) on Medicare and Medicaid rates. 

While the full revenue cycle has 14 distinct stages, compliance officers should pay particular attention to these “trapdoors” where financial operations must meet strict federal regulations: 

• Front-End Integrity (Scheduling and Registration): Accuracy is paramount to ensure Medicare and Medicaid reimbursements aren’t jeopardized by incorrect patient data or lack of prior authorization. 
• Clinical Documentation and Coding: This is a high-density risk area. Compliance must make sure that coding reflects the actual services provided to avoid allegations of “upcoding” or “unbundling,” which can trigger False Claims Act investigations. 
• 340B Drug Pricing Program: If an organization participates in 340B, the revenue cycle needs rigorous internal audits to establish compliance with drug diversion and duplicate discount prohibitions. The stakes will be even higher if the program undergoes potential changes regarding payment models. 
• Billing and Claims Submission: Errors in this stage directly impact the Clean Claim Rate. More importantly, consistent billing errors for federal healthcare programs can lead to significant liability under Anti-Kickback Statutes or the Stark Law if improper financial relationships are found. 

Monitoring Denial Management at Back End of Revenue Cycle 

A robust compliance program monitors the back end of the revenue cycle as closely as the front. Analyzing denials can reveal systemic issues in documentation or billing practices that, if left unaddressed, represent both financial loss and compliance vulnerability. 

What KPIs Should Compliance Watch as Part of Financial Oversight? 

For a healthcare compliance officer, financial data is more than just a reporting requirement. It’s a proactive tool for risk assessment. By monitoring specific KPIs, compliance teams can move from reactive auditing to strategic oversight and identify operational stressors before they escalate into violations. 

The “Big Four” Financial KPIs for Compliance Officers 

Comprehensive financial oversight should track these four metrics: 

• Operating Margin: This measures whether the organization’s core clinical mission is profitable after all operating and overhead costs are paid. A shrinking margin often leads to “cutting corners” in staffing or documentation, which directly increases compliance risk. 
• Days Cash on Hand: This indicates liquidity. How many days can an organization operate using its current cash reserves if all revenue stopped? Higher liquidity provides the financial “breathing room” to maintain compliance and quality standards even during economic downturns. 
• Clean Claim Rate (CCR): A high CCR (ideally 95% or higher) indicates that claims are being submitted without errors the first time. A low rate is a red flag for systemic billing or documentation errors that could trigger federal audits under the False Claims Act. 
• Payer Mix: It’s critical to understand the percentage of revenue coming from Medicare, Medicaid and private insurance. In many healthcare models, Medicare functions as a “break-even” payer, while Medicaid reimbursements often fall below the actual cost of care, placing additional pressure on revenue integrity. 

What to Know about Budgeting and Internal Controls 

Compliance officers should also distinguish between the Operating Budget (daily/annual clinical operations) and the Capital Budget (typically reserved for long-term investments or items over $10,000). 

To prevent fraud and ensure financial integrity, a compliance program must enforce strict segregation of duties. This assures that no single individual has control over all aspects of a financial transaction, serving as a primary defense against embezzlement and improper financial reporting. 

Using the SBAR Tool to Structure CFO and Compliance Communication 

The most effective healthcare compliance programs are those where the Chief Compliance Officer (CCO) and Chief Financial Officer (CFO) operate as strategic partners.  

However, communicating complex compliance risks in a way that aligns with financial priorities requires a structured approach. This is where the SBAR tool (Situation, Background, Assessment, Recommendation) becomes invaluable for justifying financial decisions and resource allocation. (Download a helpful SBAR template at the end of this article)

Four-Step Method for Financial Advocacy 

Use this four-step method to present compliance needs to your finance team: 

• Situation: Clearly state the immediate financial or regulatory issue.  
  Example: “We have identified a 15% discrepancy in our 340B drug pricing audits.” 

• Background: Provide the necessary context and data.  
  Example: Current Medicare reimbursement rates for these drugs are subject to strict transparency requirements. 
   
• Assessment: Offer your professional analysis of the risk.  
  Example: Failure to rectify this documentation gap poses a significant risk to operating margin and regulatory standing and could trigger a federal audit. 
   
• Recommendation: Propose a specific, data-backed solution.  
  Example: “I recommend an immediate investment in automated tracking software as part of the next capital budget cycle.” 

How Compliance Can Secure a “Seat at the Table” 

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  

Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.  

Ready to drive more compliance value? Reach out to see how YouCompli can help.  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  first appeared on YouCompli.

Revenue leakage from non-compliance with regulations exposes health systems to compliance risks and penalties. We’ve curated eleven resources to help compliance leaders be better prepared to guide alignment between regulatory compliance processes and revenue integrity goals.

Why Should Compliance Care about the Revenue Cycle? 

Over half of all regulations deal directly with revenue cycle, billing and finance. Most providers still lack an effective system or process to monitor, assess, and validate compliance with those regulations. As a result, these organizations leave themselves open to significant risks, not to mention significant revenue leakage. 

If you need to learn more about the revenue angle of healthcare compliance, these resources are a good place to start. 

Compliance Content by Compliance Experts 

The resources included in this collection Include articles from noted compliance experts including: 

• Shawn Y. DeGroot – CHC-F, CCEP, CHRC, CCPC 
• Maeve O’Neill, MEd – LPC-S, CHC, CDTLF 
• Sharon Parsley – JD, MBA, CHC, CHRC 
• Susan Thomas – CIA, CHC, CPC, CRMA 
• Maya Turner – CPMA, CPCO, CFPC, CPC, CPC-I, AAPC 
• CJ Wolf – MD, CPC, CPC-I, M.Ed. 

Learn from their advice and examples how compliance contributes to revenue performance and launch your own strategies for improvement. 

1. Blog – Mitigating Conflicts of Interest that Drive Profit Over Health  

Integrity First: Mitigating Conflicts of Interest in Clinical Decision-Making 

In healthcare, a conflict of interest (COI) occurs when secondary interests, such as financial ties or institutional goals, threaten to compromise clinical objectivity.  

These conflicts do more than just create ethical dilemmas; they often lead to overutilization of unnecessary tests and treatments, inflating costs for patients and insurers alike. For compliance leaders, addressing COIs is essential to protecting the integrity of the healthcare system and ensuring resources are used appropriately. 

This blog examines the ripple effects of COIs on both patients and providers. It discusses key components of these conflicts and the significant financial impact they have on the entire healthcare ecosystem. 

Inside this resource: 

• Identifying the Triggers: Learn to recognize the financial ties and personal relationships that can bias medical decision-making. 
• The Cost of Overutilization: Understand how unnecessary procedures create financial burdens and exploit the system for gain. 
• Systemic Impact: Explore the broader consequences of COIs, including their role in fraudulent billings. 
• Protecting Objectivity: Strategies for ensuring that clinical judgment remains aligned with the best interests of patients and public health. 

Don’t let hidden interests drive your organization’s clinical path. Read the full blog to learn how to identify and mitigate the conflicts that put your system at risk. 

2. Blog – How to Avoid False Claims Related to Medical Necessity   

Protecting the Bottom Line: Compliance as a Revenue Safeguard 

In the complex world of health system finance, a single coding error can quickly escalate into a multi-million-dollar False Claims Act liability. While Revenue Cycle Management (RCM) focuses on speed and volume, Revenue Integrity ensures that those gains aren’t lost to federal audits or recoupments. 

3. White Paper – Exploring the Four Hot Spots Of the Healthcare Revenue Cycle  

Navigating the Minefield: Mastering the Four Hot Spots of Revenue Integrity 

The healthcare revenue cycle is the financial lifeblood of your organization, but it’s also a landscape filled with hidden regulatory traps. With complexity in payer contracts and government oversight, certain areas have evolved into high-risk “hot spots” that demand immediate, expert compliance scrutiny. 

4. Case Study – Getting It Right: Minimizing Self-identified Overpayments & Maximizing Accurate Billing 

From Regulatory Burden to $400,000 in Savings: The Great River Health Story 

For a small compliance team, staying ahead of complex state coding rules and rapid federal updates is often a losing battle. At Great River Health, this challenge meant spending countless hours manually interpreting regulations, yet the team never felt fully confident that they were catching every risk. They needed a way to move away from constant research and toward decisive action. 

This featured case study explains how Great River Health transformed their compliance program from a source of stress into a vital engine for revenue integrity. By adopting a system that provides validated policy templates and expert regulatory analysis, they shifted their focus from interpretation to implementation. 

5. Blog – Healthcare Compliance is Everybody’s Business: Clinical, Revenue Cycle, IT, Sales and Marketing 

Breaking the Silos: Why Compliance is Everybody’s Business 

To ensure long-term stability, compliance leaders must lead the charge in fostering deep partnerships with clinical, IT, and revenue cycle teams. Compliance can no longer operate in isolation. As governmental and commercial payers deploy increasingly sophisticated programs, the only way to safeguard your organization is through a unified front.  

This blog explores the strategic necessity of internal alliances. It breaks down the specific skills and communication rhythms required to identify systemic risks and avoid the catastrophic penalties associated with “reverse false claims” liability. 

Inside this resource: 

• The Partnership Mandate: Why a strong relationship with your revenue cycle team is your first line of defense against advanced payer audits. 
• Beyond the Surface: Learn how to distinguish between coding-specific denials and medical necessity issues to uncover localized and systemic vulnerabilities. 
• The 60-Day Clock: Understand the critical risks of “reverse false claims” and how to manage the return of overpayments to avoid treble damages. 
• Proactive Governance: How to establish regular cross-departmental meetings that turn compliance from a reactive task into a shared culture of integrity. 

Stop letting departmental silos become a regulatory liability. Read the full blog to learn how to turn every team into a partner for revenue integrity. 

6. Blog – Uncovering $9 Million in Unbilled Services    

The $9 Million Question: How Mock Audits Uncover Hidden Revenue 

Most compliance professionals view mock audits as a shield against fines and regulatory scrutiny. However, when approached strategically, these audits can also act as a powerful engine for revenue integrity. In one striking example, a fresh set of eyes and a few “tough questions” led to the discovery of $9 million in unbilled services. 

This featured blog explores how mock audits do more than just manage risk. They’re a primary tool for building cross-departmental relationships and positioning the compliance team as a high-value partner to the rest of the organization. 

Inside this success story: 

• The “Fresh Eyes” Advantage: Why stepping away from day-to-day tasks to look at the bigger picture is essential for identifying systemic billing gaps. 
• Beyond Revenue Protection: Discover the five strategic benefits of audits, from shaping organizational culture to preventing future penalties. 
• The Power of Simple Questions: See how asking “Do we bill that?” can lead to the biggest dollar-value discoveries of your career. 
• Compliance as a Partner: How to use the audit process to build trust and influence across the business while delivering tangible financial value. 

Stop viewing audits as a burden and start seeing them as an opportunity to prove the financial impact of your compliance program. Read the full story here to learn how to turn your next mock audit into a multi-million-dollar win. 

7. Blog – Compliance Risks Associated with Outlier Payments  

The Chargemaster Trap: Managing the High Stakes of Outlier Payments 

The next resource in our collection focuses on a high-stakes area of reimbursement that often flies under the radar until an audit begins — outlier payments.  

Outlier payments are designed to protect hospitals from significant financial losses on exceptionally costly cases. However, because these supplemental payments are directly tied to hospital charges, they have become a primary target for regulatory scrutiny. If a facility raises its chargemaster prices without clear justification, it can artificially inflate these payments and trigger intense external audits. 

This blog explores the delicate balance between revenue protection and compliance risk. We examine real-world audit findings where simple human errors and system glitches led to hundreds of thousands of dollars in overpayments and potential penalties. 

Inside this resource: 

• The Scrutiny Factor: Understand why enforcement agencies are actively monitoring price increases that lead to spikes in outlier reimbursement. 
• Lessons from the Field: Review the 2020 OIG audit of an Arkansas facility that found over $580,000 in overpayments due to time-tracking and coding errors. 
• The Human Error Risk: Learn how “hardcoded” charges and misaligned supply items can create systemic billing inaccuracies that go undetected for years. 
• Strategic Collaboration: Discover why a close partnership between compliance, finance and reimbursement teams is the only way to safeguard your organization against these risks. 

Stop letting unjustified price adjustments put your hospital at risk for recoupment and penalties. Read the full blog here to learn how to proactively audit your outlier claims and maintain regulatory integrity. 

8. Blog – The Cost of Non-Compliance  

Beyond the Fine: Calculating the True Price of Non-Compliance 

In the budgeting process, the cost of non-compliance is often a forgotten line item until it becomes a hard reality. While hefty fines for HIPAA or Medicare violations are the most visible risks, they’re only the beginning.  

For healthcare organizations, the true cost includes a cascade of legal fees, operational disruptions and long-term reputational damage that can be difficult to quantify but impossible to ignore. 

This piece explores how to move beyond reactive firefighting and toward a model of operational excellence. We discuss how to use Corporate Integrity Agreements (CIAs) as a powerful benchmarking tool to identify systemic vulnerabilities before they lead to federal intervention. 

Inside this resource: 

• The Tangible and Intangible: Learn how to communicate the full spectrum of risk to your board, from immediate settlement costs to the lasting impact on patient trust. 
• Contract Integrity: Focus on the critical importance of auditing physician and medical director contracts to prevent Stark Act and Anti-Kickback Statute violations. 
• A Culture of Excellence: Understand why investing in compliance is not just a legal obligation but a cornerstone of your organization’s commitment to patient care and operational stability. 

Stop viewing compliance as a cost center. Read the full blog to learn how a proactive approach to auditing and monitoring can safeguard your organization’s future. 

9. Blog – How to Avoid Compliance Risk in Peripheral Vascular Reimbursement   

Under the Microscope: Navigating Peripheral Vascular Reimbursement Risks 

Peripheral vascular disease (PVD) reimbursement has become a lightning rod for regulatory scrutiny. With alarming statistics regarding improper payments and a surge in whistleblower investigations, health systems cannot afford to treat these interventions as routine billing.  

For compliance leaders, the challenge lies in ensuring that every procedure meets stringent medical necessity guidelines before a claim is ever submitted. 

This expert-led blog provides a deep dive into the regulatory trends and enforcement patterns currently shaping the vascular space. It provides technical insights and best practices your team needs to safeguard your organization’s reputation and financial stability. 

Inside this resource: 

• Medicare Compliance Mastery: Understand the specific documentation and coding requirements that federal auditors target in vascular interventions. 
• Fraud Warning Signs: Learn why high volumes in vascular reimbursement are triggering red flags for the OIG and how to stay ahead of these investigations. 
• Recent Investigation Insights: Review lessons learned from recent whistleblower cases that focused specifically on PVD compliance failures. 
• Best Practices for Integrity: Actionable strategies to align clinical documentation with reimbursement guidelines to ensure every claim is defensible. 

Stop letting PVD reimbursement become a vulnerability in your revenue cycle. Read the full blog here to equip your team with the knowledge to navigate this complex environment. 

10. Blog and Tip Sheet – Revenue Cycle Management Compliance: Ensuring Financial Health in Healthcare  

Financial Integrity: Mastering Revenue Cycle Management Compliance 

Revenue Cycle Management (RCM) is the essential financial engine of any healthcare provider, managing everything from claims processing to final payment.  

However, the efficiency of this cycle depends entirely on its alignment with regulatory standards. Without a foundation of strict compliance, even the most streamlined revenue process is at risk of legal repercussions and compromised financial integrity. 

11. Blog and Tip Sheet – Three Strategies to Align Compliance with Revenue Cycle  

Strategic Synergy: Bridging the Gap Between Compliance and Revenue Cycle 

For healthcare organizations, the revenue cycle is the financial lifeblood. However, when compliance and revenue cycle management operate in silos, the resulting friction creates significant regulatory and financial risks.  

To protect the bottom line and ensure long-term sustainability, compliance leaders must lead the charge in aligning these two critical functions. 

Stop letting a lack of alignment become a financial liability. Explore how these three strategies can transform your compliance program into a vital partner for revenue integrity.  

Take Free RL3M Assessment (Regulatory Lifecycle Management Maturity Model)

RL3M Assessment

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post 11 Educational Resources on Revenue Cycle and Healthcare Compliance  first appeared on YouCompli.

Many compliance professionals rely on HHS OIG focus areas as they perform risk assessments and plan subsequent auditing and monitoring activities. In November 2024, the OIG added an item to their Work Plan describing their intention to review Medicare Part B payments for skin substitutes.  

More recently, in September of 2025, the OIG published a data snapshot report that concluded Medicare Part B payment trends for skin substitutes raise major concerns about fraud, waste and abuse.  

This blog explores the implications for compliance and what health systems need to be aware of.  

How Skin Substitutes Are Covered Currently 

Skin substitutes aid in wound healing and redevelopment of skin. Medicare covers skin substitutes that are reasonable and necessary for the treatment of an enrollee’s condition. Local coverage determinations state that Medicare Part B generally covers skin substitutes for treatment of diabetic foot ulcers and venous leg ulcers that have failed to respond to at least four weeks of standard wound care.  

However, no national or local coverage requirements apply for other wound types (e.g., pressure ulcers or trauma wounds), and coverage of skin substitutes for these wounds is determined on a case-by-case basis.  

How Medicare Pays for Skin Substitutes 

Medicare Part B pays for skin substitutes based on the number of service units billed at prices ranging from approximately $100 to more than $1,000 per square centimeter.  

For payment purposes, CMS treats skin substitutes like approved prescription biologics, and skin substitutes are reimbursed in non-institutional Part B settings at 106% of the average sales price (ASP).  ASP Refers to the average price of a drug sold to providers, and it’s used for calculating reimbursement rates.  

From calendar years 2020 through 2023, Medicare Part B payments for skin substitutes increased substantially. In two years, Part B spending on skin substitutes increased 640%, going from $389 million (Q3 2022) to $2.88 billion (Q3 2024). 

What Drives Increases in Skin Substitute Pricing and Utilization? 

The rapid growth in expenditure is driven by both higher prices and increased utilization, and the OIG found concerning trends in both areas. 

Higher Prices Driven by ASP and Incentives 

Some of the factors potentially increasing prices include the ASP and incentives for providers. Manufacturers of skin substitutes can quickly bring new skin substitutes to market compared to typical products paid using ASP.  

By statute, ASP is defined as a manufacturer’s sales of a drug to all purchasers in the United States in a calendar quarter (net of most discounts) divided by the total number of units of the drug sold by the manufacturer in that same quarter. 

Calculating Payments for Billing Codes 

Manufacturers are required to report the ASPs and total sales volume for each of their Part B drugs to CMS within 30 days of the end of every quarter. CMS then uses this data to calculate a payment amount for the billing code representing the drug.  

Because different versions (i.e., dosage amounts, package sizes) of a drug may be included within the same billing code, CMS calculates an overall volume-weighted ASP for the code using the manufacturer-reported sales data. By statute, Part B payment is set at 106% of the volume-weighted ASP.  

In cases in which CMS is unable to calculate a volume-weighted ASP for a code (e.g., a new code for which ASPs have yet to be reported), Medicare Part B contractors typically use Wholesale Acquisition Costs, aka WACs (i.e., list prices) or payment invoices to determine a payment amount.  

Providers Seek More Favorable Payments Based on Spread 

Allowing for the time it takes for manufacturer price reporting and the subsequent CMS validation and calculations, there is a two-quarter lag in the ASP-payment process (e.g., first-quarter 2024 ASPs were used as the basis for third-quarter 2024 payment amounts). 

Part B providers can retain the “spread” between their acquisition cost for a drug and the Medicare payment amount. Previous OIG work found that higher spreads may correlate with increased utilization for certain drugs.  

Under the current payment system, Medicare often pays providers for skin substitutes at amounts much higher than providers’ purchase prices, and providers keep the “spread.” This creates incentives to bill for more and more units of skin substitutes and to choose products with the greatest spreads – the same types of billing trends highlighted in the OIG’s report. 

Increased Utilization Has Average Part B Payment Up 153% 

Utilization of skin substitutes has also increased steadily, with more enrollees having skin substitute claims and a higher number of units being billed per enrollee. OIG found that between the first quarter of 2023 and the third quarter of 2024: 

• Number of unique Part B enrollees with skin substitute claim increased by 53%. 
• Total number of units paid under Part B increased by 83%. 
• Average Part B payment amount for each unit of skin substitute increased by 153%. 

In less than two years, the amount paid per Part B enrollee has tripled from $40,051 to $121,501. 

28% Growth in Utilization and Payments in Home Care Settings 

The OIG also found the growth of skin substitute utilization and payments in the home care setting to be particularly notable. By the third quarter of 2024, 28% of enrollees with a paid skin substitute claim under Part B were reportedly being treated in their home. These home care enrollees accounted for more than half of Part B spending on skin substitutes that quarter. 

They also noted that utilization and expenditures for skin substitutes under Medicare Advantage (MA) are just a fraction of utilization and expenditures under original Medicare.   

For example, in the third quarter of 2024, OIG found that only 3,800 Medicare Advantage enrollees were associated with a skin substitute claim, compared to 24,000 enrollees in Part B.  

OIG concluded there were no obvious differences in the enrollee demographics of original Medicare and Medicare Advantage that would explain the massive variance in skin substitute utilization.  

Instead, they suggested variance is likely driven by MA plans’ ability to use numerous reimbursement and utilization management tools to set payment rates and coverage for products such as skin substitutes. 

Urgent Action Needed to Rein in Spending Increases and Fraud 

Based on their data snapshot report, the OIG concluded that action is urgently needed to rein in the massive increases in Medicare Part B spending for skin substitutes in non-institutional settings. They also cited numerous fraud schemes involving skin substitutes. 

Compliance professionals should make sure they are considering their organization’s use of skin substitutes and determine if there are existing risks. If so, they should monitor and audit their organization’s use of skin substitutes to ensure compliance. 

More Resources on Compliance Risk 

Know the Compliance Risk for Certain Anesthesia Services 

A good healthcare compliance program is all about reducing risk, both in patient care and in financial reimbursement. This detailed blog by compliance expert, CJ Wolf, will bring you up to date on the compliance risks associated with certain anesthesia services.   

How to Avoid Compliance Risk in Peripheral Vascular Reimbursement   

Peripheral vascular disease (PVD) reimbursement is fraught with potential compliance pitfalls. This expert-written blog addresses the pressing concern of compliance risks in PVD reimbursement. It provides insights into regulatory trends, recent investigations and best practices. 

Exclusion Screening Failure Causes Compliance Nightmare 

Even a seemingly small glitch can have major consequences for healthcare compliance. This blog shares the story of the consequences of an incident when exclusion screening software glitched. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post OIG Cites Fraud, Waste and Abuse Concerns with Skin Substitutes  first appeared on YouCompli.

Aligning healthcare regulatory compliance with revenue cycle management is critical to mitigating risks and preserving business integrity. This blog explores three effective strategies to foster collaboration between compliance teams and revenue cycle management.  

Some of the most significant compliance risks faced by healthcare organizations today are found in the revenue cycle. The HHS OIG has stated, “One of the best ways to identify fraud and abuse risks is to follow the money.” 

For many healthcare organizations, this means having a good working relationship with the entity’s revenue cycle team.  

The revenue cycle is the process that starts with a patient’s initial appointment and ends with full payment for services. It encompasses all the administrative and clinical functions that contribute to collecting patient service revenue.  For healthcare organizations that provide services to patients, the revenue cycle is the organization’s financial lifeblood. 

3 Ways Compliance Can Stay Connected with RCM 

If compliance has a good working relationship with revenue cycle management, the two functions can enjoy a fruitful outcome.  

Compliance professionals should consider the following three ways to interact with the revenue cycle team. 

1. Regular Collaboration 

We know from OIG guidance documents that, to be effective, the compliance officer should maintain a degree of separation from the entity’s delivery of healthcare items, services, and related operations.  

Even though this means the compliance officer should not be responsible, either directly or indirectly, for the delivery of healthcare items and services or billing, coding, or claim submission, it does not mean the compliance officer should not be well-versed in these functions through regular communication and collaboration. 

Take Advantage of Compliance Committee Connections 

Regularly collaborating with the revenue cycle team will inform compliance professionals of the specific risks and potential compliance red flags the revenue cycle may be facing.  Many organizations ensure this collaboration by having revenue cycle leadership serve on the organization’s compliance committee.  

In fact, the OIG states the compliance committee “…should be comprised of the relevant leaders of both operational and supporting departments, which could include Billing and Coding, Clinical and Medical, Finance, Internal Audit, IT, HIM, Human Resources, Legal, Quality, Risk Management, Sales and Marketing, and other operational managers.”  Most of the departments suggested by the OIG play a role in the revenue cycle. 

In addition to revenue cycle personnel participating in the compliance committee, collaboration between compliance and revenue cycle can occur on a weekly basis through meetings and sharing of revenue cycle data such as denial rates, reports from electronic claims editors, communications from third party payors and any internal coding and billing monitoring the revenue cycle is performing. 

2. Proactive Claims Auditing  

The OIG tells healthcare providers that they “…should take proactive measures to ensure compliance with program rules, including regular reviews to keep billing and coding practices up to date as well as regular internal billing and coding audits.” 

In organizations that submit claims for services, a sizable number of resources should be dedicated to ensuring the claims they are submitting for reimbursement meet all program requirements.  

The revenue cycle team should have monitoring efforts in place for correct coding and billing.  Also, compliance departments should ensure that independent claims audits are also occurring regularly. 

Assisting Revenue with 60-Day Repayment Rule Requirements  

Even if an entity makes innocent billing mistakes, they have an obligation to repay the money to government third-party payers such as Medicare and Medicaid. The Affordable Care Act included a requirement that entities must report and repay overpayments by the later of: “(A) the date which is 60 days after the date on which the overpayment was identified; or (B) the date any corresponding cost report is due, if applicable.”  Sometimes this is referred to as the 60-day repayment rule. 

If a revenue cycle team’s internal monitoring identifies overpayments, it is critical for compliance departments to know the date of discovery, so the organization does not run afoul of the 60-day repayment rule. If the entity does not monitor the repayment requirements, they could be subject to liability under the Federal False Claims Act. 

3. Training and Education Geared to Job Roles 

Coding and billing rules are regularly updated and can change frequently, and it’s often difficult for busy clinicians to stay on top of the changing regulations. Compliance and revenue cycle teams should work together to ensure those involved in revenue cycle functions are educated on the most current rules. 

The OIG recommends targeting training depending on an individual’s role. Thus, those involved in revenue cycle operations need to provide training and education specific to the nuances of the revenue cycle. The training sessions should cover any compliance risks specific to the learners’ roles and responsibilities.  

Depending on the learners’ roles, these may include: 

• Billing 
• Coding 
• Documentation 
• Medical necessity 
• Beneficiary inducements 
• Gifts 
• Interactions with physicians  
• Other sources or recipients of referrals of federal healthcare program business 

Three Ways to Show You Follow the Money

If healthcare organizations are going to address their biggest compliance risks, they must include the revenue cycle. Compliance professionals can lead in addressing revenue cycle risks by: 

• Driving effective collaboration between compliance and revenue cycle teams 
• Verifying that proper auditing and monitoring of claims are occurring  
• Ensuring those involved in revenue cycle receive targeted training based on their specific role.  

Doing these three things helps show your compliance program is indeed “following the money” as suggested by enforcement agencies such as the OIG. 

About Solutions for Compliance Management and Operations 

Need help keeping track of everything going on in regulatory management? When multiple people and departments are involved, the last thing stretched compliance teams need is more manual work.  

YouCompli compliance solutions keep cross-functional engagement organized, verified and on schedule.  

• Identify and assign specific individuals responsible for completing regulatory requirements. 
• Track progress and on-time completion of all regulatory requirements. 
• Verify that regulatory requirements have been acted upon within the organization. 
• Gauge and quantify potential areas of risk related to incomplete regulatory requirement assignments. 

Detailed reports equip compliance teams with oversight information they need to effectively communicate, act on, monitor, and focus organizational compliance efforts. 

Combine YouCompli solutions with the three best practices in this blog to build productive connections with Revenue and other departments.  

More Resources About Revenue Cycle Management and Compliance 

If you’re interested in learning more about the Revenue angle of healthcare compliance, here are a few additional resources: 

White Paper: Exploring the Four Hot Spots Of the Healthcare Revenue Cycle 

Case Study: Getting It Right: Minimizing Self-identified Overpayments & Maximizing Accurate Billing 

Tips and Tactics: Revenue Cycle Management Compliance: Ensuring Financial Health in Healthcare 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

The post Three Strategies to Align Compliance with Revenue Cycle  first appeared on YouCompli.