New compliance professionals benefit from a variety of resources to ramp up their knowledge and value. If you’re new to the healthcare compliance field (or know someone who is), save and share this article 

Getting Started for Early-Career Compliance Professionals 

The 20+ foundational resources that follow were curated from the YouCompli resource library. This set is tailored specifically for early-career compliance professionals. Start reading for ideas to build your: 

• Leadership skills 
• Operational credibility 
• Cross-departmental influence 

Read Expert-Sourced Content Designed for Professional Development 

Written for (and sometimes directly by) healthcare compliance executives, the information is practical and easy to understand. 

The articles focus on a variety of important topics: 

• Communication and Professional Growth for New Leaders 
• Operational and Audit Fundamentals for Building Compliance Expertise 
• Technology and Strategic Planning for Regulatory Change Management 
• Compliance Program Building and Oversight 
• Video Hub: Expert Guidance for Healthcare Compliance Professionals 
• Downloadable Tip Sheets for Quick Ideas and Actions 
   

Pick where you need help most today and dive in. (A few resources fall into multiple categories, so you get double the return when you read them.) 

Communication and Professional Growth for New Leaders 

From soft skills to dollar signs, these articles cover areas that sometimes get neglected in more formal compliance leader training. These expert resources cover aspects of compliance communications you might not find anywhere else. Learn about the persuasive communication skills that are the secret superpowers behind strong compliance leaders.  

Aggressive vs Assertive Communication: What New Healthcare Compliance Officers Need to Know  

Get advice tailored for new leaders on building authority and articulating compliance risks without creating unnecessary friction. New compliance executive can learn how to speak with authority and assertiveness without damaging cross-departmental relationships.  

This article covers:  

• Key differences between two common communication styles  
• How assertive communication benefits the compliance program  
• Strategies to help you master this skillset 

Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Being aware of how we do our own work is paramount for an effective compliance program and incorporating self-awareness into your healthcare compliance program can enhance its effectiveness. For example, it improves your ability to empathize with the challenges operational leaders face when adjusting a process to meet a regulatory requirement. To help build awareness, explore these 18 actionable tips for compliance officers. 

Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  

For effective healthcare compliance leaders, financial literacy isn’t optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  Explains key financial concepts so business newcomers can align compliance goals with executives’ organizational priorities.  

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.   

Operational and Audit Fundamentals for Building Compliance Expertise 

Business operations are essential partners in a good compliance program, and audits are foundational to healthcare compliance in those areas. These resources drill down into both, explaining how to reduce friction and frustration through proactive partnerships and education.  

Audit Readiness? How about Audit Etiquette?  

In this blog, experts offer the real scoop on audit readiness in healthcare. It outlines crucial operational protocols and relationship dynamics for leading teams through smooth, defensible audits. Learn the unfiltered truth about compliance audits and what audit etiquette means. Get essential tips on: 

• Preparing for audits 
• Role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• What does audit readiness mean? 

Healthcare Quality Leadership: How to Be an Operational Partner, Not a Roadblock  

In every organization, there’s a moment where the quality department becomes either the trusted operational partner or the operational roadblock. The difference between the two comes from how you communicate, assign responsibility and how you follow through. This blog explains how to adopt the OG style for more effective quality programs in healthcare, with “Three Ways to Partner like a Pro.” Direct the strategies that shift compliance from a gatekeeper to a strategic business enabler. 

Three Tips for Strong Compliance Education Practices  

Compliance orientation educates new staff members about company policies, procedures, and various regulations that govern their specific roles. Ongoing compliance training ensures that as regulations evolve, all employees are appropriately educated on implications and requirements. With its emphasis on risk management, compliance training protects both employees and organizations from legal and ethical pitfalls.  

A good understanding of compliance helps employees safeguard the company against lawsuits and reputational damage. Get core principles and three tips for clear, memorable staff training programs that drive actual behavioral change. Two experts – one in education and one in compliance – share advice and analogies to improve your compliance education practices.    

Technology and Strategic Planning for Regulatory Change Management 

Technology and strategy have a lot in common. We expect both to be versatile and responsive, while at the same time, they have to hold up and carry the organization over the long term. These selections explore ideas that will help novice leaders leverage technology to drive strategy and value.  

What to Look for in Regulatory Change Management Software for Healthcare Compliance 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation, dashboard details and insights into completed work. Get a practical checklist to help new leaders evaluate software capabilities for tool selection. Learn six non-negotiables for regulatory change management software and processes. 

AI Guide for Healthcare Compliance Leaders  

From Manual to Scalable: How to Manage Healthcare Compliance Risk 

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity. Updates are tracked. Summaries are circulated.  But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

From a systems-thinking perspective, this is a structural failure, not an execution problem.  In this piece, Lisa Estrada explores systems-thinking strategies to move beyond manual processes and build a scalable regulatory compliance process.  

Compliance Program Building and Oversight 

During your compliance career, you may have opportunities to build a program or at least manage one. Using the metrics and collaboration-building practices covered in these resources will set you on the path. 

5 Strategies for Compliance Accountability Across the Organization  

While supporting operational teams in finding compliant solutions is part of your role, becoming the de facto fixer of what constitutes “operationally friendly” is beyond your scope. That piece must be owned by operations.  The challenge becomes how to get operational leaders to take ownership to resolve their own compliance challenges. 

These five strategies will help you encourage your operational leaders to take responsibility for their particular compliance issues, while preserving your role as a trusted advisor. Respected compliance professional Jay Anstine outlines methods for instilling shared ownership of compliance requirements across clinical and administrative business units.  

Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track? 

How Slowing Down Makes for a More Productive Compliance Program  

As regulations change or investigations are needed, we often get pushed to work faster, meet tighter deadlines, and juggle multiple tasks simultaneously.  

While this approach might seem efficient on the surface, it often leads to serious downsides: 

• Burnout 
• Decreased productivity 
• Decline in the quality of work  

This interesting piece focuses on transitioning from reactive firefighting to building deliberate, repeatable compliance processes. You’ll get five solid tips to help you and your compliance team slow things down in a good way. 

Video Hub: Expert Guidance for Healthcare Compliance Professionals 

While we can’t go into all of them here, the YouCompli video library is packed with useful visual learning materials.  Explore the full catalog, featuring expert interviews and practical strategies. 

Real Conversations. Practical Compliance Insights. 

Where do you need ideas and advice? 

• Compliance Leadership & Mindset 
• Influence, Trust & Seat at the Table 
• Operationalizing Compliance  
• Efficiency, Clarity & Saving Time 
• Customer Perspectives & Real‑World Experience 

Hear directly from compliance leaders who understand the realities of the work. These short videos share honest perspectives on simplifying regulatory requirements, building trust with the business, and turning compliance into a strategic advantage. 

Downloadable Tip Sheets for Quick Ideas and Actions 

For the compliance leader on the go (isn’t that all of us?) the Tip Sheet Library offers quick, useful information. Explore the collection and start downloading tip sheets to start your own handy idea file. 

• Compliance Career Tips 
• Compliance Culture 
• Compliance & Business Strategy 
• Healthcare Quality 
• Industry Trends 
• Rev Cycle 
• Rules and Regulations 

Need More Specialized Support for Your Healthcare Compliance Program? 

Not only does YouCompli have educational resources to help compliance professionals, we also human resources who can help. If you’d like to speak to someone to answer any questions, just reach out. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Resources to Accelerate New Healthcare Compliance Careers  first appeared on YouCompli.

The HHS OIG recently released an audit report in which they concluded that for a recent one-year period, Medicare improperly paid physicians approximately $15.2 million for sacroiliac joint (SI) injections (see: https://oig.hhs.gov/reports/all/2026/medicare-improperly-paid-physicians-an-estimated-152-million-for-sacroiliac-joint-injections/).  

SI injections can help some patients improve their spinal mobility as well as relieve pain. Medicare covers these injections under certain conditions but not others. That’s where confusion can create painful compliance risks. 

Most Recent Audit in Series Related to Spinal Pain Management Services 

This was the most recent audit in a series of audits related to spinal pain management services which the OIG has been performing over many recent years.  

In prior audits of similar spinal services, the OIG found, for example, that Medicare improperly paid physicians for facet-joint interventions for more than 50 percent of sampled services that didn’t comply with one or more of the Medicare requirements:  

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-an-estimated-30-million-for-spinal-facet-joint-interventions/ 
• https://oig.hhs.gov/documents/audit/9596/A-09-20-03003-Complete%20Report.pdf 
• https://oig.hhs.gov/documents/audit/9602/A-09-20-03010-Complete%20Report.pdf  

They also reported finding improper payments associated with epidural steroid injections: 

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-for-epidural-steroid-injection-sessions/ 

Audits Continue in Therapeutic Spinal Pain 

In addition, last year, they published audit findings that said Medicare could have saved an estimated $17.7 Million if CMS oversight had prevented at-risk payments for anesthesia administered during spinal pain management procedures: 

• https://oig.hhs.gov/reports/all/2025/medicare-could-have-saved-an-estimated-177-million-if-cmss-oversight-had-prevented-at-risk-payments-for-anesthesia-administered-during-spinal-pain-management-procedures/  

Consequently, it should come as no surprise to healthcare compliance professionals that the audits in the therapeutic spinal pain space continue with the recent report about SI joint injections. 

Background on Crucial SI Joints 

The SI joints connect the lower portion of the spine to the pelvis. 

They support upper-body weight and play an important role in walking and changes in posture or position, such as moving from standing to sitting. These joints become painful for various reasons, including sacroiliac joint dysfunction, which occurs when the joint moves too much or too little, often due to injury, pregnancy or osteoarthritis.  

To improve movement and relieve lower back pain, a physician may administer an SI joint injection. A diagnostic injection is first used to determine whether the SI joint is the source of the pain. Significant immediate pain relief following the injection strongly suggests that the SI joint is responsible.  

(Image from page 2 of the OIG report) 

Once the SI joint is confirmed as the pain source, a therapeutic injection may be administered, with pain relief potentially lasting up to six months. 

How SI Joint Injections Are Covered 

Medicare Part B covers SI joint injections when medically reasonable and necessary. Five of seven Medicare Administrative Contractors (MACs) have local coverage determinations (LCDs) outlining requirements for  

• Pain indications 
• Imaging and pain assessment 
• Coverage limits  
• Diagnostic and therapeutic injections 

These LCDs limit coverage to two diagnostic and four therapeutic injection sessions within a rolling 12-month period, whether performed unilaterally or bilaterally.  

Billing and Coding for SI Joint Injection Procedures 

Each MAC also issued billing and coding guidance stating that physicians must add the “KX” modifier to each claim line for diagnostic injections to distinguish them from therapeutic injections. (Appendix C of the OIG Audit report summarizes the MACs, the states they cover, and the specific LCD number and LCD Reference article pertinent to their audit.) 

CPT code 27096 is used for injections made directly into the sacroiliac joint, while CPT code 64451 is used for injections targeting the nerves that innervate the sacroiliac joint. 

OIG Selects 100 Random Samples out of 186,000+ Procedural Sessions 

For the audit report, the OIG selected a random sample of 100 SI joint procedural sessions from a population of 186,842 sessions paid for by five MACs in a one-year period. They requested physicians’ supporting documentation to determine if the claims met Medicare requirements including LCD and LCD Reference Articles.   

Of the 100 sampled sessions, 28 complied with Medicare requirements, and 75 complied with Medicare billing guidance. However, the remaining 72 sessions didn’t comply with Medicare requirements, and 25 didn’t comply with Medicare billing guidance.  

Seventy-two sampled sessions didn’t comply with one or more of the requirements. The OIG report summarizes the noncompliant sessions by the type of noncompliance observed: 

(The total exceeds 72 sessions because 41 sessions had more than one deficiency.) 

Estimated Improper Payments of $15.2 Million in Sample Universe 

OIG then extrapolated their findings across the entire population of 186,842 sessions and calculated overpayments to determine their estimated improper payment amount of $15.2 million for the universe of sessions sampled for the one-year period. 

OIG found that although CMS had systems to identify some billing errors, it didn’t provide enough additional oversight or education to help physicians understand and follow Medicare requirements. CMS relied on MACs to educate physicians, but this wasn’t sufficient.  

As a result, some physicians may not have fully understood the requirements and billing rules. Physicians with billing errors said that more frequent and consistent training would have helped them understand the rules and avoid future errors. 

Other Improper Payments Assumed, Potentially Pushing Total Higher 

As mentioned, the sample universe of SI joint procedural sessions was limited to the five of the seven MACs that had issued LCDs. The other two MACs that didn’t have LCDs paid physicians $12.3 million for sacroiliac joint injection sessions. That accounts for approximately 36 percent of total Medicare payments for sacroiliac joint injections nationwide.   

Since these sessions were excluded from the audit, OIG wrote that this set of payments to physicians may also include improper payments. If true, the estimated $15.2 million in improper payments could potentially be higher. 

Four Areas of Noncompliance in SI Joint Injection Procedures 

Below are four categories of noncompliance and indications of unmet requirements: 

1 – Indications of Pain Requirements Not Met 

• At least three positive findings with provocative maneuvers 
• Low back pain below the L5 vertebra without radiculopathy 
• Low back pain that persists despite a minimum of four weeks of conservative therapies 
• Clinical findings and imaging studies that do not suggest any other diagnosed or obvious cause of the lumbosacral pain such as tumor and fracture 
• Low back pain for at least three months 
• Moderate to severe low back pain primarily experienced over the anatomical location of the sacroiliac joints between the upper level of the iliac crests and the gluteal fold 

2 – Imaging and Pain Assessments Requirements Not Met 

• The sacroiliac joint primary pain level must be measured prior to the injection at the beginning of the session. 
• The post procedure pain level must be measured at the end of the session. 
• The injections must be performed under computed tomography (CT) or fluoroscopy image guidance with contrast unless the patient has a documented contrast allergy so that ultrasound guidance without contrast may be considered. 

3 – Diagnostic or Therapeutic Sacroiliac Joint Injections Requirements Not Met 

• A diagnostic injection must have provided a minimum of 75 percent relief of primary pain before a therapeutic injection is administered 
• A subsequent therapeutic injection is not reasonable and necessary when the prior therapeutic injection did not result in at least 50 percent consistent pain relief or functional improvement for at least three months 

4 – Limitation of Coverage Requirements Not Met 

• Administer other musculoskeletal injections in the lumbosacral spine during the same session as sacroiliac joint injections 
• Perform multiple injections (e.g., epidural steroid injections, facet-joint injections, and trigger point injections) during the same session as sacroiliac joint injections and during the period when the physician is evaluating whether the injection reduced pain (i.e., efficacy assessment period) 

The Audit Details Smart Compliance Professionals Look For 

Like most medical claims’ audits, the “devil is in the details”. To avoid problems, wise compliance professionals will: 

1. Monitor the most recent LCDs from their MAC 
2. Maintain a process to review the LCDs and implement processes to ensure compliance 
3. Perform records audits for both coding and medical necessity  

Some coders might have the requisite medical knowledge to audit for medical necessity. However, it usually requires a clinical background as well as an understanding of Medicare billing requirements such as LCDs. 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Here are other resources to check out next: 

How to Avoid False Claims Related to Medical Necessity 

This expert blog gives compliance readers actionable steps to avoid civil monetary penalties and False Claims Act scrutiny resulting from documented medical necessity failures. 

Physician Coding and Billing Errors Enforcement: Compliance 

Get more context on enforcement actions stemming from unbundling, modifier misuse, and improper billing during same-day procedures. 

Know the Compliance Risk for Certain Anesthesia Services 

Learn about another recent OIG audit targeting spinal injection procedures and associated anesthesia/sedation coverage limitations. 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

The linked article specifically discusses how MAC LCDs define medical necessity (such as requiring four weeks of conservative therapy prior to approving spinal injections)

The post Don’t Let Pain Injections Cause Regulatory Compliance Pain  first appeared on YouCompli.

A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.

Compliance risks associated with medical necessity happen when providers fail to show clinical evidence that a service is essential for a patient’s health. This often leads to legal, financial and operational consequences. 

This article uses a specific example to explore the implications of medical necessity for healthcare systems. 

Recent False Claims Act Complaint Hinges on Medical Necessity  

Recently we wrote an introductory article discussing in general terms the compliance risks associated with medical necessity. That was first in a series on medical necessity. Now this article introduces a specific example.   

In this case, the U.S Department of Justice (DOJ) filed a False Claims Act complaint against a hospital group and three long-term care hospitals. They allege the False Claims Act was violated because some of the care provided (for which the hospital was reimbursed) wasn’t medically necessary. 

Three Ways Medical Necessity Impacts Performance 

Medical necessity remains a serious compliance risk for providers, including hospitals and health systems. It impacts these organizations in several significant ways: 

• Performance and Efficiency 
• Financial and Compliance Risk 
• Patient Outcomes and Quality 

1. Performance and Efficiency 

Administrative Burden: Research shows that “medical necessity” serves as a primary tool for allocating resources, but varying definitions across payers create administrative churn. Studies indicate that managing these requirements increases the revenue cycle workload, leading to delayed payments and reduced efficiency. 

Operational Streamlining: Conversely, some evidence suggests that when medical necessity is effectively operationalized (e.g., integrated into EHRs), it can increase the speed of diagnosis by eliminating redundant or non-essential tests.  

2. Financial and Compliance Risk 

Denial Management: A major area of study involves “medical necessity” as a driver of claim denials. Research by organizations like AAPC indicates that failure to validate medical necessity can lead to revenue loss, recoupments, and payer audits. 

Regulatory Exposure: Inadequate documentation of medical necessity is a leading cause of False Claims Act allegations, representing a high-stakes legal and compliance risk for health systems.  

3. Patient Outcomes and Quality 

Care Appropriateness: Studies suggest that medical necessity standards help align clinical care with evidence-based guidelines, which can improve patient safety by reducing exposure to unnecessary, potentially harmful procedures. 

Equity and Access: Research into determinants of health system performance warns that restrictive criteria can limit access to essential care for vulnerable populations if based on cost-containment instead of individual patient needs.  

Allege Longer Stays to Increase Medicare Reimbursement 

The example covered here reflects some of these negative impacts. In this False Claims case, the DOJ alleges that the hospitals held patients in the hospital longer than medically necessary in order to increase Medicare reimbursement.  

Long-term care hospitals (LTCHs) provide inpatient services for patients whose medically complex conditions require long hospital stays and programs of care. Medicare reimburses LTCHs based, in part, on a patient’s length of stay.   

By allegedly delaying discharge of certain patients, even when their course of treatment had been completed or when they could have been transferred to a lower level of care, the hospital received higher payments than they should have. 

The DOJ did not discover this issue on their own. The lawsuit was originally filed by a former employee of one of the hospitals through the qui tam or whistleblower provisions of the False Claims Act.  

How Internal Concerns Become Full-Blown Investigations 

Though allegations of medically unnecessary care may be a common reason such lawsuits are filed, understanding the details of a specific case is important.  

It can help compliance professionals see how concerns, potentially first reported internally, can develop into full blown investigations or additional complaints being filed with the court by the DOJ, as in this example. 

Manipulating Qualifying Patient Stays for Higher Reimbursement 

In the complaint, the DOJ alleges that the defendants illegally inflated their Medicare payments by holding patients who were ready for discharge until they reached a certain threshold date that, once reached, would trigger increased reimbursement.  

Certain Medicare patients who meet an average length of stay over the twenty-five days that LTCHs must maintain are referred to as a Qualifying Patient. The Government claimed the defendants also inappropriately held Qualifying Patients long enough to meet the 25-day average length of stay requirement to maintain their LTCH status and be paid at the higher LTCH rate.  

In the court document filed by the DOJ, it’s alleged that one executive told her employees, “No one is leaving early. We lose money.” Unfortunately, this wasn’t the only example of their alleged poorly handled medical necessity determinations. 

Ignored Alternatives Could Have Been Fraction of the Cost 

According to the complaint, many of these patients could have been discharged earlier and received care at home or in a nursing facility for a fraction of the cost to Medicare.   

The complaint also states that when employees raised concerns about the practices to one of its executives, the executive dismissed them, noting they would make money even if Medicare denied some medically unnecessary claims.  

Compliance Responsible for Appropriate Processes 

Compliance programs should ensure that appropriate processes exist to confirm the appropriate clinical criteria are met when it comes to admission and discharge actions.  According to the government, LTCHs specifically must have a documented process that: 

“screens patients prior to admission for appropriateness of admission to a long-term care hospital, validates within 48 hours of admission that patients meet admission criteria for long-term care hospitals, regularly evaluates patients throughout their stay for continuation of care in a long-term care hospital, and assesses the available discharge options when patients no longer meet such continued stay criteria.” 

The government states that in 2017, CMS observed that LTCHs appeared to be improperly holding patients beyond the key time threshold to obtain the full payment, which resulted in potentially improper delays in patient discharges other than solely for medical reasons.  

As a result, in fiscal year 2018, CMS revised the payment methodology to reduce LTCHs’ financial incentive to delay patient discharges until after the threshold. 

Example of Inappropriate Intent to Maximize Revenue 

The DOJ’s complaint contains statements that appear to imply they have emails or other documentation that show the intent to delay discharge. For example, an executive allegedly emailed a broad group of staff to praise them for getting “patients discharged on their correct discharge day to maximize our revenue.”   

Reportedly, the same executive also developed a bonus plan for a case manager in 2018 that required her to discharge 90 percent of patients on the “ideal discharge date” to receive a bonus. The ideal discharge date was a date calculated in a way (and reported on a dashboard) to lengthen the stay to meet higher reimbursement goals. 

Of course, the claims asserted in the complaint filed by the DOJ are allegations only.  However, most of the time the DOJ is not going to file a complaint if they do not believe they have or will obtain the evidence they need to either pursue the case further in court or lead to a mutually agreed upon financial settlement. 

Requirements for Medical Necessity Determinations 

Medical necessity determinations tend to be circumstance-specific. Auditing and monitoring for medical necessity will also typically require the involvement of a professional with clinical training or background.   

At times, it may be appropriate (if there are no conflicts of interest) to have a medical director from the organization be involved in such determinations. At other times, it may be a better idea to seek independent expertise from someone outside your organization. 

Learn from Examples of Medical Necessity Problems 

Watch for the next article in this series when we take another deep dive into an example of medical necessity in healthcare. In the meantime, browse these curated selections. 

Find More Advice and Ideas in These Related Articles 

• Introductory Article: Understanding Medical Necessity Compliance Risks The first post in this series, covering the foundational definitions and general compliance risks healthcare providers face today. 
• The False Claims Act: A Guide for Healthcare Leaders A deeper look into how inadequate documentation can trigger False Claims Act allegations and the resulting legal stakes for health systems. 
• Strategies for Reducing Claim Denials and Revenue Loss Practical insights into how medical necessity acts as a driver for claim denials and how to improve your revenue cycle workload. 
• Aligning Clinical Care with Evidence-Based Guidelines Learn how to leverage medical necessity standards to improve patient safety and ensure care appropriateness across your organization. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Compliance Risk Is Driven by Medical Necessity Problems  first appeared on YouCompli.

Six Capabilities Needed to Drive Scalable Change Management  

For healthcare compliance leaders, the challenge isn’t just lack of information. It’s a lack of time. 

When a new regulation or update is enacted, the clock starts ticking toward its inevitable effective date and another compliance deadline. Regulatory change management is a moving target with constant deadlines and uncertain task status. 

Without the right tools and systems, all that many compliance leaders can hope for is a link to a government website buried in your inbox from a listserv, or a lengthy regulation that needs reviewed to get started. 

That’s why a modern regulatory change management (RCM) system should do more than just notify you when regulatory changes occur.  

To be truly useful, RCM software needs to transform complex regulations into actionable tasks that clinical and administrative teams can execute without needing law degrees or spending a lot of time extracting all the need-to-implement details.  

Beyond the Regulation: 6 Non-Negotiables for Regulatory Change Management Software 

The shift from uncertainty and static reading material to active management and confident compliance is critical for any modern healthcare system. 

If you’re evaluating a regulatory change management (RCM) solution, look for these six essential capabilities to move your team from “reading” to “doing.” 

Top Requirements for Regulatory Change Management Processes: 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

2. Efficient Relevance Identification and Assessment Saves Time 

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

4. Workflow Accountability and Oversight for Defensible Audit Trail  

5. Proactive Notification and Escalation Reduce Manual Steps 

6. On-Demand Analytics and Reporting for Actionable Data 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

Many compliance solutions just offer a link to a government website. That’s not enough for healthcare teams that are already stretched and overworked. Asking a pharmacy director or a head of nursing to read a hundred-page statute on drug pedigree requirements isn’t a sustainable compliance strategy. 

Can It Do the Heavy Lifting? 

A true regulatory change management solution does the heavy lifting for you. A best-in-class solution provides not only the source regulations, but analysis for those regulatory changes relevant to your organization or department.  

This analysis serves as a bridge between the legal language of the regulators and the daily operations of the hospital. Model procedures outline updated provisions of regulatory changes, that is – the requirements, in an operational way.  

From “Legalese” to “Actionable” 

For instance, if a new rule regarding patient privacy in telehealth is released, your software shouldn’t just notify you of the change. The tool should provide a comprehensive overview of what’s included in those changes for you to operationalize. The overview provides all the need-to-know information combined with workflow to assign work and track that it gets done.  

By clearly presenting these tasks, the system reduces the cognitive load on your department heads and ensures nothing is overlooked in the transition from “legalese” to “actionable.” When your team knows exactly what they need to do, the risk of non-compliance drops significantly. 

2. Efficient Relevance Identification and Assessment Saves Time 

Not every regulatory change applies to every organization. Identifying if a regulation or part of one that applies to your organization can take time, resources, and effort to read and see if, how and what applies. A regulatory change management solution should facilitate identification of what’s relevant. Then you can put a quick focus on regulatory changes that specifically impact your organization.  

Capabilities That Reduce Effort Spent Reading Regulations 

Regulation Relevance Check: Your software should guide you through a relevance check and allow you to quickly (within a minute or less), identify if a regulation is relevant or not. 

The “Don’t Know” Button: If a user is unsure of how to answer a question to determine relevance, the software should provide the ability to assign questions to additional staff who have information needed to answer yes or no. Look for a workflow solution that allows you to reach out if you’re unsure of the answer. 

Once the subject matter expert provides their response, you decide if the requirement is relevant as assisted by the question tips. These walk you through the relevance decision-making process.  

The workflow process ends at Step One for requirements that aren’t relevant. It progresses to task assignment and review only for the regulatory work your organization actually needs to get done.  

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

In a busy health system, the person doing the work isn’t always the person who needs to verify that it was done. That creates blind spots and broken workflows. 

Regulatory change management (RCM) software avoids this by allowing you to: 

• Automate Assignments by Department: Assign requirements based on staff department (e.g., pharmacy, radiology, professional fee revenue cycle). 

• Differentiate Roles: Software distinguishes between an Assignee (the person doing the work) and a Monitor (the person providing oversight/cc’d). 

• Set Audit Trails: Every comment and status change should be time-stamped with the username to ensure a defensible record for future audits. 

RCM software reflects your organization’s reality through distinct user roles and automated workflows to them. These roles define who has the hands-on responsibility and who has oversight responsibility, creating a clear chain of command. 

The Role of the Monitor 

The monitor role is an essential feature of modern change management software. Think of this as a structured “cc” function. A department director might need to see that a change is occurring without being the one to upload proof of completion. This keeps leadership informed and accountable without cluttering their daily task lists.  

For instance, a Chief Nursing Officer might want to monitor the progress of a new patient safety protocol across multiple departments without being responsible for each individual task. This separation of duties is a hallmark of a mature compliance program. 

Smart Duplication for Scalable Efficiency 

Also look for “smart duplication” in regulatory change software. For example, if you manage five different hospitals, you shouldn’t have to manually create five identical tasks. An “Assign to All” feature lets you create unique, trackable requirements for each location simultaneously.  

Each hospital administrator receives their own task, but the corporate compliance office can see the progress of all five locations in a single view.  

This maintains centralized oversight while ensuring local accountability. This feature is particularly useful for large health systems that need consistency across dozens of locations and departments while allowing for local execution. 

4. Workflow Accountability and Oversight for Defensible Audit Trail 

The saying goes that if it wasn’t documented, it didn’t happen, and sometimes that applies to healthcare audits. An effective audit trail should be able to reconstruct the entire decision-making process for any given regulation. 

Your software shouldn’t just track completion status. It should capture the entire story of your compliance efforts, providing a clear path for auditors to follow.  

Centralized Commenting Backs Up Workflow Decisions 

Centralized commenting is a key part of a defensible audit trail. Compliance leaders can move away from fragmented check-in emails and internal chat threads. Instead, all discussions regarding a specific regulation live inside a dedicated task workspace.  

This creates a time-stamped, unalterable record of: 

• Who made decisions 
• What questions were asked 
• When work was completed 

If an auditor asks why a certain policy was changed six months ago, you can provide the exact thread of discussion that led to that decision. This level of transparency builds trust with regulators and simplifies the audit process. 

5. Proactive Notification and Escalation Reduce Manual Steps 

Compliance shouldn’t be a surprise. Proactive notification and escalation ensure that deadlines are known and met. A good compliance management system sends automated reminders well before an effective date passes.  

If a task remains untouched as a deadline approaches, the software should trigger a proactive escalation to supervisors. This ensures potential gaps are addressed before they become regulatory violations.  

Automated escalations remove the need for compliance officers to manually follow up with department heads, saving time and reducing friction between departments.  

Proactive Notifications Improve Efficiency 

A static dashboard is where compliance tasks go to die. Instead, look for a dynamic, proactive system that pushes information to your team. With email integration, direct links from an email notification take users straight to their requirement and task workspace in the software. 

6. On-Demand Analytics and Reporting for Actionable Data 

The Analytics Dashboard is designed for what healthcare compliance leaders need to see: 

• What’s overdue?  
• Where do I need to focus?  
• What do we need to do? 

With one click, see everything happening in the workflow, then export important information into spreadsheets or slides for sharing or presenting.  

The outcomes of using a dashboard to manage compliance workflow are: 

• Efficient, reliable access to real-time, high-quality data 
• Simplicity and ease of use save time 
• Visibility and transparency lead to peace of mind 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation for details of dashboard information and insights into completed work. 

Next Steps in Your Software Journey: Look for a Partner, Not a PDF Repository 

When evaluating software vendors, ask if the solution actually helps you do the work or does it just give you more things to read. The right regulatory change management software doesn’t stop at sending notifications of regulatory changes. Instead, it actively manages your workload.  

By prioritizing expert analysis, intelligent relevance filtering, and clear role definitions, a good software tool can move your compliance department from an underappreciated burden to a streamlined operational partner.  

A truly effective solution empowers your staff and provides peace of mind to executive leadership. The goal is a culture of compliance where every team member knows exactly what is expected of them and has the tools to achieve it. We share that goal. Reach out if you’d like to know what regulatory change management software can do for you. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post What to Look for in Regulatory Change Management Software for Healthcare Compliance  first appeared on YouCompli.

Ensuring medical necessity for services or supplies isn’t just about getting paid. It’s a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders. 

This is the first article in a series on medical necessity — an area that many compliance programs struggle with. In this piece, we explain the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems. 

Impact of Denial Rates and Medical Necessity on Payer Costs  

Data suggests that medical necessity is becoming a primary way for payers to manage costs, making it even more worthy of leadership attention. The “State of Claims 2025” Report found that 54% of providers agree claim denials are increasing faster than they can appeal. 

A data accuracy gap also contributes to the problem. Roughly 41% of healthcare organizations report at least 1 in 10 claims is denied, often due to “bad data” at intake or lack of clinical justification. 

All of this creates further justification for the need to better understand medical necessity from a compliance standpoint. 

Role of Clinician Review in Determining Medical Necessity 

Medical necessity isn’t an easy compliance risk to tackle, especially when OIG recommendations bump up against front-line reality. Sometimes, clinicians view medical necessity as their bailiwick.   

Of course, their expertise is the basis for medical decision making. Generally speaking, clinicians are making their decisions based on what they believe is medically necessary. They are the clinically trained professionals and should know when something is medically necessary or not, right?  

However, from a compliance standpoint, medical necessity often really means “covered” by a third-party payor. If something is considered “not medically necessary,” it may actually mean it does not meet payor coverage requirements. 

OIG on Clinical Review of Medical Necessity in Claims Audits 

In their General Compliance Program Guidance document (GCPG), the Department of Health and Human Services (HHS) Office of Inspector General (OIG) emphasized the importance of ensuring claims submitted to government payors are medically necessary. 

Specifically, they note:  

“Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Considerations for Compliance Risks in NCD and LCD 

Other entities have also emphasized medical necessity as coverage criteria. For example, Medicare publishes National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs). These are, in essence, coverage criteria for a specific service.  

Though generally accepted medical guidelines or medical practice may suggest a certain treatment plan is appropriate, the LCD might not cover the service for a particular condition or diagnosis or might not allow the service at a particular cadence or frequency. 

Example: Meeting LCDs for Pain Injection Procedures 

LCDs addressing pain injection procedures are a good example of this. A Medicare LCD might state that before Medicare considers a spinal injection “medically necessary” (think “covered”), the patient needs to have failed four months of conservative therapy (e.g., lifestyle changes, physical therapy, etc.)   

Or the LCD might state a total of four injections in a twelve-month period is the maximum number of injections they will allow. Additionally, an LCD might require that a patient has a certain condition (represented by an ICD-10 or diagnosis code i.e., diagnosis code) before considering a service covered.   

There is potential compliance risk in all these areas if coverage criteria are not met and documented in the medical record or if codes are reported to ensure coverage, but the medical record does not support the diagnosis code reported. 

Overlap with Patient Safety 

Medical necessity can also overlap with patient safety issues. If a physician exaggerates the severity of a condition to make it look like the services should be covered, a patient could undergo a procedure that was not appropriate or medically necessary to perform in the first place.  

This raises patient safety issues for subjecting a patient to certain risks when the service does not appropriately meet clinical standards or indications for performance. 

How Medical Necessity Compliance Is Enforced 

The government utilizes various tools for enforcing medical necessity compliance.  These include the False Claims Act (FCA), typically used by the U.S. Department of Justice (DOJ), and the Civil Monetary Penalties Law (CMPL) utilized by the OIG. 

The DOJ can investigate allegations of medically unnecessary services when credible information is brought to its attention by whistleblowers (qui tam relators). A qui tam relator is a private individual or entity who files a lawsuit on behalf of the government under the FCA against companies or individuals committing fraud. Or the DOJ can investigate on their own, typically because of data analytics they proactively perform. 

How OIG Pursues Financial Penalties and Program Exclusion 

The OIG is authorized to pursue monetary penalties and exclusion through a variety of civil authorities, most notably the CMPL. Under the CMPL, OIG can seek assessments in lieu of damages, Civil Monetary Penalties (CMP), and exclusion from participation in federal health care programs.   

According to the OIG, one example of conduct that could lead to CMP liability is presenting a claim for a pattern of medical or other items or services that a person knows or should know are not medically necessary. 

Medical Necessity Risk Tied to Clinical Services 

There isn’t a one-size-fits-all risk profile when it comes to medical necessity. Each organization’s risk is going to be tied to the clinical services it offers or orders. Organizations and their compliance programs should undertake risk assessments tailored to their particular situation.  

Via the GCPG document, the OIG recommends that when conducting risk assessments, organizations should “ensure that medical necessity, patient safety, and other quality compliance issues are included in the risk universe.” 

Download Tip Sheet

Coming Articles: Details of Recent Enforcement Actions 

In subsequent articles in this series, we’ll take a closer look at the details of recent enforcement actions involving allegations that submitted claims lacked medical necessity. This information will help compliance leaders stay on top of situations and reduce risks in their own organizations.  

Read Part Two Here

About the Author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 27 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Medical Necessity: A Guide for Healthcare Compliance Leaders  first appeared on YouCompli.

Why Managing Compliance Risk Is Like Eating Spinach 

The overwhelming pace and complexity of healthcare regulatory change have become so routine that the constant grind now poses a distinct compliance risk to the organization it’s intended to protect. 

Yet, many hospitals still treat regulatory change as a routine monitoring activity, failing to adopt the systems thinking and discipline necessary to truly mitigate the risk.  

This article by a top healthcare compliance expert explains what it takes to make that transformation. (She also explains what spinach has in common with compliance risk assessment.) 

Beyond Spinach: A Systems Thinking View of Regulatory Change  

’Tis the season! Compliance risk assessment season, that is.  

Many healthcare organizations are in the middle of this annual “eat your spinach” preventative exercise, with compliance folks wandering the halls asking executives what keeps them up at night.  

This year, a CFO for one of my hospital clients raised a significant risk that is so ever-present it’s often treated as a constant rather than a risk. The pace and complexity of regulatory change in healthcare are so familiar that they’re easy to overlook as a distinct risk.  

Regulatory Change Complexity as Permanent Risk  

For those who do recognize and record risk, this one almost certainly hits near the top of the scoring index. Regulatory change in healthcare isn’t an occasional disruption. It’s a permanent condition of the operating environment.  

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity rather than applying systems thinking. Updates are tracked. Summaries are circulated.  

But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

Systems Thinking Brings Structure to Reducing Compliance Risk 

From a systems-thinking perspective, this is a structural failure, not an execution problem.  

A persistent, high-scoring risk should not rely on individual effort, institutional memory, or ad hoc judgment calls to be managed effectively. It should be supported by infrastructure that reliably converts inputs into outputs.  

In this case, the input is regulatory change. The needed outputs are: 

• Applicability analysis 
• Operational decisions 
• Documented rationale 
• Accountable follow-through 

Failing to Operationalize Compliance Leaves You Open to Risk 

That’s where many regulatory compliance programs feel the strain. The risk isn’t failing to notice regulatory change. The risk is failing to operationalize it in a consistent, defensible way, especially across multiple departments, leaders, and decision points.  

From Effort-Based Compliance to System-Based Compliance 

Coming out of risk assessment season, this creates an opportunity to ask a more fundamental question: Do we actually have a system for managing regulatory change, or do we just know it’s a problem?  

Seen this way, the value isn’t the technology itself. It’s the shift from effort-based compliance to system-based compliance. And with systems and technology, you can do all this in a way that is repeatable and reviewable.  

In short, “eating your spinach” and doing annual assessments is good discipline. Relying on systems is how you stay healthy the rest of the time.  

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post From Manual to Scalable: How to Manage Healthcare Compliance Risk  first appeared on YouCompli.

It amazes us how many healthcare facilities don’t always store records appropriately. Check that. People don’t store records properly.  

Just this week, I was in a colleague’s office. Literally, it looked like Staples puked up aisle 3. I asked her what everything was, because you couldn’t make heads or tails of any of it. She explained that it was patient records that she didn’t know what to do with.  

I asked her, “Well, what does the process say to do?”  

“Process?” she said. Nice girl, means well, greener than a pepper tree.  

After helping her re-organize everything, I was motivated to put together some ideas to help others in her situation. Here are some record retention best practices in the event you have hoarded up some claptrap and now have to figure out what to do with it.  

What Records Do You Have? Archival or Data? 

First step, take an assessment of everything you have. Samples? Materials? Records?  

Archival storage should be for all original records, including source data and metadata, which are generated, recorded, calculated or transcribed at the time of an activity. This data allows full and complete reconstruction and evaluation of the activity.  

Data storage may be written, printed electronically, scanned image, photographic, or other form for later reference. Raw data obtained from measurement, testing, processing, direct observation or computer, and instrument printouts should be represented exactly as captured at its source without transformation, aggregation or calculation.  

Responsible Parties and Retention Periods 

All personnel should be responsible for handling, submitting or returning records to the archive in the same conditions in which they were found.  

Keep in mind that different items are governed by different regulations, so you need to check retention periods. The retention period begins when all work with samples or records is complete. Specified retention periods supersede any other retention requirements unless explicitly noted. 

Factors Influencing Retention Period Requirements 

• State and federal laws: State laws are the primary source for retention periods, which can range from three to over ten years. Federal laws, like those from CMS for Medicare, may also have specific requirements.  
• Patient age: Records for minors often require longer retention periods, usually extending past the age of majority.  
• Type of record: Different types of records can have different retention requirements. For instance, some states require longer retention for certain records like mammography images.  
• Legal and regulatory changes: Laws and regulations can change, so it’s important to stay updated on current requirements. 

Scope of Work in Healthcare Records Retention Process 

Generally, quality or project management takes the lead on records retention. The scope of work involves: 

• Archiving, filing, retaining, organizing and retrieving records 
• Maintaining security and integrity of records in archives if stored on-site 
• Collecting and cataloging records, including: 
• Assigning archival numbers 
• Preparing archive labels, updates to archival forms 
• Making copies of any supporting electronic data  
• Handling off-site storage as applicable.  

On-Site and Off-Site Record Storage Locations 

For healthcare records, you have two storage choices: on-site or off-site.  

If you store records on-site, storage must be access-controlled, and all records must be stored appropriately to ensure integrity and preservation, minimize deterioration and facilitate timely retrieval. All original paper records should be stored in secure, fireproof filing cabinets or appropriate containers, like folders, binders, weather-proof envelopes, cases or boxes. 

If you decide to store records off-site, make sure to use a qualified contractor specializing in off-site medical records storage. Quality should be involved in sending records off-site. All records should be assigned a unique number or other appropriate identifiers which your site must maintain.  

Records should be sent off-site appropriately grouped by record type. This is important because at some point, you might need to retrieve them. And you generally don’t have much notice to retrieve something. It’s generally an immediate need or within 24-48 hours, so if you don’t know where the records are or how they are organized, you won’t be able to produce them as you need to. That’s a problem.  

General Guidelines to Reduce Risk in Records Retention 

Healthcare record retention is governed by federal and state laws, requiring that records be kept for a specific period for patient access, legal protection, and compliance.  

Your organization should operate under the basic requirements for retaining records unless otherwise specified. Use these general guidelines to ensure your processes are set up for retention compliance: 

• Without a specified retention period, a minimum period of 10 years should be used.  
• Once the defined retention period is reached, samples and records may continue to be maintained, returned, transferred to the appropriate owner, or destroyed.  
• Do not destroy anything without appropriate approval from the functional owner.  
• Record destruction must be appropriately documented to denote the end of the life cycle. 

What’s Your Next Step? 

When you have these processes and practices in place, records retention will be a lot more efficient and a lot less stressful.  

Want more ideas for optimizing compliance and quality? You’ll find guidance in these popular articles. 

• Four Ways to Integrate Compliance with Safety/Quality Efforts 
• Best Practices for Better Training in Healthcare Compliance
• Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Andrea has taught first grade in Willoughby, Ohio for 27 years in the same classroom that she attended school as a child. She earned a Bachelor of Science in elementary education with a minor in language arts from John Carroll University and a Master’s Degree in the Art of Teaching and Education from Marygrove College. 

John builds and fixes quality departments, while currently thriving as the Administrator & Director of Quality, Risk Management and Compliance at River Vista, a behavioral hospital in Columbus, Ohio.

---

The Q-Kids – John R Nocero and Andrea L Bordonaro – are experts at everything quality, regulatory, education training and compliance and love sharing their knowledge on YouCompli.

Follow them on LinkedIn – for more quality content or send them a message – they’d love to hear from you.

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Hoarders Need Borders: Quality’s Role in Healthcare Record Storage  first appeared on YouCompli.

Many compliance professionals rely on HHS OIG focus areas as they perform risk assessments and plan subsequent auditing and monitoring activities. In November 2024, the OIG added an item to their Work Plan describing their intention to review Medicare Part B payments for skin substitutes.  

More recently, in September of 2025, the OIG published a data snapshot report that concluded Medicare Part B payment trends for skin substitutes raise major concerns about fraud, waste and abuse.  

This blog explores the implications for compliance and what health systems need to be aware of.  

How Skin Substitutes Are Covered Currently 

Skin substitutes aid in wound healing and redevelopment of skin. Medicare covers skin substitutes that are reasonable and necessary for the treatment of an enrollee’s condition. Local coverage determinations state that Medicare Part B generally covers skin substitutes for treatment of diabetic foot ulcers and venous leg ulcers that have failed to respond to at least four weeks of standard wound care.  

However, no national or local coverage requirements apply for other wound types (e.g., pressure ulcers or trauma wounds), and coverage of skin substitutes for these wounds is determined on a case-by-case basis.  

How Medicare Pays for Skin Substitutes 

Medicare Part B pays for skin substitutes based on the number of service units billed at prices ranging from approximately $100 to more than $1,000 per square centimeter.  

For payment purposes, CMS treats skin substitutes like approved prescription biologics, and skin substitutes are reimbursed in non-institutional Part B settings at 106% of the average sales price (ASP).  ASP Refers to the average price of a drug sold to providers, and it’s used for calculating reimbursement rates.  

From calendar years 2020 through 2023, Medicare Part B payments for skin substitutes increased substantially. In two years, Part B spending on skin substitutes increased 640%, going from $389 million (Q3 2022) to $2.88 billion (Q3 2024). 

What Drives Increases in Skin Substitute Pricing and Utilization? 

The rapid growth in expenditure is driven by both higher prices and increased utilization, and the OIG found concerning trends in both areas. 

Higher Prices Driven by ASP and Incentives 

Some of the factors potentially increasing prices include the ASP and incentives for providers. Manufacturers of skin substitutes can quickly bring new skin substitutes to market compared to typical products paid using ASP.  

By statute, ASP is defined as a manufacturer’s sales of a drug to all purchasers in the United States in a calendar quarter (net of most discounts) divided by the total number of units of the drug sold by the manufacturer in that same quarter. 

Calculating Payments for Billing Codes 

Manufacturers are required to report the ASPs and total sales volume for each of their Part B drugs to CMS within 30 days of the end of every quarter. CMS then uses this data to calculate a payment amount for the billing code representing the drug.  

Because different versions (i.e., dosage amounts, package sizes) of a drug may be included within the same billing code, CMS calculates an overall volume-weighted ASP for the code using the manufacturer-reported sales data. By statute, Part B payment is set at 106% of the volume-weighted ASP.  

In cases in which CMS is unable to calculate a volume-weighted ASP for a code (e.g., a new code for which ASPs have yet to be reported), Medicare Part B contractors typically use Wholesale Acquisition Costs, aka WACs (i.e., list prices) or payment invoices to determine a payment amount.  

Providers Seek More Favorable Payments Based on Spread 

Allowing for the time it takes for manufacturer price reporting and the subsequent CMS validation and calculations, there is a two-quarter lag in the ASP-payment process (e.g., first-quarter 2024 ASPs were used as the basis for third-quarter 2024 payment amounts). 

Part B providers can retain the “spread” between their acquisition cost for a drug and the Medicare payment amount. Previous OIG work found that higher spreads may correlate with increased utilization for certain drugs.  

Under the current payment system, Medicare often pays providers for skin substitutes at amounts much higher than providers’ purchase prices, and providers keep the “spread.” This creates incentives to bill for more and more units of skin substitutes and to choose products with the greatest spreads – the same types of billing trends highlighted in the OIG’s report. 

Increased Utilization Has Average Part B Payment Up 153% 

Utilization of skin substitutes has also increased steadily, with more enrollees having skin substitute claims and a higher number of units being billed per enrollee. OIG found that between the first quarter of 2023 and the third quarter of 2024: 

• Number of unique Part B enrollees with skin substitute claim increased by 53%. 
• Total number of units paid under Part B increased by 83%. 
• Average Part B payment amount for each unit of skin substitute increased by 153%. 

In less than two years, the amount paid per Part B enrollee has tripled from $40,051 to $121,501. 

28% Growth in Utilization and Payments in Home Care Settings 

The OIG also found the growth of skin substitute utilization and payments in the home care setting to be particularly notable. By the third quarter of 2024, 28% of enrollees with a paid skin substitute claim under Part B were reportedly being treated in their home. These home care enrollees accounted for more than half of Part B spending on skin substitutes that quarter. 

They also noted that utilization and expenditures for skin substitutes under Medicare Advantage (MA) are just a fraction of utilization and expenditures under original Medicare.   

For example, in the third quarter of 2024, OIG found that only 3,800 Medicare Advantage enrollees were associated with a skin substitute claim, compared to 24,000 enrollees in Part B.  

OIG concluded there were no obvious differences in the enrollee demographics of original Medicare and Medicare Advantage that would explain the massive variance in skin substitute utilization.  

Instead, they suggested variance is likely driven by MA plans’ ability to use numerous reimbursement and utilization management tools to set payment rates and coverage for products such as skin substitutes. 

Urgent Action Needed to Rein in Spending Increases and Fraud 

Based on their data snapshot report, the OIG concluded that action is urgently needed to rein in the massive increases in Medicare Part B spending for skin substitutes in non-institutional settings. They also cited numerous fraud schemes involving skin substitutes. 

Compliance professionals should make sure they are considering their organization’s use of skin substitutes and determine if there are existing risks. If so, they should monitor and audit their organization’s use of skin substitutes to ensure compliance. 

More Resources on Compliance Risk 

Know the Compliance Risk for Certain Anesthesia Services 

A good healthcare compliance program is all about reducing risk, both in patient care and in financial reimbursement. This detailed blog by compliance expert, CJ Wolf, will bring you up to date on the compliance risks associated with certain anesthesia services.   

How to Avoid Compliance Risk in Peripheral Vascular Reimbursement   

Peripheral vascular disease (PVD) reimbursement is fraught with potential compliance pitfalls. This expert-written blog addresses the pressing concern of compliance risks in PVD reimbursement. It provides insights into regulatory trends, recent investigations and best practices. 

Exclusion Screening Failure Causes Compliance Nightmare 

Even a seemingly small glitch can have major consequences for healthcare compliance. This blog shares the story of the consequences of an incident when exclusion screening software glitched. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post OIG Cites Fraud, Waste and Abuse Concerns with Skin Substitutes  first appeared on YouCompli.