Six Capabilities Needed to Drive Scalable Change Management  

For healthcare compliance leaders, the challenge isn’t just lack of information. It’s a lack of time. 

When a new regulation or update is enacted, the clock starts ticking toward its inevitable effective date and another compliance deadline. Regulatory change management is a moving target with constant deadlines and uncertain task status. 

Without the right tools and systems, all that many compliance leaders can hope for is a link to a government website buried in your inbox from a listserv, or a lengthy regulation that needs reviewed to get started. 

That’s why a modern regulatory change management (RCM) system should do more than just notify you when regulatory changes occur.  

To be truly useful, RCM software needs to transform complex regulations into actionable tasks that clinical and administrative teams can execute without needing law degrees or spending a lot of time extracting all the need-to-implement details.  

Beyond the Regulation: 6 Non-Negotiables for Regulatory Change Management Software 

The shift from uncertainty and static reading material to active management and confident compliance is critical for any modern healthcare system. 

If you’re evaluating a regulatory change management (RCM) solution, look for these six essential capabilities to move your team from “reading” to “doing.” 

Top Requirements for Regulatory Change Management Processes: 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

2. Efficient Relevance Identification and Assessment Saves Time 

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

4. Workflow Accountability and Oversight for Defensible Audit Trail  

5. Proactive Notification and Escalation Reduce Manual Steps 

6. On-Demand Analytics and Reporting for Actionable Data 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

Many compliance solutions just offer a link to a government website. That’s not enough for healthcare teams that are already stretched and overworked. Asking a pharmacy director or a head of nursing to read a hundred-page statute on drug pedigree requirements isn’t a sustainable compliance strategy. 

Can It Do the Heavy Lifting? 

A true regulatory change management solution does the heavy lifting for you. A best-in-class solution provides not only the source regulations, but analysis for those regulatory changes relevant to your organization or department.  

This analysis serves as a bridge between the legal language of the regulators and the daily operations of the hospital. Model procedures outline updated provisions of regulatory changes, that is – the requirements, in an operational way.  

From “Legalese” to “Actionable” 

For instance, if a new rule regarding patient privacy in telehealth is released, your software shouldn’t just notify you of the change. The tool should provide a comprehensive overview of what’s included in those changes for you to operationalize. The overview provides all the need-to-know information combined with workflow to assign work and track that it gets done.  

By clearly presenting these tasks, the system reduces the cognitive load on your department heads and ensures nothing is overlooked in the transition from “legalese” to “actionable.” When your team knows exactly what they need to do, the risk of non-compliance drops significantly. 

2. Efficient Relevance Identification and Assessment Saves Time 

Not every regulatory change applies to every organization. Identifying if a regulation or part of one that applies to your organization can take time, resources, and effort to read and see if, how and what applies. A regulatory change management solution should facilitate identification of what’s relevant. Then you can put a quick focus on regulatory changes that specifically impact your organization.  

Capabilities That Reduce Effort Spent Reading Regulations 

Regulation Relevance Check: Your software should guide you through a relevance check and allow you to quickly (within a minute or less), identify if a regulation is relevant or not. 

The “Don’t Know” Button: If a user is unsure of how to answer a question to determine relevance, the software should provide the ability to assign questions to additional staff who have information needed to answer yes or no. Look for a workflow solution that allows you to reach out if you’re unsure of the answer. 

Once the subject matter expert provides their response, you decide if the requirement is relevant as assisted by the question tips. These walk you through the relevance decision-making process.  

The workflow process ends at Step One for requirements that aren’t relevant. It progresses to task assignment and review only for the regulatory work your organization actually needs to get done.  

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

In a busy health system, the person doing the work isn’t always the person who needs to verify that it was done. That creates blind spots and broken workflows. 

Regulatory change management (RCM) software avoids this by allowing you to: 

• Automate Assignments by Department: Assign requirements based on staff department (e.g., pharmacy, radiology, professional fee revenue cycle). 

• Differentiate Roles: Software distinguishes between an Assignee (the person doing the work) and a Monitor (the person providing oversight/cc’d). 

• Set Audit Trails: Every comment and status change should be time-stamped with the username to ensure a defensible record for future audits. 

RCM software reflects your organization’s reality through distinct user roles and automated workflows to them. These roles define who has the hands-on responsibility and who has oversight responsibility, creating a clear chain of command. 

The Role of the Monitor 

The monitor role is an essential feature of modern change management software. Think of this as a structured “cc” function. A department director might need to see that a change is occurring without being the one to upload proof of completion. This keeps leadership informed and accountable without cluttering their daily task lists.  

For instance, a Chief Nursing Officer might want to monitor the progress of a new patient safety protocol across multiple departments without being responsible for each individual task. This separation of duties is a hallmark of a mature compliance program. 

Smart Duplication for Scalable Efficiency 

Also look for “smart duplication” in regulatory change software. For example, if you manage five different hospitals, you shouldn’t have to manually create five identical tasks. An “Assign to All” feature lets you create unique, trackable requirements for each location simultaneously.  

Each hospital administrator receives their own task, but the corporate compliance office can see the progress of all five locations in a single view.  

This maintains centralized oversight while ensuring local accountability. This feature is particularly useful for large health systems that need consistency across dozens of locations and departments while allowing for local execution. 

4. Workflow Accountability and Oversight for Defensible Audit Trail 

The saying goes that if it wasn’t documented, it didn’t happen, and sometimes that applies to healthcare audits. An effective audit trail should be able to reconstruct the entire decision-making process for any given regulation. 

Your software shouldn’t just track completion status. It should capture the entire story of your compliance efforts, providing a clear path for auditors to follow.  

Centralized Commenting Backs Up Workflow Decisions 

Centralized commenting is a key part of a defensible audit trail. Compliance leaders can move away from fragmented check-in emails and internal chat threads. Instead, all discussions regarding a specific regulation live inside a dedicated task workspace.  

This creates a time-stamped, unalterable record of: 

• Who made decisions 
• What questions were asked 
• When work was completed 

If an auditor asks why a certain policy was changed six months ago, you can provide the exact thread of discussion that led to that decision. This level of transparency builds trust with regulators and simplifies the audit process. 

5. Proactive Notification and Escalation Reduce Manual Steps 

Compliance shouldn’t be a surprise. Proactive notification and escalation ensure that deadlines are known and met. A good compliance management system sends automated reminders well before an effective date passes.  

If a task remains untouched as a deadline approaches, the software should trigger a proactive escalation to supervisors. This ensures potential gaps are addressed before they become regulatory violations.  

Automated escalations remove the need for compliance officers to manually follow up with department heads, saving time and reducing friction between departments.  

Proactive Notifications Improve Efficiency 

A static dashboard is where compliance tasks go to die. Instead, look for a dynamic, proactive system that pushes information to your team. With email integration, direct links from an email notification take users straight to their requirement and task workspace in the software. 

6. On-Demand Analytics and Reporting for Actionable Data 

The Analytics Dashboard is designed for what healthcare compliance leaders need to see: 

• What’s overdue?  
• Where do I need to focus?  
• What do we need to do? 

With one click, see everything happening in the workflow, then export important information into spreadsheets or slides for sharing or presenting.  

The outcomes of using a dashboard to manage compliance workflow are: 

• Efficient, reliable access to real-time, high-quality data 
• Simplicity and ease of use save time 
• Visibility and transparency lead to peace of mind 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation for details of dashboard information and insights into completed work. 

Next Steps in Your Software Journey: Look for a Partner, Not a PDF Repository 

When evaluating software vendors, ask if the solution actually helps you do the work or does it just give you more things to read. The right regulatory change management software doesn’t stop at sending notifications of regulatory changes. Instead, it actively manages your workload.  

By prioritizing expert analysis, intelligent relevance filtering, and clear role definitions, a good software tool can move your compliance department from an underappreciated burden to a streamlined operational partner.  

A truly effective solution empowers your staff and provides peace of mind to executive leadership. The goal is a culture of compliance where every team member knows exactly what is expected of them and has the tools to achieve it. We share that goal. Reach out if you’d like to know what regulatory change management software can do for you. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post What to Look for in Regulatory Change Management Software for Healthcare Compliance  first appeared on YouCompli.

Ensuring medical necessity for services or supplies isn’t just about getting paid. It’s a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders. 

This is the first article in a series on medical necessity — an area that many compliance programs struggle with. In this piece, we explain the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems. 

Impact of Denial Rates and Medical Necessity on Payer Costs  

Data suggests that medical necessity is becoming a primary way for payers to manage costs, making it even more worthy of leadership attention. The “State of Claims 2025” Report found that 54% of providers agree claim denials are increasing faster than they can appeal. 

A data accuracy gap also contributes to the problem. Roughly 41% of healthcare organizations report at least 1 in 10 claims is denied, often due to “bad data” at intake or lack of clinical justification. 

All of this creates further justification for the need to better understand medical necessity from a compliance standpoint. 

Role of Clinician Review in Determining Medical Necessity 

Medical necessity isn’t an easy compliance risk to tackle, especially when OIG recommendations bump up against front-line reality. Sometimes, clinicians view medical necessity as their bailiwick.   

Of course, their expertise is the basis for medical decision making. Generally speaking, clinicians are making their decisions based on what they believe is medically necessary. They are the clinically trained professionals and should know when something is medically necessary or not, right?  

However, from a compliance standpoint, medical necessity often really means “covered” by a third-party payor. If something is considered “not medically necessary,” it may actually mean it does not meet payor coverage requirements. 

OIG on Clinical Review of Medical Necessity in Claims Audits 

In their General Compliance Program Guidance document (GCPG), the Department of Health and Human Services (HHS) Office of Inspector General (OIG) emphasized the importance of ensuring claims submitted to government payors are medically necessary. 

Specifically, they note:  

“Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Considerations for Compliance Risks in NCD and LCD 

Other entities have also emphasized medical necessity as coverage criteria. For example, Medicare publishes National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs). These are, in essence, coverage criteria for a specific service.  

Though generally accepted medical guidelines or medical practice may suggest a certain treatment plan is appropriate, the LCD might not cover the service for a particular condition or diagnosis or might not allow the service at a particular cadence or frequency. 

Example: Meeting LCDs for Pain Injection Procedures 

LCDs addressing pain injection procedures are a good example of this. A Medicare LCD might state that before Medicare considers a spinal injection “medically necessary” (think “covered”), the patient needs to have failed four months of conservative therapy (e.g., lifestyle changes, physical therapy, etc.)   

Or the LCD might state a total of four injections in a twelve-month period is the maximum number of injections they will allow. Additionally, an LCD might require that a patient has a certain condition (represented by an ICD-10 or diagnosis code i.e., diagnosis code) before considering a service covered.   

There is potential compliance risk in all these areas if coverage criteria are not met and documented in the medical record or if codes are reported to ensure coverage, but the medical record does not support the diagnosis code reported. 

Overlap with Patient Safety 

Medical necessity can also overlap with patient safety issues. If a physician exaggerates the severity of a condition to make it look like the services should be covered, a patient could undergo a procedure that was not appropriate or medically necessary to perform in the first place.  

This raises patient safety issues for subjecting a patient to certain risks when the service does not appropriately meet clinical standards or indications for performance. 

How Medical Necessity Compliance Is Enforced 

The government utilizes various tools for enforcing medical necessity compliance.  These include the False Claims Act (FCA), typically used by the U.S. Department of Justice (DOJ), and the Civil Monetary Penalties Law (CMPL) utilized by the OIG. 

The DOJ can investigate allegations of medically unnecessary services when credible information is brought to its attention by whistleblowers (qui tam relators). A qui tam relator is a private individual or entity who files a lawsuit on behalf of the government under the FCA against companies or individuals committing fraud. Or the DOJ can investigate on their own, typically because of data analytics they proactively perform. 

How OIG Pursues Financial Penalties and Program Exclusion 

The OIG is authorized to pursue monetary penalties and exclusion through a variety of civil authorities, most notably the CMPL. Under the CMPL, OIG can seek assessments in lieu of damages, Civil Monetary Penalties (CMP), and exclusion from participation in federal health care programs.   

According to the OIG, one example of conduct that could lead to CMP liability is presenting a claim for a pattern of medical or other items or services that a person knows or should know are not medically necessary. 

Medical Necessity Risk Tied to Clinical Services 

There isn’t a one-size-fits-all risk profile when it comes to medical necessity. Each organization’s risk is going to be tied to the clinical services it offers or orders. Organizations and their compliance programs should undertake risk assessments tailored to their particular situation.  

Via the GCPG document, the OIG recommends that when conducting risk assessments, organizations should “ensure that medical necessity, patient safety, and other quality compliance issues are included in the risk universe.” 

Download Tip Sheet

Coming Articles: Details of Recent Enforcement Actions 

In subsequent articles in this series, we’ll take a closer look at the details of recent enforcement actions involving allegations that submitted claims lacked medical necessity. This information will help compliance leaders stay on top of situations and reduce risks in their own organizations.  

About the Author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 27 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Medical Necessity: A Guide for Healthcare Compliance Leaders  first appeared on YouCompli.

Why Managing Compliance Risk Is Like Eating Spinach 

The overwhelming pace and complexity of healthcare regulatory change have become so routine that the constant grind now poses a distinct compliance risk to the organization it’s intended to protect. 

Yet, many hospitals still treat regulatory change as a routine monitoring activity, failing to adopt the systems thinking and discipline necessary to truly mitigate the risk.  

This article by a top healthcare compliance expert explains what it takes to make that transformation. (She also explains what spinach has in common with compliance risk assessment.) 

Beyond Spinach: A Systems Thinking View of Regulatory Change  

’Tis the season! Compliance risk assessment season, that is.  

Many healthcare organizations are in the middle of this annual “eat your spinach” preventative exercise, with compliance folks wandering the halls asking executives what keeps them up at night.  

This year, a CFO for one of my hospital clients raised a significant risk that is so ever-present it’s often treated as a constant rather than a risk. The pace and complexity of regulatory change in healthcare are so familiar that they’re easy to overlook as a distinct risk.  

Regulatory Change Complexity as Permanent Risk  

For those who do recognize and record risk, this one almost certainly hits near the top of the scoring index. Regulatory change in healthcare isn’t an occasional disruption. It’s a permanent condition of the operating environment.  

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity rather than applying systems thinking. Updates are tracked. Summaries are circulated.  

But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

Systems Thinking Brings Structure to Reducing Compliance Risk 

From a systems-thinking perspective, this is a structural failure, not an execution problem.  

A persistent, high-scoring risk should not rely on individual effort, institutional memory, or ad hoc judgment calls to be managed effectively. It should be supported by infrastructure that reliably converts inputs into outputs.  

In this case, the input is regulatory change. The needed outputs are: 

• Applicability analysis 
• Operational decisions 
• Documented rationale 
• Accountable follow-through 

Failing to Operationalize Compliance Leaves You Open to Risk 

That’s where many regulatory compliance programs feel the strain. The risk isn’t failing to notice regulatory change. The risk is failing to operationalize it in a consistent, defensible way, especially across multiple departments, leaders, and decision points.  

From Effort-Based Compliance to System-Based Compliance 

Coming out of risk assessment season, this creates an opportunity to ask a more fundamental question: Do we actually have a system for managing regulatory change, or do we just know it’s a problem?  

Seen this way, the value isn’t the technology itself. It’s the shift from effort-based compliance to system-based compliance. And with systems and technology, you can do all this in a way that is repeatable and reviewable.  

In short, “eating your spinach” and doing annual assessments is good discipline. Relying on systems is how you stay healthy the rest of the time.  

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post From Manual to Scalable: How to Manage Healthcare Compliance Risk  first appeared on YouCompli.

It amazes us how many healthcare facilities don’t always store records appropriately. Check that. People don’t store records properly.  

Just this week, I was in a colleague’s office. Literally, it looked like Staples puked up aisle 3. I asked her what everything was, because you couldn’t make heads or tails of any of it. She explained that it was patient records that she didn’t know what to do with.  

I asked her, “Well, what does the process say to do?”  

“Process?” she said. Nice girl, means well, greener than a pepper tree.  

After helping her re-organize everything, I was motivated to put together some ideas to help others in her situation. Here are some record retention best practices in the event you have hoarded up some claptrap and now have to figure out what to do with it.  

What Records Do You Have? Archival or Data? 

First step, take an assessment of everything you have. Samples? Materials? Records?  

Archival storage should be for all original records, including source data and metadata, which are generated, recorded, calculated or transcribed at the time of an activity. This data allows full and complete reconstruction and evaluation of the activity.  

Data storage may be written, printed electronically, scanned image, photographic, or other form for later reference. Raw data obtained from measurement, testing, processing, direct observation or computer, and instrument printouts should be represented exactly as captured at its source without transformation, aggregation or calculation.  

Responsible Parties and Retention Periods 

All personnel should be responsible for handling, submitting or returning records to the archive in the same conditions in which they were found.  

Keep in mind that different items are governed by different regulations, so you need to check retention periods. The retention period begins when all work with samples or records is complete. Specified retention periods supersede any other retention requirements unless explicitly noted. 

Factors Influencing Retention Period Requirements 

• State and federal laws: State laws are the primary source for retention periods, which can range from three to over ten years. Federal laws, like those from CMS for Medicare, may also have specific requirements.  
• Patient age: Records for minors often require longer retention periods, usually extending past the age of majority.  
• Type of record: Different types of records can have different retention requirements. For instance, some states require longer retention for certain records like mammography images.  
• Legal and regulatory changes: Laws and regulations can change, so it’s important to stay updated on current requirements. 

Scope of Work in Healthcare Records Retention Process 

Generally, quality or project management takes the lead on records retention. The scope of work involves: 

• Archiving, filing, retaining, organizing and retrieving records 
• Maintaining security and integrity of records in archives if stored on-site 
• Collecting and cataloging records, including: 
• Assigning archival numbers 
• Preparing archive labels, updates to archival forms 
• Making copies of any supporting electronic data  
• Handling off-site storage as applicable.  

On-Site and Off-Site Record Storage Locations 

For healthcare records, you have two storage choices: on-site or off-site.  

If you store records on-site, storage must be access-controlled, and all records must be stored appropriately to ensure integrity and preservation, minimize deterioration and facilitate timely retrieval. All original paper records should be stored in secure, fireproof filing cabinets or appropriate containers, like folders, binders, weather-proof envelopes, cases or boxes. 

If you decide to store records off-site, make sure to use a qualified contractor specializing in off-site medical records storage. Quality should be involved in sending records off-site. All records should be assigned a unique number or other appropriate identifiers which your site must maintain.  

Records should be sent off-site appropriately grouped by record type. This is important because at some point, you might need to retrieve them. And you generally don’t have much notice to retrieve something. It’s generally an immediate need or within 24-48 hours, so if you don’t know where the records are or how they are organized, you won’t be able to produce them as you need to. That’s a problem.  

General Guidelines to Reduce Risk in Records Retention 

Healthcare record retention is governed by federal and state laws, requiring that records be kept for a specific period for patient access, legal protection, and compliance.  

Your organization should operate under the basic requirements for retaining records unless otherwise specified. Use these general guidelines to ensure your processes are set up for retention compliance: 

• Without a specified retention period, a minimum period of 10 years should be used.  
• Once the defined retention period is reached, samples and records may continue to be maintained, returned, transferred to the appropriate owner, or destroyed.  
• Do not destroy anything without appropriate approval from the functional owner.  
• Record destruction must be appropriately documented to denote the end of the life cycle. 

What’s Your Next Step? 

When you have these processes and practices in place, records retention will be a lot more efficient and a lot less stressful.  

Want more ideas for optimizing compliance and quality? You’ll find guidance in these popular articles. 

• Four Ways to Integrate Compliance with Safety/Quality Efforts 
• Best Practices for Better Training in Healthcare Compliance
• Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Andrea has taught first grade in Willoughby, Ohio for 27 years in the same classroom that she attended school as a child. She earned a Bachelor of Science in elementary education with a minor in language arts from John Carroll University and a Master’s Degree in the Art of Teaching and Education from Marygrove College. 

John builds and fixes quality departments, while currently thriving as the Administrator & Director of Quality, Risk Management and Compliance at River Vista, a behavioral hospital in Columbus, Ohio.

---

The Q-Kids – John R Nocero and Andrea L Bordonaro – are experts at everything quality, regulatory, education training and compliance and love sharing their knowledge on YouCompli.

Follow them on LinkedIn – for more quality content or send them a message – they’d love to hear from you.

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Hoarders Need Borders: Quality’s Role in Healthcare Record Storage  first appeared on YouCompli.

Many compliance professionals rely on HHS OIG focus areas as they perform risk assessments and plan subsequent auditing and monitoring activities. In November 2024, the OIG added an item to their Work Plan describing their intention to review Medicare Part B payments for skin substitutes.  

More recently, in September of 2025, the OIG published a data snapshot report that concluded Medicare Part B payment trends for skin substitutes raise major concerns about fraud, waste and abuse.  

This blog explores the implications for compliance and what health systems need to be aware of.  

How Skin Substitutes Are Covered Currently 

Skin substitutes aid in wound healing and redevelopment of skin. Medicare covers skin substitutes that are reasonable and necessary for the treatment of an enrollee’s condition. Local coverage determinations state that Medicare Part B generally covers skin substitutes for treatment of diabetic foot ulcers and venous leg ulcers that have failed to respond to at least four weeks of standard wound care.  

However, no national or local coverage requirements apply for other wound types (e.g., pressure ulcers or trauma wounds), and coverage of skin substitutes for these wounds is determined on a case-by-case basis.  

How Medicare Pays for Skin Substitutes 

Medicare Part B pays for skin substitutes based on the number of service units billed at prices ranging from approximately $100 to more than $1,000 per square centimeter.  

For payment purposes, CMS treats skin substitutes like approved prescription biologics, and skin substitutes are reimbursed in non-institutional Part B settings at 106% of the average sales price (ASP).  ASP Refers to the average price of a drug sold to providers, and it’s used for calculating reimbursement rates.  

From calendar years 2020 through 2023, Medicare Part B payments for skin substitutes increased substantially. In two years, Part B spending on skin substitutes increased 640%, going from $389 million (Q3 2022) to $2.88 billion (Q3 2024). 

What Drives Increases in Skin Substitute Pricing and Utilization? 

The rapid growth in expenditure is driven by both higher prices and increased utilization, and the OIG found concerning trends in both areas. 

Higher Prices Driven by ASP and Incentives 

Some of the factors potentially increasing prices include the ASP and incentives for providers. Manufacturers of skin substitutes can quickly bring new skin substitutes to market compared to typical products paid using ASP.  

By statute, ASP is defined as a manufacturer’s sales of a drug to all purchasers in the United States in a calendar quarter (net of most discounts) divided by the total number of units of the drug sold by the manufacturer in that same quarter. 

Calculating Payments for Billing Codes 

Manufacturers are required to report the ASPs and total sales volume for each of their Part B drugs to CMS within 30 days of the end of every quarter. CMS then uses this data to calculate a payment amount for the billing code representing the drug.  

Because different versions (i.e., dosage amounts, package sizes) of a drug may be included within the same billing code, CMS calculates an overall volume-weighted ASP for the code using the manufacturer-reported sales data. By statute, Part B payment is set at 106% of the volume-weighted ASP.  

In cases in which CMS is unable to calculate a volume-weighted ASP for a code (e.g., a new code for which ASPs have yet to be reported), Medicare Part B contractors typically use Wholesale Acquisition Costs, aka WACs (i.e., list prices) or payment invoices to determine a payment amount.  

Providers Seek More Favorable Payments Based on Spread 

Allowing for the time it takes for manufacturer price reporting and the subsequent CMS validation and calculations, there is a two-quarter lag in the ASP-payment process (e.g., first-quarter 2024 ASPs were used as the basis for third-quarter 2024 payment amounts). 

Part B providers can retain the “spread” between their acquisition cost for a drug and the Medicare payment amount. Previous OIG work found that higher spreads may correlate with increased utilization for certain drugs.  

Under the current payment system, Medicare often pays providers for skin substitutes at amounts much higher than providers’ purchase prices, and providers keep the “spread.” This creates incentives to bill for more and more units of skin substitutes and to choose products with the greatest spreads – the same types of billing trends highlighted in the OIG’s report. 

Increased Utilization Has Average Part B Payment Up 153% 

Utilization of skin substitutes has also increased steadily, with more enrollees having skin substitute claims and a higher number of units being billed per enrollee. OIG found that between the first quarter of 2023 and the third quarter of 2024: 

• Number of unique Part B enrollees with skin substitute claim increased by 53%. 
• Total number of units paid under Part B increased by 83%. 
• Average Part B payment amount for each unit of skin substitute increased by 153%. 

In less than two years, the amount paid per Part B enrollee has tripled from $40,051 to $121,501. 

28% Growth in Utilization and Payments in Home Care Settings 

The OIG also found the growth of skin substitute utilization and payments in the home care setting to be particularly notable. By the third quarter of 2024, 28% of enrollees with a paid skin substitute claim under Part B were reportedly being treated in their home. These home care enrollees accounted for more than half of Part B spending on skin substitutes that quarter. 

They also noted that utilization and expenditures for skin substitutes under Medicare Advantage (MA) are just a fraction of utilization and expenditures under original Medicare.   

For example, in the third quarter of 2024, OIG found that only 3,800 Medicare Advantage enrollees were associated with a skin substitute claim, compared to 24,000 enrollees in Part B.  

OIG concluded there were no obvious differences in the enrollee demographics of original Medicare and Medicare Advantage that would explain the massive variance in skin substitute utilization.  

Instead, they suggested variance is likely driven by MA plans’ ability to use numerous reimbursement and utilization management tools to set payment rates and coverage for products such as skin substitutes. 

Urgent Action Needed to Rein in Spending Increases and Fraud 

Based on their data snapshot report, the OIG concluded that action is urgently needed to rein in the massive increases in Medicare Part B spending for skin substitutes in non-institutional settings. They also cited numerous fraud schemes involving skin substitutes. 

Compliance professionals should make sure they are considering their organization’s use of skin substitutes and determine if there are existing risks. If so, they should monitor and audit their organization’s use of skin substitutes to ensure compliance. 

More Resources on Compliance Risk 

Know the Compliance Risk for Certain Anesthesia Services 

A good healthcare compliance program is all about reducing risk, both in patient care and in financial reimbursement. This detailed blog by compliance expert, CJ Wolf, will bring you up to date on the compliance risks associated with certain anesthesia services.   

How to Avoid Compliance Risk in Peripheral Vascular Reimbursement   

Peripheral vascular disease (PVD) reimbursement is fraught with potential compliance pitfalls. This expert-written blog addresses the pressing concern of compliance risks in PVD reimbursement. It provides insights into regulatory trends, recent investigations and best practices. 

Exclusion Screening Failure Causes Compliance Nightmare 

Even a seemingly small glitch can have major consequences for healthcare compliance. This blog shares the story of the consequences of an incident when exclusion screening software glitched. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post OIG Cites Fraud, Waste and Abuse Concerns with Skin Substitutes  first appeared on YouCompli.

A good healthcare compliance program is all about reducing risk, both in patient care and in financial reimbursement. This detailed blog by compliance expert, CJ Wolf, will bring you up to date on the compliance risks associated with certain anesthesia services.   

The OIG just published audit results and report (July 31, 2025) outlining the issues in this area. This article is a summary of that report, along with what it might mean for compliance professionals.  

The implications can be huge. For example, OIG concluded that Medicare paid $45.7 million for anesthesia services provided during the SPM procedure sessions that were at risk for noncompliance with Medicare requirements.  

What to Know About Anesthesia, Compliance and the Latest OIG Audit 

The U.S. Department of Health and Human Services Office of Inspector General (OIG) recently released a nationwide audit report highlighting potential improper payments for anesthesia services provided during select spinal injection procedures  

It is only under rare circumstances that Medicare Part B covers the cost of anesthesia during certain spinal pain management (SPM) procedures. In fact, a prior OIG audit found that 27% of billed anesthesia services during SPM procedures did not have supporting medical documentation that would justify the use of anesthesia.  Given these circumstances, the OIG decided to perform the more recent nationwide audit and publish its findings. 

Goal of OIG Audit Regarding Medicare Part B Payments 

The OIG’s goal in the audit was to identify Medicare Part B payments to physicians for anesthesia administered during selected SPM procedures that were at risk for noncompliance with Medicare requirements. 

The specific SPM procedures included in the audit were: 

• Facet-joint injections 
• Facet-joint denervation (aka radiofrequency ablation) 
• Epidural steroid injections 
• Sacroiliac joint injections 

Medicare Coverage Only in Rare Circumstances 

As mentioned, it is only in rare circumstances that Medicare covers the cost of certain anesthesia services provided during SPM procedures. The types of anesthesia services that could potentially be covered under these rare circumstances include: 

• Moderate sedation: Administration of a drug-induced depression of consciousness during which a patient responds purposefully to verbal commands, either alone or accompanied by light tactile stimulation. No interventions are required to maintain the enrollee’s airway, and spontaneous ventilation is adequate. 

• General anesthesia: Administration of a drug-induced loss of consciousness during which a patient is not arousable, even by painful stimulation. The ability to independently maintain breathing is often impaired. The patient often requires assistance in maintaining an open airway that allows for adequate airflow and proper oxygenation of the lungs. Positive pressure ventilation may be required because of depressed spontaneous ventilation or drug-induced depression of neuromuscular function. 

• Monitored anesthesia care: This is a specific anesthesia service for a diagnostic or therapeutic procedure. Indications for monitored anesthesia care include the need for deeper levels of analgesia (i.e., the inability to feel pain) and sedation than can be provided by moderate sedation. Monitored anesthesia care falls between moderate sedation and general anesthesia. 

MAC LCDs Published for Select SPM Procedures 

Medicare Part B claims are adjudicated and paid by Medicare Administrative Contractors (MAC).  MACs are charged with ensuring proper payment of claims.  They are to safeguard Medicare funds against improper medical coding and billing, fraud and abuse. One way they do this is by publishing local coverage determinations (LCDs) which outline when certain services are, or are not, covered. 

The MAC LCDs for the selected SPM procedures explain that the use of moderate sedation, general anesthesia, and monitored anesthesia care is usually unnecessary or rarely indicated for these procedures. However, individual consideration may be given in rare cases when documentation clearly established the need for such anesthesia. 

Audit to Confirm Compliance with Limited Coverage Rules 

The OIG wanted to confirm compliance with these limited coverage rules for anesthesia services billed along with the SPM procedures. To do so, they identified an audit period consisting of claims for SPM procedure dates of service between May 2, 2021, and August 31, 2023, during which Medicare paid for 3.9 million sessions of SPM procedures.   

For this audit period, physicians billed for anesthesia services nearly 18% of the time. The MACs paid $46.2 million for the anesthesia services or 99.5% of the time that anesthesia was billed during the same SPM procedure session. 

Then, the OIG identified and selected a nonstatistical sample of 28 sessions where both anesthesia and the selected SPM procedures were billed. To verify compliance, the OIG obtained the supporting medical documentation for these sessions and had an independent medical reviewer determine whether the anesthesia was medically necessary and met the rare circumstances when Medicare would cover the anesthesia service.  

Medical Records Fail to Document Necessity 

For 20 of the 28 sampled sessions, the medical reviewer determined the supporting medical records did not document a rare circumstance in which administering anesthesia was reasonable or necessary for the specific SPM procedure.   

One such example included a session where a physician administered moderate sedation to a patient during an epidural steroid injection session. The medical records provided by the physician stated that this type of anesthesia was administered because of the patient’s anxiety, which is not a medically necessary indication meeting coverage criteria according to the LCD. The medical records also did not have evidence of failed oral sedation, which could have necessitated moderate sedation. 

The OIG stated they could not provide an overall estimate of improper payments for the entire audit period because the sample they used was a nonstatistical sample. However, they concluded that Medicare paid $45.7 million for anesthesia services provided during the SPM procedure sessions that were at risk for noncompliance with Medicare requirements. 

OIG Recommendations Include Provider Education 

One of the more significant recommendations the OIG made for CMS and the MACs is to  

• Educate providers on the coverage criteria 
• Review claims for improper billing of anesthesia services 

For providers, this means your MAC may begin auditing such claims. 

Compliance Tip for Anesthesia Billing 

Compliance professionals should assess how often their organizations bill anesthesia services at the same time as the SPM procedures and review the medical records to determine if the sessions meet the rare circumstances found in the LCD requirements for coverage of both services. 

More Resources about Compliance Risks 

Continue learning about the complexities of Medicare reimbursement and compliance in these other piece by CJ Wolf. 

Compliance Risks Associated with Outlier Payments 

In some circumstances, payers like Medicare, for example, will reimburse additional amounts beyond the prospective payment rate. These additional payments are called “outlier payments.” Outlier payments provide additional reimbursement for cases of exceptionally costly treatments.   

How to Avoid Compliance Risk in Peripheral Vascular Reimbursement   

Peripheral vascular disease (PVD) reimbursement is fraught with potential compliance pitfalls. This expert-written blog addresses the pressing concern of compliance risks in PVD reimbursement. It provides insights into regulatory trends, recent investigations and best practices. It provides insights into regulatory trends, recent investigations and best practices. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Know the Compliance Risk for Certain Anesthesia Services  first appeared on YouCompli.

A conflict of interest (COI) in healthcare occurs when a person or organization involved in medical decision-making, such as a doctor, researcher or healthcare administrator, has a secondary interest (financial, professional or personal) that could compromise or influence their objectivity and clinical judgment.  

This secondary interest has the potential to affect decisions about diagnosis, treatment, or research in a way that’s not aligned with the best interests of the patient or public health.  

Key Components of a Conflict of Interest 

Key elements of a conflict of interest include: 

• Financial ties, such as relationships with pharmaceutical companies or medical device manufacturers 
• Personal or professional relationships that can bias medical decision making 
• Institutional interests that influence financial or strategic decisions 

Why COI Must Be Addressed 

The identification and mitigation of COI in healthcare is critically important because they directly affect the quality of patient care, the integrity of medical research, and the overall trust in healthcare systems.  

Here’s why it’s essential to avoid conflicts of interest: 

1. Protect Patient Health and Safety 

When a healthcare provider has financial or personal incentives that conflict with the patient’s best interests, it could lead to recommendations for unnecessary treatments or suboptimal care. This can directly harm patients, either through unnecessary side effects, prolonged treatments, or missed opportunities for better outcomes.   

Patients trust healthcare providers to make decisions based on their health needs, not on external incentives. If a physician is influenced by financial or personal gain, it undermines this trust and can result in patient harm. 

2. Ensure Clinical Objectivity and Best Practices with Evidence-Based Decisions 

In healthcare, clinical decisions should be grounded in the best available scientific evidence. COI can distort clinical judgment, leading to decisions based on profit motives or personal interests, rather than sound evidence or best practices. 

When decisions are made objectively, based on the best evidence and clinical standards, it ensures optimal outcomes for patients and trust in the system. 

3. Reducing Healthcare Costs by Avoiding Unnecessary Procedures 

COI can lead to overutilization of tests, procedures and treatments that are not medically necessary, inflating healthcare costs for individuals and insurance systems. Unnecessary treatments contribute to the rising cost of healthcare and can create financial burdens on patients, insurers and the healthcare system as a whole.  

Mitigating COI can lower costs by ensuring that treatments are based on necessity and effectiveness, not financial incentives. 

4. Preventing Fraud and Abuse in Healthcare Through Ethical Integrity 

COI can open the door to fraudulent practices, such as billing for unnecessary services, overprescribing medications, or manipulating patient data for personal gain.  

Addressing COIs protects the integrity of the healthcare system, ensuring that resources are used appropriately and that the system is not exploited for financial gain. 

Impact of Conflicts of Interest on Healthcare Systems 

Role of Compliance Officer in COI Management 

The compliance officer helps ensure transparency, ethical decision-making, and accountability, thereby protecting patients and maintaining system integrity. The compliance officer’s role in mitigating COI risk involves: 

Monitoring: Ensuring healthcare professionals and organizations disclose any potential COI, particularly financial or personal interests, that could influence decisions. 

Policy Enforcement: Implementing and enforcing clear COI policies and procedures, including guidelines for recusal or divestment when conflicts arise. 

Education and Training: Providing ongoing education to staff about identifying and managing COI to maintain ethical standards.  

Auditing and Reporting: Regularly auditing practices for compliance with COI regulations and reporting any violations to ensure corrective actions. 

An Unfortunate Example of a Deliberate COI 

In 2015, Dr. Farid Fata was sentenced to 45 years in a federal prison by U.S. District Judge Paul Borman. Dr. Fata, who had built an empire of upscale cancer clinics, intentionally misdiagnosed patients and illegally billed Medicare for the treatment.  

He grossly over-treated, under-treated, and misdiagnosed hundreds of patients by telling them they had cancer when they did not. He administered too much or improper treatment to others who did have cancer and continued to give chemotherapy to terminal patients who no longer needed it.  

Over $34M in Billings from Fraudulent Treatments 

About 550 patients have been identified as victims, with 34.7 million in billings to patients and insurance companies, and 17.6 million paid for work Dr. Fata admitted was unnecessary. Prosecutors say Dr. Fata was notorious for treating all his patients personally and keeping other medical professionals away.

The U.S. Attorney’s office said Dr. Fata, “is the most egregious fraudster in the history of the country, measured not only by the millions of dollars he stole but by the harm he inflicted on his victims.”   

This case is one of the most extreme, but it highlights a powerful conflict of interest where financial incentives result in harmful over-treatment of patients. Financial pressure or incentives, whether directly or indirectly tied to volume of procedures, can lead some physicians to recommend unnecessary treatments. These actions exploit the trust of patients, who rely on the expertise of their doctors for decisions that can affect their health, safety, and financial well-being.¹

Conflicts Embedded in Medical Guidelines and Standards 

A unique and mind-blowing aspect of COI in healthcare that few people realize is how deeply conflicts can be embedded in medical guidelines and “evidence-based” standards themselves, shaping the very definition of disease and thresholds for treatment in ways that drive profit more than health. 

When a physician prescribes a statin or a glucose-lowering drug, it feels like a purely clinical decision. But that decision is based on guidelines often crafted by panels with financial ties to drug manufacturers. Even physicians who believe they’re making objective decisions may be following protocols shaped behind the scenes by corporate influence. 

Medical guidelines—the foundation of diagnosis and treatment—are often written by experts who have financial ties to pharmaceutical or device companies whose products benefit from more liberal definitions of disease.   

The assumption is that practitioners and patients need guidance for medical decision making. But in many cases, it’s the interests of pharmaceutical and medical device companies subtly shaping the physician’s practice by influencing how diseases are defined. It seems like medicine is in control, but often, industry tailors the rules of the game through guideline panels, research funding and educational influence. 

Workforce Awareness Needed to Reduce COI 

Members of a healthcare organization’s workforce need to understand what constitutes a Conflict of Interest. COI occur when personal, financial, or professional interests interfere with objective decision-making that affects patient care, research, or organizational integrity.  

The workforce also needs to be aware of disclosure requirements, because they must disclose any potential COI to the compliance officer or management, especially financial relationships with outside entities. Workforce members have an ethical responsibility to prioritize patient welfare, transparency and integrity over external interests in all decisions. 

How Employees Should Respond to COI Suspicions 

If an employee suspects a COI might be an issue, they should promptly report suspicions to the compliance officer, management or through confidential reporting channels. If they are uncertain, the workforce member can seek advice on whether a situation constitutes a COI and how to proceed. This ensures accountability and maintains ethical standards in the organization. 

A solid conflict of interest mitigation process is crucial for a healthcare organization because it ensures patient safety, maintains ethical decision-making, prevents financial exploitation, and preserves public trust. Without it, the integrity of care is compromised, risks to patient health increase, and the organization’s reputation and legal standing are jeopardized. 

1. https://www.justice.gov/archives/opa/pr/detroit-area-doctor-sentenced-45-years-prison-providing-medically-unnecessary-chemotherapy  ︎

Susan is a healthcare compliance leader with over four decades working in a variety of administrative and managerial capacities, including strategic planning, regulatory oversight, revenue cycle risk mitigation, denial and appeal management, privacy and information security, healthcare advocacy, clinical department leadership, provider practice administration, risk management, and quality outcomes.  Currently, Susan provides compliance and privacy consulting services to a variety of healthcare organizations, including program implementation, policy and procedure development, compliance and privacy training, and regulatory oversight administration.  

Susan is a Certified Internal Auditor (CIA), Certified Healthcare Compliance (CHC), Certified Professional Coder (CPC) and holds a Certification in Risk Management (CRMA).  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA

The post Mitigating Conflicts of Interest that Drive Profit Over Health  first appeared on YouCompli.

Peripheral vascular disease (PVD) reimbursement is fraught with potential compliance pitfalls. With increased scrutiny and worrisome statistics about improper payments, healthcare providers must identify and mitigate any PVD compliance risks that could jeopardize their operations.  

This expert-written blog addresses the pressing concern of compliance risks in PVD reimbursement. It provides insights into regulatory trends, recent investigations and best practices.  

Equip yourself with the knowledge to navigate this complex environment and safeguard your organization’s reputation and financial sustainability. Learn effective strategies to mitigate compliance risks in peripheral vascular reimbursement by focusing on medical necessity and adherence to guidelines. 

What’s your compliance risk when it comes to reimbursement for specific medical procedures like peripheral vascular interventions (PVD)? 

Hospitals, health systems and medical practices providing peripheral vascular procedures should be aware of recent scrutiny of these services by government enforcement agencies. 

What Therapies Target Peripheral Vascular Disease? 

Peripheral vascular disease can result in the narrowing or blockage of arteries in the periphery, such as the lower extremities. There are many different therapies to address PVD, including the typical first-line treatment of lifestyle changes and medications.  Lifestyle changes include quitting smoking, eating a healthy diet low in saturated fats, regular exercise and weight management. Some PVD medications include the statin class of drugs, antiplatelet agents, ACE inhibitors and others.   

If lifestyle changes and medications don’t work, and certain clinical criteria are met, patients can undergo peripheral vascular procedures. These are minimally invasive procedures intended to improve blood flow through the arteries. Angioplasties, atherectomies and placement of stents are types of peripheral vascular procedures. 

OIG Looks at Compliance Risk in PVD Reimbursement  

Enforcement agencies are concerned with the increasing volume of these procedures. The problem relates to suspicions that some clinicians perform these procedures when they’re not medically necessary. 

The HHS OIG has added two different projects to their work plan related to peripheral vascular procedures. The first is “Utilization of Peripheral Vascular Procedures and CMS’s Related Program Integrity Efforts.” They report that in one calendar year, Medicare paid more than $600 million for atherectomies and angioplasties in peripheral arteries with and without a stent.   

Editor’s Note: The Work Plan is a guide to OIG priorities around oversight and compliance. By reviewing the Work Plan, health systems can identify potential compliance risks and proactively take action to mitigate them. 

Fraud Concerns Over Vascular Reimbursement Volume 

The OIG also states that both CMS and whistleblower fraud investigations have identified these surgeries as vulnerable to improper payments. This particular project is designed to determine trends in Medicare fee-for-service for surgeries in peripheral arteries over several years and identify paid claims that exhibit questionable characteristics.  

The OIG will also describe program integrity activities that CMS and its contractors have taken to combat fraud, waste and abuse specific to procedures in peripheral arteries. The report is expected to be issued in 2026. 

Understanding Medicare Compliance for Vascular Interventions 

The second work plan project is named “Medicare Payments for Lower Extremity Peripheral Vascular Procedures.” The OIG reports that peripheral vascular procedures in an office setting have increased among the Medicare population over the past decade.  

In fact, OIG says for calendar years 2022 and 2023, Medicare paid approximately $1.16 billion for lower extremity peripheral vascular procedures in office settings. Their concern is that these procedures are generally recommended only after patients have exhausted medical and exercise therapy and have lifestyle-limiting symptoms.  

The OIG plans to analyze Medicare fee-for-service for peripheral vascular procedures for questionable characteristics. They would also like to assess whether these procedures complied with CMS requirements and met applicable treatment guidelines. This report is expected to be released in 2025 under report number W-00-24-35914. 

Whistleblower Fraud Investigations Find Compliance Issues 

The OIG reported that there have been some whistleblower fraud investigations concerning these procedures. One case recently occurred in Florida where the whistleblower was a physician who claimed a vascular center and its providers were performing and billing for medically unnecessary peripheral vascular procedures.   

The government intervened in the case and alleged the providers submitted false claims to Medicare for percutaneous transluminal angioplasties that were not reasonably or medically necessary because they were performed without appropriate diagnostic imaging or clinical justification.   

The case was resolved when the medical providers agreed to pay $810,301, of which $337,625 was restitution. The defendants also agreed to pay $85,000 for the whistleblower’s reasonable expenses, including attorneys’ fees and costs. 

Report: Faster Treatment, Higher Costs with Office Procedures 

The Journal of Vascular Surgery published a report in June 2024 that concluded Medicare patients with peripheral artery disease are treated more quickly but undergo higher cost interventions in office-based laboratories compared to outpatient hospital settings. 

The authors used publicly available Medicare fee-for-service claims data spanning a five-year period that identified all patients undergoing certain peripheral procedures for certain conditions. They then evaluated the associations of patient and procedure characteristics with the site of service. 

Steps for Compliance in Peripheral Vascular Reimbursement 

So, what’s a compliance officer to do?  The first step is to determine the level of involvement the organization has in these particular procedures.  

If found to be significant, it’s probably wise to evaluate the clinical guidelines and policies in place for use of peripheral vascular procedures. Most organizations have a medical director or department chair who could guide a review to determine if procedures are medically necessary.  

Seek Out External Resources about PVD Compliance 

Alternatively, seeking external expertise is also an option. Though professional societies’ clinical practice guidelines are not the “end-all,” it might be useful to reference such guidelines as a starting point.  

These might include: 

• Society of Vascular Surgery

• American College of Cardiology/American Heart Association Joint Committe

• Society of Interventional Radiology

Best Practices for Peripheral Vascular Procedure Compliance  

Most compliance programs only perform medical coding reviews of the procedure documentation, but the OIG suggests including medical necessity audits as well. In their General Compliance Program Guidance (GCPG) document, they state, “Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary.  

“Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Given this, compliance professionals shouldn’t ignore the question of medical necessity for peripheral artery procedures. Scrutiny of these services continues to be a priority for the OIG and their work plan as well as the Department of Justice, as evidenced by cases that result either from data analytics or whistleblowers. 

Confident Compliance Starts Now 

YouCompli customers are confident in their approach to compliance challenges like managing PVD reimbursement. Learn more about the unique combination of expert human analysis and digital compliance management tools. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA

The post How to Avoid Compliance Risk in Peripheral Vascular Reimbursement   first appeared on YouCompli.

Healthcare compliance/accreditation professional Amy Laufmann, MBA, has held a variety of quality and compliance roles for over ten years in multiple settings. Currently the Client Success Manager at YouCompli, she works with healthcare organizations across the country every day, from single-state healthcare systems to systems spanning nationwide. She shares her experience not only having worked in the field, but also the knowledge and insight gained from supporting organizations using the YouCompli compliance software to manage regulatory compliance changes in their organizations. 

Let’s Talk Regulatory Change Management and Compliance Software

In this expert interview, Amy shares insight surrounding compliance management software (like YouCompli) and examples of what it takes for organizations to be successful.

Question: What are the advantages of using compliance software?

Amy Laufmann: Compliance software allows for automation number one, and then accountability.

As far as automation is concerned, the software offloads manual tasks from compliance teams. Essentially, automation skips the manual process of fighting through all the noise and duplications to find out what regulations apply and then delivers it directly to the department accountable for completing the work.

It brings you quickly and directly to the point of starting the compliance work that needs to be done in response to regulatory changes.

YouCompli helps compliance teams start at that point, as they are alerted to regulatory changes that impact their organization. They also get information on what needs to be done to share directly with the impacted departments.

Q: How Do You Know if You’re Catching All the Right Regs?

AL: I remember working at an organization where we had just hired a new Chief Compliance Officer, who was meeting with our team. He asked how our team ensures that we’re monitoring all applicable federal and state rules, and updated accreditation standards.

The team was silent, because despite our best efforts, the process of listserv notifications and the endless newsletters and different compliance organizations did leave concern that something could easily be missed. I’m not going to lie… despite my best efforts, the thought of “What did I miss?” really did surface occasionally.

It’s important to note that software automation eliminates the challenge of simply finding all the rules and regulations that organizations need to be aware of before even getting started doing the work.

Special Care Needed for State Regulatory Changes

Additionally, state regulatory changes are not always the easiest to monitor, track and implement. Often, hospital associations and government relations departments help get important bills on the radar of compliance teams.

However, government websites or other legislative tracking web applications are essentially online libraries. Their results often include bills both passed or not, supported or opposed, and it can be very cumbersome to translate that information into where bills are in the process, which are passed, failed, signed by the governor, etc.

If you know what you’re looking for, great. If you need to find out what should be on your radar, you can very easily miss something and have difficulty finding what you need, especially for those things that may be a bit more obscure, like healthcare transportation.

How Compliance Software Provides Closed-Loop Accountability

That brings me to the second advantage, accountability. Compliance software provides accountability for those folks responsible for implementing the regulatory change and clearly identifying what work has been done in order to comply.

Compliance software has tools built within it to manage that workflow. It can alert staff when they’re assigned work related to regulatory changes, as well as those who need to monitor that work when it’s been done.

Compliance is all about closing the loop and documenting what’s been done, and compliance software automates this process through workflow to ensure the loop gets closed.

Q: It sounds like compliance teams could use help. What features should organizations look for in a compliance management tool?

AL: Compliance management software must include all the regulators you care about. It has to include both federal and state rules and regulations and centralize that information to ensure it funnels into your organization from one source. If I’m going to invest in a compliance solution, it must eliminate the need for me to care about any other noise when it comes to monitoring regulatory changes.

In addition to one source of truth, the ability to have workflow is crucial, as compliance work is typically a very manual process of spreadsheets, tracking, notes and emails scattered across many different places in an organization.

Compliance software should include workflow that allows compliance teams to assign tasks, provide information, and track regulatory work. It should maintain that information within reach of not only compliance teams, but other stakeholders like managers and directors who may want oversight on work impacting their teams, as well as completion status.

Guidance About Compliance Reporting Tools

Lastly, compliance management tools should include the ability to report on the state of compliance work within an organization. What if you could see on-demand and in real time all regulatory work assigned, in progress and complete without having to pull information from multiple spreadsheets, departments, forms, etc.

Compliance software should allow your organization to identify the department, date ranges, status type, or even users and the associated regulatory work.

Reporting within compliance software can help you:

• Identify the state of assigned, in progress, overdue, and completed regulatory work.
• Spot bottlenecks where compliance work is not progressing.
• Are there users, departments, or types of regulations that are going unaddressed?
• Spot departments or individuals who address compliance work in a timely manner and keep their impacted areas in compliance with regulatory changes.
• Who deserves recognition and kudos for getting the work done?
• Facilitate communication and credibility for compliance teams as experts on the state of compliance within their organizations.

Recap: What to Look for in Compliance Management Software

In summary, compliance management software should provide:

• Single source of information to ensure your organization is reviewing all necessary regulatory changes, that is, all the regulatory information your organization needs to know.
• Workflow automation to assign, monitor and complete regulatory work.
• Centralized database to store all information and documentation to implement regulatory changes.
• On-demand reporting to observe all regulatory work, current state and departmental impact for both high-level teams like leadership, as well as detail-level reporting to monitor work assignments by department, user or effective dates.

Compliance Management Goal: Eliminate as Much Risk as Possible – And Software Helps

Healthcare organizations and the compliance teams within them won’t often come out and say it, but 100% compliance 100% of the time just isn’t possible. It is nearly impossible to be ahead of the regulatory change game all of the time and have everyone in an organization compliant with every rule and regulation on the books.

If that were the case, things like billing errors, overpayments, self-disclosures, ADRs and plans of correction would cease to exist.

The point is to eliminate as many potential areas of compliance risk as possible. Compliance software lends itself very well to getting the high value/high risk/high impact regulatory work addressed but still doesn’t let regulatory changes less likely to cause reputational damage or severe financial penalties fall off the radar. It ensures that when capacity and resources are available, those changes too are addressed.

Compliance software like YouCompli provides a valuable, comprehensive picture of the landscape in your organization.

Q: How fast can you go live with compliance software in an organization?

AL: This is a question I get asked all the time, and if I’m honest, I have a love-hate relationship with it. First, let me say if an organization were to purchase YouCompli, ultimately, I could have the software live and sending you notifications of all regulatory changes the same day your desired regulators, jurisdictions and users are identified.

The challenge here is not how quickly we can flip the switch and provide the software to you. It’s really identifying the organization’s goals in using the software in order to either support or improve upon them when we turn on the software.

Launching compliance software within healthcare organizations can be as simple or as complicated as they wish it to be. My job is to help organizations understand how the software works to support and improve their regulatory change management processes.

Four Requirements for Quick, Successful Regulatory Software Roll Out

A lot of the success or failure of this process has to do with a few common themes within a timeframe that’s realistic for the health system.

• Strong support from leadership and communication from senior leaders clearly outlining expectations and processes for utilizing compliance management software.
• Compliance teams have good manual processes in place and want to optimize their efficiency and eliminate time spent on manual work.
• Organizations have clear roles and expectations for responsibility in completing regulatory work in existing structures.
• Compliance is viewed as a part of operations but needs a framework of standard processes and automation to support their efforts.

Integrate with Existing Compliance Processes or Start from Scratch?

When You Have Processes

When organizations have a good foundation to manage work related to regulatory changes, compliance software can almost immediately support that process and make it much less time-intensive by automating all manual parts of the existing framework.

When You Need Processes

For organizations needing compliance software to support a new process or to build a framework for ensuring regulatory work is completed, the software is still quite simple to implement. We provide a framework outlining the process, steps involved and required information, so your organization has an outline for success from day one.

Q: What Do You Need to Roll Out Compliance Software?

AL: Implementation and roll out depend on an organization’s ability to provide the following information:

• Jurisdictions and Regulators: What federal regulators, MACs, and state jurisdictions apply to your organization? (YouCompli provides a list for your organization to select/include in your system.)
• Regulatory Assignments: What do you want the workflow process to look like?
  • Centralized Assignments: All regulatory changes are funneled through compliance teams for review before assigning task work to impacted departments.
  • Decentralized Assignments: All regulatory changes are funneled directly to identified department leaders who are responsible for managing and completing regulatory work specific to their department. (YouCompli provides a “regulatory rolodex” for you to identify department-level, automated assignments.)
• Software Administrator and General User Training Sessions:
  • YouCompli administer training typically consists of one 45- to 60-minute session for leaders who will use the software to manage and oversee regulatory work.
  • YouCompli general user training sessions include a 30-minute overview of how to use the software to complete any assigned regulatory work.

Q: What Should You Know about Software Training and Ease of Use?

AL: Ease of use and training are worth noting because ultimately everyone wants the software to be used.

Speaking of the YouCompli solution specifically, the software is easy-to-use and provides step-by-step instructions guiding users through the process of completing assigned work. It includes on-demand training videos directly linked to those steps, as well as responsive and proactive support not only during implementation, but throughout your time using the YouCompli software.

This support comes directly from our team of industry experts who provide credible, reliable and actionable information. The support crew includes people who’ve worked directly within healthcare compliance, as well as attorneys.

So, when I’m asked how quickly can we go live with YouCompli, the answer is as fast as you’d like. However, to set your organization up for success, I most often recommend identifying a timeline that aligns with ensuring your software is well-utilized and that you get the most value from configuring it.

Q: Do healthcare organizations need to be concerned about privacy and security with compliance tools?

AL: YouCompli specifically is a cloud-based software that enables organizations with web access to use standard username and password access. The software lets organizations easily assign and manage user roles and provides the ability to control what those different roles have access to in the solution.

We also set up Security Assertion Markup Language (SAML) which allows the software to authenticate users on an organization’s network and bypass password entry entirely.

The compliance software is not HIPAA-compliant and should not be used to store protected health or confidential information. This is something you will always want to check for any software your organization evaluates.

Most importantly, you want to ensure that the security and privacy that a compliance tool does or does not provide is clearly communicated to all users.

Q: Any Additional Thoughts to Share?

AL: Healthcare compliance is complex. It touches every department within a healthcare system, but it is often an underdeveloped program. I think despite all of the advancements in technology, tools and applications, finding software that actually works for healthcare compliance teams is difficult, and the value of finding a great one is underrated for this particular field.

I currently work for YouCompli, and of course I’m going to be promoting that solution, but I think it’s important to note that I’m only a YouCompli Client Success Manager because first I was a YouCompli client.

My passion for improving access to technology and tools to support regulatory compliance teams and helping them get the most value and support when using software is why I’m here.

I’ve worked at health systems using YouCompli, and I’ve worked at health systems for quite some time without YouCompli. I’ve experienced first-hand the vastly significant difference it made for compliance teams and the organizations they serve, and I can’t imagine working directly in compliance without it ever again.

Q: Ready to Take the Next Step Towards Confident Compliance?

With so many capabilities and benefits, what’s holding you back from learning more about compliance management software and confident compliance? Here are other resources you might want to look at.

White Paper: Empowering Compliance Officers to Drive Better Health and Business Outcomes – How effective regulatory change management practices help healthcare organizations mitigate risk

White Paper: The Opportunity for Compliance to Create Value for Healthcare Organizations – Best practices for demonstrating how compliance makes an impact

White Paper: Doubling Your Impact: Demonstrating Compliance’s Value and Shaping Culture – Best practices for proving your value in five key areas.

Amy Laufmann is client success manager at YouCompli. She has 10+ years of experience in healthcare compliance and operations, and is passionate about helping healthcare organizations operate better and deliver better patient outcomes.  

Take Free RL3M Assessment (Regulatory Lifecycle Management Maturity Model)

RL3M Assessment

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

---

27 Ungated Resources for Compliance Leaders and Teams 

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now

---

• One Compliance Pro’s Regulatory Change Management Process    by Amy Laufmann, MBA
• Five ways to show how healthcare Compliance delivers value by Jerry Shafran
• Revenue Cycle Management Compliance: Ensuring… by Maya Turner, CPMA, CPCO, CFPC, CPC, CPC-I, AAPC
• 12 key metrics for compliance officers looking to… by Kenneth Zeko, JD, CHC
• Transforming Compliance to a Department of Yes  by Lisa Herota, RHIA, CHC, CHPS, CCS Compliance & Privacy Officer
• Three Strategies to Align Compliance with Revenue Cycle  by CJ Wolf, MD
• How the Three Lines Model Strengthens Healthcare Compliance by Kenneth Zeko, JD, CHC
• Mitigating Conflicts of Interest that Drive Profit… by Susan Thomas
• Navigating Compliance Responsibility: A Foundation… by Amy Laufmann, MBA
• New Regulation– Now What? Step-by-Step Guide to… by Amy Laufmann, MBA

The post Expert Advice: Compliance Software Q&A with a Compliance Professional  first appeared on YouCompli.