This article uses a specific example to explore the implications of medical necessity for healthcare systems. 

Recent False Claims Act Complaint Hinges on Medical Necessity  

Recently we wrote an introductory article discussing in general terms the compliance risks associated with medical necessity. That was first in a series on medical necessity. Now this article introduces a specific example.   

In this case, the U.S Department of Justice (DOJ) filed a False Claims Act complaint against a hospital group and three long-term care hospitals. They allege the False Claims Act was violated because some of the care provided (for which the hospital was reimbursed) wasn’t medically necessary. 

Three Ways Medical Necessity Impacts Performance 

Medical necessity remains a serious compliance risk for providers, including hospitals and health systems. It impacts these organizations in several significant ways: 

• Performance and Efficiency 
• Financial and Compliance Risk 
• Patient Outcomes and Quality 

1. Performance and Efficiency 

Administrative Burden: Research shows that “medical necessity” serves as a primary tool for allocating resources, but varying definitions across payers create administrative churn. Studies indicate that managing these requirements increases the revenue cycle workload, leading to delayed payments and reduced efficiency. 

Operational Streamlining: Conversely, some evidence suggests that when medical necessity is effectively operationalized (e.g., integrated into EHRs), it can increase the speed of diagnosis by eliminating redundant or non-essential tests.  

2. Financial and Compliance Risk 

Denial Management: A major area of study involves “medical necessity” as a driver of claim denials. Research by organizations like AAPC indicates that failure to validate medical necessity can lead to revenue loss, recoupments, and payer audits. 

Regulatory Exposure: Inadequate documentation of medical necessity is a leading cause of False Claims Act allegations, representing a high-stakes legal and compliance risk for health systems.  

3. Patient Outcomes and Quality 

Care Appropriateness: Studies suggest that medical necessity standards help align clinical care with evidence-based guidelines, which can improve patient safety by reducing exposure to unnecessary, potentially harmful procedures. 

Equity and Access: Research into determinants of health system performance warns that restrictive criteria can limit access to essential care for vulnerable populations if based on cost-containment instead of individual patient needs.  

Allege Longer Stays to Increase Medicare Reimbursement 

The example covered here reflects some of these negative impacts. In this False Claims case, the DOJ alleges that the hospitals held patients in the hospital longer than medically necessary in order to increase Medicare reimbursement.  

Long-term care hospitals (LTCHs) provide inpatient services for patients whose medically complex conditions require long hospital stays and programs of care. Medicare reimburses LTCHs based, in part, on a patient’s length of stay.   

By allegedly delaying discharge of certain patients, even when their course of treatment had been completed or when they could have been transferred to a lower level of care, the hospital received higher payments than they should have. 

The DOJ did not discover this issue on their own. The lawsuit was originally filed by a former employee of one of the hospitals through the qui tam or whistleblower provisions of the False Claims Act.  

How Internal Concerns Become Full-Blown Investigations 

Though allegations of medically unnecessary care may be a common reason such lawsuits are filed, understanding the details of a specific case is important.  

It can help compliance professionals see how concerns, potentially first reported internally, can develop into full blown investigations or additional complaints being filed with the court by the DOJ, as in this example. 

Manipulating Qualifying Patient Stays for Higher Reimbursement 

In the complaint, the DOJ alleges that the defendants illegally inflated their Medicare payments by holding patients who were ready for discharge until they reached a certain threshold date that, once reached, would trigger increased reimbursement.  

Certain Medicare patients who meet an average length of stay over the twenty-five days that LTCHs must maintain are referred to as a Qualifying Patient. The Government claimed the defendants also inappropriately held Qualifying Patients long enough to meet the 25-day average length of stay requirement to maintain their LTCH status and be paid at the higher LTCH rate.  

In the court document filed by the DOJ, it’s alleged that one executive told her employees, “No one is leaving early. We lose money.” Unfortunately, this wasn’t the only example of their alleged poorly handled medical necessity determinations. 

Ignored Alternatives Could Have Been Fraction of the Cost 

According to the complaint, many of these patients could have been discharged earlier and received care at home or in a nursing facility for a fraction of the cost to Medicare.   

The complaint also states that when employees raised concerns about the practices to one of its executives, the executive dismissed them, noting they would make money even if Medicare denied some medically unnecessary claims.  

Compliance Responsible for Appropriate Processes 

Compliance programs should ensure that appropriate processes exist to confirm the appropriate clinical criteria are met when it comes to admission and discharge actions.  According to the government, LTCHs specifically must have a documented process that: 

“screens patients prior to admission for appropriateness of admission to a long-term care hospital, validates within 48 hours of admission that patients meet admission criteria for long-term care hospitals, regularly evaluates patients throughout their stay for continuation of care in a long-term care hospital, and assesses the available discharge options when patients no longer meet such continued stay criteria.” 

The government states that in 2017, CMS observed that LTCHs appeared to be improperly holding patients beyond the key time threshold to obtain the full payment, which resulted in potentially improper delays in patient discharges other than solely for medical reasons.  

As a result, in fiscal year 2018, CMS revised the payment methodology to reduce LTCHs’ financial incentive to delay patient discharges until after the threshold. 

Example of Inappropriate Intent to Maximize Revenue 

The DOJ’s complaint contains statements that appear to imply they have emails or other documentation that show the intent to delay discharge. For example, an executive allegedly emailed a broad group of staff to praise them for getting “patients discharged on their correct discharge day to maximize our revenue.”   

Reportedly, the same executive also developed a bonus plan for a case manager in 2018 that required her to discharge 90 percent of patients on the “ideal discharge date” to receive a bonus. The ideal discharge date was a date calculated in a way (and reported on a dashboard) to lengthen the stay to meet higher reimbursement goals. 

Of course, the claims asserted in the complaint filed by the DOJ are allegations only.  However, most of the time the DOJ is not going to file a complaint if they do not believe they have or will obtain the evidence they need to either pursue the case further in court or lead to a mutually agreed upon financial settlement. 

Requirements for Medical Necessity Determinations 

Medical necessity determinations tend to be circumstance-specific. Auditing and monitoring for medical necessity will also typically require the involvement of a professional with clinical training or background.   

At times, it may be appropriate (if there are no conflicts of interest) to have a medical director from the organization be involved in such determinations. At other times, it may be a better idea to seek independent expertise from someone outside your organization. 

Learn from Examples of Medical Necessity Problems 

Watch for the next article in this series when we take another deep dive into an example of medical necessity in healthcare. In the meantime, browse these curated selections. 

Find More Advice and Ideas in These Related Articles 

• Introductory Article: Understanding Medical Necessity Compliance Risks The first post in this series, covering the foundational definitions and general compliance risks healthcare providers face today. 
• The False Claims Act: A Guide for Healthcare Leaders A deeper look into how inadequate documentation can trigger False Claims Act allegations and the resulting legal stakes for health systems. 
• Strategies for Reducing Claim Denials and Revenue Loss Practical insights into how medical necessity acts as a driver for claim denials and how to improve your revenue cycle workload. 
• Aligning Clinical Care with Evidence-Based Guidelines Learn how to leverage medical necessity standards to improve patient safety and ensure care appropriateness across your organization. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Compliance Risk Is Driven by Medical Necessity Problems  first appeared on YouCompli.

With the release of the CIA changes within the General Compliance Program Guidance (GCPG), the OIG has officially moved the goal posts. This isn’t just a new set of rules for organizations under investigation. 

The May 2026 update to the Corporate Integrity Agreement (CIA) framework signals a definitive shift from passive reporting to active governance. Compliance is no longer an administrative sub-function. It’s now a board-level strategic imperative. 

The OIG’s Modernized CIA: Your New Compliance North Star 

Whether you’re a leader in an acute care organization, or in a non-acute care market like home health, ASCs, labs, or behavioral health, these updates represent your new “North Star.”  

This blog offers a roadmap to navigating the four pillars of this modernized framework. 

• Pillar 1: The Board’s Mandatory Compliance Partner 
• Pillar 2: Catching Every Whisper in the “Any Modality” Net 
• Pillar 3: Technological Accountability and the IT Governance Mandate 
• Pillar 4: The Elevated (and Independent) Compliance Officer 

Pillar 1: The Board’s Mandatory Compliance Partner 

What does the OIG’s mandatory independent board compliance expert requirement mean for healthcare leadership? 

For years, boards could fulfill their oversight duties by simply reviewing a quarterly slide deck. Those days are over. The OIG now requires the appointment of an independent compliance expert with federal healthcare program experience to review program effectiveness and report findings directly to the board. 

An expert is only as effective as the data they have to work with. To be truly “audit-ready,” your organization needs a living, centralized record of every regulatory change and the specific actions taken in response. Without this “evidence engine,” an independent expert will spend hundreds of billable hours just trying to find the paper trail. That could create a massive financial liability for the board. 

Boards are also now mandated to formally respond to the expert’s findings in their annual reports. You can’t “file and forget” an audit anymore. The OIG is looking for a “culture of inquiry” where board members aren’t just receiving information but actively challenging it. 

Pillar 2: Catching Every Whisper in the “Any Modality” Net 

How has the OIG expanded the definition of a healthcare disclosure program beyond the traditional hotline? 

The OIG has finally caught up with how the modern healthcare workplace actually communicates. A “disclosure” is no longer defined by the phone number it was called into. Now it’s defined as any report made through any modality. 

The reality is, in a busy lab or ASC, a compliance concern rarely starts with a formal hotline call. It starts with an email to a supervisor, a quick Teams message between nurses, or an “off-the-cuff” comment in a hallway or breakroom. 

The Roadmap Action: If a billing concern is raised in a Microsoft Teams thread but never makes it into your formal compliance log, you are in violation of the new standards. 

• Modality Audit: You must ensure your intake log captures: 
• Digital Channels: Email, Slack, Microsoft Teams, Zoom chat, and other messaging platforms. 
• Interpersonal Channels: In-person “walk-ins” and verbal reports made to management or HR. 
• The Log Requirement: Every report, regardless of how it is received, must be tracked with its nature, status, and corrective action taken. 

Pillar 3: Technological Accountability and the IT Governance Mandate 

What are the specific OIG reporting requirements for Generative AI and Information Technology in the 2026 CIA framework? 

In perhaps the most significant update to the compliance landscape in decades, the OIG is mandating technological accountability. IT has gone from support service to a governance partner. 

Set a Place for the Mandatory IT Seat at the Table 

The modernized CIA framework requires that the Compliance Committee formally include IT expertise. The OIG recognizes that in a digital-first environment, governance is impossible without an understanding of the underlying infrastructure, data flows, and automated systems. 

The Roadmap Action: Organizations should update their Compliance Committee Charters to include a CTO, CISO, or equivalent technical lead. This individual is responsible for bridging the gap between regulatory mandates and digital execution.

Defining and Inventorying Generative AI as a Requirement 

The OIG has introduced a formal, rigorous definition of Generative AI for reporting purposes. The new definition focuses on foundation models and systems that “generate new content or inferred outputs” used in clinical, billing, or administrative decision-making. 

Your Generative AI Inventory must track: 

1. Life Cycle Use Cases: Identifying where AI is deployed, such as automated utilization reviews, draft patient communications, clinical note summarization, or coding/billing reconciliation. 
2. Deployment Status: Reporting whether a tool is in the “Pilot,” “Pre-deployment,” or “Production” phase. 
3. Data Provenance and Security: Documenting how Protected Health Information (PHI) is shielded from being used as training data for public or foundation models. 

The Risk of “Shadow AI” 

The OIG is particularly focused on “Shadow AI”, meaning automated tools implemented by individual departments without the Compliance Committee’s knowledge. Under the new reporting mandates, a marketing team using an AI bot to answer patient queries or a billing department using a third-party “coding assistant” without formal approval is now a reportable risk. 

By mandating these inventories, the OIG is forcing a shift from “trust” to “verification.” Compliance committees must document their review and approval of any AI tool before it impacts federal healthcare program billing or patient care. This creates a mandatory “accountability trail” that proves the organization is managing AI risks, such as algorithmic bias and “hallucinated” clinical data. 

Pillar 4: The Elevated (and Independent) Compliance Officer 

How is the OIG changing the independence and stature of the Compliance Officer role? 

The OIG is giving the Compliance Officer (CO) role real “teeth.” The new framework explicitly states that the CO must report directly to the CEO and cannot be subordinate to the General Counsel or the CFO. 

This change is about removing conflicts of interest. Legal and Finance have their own mandates, and Compliance must be free to evaluate them both. 

The Roadmap Action: 

• Direct Board Access: The CO must have direct, unfiltered access to the board. 
• Executive Sessions: Mandatory quarterly meetings with the board, including at least one portion in “executive session” without other senior management present. 
• Board Supervision: The board is now responsible for the supervision and performance evaluation of the CO, further decoupling the role from the CEO’s sole influence. 

Conclusion: Your Proactive CIA Readiness Checklist: Four Tactical Steps 

The OIG isn’t about making the job harder. They’re making it more technical and more transparent. To align with these modernized expectations before a regulatory knock at the door, prioritize these four tactical steps: 

1. Appoint an IT Lead to Compliance: Update your charter to include a technical expert who can oversee your AI and data governance. 
2. Conduct an AI Audit: Identify where automated tools are being used. Document what tools are being used, for what purpose, and how the data is being protected. 
3. Centralize Your “Any Modality” Intake: Move away from fragmented email folders. You need a single source of truth that can export a defensible log of every hallway conversation and digital message. 
4. Adopt the Gold Standard Early: Treat these new CIA mandates as a “Pre-Settlement Readiness Review.” Adopting these standards now proves to the OIG that your organization is committed to a culture of integrity, not just the appearance of one. 

Need some help putting together your “evidence engine” and a proactive CIA strategy? YouCompli takes acute and non-acute care organizations from chaos to compliance confidence. Reach out with your questions and challenges. 

Blog Glossary 

• General Compliance Program Guidance (GCPG): The OIG’s definitive framework for healthcare compliance.  
• Active Governance: A model where leadership and the board are directly involved in compliance effectiveness, moving beyond “check-the-box” reporting to formal responses and resource allocation. 
• Corporate Integrity Agreements (CIA): Binding five-year contract between healthcare entity and the HHS Office of Inspector General (OIG), imposed as part of a civil settlement to resolve allegations of fraud or abuse. 
• Shadow AI: The unauthorized or undocumented use of artificial intelligence tools within an organization without the review or approval of the Compliance Committee or IT leadership. 
• Generative AI: A category of technology utilizing foundation models to generate new content or inferred outputs used in clinical, administrative, or billing decision-making. 

Six More Resources 

Four Ways to Engage Leaders in a Culture of Compliance – Building positive, proactive relationships with leaders is crucial to a culture of compliance. Learn four approaches to engage leaders. 

10 Tips for Building a Compliance Culture in Healthcare – The tips explore how you can convince leaders that a strong compliance culture adds value to the organization. 

What to Look for in Regulatory Change Management Software for Healthcare Compliance – A modern regulatory change management (RCM) system does more than just notify you when regulatory changes occur. Learn what’s really possible today and why it matters. 

Your Board Committee Is Only as Effective as You Make It – Ten ways to engage your healthcare compliance board committee. 

How to Use AI for Systems Thinking in Compliance Processes – Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. 

Experts Weigh In: The Oversight Role of a Healthcare Board of Directors – Whether new to the field or a seasoned professional, get ideas on how support your board’s oversight responsibility for the compliance program. 

About the Author 

Jerry Shafran is the founder and CEO of YouCompli with years of experience in the healthcare compliance space.

He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages and sells software and content solutions that simplify complex work. His innovations help compliance professionals focus on their core priorities.  

AI Handbook for Compliance Pro’s

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post OIG Compliance North Star: Roadmap to the 2026 Modernized CIA Framework  first appeared on YouCompli.

Regulatory compliance leadership isn’t for the faint of heart. Every day, leaders in our field face a fundamental choice that dictates the future of their organizations and their careers. It’s a choice between two distinct types of “hard.” 

One path leads to a plateau of administrative burden, while the other leads to a breakthrough in operational excellence. To move the needle on key compliance metrics, you must decide which challenges you’re willing to embrace. 

The Big Job of Regulatory Change Management 

Regulatory change rarely lives in one department. It touches:  

• Compliance  
• Revenue cycle  
• Legal 
• Clinical operations  
• IT 
• Quality 

Someone must translate regulatory language into operational tasks that those teams can execute. That translation step is where many organizations struggle. Well, guess what? You’re the translation step. 

Someone must translate regulatory language into operational tasks that those teams can execute. That translation step is where many organizations struggle. Well, guess what? You’re the translation step. 

Pick the Hard Work and Then Do It 

The compliance professional’s goal is to move metrics. Period. Whether it’s an outcome of no findings during a state inspection, ensuring everyone is signed off on education and training modules, or the weekly operational numbers posted for the entire organization to see, it’s your responsibility You know the work needs to happen. The challenge is getting the organization aligned around it. And that’s hard. 

Your organization’s leaders trust you to handle it, and they probably see you as capable of doing more. This visibility is an advantage, especially if you want to move up in the organization. But be aware, because corporate and everyone else is watching, looking for cracks in the armor or making you out as the target.  

Our advice? Choose your hard. Here’s how.  

Choose Your Hard: Two Options  

We all want an easier professional life. Less stress from daily meetings. More happiness from the validation of receiving praise from a job well done. Fewer complications from multiple people coming to your door every day to solve problems that aren’t yours.  

Here’s the truth nobody likes to admit: There’s no easy path. There’s only a choice between hard options. So, choose wisely.  

As we see it, you have two options: 

Option 1: Keep Doing What You’re Doing: The Administrative Burden of Stagnation 

This isn’t difficult. You’re basically choosing to do the same things you’ve been doing in the same manner. Keep leading the daily morning compliance meeting in the same style. Keep walking through the units waving and shimmying around but not really being authoritative or looking for issues. Talking to employees but not finding anything out, just basically wasting time. 

And please, avoid the hard conversations around people constantly interrupting you with their problems instead of doing what you get paid to do.  

This is hard, but not for the reason you think. This is hard because, well, we know you, you’re busy, but not productive. You are seen, but you aren’t really doing anything. You think you’re managing, but you’re really just walking around. 

You Get Credit for Moving the Needle, Not for Inertia 

You also think you should be promoted and moved up for doing what you’re supposed to do.  

Here’s the hard truth. You don’t get credit for the things you’re supposed to do. If you’re supposed to lead orientation, write policies, make presentations, all that is in your job description. It’s a basic function of your job. You’re not getting additional credit for that. You get credit for moving the needle, not stagnation.  

This version will feel easy in the moment. But over time, it becomes a cycle. Anxiety creeps in. Stress builds quietly. Communication gets messy. You start telling yourself little lies to stay comfortable. You get moments of happiness, but they don’t last because they’re built on escape, not stability. 

When a compliance department functions as a separate silo rather than a strategic partner, the friction is constant. You’re working hard, but you are not working toward a breakthrough. You are merely surviving the administrative weight of healthcare regulations. 

Option 2: Face Challenges Head-on: The Discipline of Operationalizing Compliance 

The alternative is the “hard” of growth. This involves the difficult work of Revenue Cycle Management (RCM) integration, fostering cross-functional alignment, and ensuring that compliance is viewed as a driver of healthcare quality and patient safety. 

It takes discipline to move beyond the checklist and into this strategy. It’s “hard” because it requires changing the culture of an organization, but it’s the only path that leads to: 

• Sustainable Revenue Integrity: Moving from reactive auditing to proactive prevention.
• Enhanced Patient Safety: Aligning regulatory requirements with frontline clinical care. 
• Professional Authority: Establishing compliance as a core pillar of the leadership team. 

Cut the noise. Reduce the dopamine overload. Sit with discomfort instead of running from it. Say the hard things. Build better habits. Run different meetings. If your boss is giving you a directive that you have to go and talk to the director of nursing and get his or her staff to carry out a particular order, don’t walk up to them and go “Hey, boss, wants you to do this” and tell them exactly the same order that was told to you. That’s not changing. That’s parroting.  

You need to do that a bit differently, such as “boss wants your team to do XYZ. Do you know how to do this? Does your team know how to do this? What are the gaps? What can I do for you right now?” 

The Hard Path Is Uncomfortable but Pays Off Over Time 

See the difference? It’s subtle, but effective. Basketball fans can think of it as the difference between telling your basketball team to run the triangle offense and perfecting the triple-post with all your front court repeatedly until it’s second nature, creating multiple scoring options based on defensive reactions. When you repeatedly do the hard thing, it pays off over the long term. 

This hard path is uncomfortable, and at first, it feels worse, not better. It’s hard to sit in the discomfort. But over time, something starts to change. Your brain slows down. Your emotions stabilize. You stop needing constant stimulation just to feel okay.  

And one day somewhere down the line, you realize: You’re not chasing happiness anymore or trying to be the part. You don’t need to wear a three-piece suit to the corporate board meeting. You can wear a Roman Reigns OTC crewneck. You don’t have to pretend to be the part. You are the part. And you are just experiencing it. 

Choosing the Tough Option Compounds the Benefits 

The tricky part about Option 2 is that it doesn’t feel like it’s working at first. That’s where most people quit. Option 2 is harder. But it compounds. It’s the difference between escaping your life and actually building one you don’t need to escape from.  

Be a long gamer because taking the “easy” path now often becomes the hardest life later. And the hard path now? That’s the one that sets you free. 

Andrea has taught first grade in Willoughby, Ohio for 27 years in the same classroom that she attended school as a child. She earned a Bachelor of Science in elementary education with a minor in language arts from John Carroll University and a Master’s Degree in the Art of Teaching and Education from Marygrove College. 

John builds and fixes quality departments, while currently thriving as the Administrator & Director of Quality, Risk Management and Compliance at River Vista, a behavioral hospital in Columbus, Ohio.

---

The Q-Kids – John R Nocero and Andrea L Bordonaro – are experts at everything quality, regulatory, education training and compliance and love sharing their knowledge on YouCompli.

Follow them on LinkedIn – for more quality content or send them a message – they’d love to hear from you.

---

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post The Compliance Leadership Paradox: Why You Must Choose Your Hard  first appeared on YouCompli.

For healthcare compliance leaders, the challenge isn’t just lack of information. It’s a lack of time. 

When a new regulation or update is enacted, the clock starts ticking toward its inevitable effective date and another compliance deadline. Regulatory change management is a moving target with constant deadlines and uncertain task status. 

Without the right tools and systems, all that many compliance leaders can hope for is a link to a government website buried in your inbox from a listserv, or a lengthy regulation that needs reviewed to get started. 

That’s why a modern regulatory change management (RCM) system should do more than just notify you when regulatory changes occur.  

To be truly useful, RCM software needs to transform complex regulations into actionable tasks that clinical and administrative teams can execute without needing law degrees or spending a lot of time extracting all the need-to-implement details.  

Beyond the Regulation: 6 Non-Negotiables for Regulatory Change Management Software 

The shift from uncertainty and static reading material to active management and confident compliance is critical for any modern healthcare system. 

If you’re evaluating a regulatory change management (RCM) solution, look for these six essential capabilities to move your team from “reading” to “doing.” 

Top Requirements for Regulatory Change Management Processes: 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

2. Efficient Relevance Identification and Assessment Saves Time 

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

4. Workflow Accountability and Oversight for Defensible Audit Trail  

5. Proactive Notification and Escalation Reduce Manual Steps 

6. On-Demand Analytics and Reporting for Actionable Data 

1. Expert-Led Analysis for Continuous Regulatory Intelligence and Monitoring 

Many compliance solutions just offer a link to a government website. That’s not enough for healthcare teams that are already stretched and overworked. Asking a pharmacy director or a head of nursing to read a hundred-page statute on drug pedigree requirements isn’t a sustainable compliance strategy. 

Can It Do the Heavy Lifting? 

A true regulatory change management solution does the heavy lifting for you. A best-in-class solution provides not only the source regulations, but analysis for those regulatory changes relevant to your organization or department.  

This analysis serves as a bridge between the legal language of the regulators and the daily operations of the hospital. Model procedures outline updated provisions of regulatory changes, that is – the requirements, in an operational way.  

From “Legalese” to “Actionable” 

For instance, if a new rule regarding patient privacy in telehealth is released, your software shouldn’t just notify you of the change. The tool should provide a comprehensive overview of what’s included in those changes for you to operationalize. The overview provides all the need-to-know information combined with workflow to assign work and track that it gets done.  

By clearly presenting these tasks, the system reduces the cognitive load on your department heads and ensures nothing is overlooked in the transition from “legalese” to “actionable.” When your team knows exactly what they need to do, the risk of non-compliance drops significantly. 

2. Efficient Relevance Identification and Assessment Saves Time 

Not every regulatory change applies to every organization. Identifying if a regulation or part of one that applies to your organization can take time, resources, and effort to read and see if, how and what applies. A regulatory change management solution should facilitate identification of what’s relevant. Then you can put a quick focus on regulatory changes that specifically impact your organization.  

Capabilities That Reduce Effort Spent Reading Regulations 

Regulation Relevance Check: Your software should guide you through a relevance check and allow you to quickly (within a minute or less), identify if a regulation is relevant or not. 

The “Don’t Know” Button: If a user is unsure of how to answer a question to determine relevance, the software should provide the ability to assign questions to additional staff who have information needed to answer yes or no. Look for a workflow solution that allows you to reach out if you’re unsure of the answer. 

Once the subject matter expert provides their response, you decide if the requirement is relevant as assisted by the question tips. These walk you through the relevance decision-making process.  

The workflow process ends at Step One for requirements that aren’t relevant. It progresses to task assignment and review only for the regulatory work your organization actually needs to get done.  

3. Automated Assignment Mapping to Departments, Assignees and Monitors 

In a busy health system, the person doing the work isn’t always the person who needs to verify that it was done. That creates blind spots and broken workflows. 

Regulatory change management (RCM) software avoids this by allowing you to: 

• Automate Assignments by Department: Assign requirements based on staff department (e.g., pharmacy, radiology, professional fee revenue cycle). 

• Differentiate Roles: Software distinguishes between an Assignee (the person doing the work) and a Monitor (the person providing oversight/cc’d). 

• Set Audit Trails: Every comment and status change should be time-stamped with the username to ensure a defensible record for future audits. 

RCM software reflects your organization’s reality through distinct user roles and automated workflows to them. These roles define who has the hands-on responsibility and who has oversight responsibility, creating a clear chain of command. 

The Role of the Monitor 

The monitor role is an essential feature of modern change management software. Think of this as a structured “cc” function. A department director might need to see that a change is occurring without being the one to upload proof of completion. This keeps leadership informed and accountable without cluttering their daily task lists.  

For instance, a Chief Nursing Officer might want to monitor the progress of a new patient safety protocol across multiple departments without being responsible for each individual task. This separation of duties is a hallmark of a mature compliance program. 

Smart Duplication for Scalable Efficiency 

Also look for “smart duplication” in regulatory change software. For example, if you manage five different hospitals, you shouldn’t have to manually create five identical tasks. An “Assign to All” feature lets you create unique, trackable requirements for each location simultaneously.  

Each hospital administrator receives their own task, but the corporate compliance office can see the progress of all five locations in a single view.  

This maintains centralized oversight while ensuring local accountability. This feature is particularly useful for large health systems that need consistency across dozens of locations and departments while allowing for local execution. 

4. Workflow Accountability and Oversight for Defensible Audit Trail 

The saying goes that if it wasn’t documented, it didn’t happen, and sometimes that applies to healthcare audits. An effective audit trail should be able to reconstruct the entire decision-making process for any given regulation. 

Your software shouldn’t just track completion status. It should capture the entire story of your compliance efforts, providing a clear path for auditors to follow.  

Centralized Commenting Backs Up Workflow Decisions 

Centralized commenting is a key part of a defensible audit trail. Compliance leaders can move away from fragmented check-in emails and internal chat threads. Instead, all discussions regarding a specific regulation live inside a dedicated task workspace.  

This creates a time-stamped, unalterable record of: 

• Who made decisions 
• What questions were asked 
• When work was completed 

If an auditor asks why a certain policy was changed six months ago, you can provide the exact thread of discussion that led to that decision. This level of transparency builds trust with regulators and simplifies the audit process. 

5. Proactive Notification and Escalation Reduce Manual Steps 

Compliance shouldn’t be a surprise. Proactive notification and escalation ensure that deadlines are known and met. A good compliance management system sends automated reminders well before an effective date passes.  

If a task remains untouched as a deadline approaches, the software should trigger a proactive escalation to supervisors. This ensures potential gaps are addressed before they become regulatory violations.  

Automated escalations remove the need for compliance officers to manually follow up with department heads, saving time and reducing friction between departments.  

Proactive Notifications Improve Efficiency 

A static dashboard is where compliance tasks go to die. Instead, look for a dynamic, proactive system that pushes information to your team. With email integration, direct links from an email notification take users straight to their requirement and task workspace in the software. 

6. On-Demand Analytics and Reporting for Actionable Data 

The Analytics Dashboard is designed for what healthcare compliance leaders need to see: 

• What’s overdue?  
• Where do I need to focus?  
• What do we need to do? 

With one click, see everything happening in the workflow, then export important information into spreadsheets or slides for sharing or presenting.  

The outcomes of using a dashboard to manage compliance workflow are: 

• Efficient, reliable access to real-time, high-quality data 
• Simplicity and ease of use save time 
• Visibility and transparency lead to peace of mind 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation for details of dashboard information and insights into completed work. 

Next Steps in Your Software Journey: Look for a Partner, Not a PDF Repository 

When evaluating software vendors, ask if the solution actually helps you do the work or does it just give you more things to read. The right regulatory change management software doesn’t stop at sending notifications of regulatory changes. Instead, it actively manages your workload.  

By prioritizing expert analysis, intelligent relevance filtering, and clear role definitions, a good software tool can move your compliance department from an underappreciated burden to a streamlined operational partner.  

A truly effective solution empowers your staff and provides peace of mind to executive leadership. The goal is a culture of compliance where every team member knows exactly what is expected of them and has the tools to achieve it. We share that goal. Reach out if you’d like to know what regulatory change management software can do for you. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post What to Look for in Regulatory Change Management Software for Healthcare Compliance  first appeared on YouCompli.

Ensuring medical necessity for services or supplies isn’t just about getting paid. It’s a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders. 

This is the first article in a series on medical necessity — an area that many compliance programs struggle with. In this piece, we explain the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems. 

Impact of Denial Rates and Medical Necessity on Payer Costs  

Data suggests that medical necessity is becoming a primary way for payers to manage costs, making it even more worthy of leadership attention. The “State of Claims 2025” Report found that 54% of providers agree claim denials are increasing faster than they can appeal. 

A data accuracy gap also contributes to the problem. Roughly 41% of healthcare organizations report at least 1 in 10 claims is denied, often due to “bad data” at intake or lack of clinical justification. 

All of this creates further justification for the need to better understand medical necessity from a compliance standpoint. 

Role of Clinician Review in Determining Medical Necessity 

Medical necessity isn’t an easy compliance risk to tackle, especially when OIG recommendations bump up against front-line reality. Sometimes, clinicians view medical necessity as their bailiwick.   

Of course, their expertise is the basis for medical decision making. Generally speaking, clinicians are making their decisions based on what they believe is medically necessary. They are the clinically trained professionals and should know when something is medically necessary or not, right?  

However, from a compliance standpoint, medical necessity often really means “covered” by a third-party payor. If something is considered “not medically necessary,” it may actually mean it does not meet payor coverage requirements. 

OIG on Clinical Review of Medical Necessity in Claims Audits 

In their General Compliance Program Guidance document (GCPG), the Department of Health and Human Services (HHS) Office of Inspector General (OIG) emphasized the importance of ensuring claims submitted to government payors are medically necessary. 

Specifically, they note:  

“Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Considerations for Compliance Risks in NCD and LCD 

Other entities have also emphasized medical necessity as coverage criteria. For example, Medicare publishes National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs). These are, in essence, coverage criteria for a specific service.  

Though generally accepted medical guidelines or medical practice may suggest a certain treatment plan is appropriate, the LCD might not cover the service for a particular condition or diagnosis or might not allow the service at a particular cadence or frequency. 

Example: Meeting LCDs for Pain Injection Procedures 

LCDs addressing pain injection procedures are a good example of this. A Medicare LCD might state that before Medicare considers a spinal injection “medically necessary” (think “covered”), the patient needs to have failed four months of conservative therapy (e.g., lifestyle changes, physical therapy, etc.)   

Or the LCD might state a total of four injections in a twelve-month period is the maximum number of injections they will allow. Additionally, an LCD might require that a patient has a certain condition (represented by an ICD-10 or diagnosis code i.e., diagnosis code) before considering a service covered.   

There is potential compliance risk in all these areas if coverage criteria are not met and documented in the medical record or if codes are reported to ensure coverage, but the medical record does not support the diagnosis code reported. 

Overlap with Patient Safety 

Medical necessity can also overlap with patient safety issues. If a physician exaggerates the severity of a condition to make it look like the services should be covered, a patient could undergo a procedure that was not appropriate or medically necessary to perform in the first place.  

This raises patient safety issues for subjecting a patient to certain risks when the service does not appropriately meet clinical standards or indications for performance. 

How Medical Necessity Compliance Is Enforced 

The government utilizes various tools for enforcing medical necessity compliance.  These include the False Claims Act (FCA), typically used by the U.S. Department of Justice (DOJ), and the Civil Monetary Penalties Law (CMPL) utilized by the OIG. 

The DOJ can investigate allegations of medically unnecessary services when credible information is brought to its attention by whistleblowers (qui tam relators). A qui tam relator is a private individual or entity who files a lawsuit on behalf of the government under the FCA against companies or individuals committing fraud. Or the DOJ can investigate on their own, typically because of data analytics they proactively perform. 

How OIG Pursues Financial Penalties and Program Exclusion 

The OIG is authorized to pursue monetary penalties and exclusion through a variety of civil authorities, most notably the CMPL. Under the CMPL, OIG can seek assessments in lieu of damages, Civil Monetary Penalties (CMP), and exclusion from participation in federal health care programs.   

According to the OIG, one example of conduct that could lead to CMP liability is presenting a claim for a pattern of medical or other items or services that a person knows or should know are not medically necessary. 

Medical Necessity Risk Tied to Clinical Services 

There isn’t a one-size-fits-all risk profile when it comes to medical necessity. Each organization’s risk is going to be tied to the clinical services it offers or orders. Organizations and their compliance programs should undertake risk assessments tailored to their particular situation.  

Via the GCPG document, the OIG recommends that when conducting risk assessments, organizations should “ensure that medical necessity, patient safety, and other quality compliance issues are included in the risk universe.” 

Download Tip Sheet

Coming Articles: Details of Recent Enforcement Actions 

In subsequent articles in this series, we’ll take a closer look at the details of recent enforcement actions involving allegations that submitted claims lacked medical necessity. This information will help compliance leaders stay on top of situations and reduce risks in their own organizations.  

Read Part Two Here

About the Author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 27 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Medical Necessity: A Guide for Healthcare Compliance Leaders  first appeared on YouCompli.

For years healthcare leaders have been faced with demonstrating their value and answering the question, “How is compliance doing?” Getting the answers typically involves a scattered, manual process of pulling data from multiple sources, departments, and teams, then going through the process of aggregating that data to pull important, need-to-know information. By the time that step is complete, often the information is already out of date. 

Compliance Confidence with Real-Time Data. Now You Have Answers. 

We knew there was a better way, and who better to partner with than our existing clients? With our expertise and their input, we developed the new YouCompli Analytics Dashboard, now a standard tool within YouCompli Software for all clients.  

This blog explains what the YouCompli Analytics Dashboard is and how it helps compliance leaders demonstrate the immense value they bring to an organization through their ability to monitor and oversee regulatory work in real time. 

Problem: Accessing Important Compliance Metrics and Data 

Compliance leaders need to monitor and oversee regulatory work throughout the organization, and that can be very challenging. Many organizations lack the time and resources to quickly access regulatory information that may be scattered across an organization and then roll it up into a reportable and actionable result. 

The Solution: Real-Time Metrics and Transparency 

The YouCompli Analytics Dashboard takes regulatory changes and immediately provides you with information on key performance indicators (KPIs) when it comes to compliance. These KPIs are simple to access.  

Just identify the date range of information you want to review and let YouCompli take it from there. You’ll be provided with real-time, on-demand information on all the need-to-know metrics when it comes to implementing and complying with new and updated regulations.  

Task Status: Summary of current task status (e.g., accepted, assigned, in progress, completed) of task due dates within the selected date range. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Instead of pulling multiple reports in YouCompli to filter, sort, and manipulate to showcase the regulatory work, now by entering a date range, we’ll do all the hard work for you.  

• Want to know how long it takes you to comply with new regulatory requirements? YouCompli will tell you!  
• Want to know exactly what hasn’t been done yet? See the total amount and then click the number to have the list of overdue requirements at that moment.  
• Doing great? See your overall requirement and task completion rates immediately on how your organization is doing from 0% – 100% to get right to the work that needs to get done or celebrate your accomplishments for a job well done.  

Benchmark data, set goals, and have real-time information to measure improvements against previous performance. 

YouCompli Analytics Dashboard = Operational Accountability 

The YouCompli Analytics Dashboard brings transparency to all departments to evaluate where compliance activities are timely and complete. It also allows you to identify gaps in regulatory oversight and accountability and ensures you’re able to quickly address them. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Requirement Status: Summary of current status (e.g., accepted, assigned, in progress, completed) of requirements effective during the selected date range. 

The YouCompli Analytics Dashboard brings to light regulatory compliance activities and how the work is distributed across an organization. It gives insight into: 

The value of regulatory change management software. 

• How many regulations did our organization review? 
• How many regulatory changes have we completed? 
• How many regulatory changes have yet to be done, and … 
• Does this pose potential risk of penalties, fines, investigations or reputation? 
• How are we doing overall? 

YouCompli Analytics Dashboard = Everything You Need to Know 

Nothing comes close to the YouCompli Analytics Dashboard when it comes to quickly and easily monitoring and overseeing the state of regulatory compliance. Whether you’re looking for high-level information for boards and senior leadership teams or more detailed information for compliance committee or department-level teams, the YouCompli Analytics Dashboard provides all the need-to-know information.  

Requirement Completion Rate: Percentage of requirements effective within the selected date range that have been completed. 

Task Completion Rate: Percentage of tasks completed for requirements effective within the selected date range.  

YouCompli Analytics Dashboard Overview 

The YouCompli Analytics Dashboard provides your organization with the following information: 

• Requirement and Task Completion Rates 
• Average Number of Days to Complete Regulatory Requirements and Tasks 
• Requirements Completed with Missing Important Information (Relevance) 
• Total Requirements and Tasks Overdue  
• Total Volume of Regulatory Requirements Published/Assigned in YouCompli  
• List of All Requirements and Tasks Completed 
• Regulatory Requirement and Task Status (Assigned, Accepted, In Progress and Completed  
• Regulatory Requirement Heat Map: Top 5 Departments with Overdue Regulatory Requirements 
• Open Regulatory Requirements Across All Departments 
• Software Utilization Monitoring (Software User Activity and Requirement Completions) 

Example: Values link to detailed reports showing all contributing data. 

What the Data Means: 

Average Days to Requirement Completion: Average number of days between requirement published date and requirement completion date for requirements effective within selected date range.   

Average Dates to Task Completion: Average number of days between the task assigned date and the task completion date for tasks associated with requirements effective during the selected date range.   

Total Requirements Completed, Relevance Unknown: Total number of requirements completed within the selected date range, but relevance status was not answered.  

Total Requirements Overdue: The total count of incomplete requirements past their effective date within the selected timeframe.  

Total Tasks Overdue: Total number of tasks not completed and past their due date within the selected date range. 

YouCompli Analytics Dashboard Demonstrates Your Compliance Value 

The YouCompli Analytics Dashboard is standard part of the YouCompli software and is just one of the ways our client success team works for clients every day. We take feedback and opportunities to continuously improve for the valued clients we serve every day. Want to learn more? Let’s start a conversation. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Healthcare Compliance KPIs: Real-Time Data Dashboards  first appeared on YouCompli.

For healthcare compliance leaders, financial literacy is not optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  

To identify anomalies or potential regulatory “red flags,” compliance officers must move beyond a high-level view of healthcare finance and understand how clinical operations translate into financial entries. 

What does a compliance leader need to understand? Things like: 

• Budgeting and capital planning 
• Internal controls and risk 
• Grant and research compliance  
• Key performance indicators (KPIs) 
• Communication between CFO and compliance officer 

Familiarity with the 14 steps of the revenue cycle is also valuable for mitigating risks associated with reimbursements and 340B compliance. (This topic is covered later in the blog.) 

Where Do Healthcare Compliance and Finance Intersect? 

Regulatory compliance and healthcare finance overlap in multiple ways. Compliance-related areas with a financial angle include: 

• Medicare, Medicaid reimbursement 
• 340B drug pricing 
• Stark Law and anti-kickback statutes 
• Charity care 
• Financial assistance requirements  

What Should Compliance Leaders Understand About Financial Statements? 

To build fiscal literacy, let’s start with some foundational concepts – financial statements. Compliance officers should have a basic understanding of these types of statements: 

1. Balance Sheet 
2. Income Statement 
3. Cash Flow Statement 

1. The Balance Sheet: Assessing Financial Integrity Through a “Snapshot” 

The balance sheet provides a snapshot of an organization’s financial health at a specific point in time, detailing its assets, liabilities and equity. 

Why Compliance Should Care: Monitoring the balance sheet helps ensure that assets are properly recorded, and that liabilities like these are appropriately disclosed: 

• Potential legal settlements 
• Debt obligations 
• Medicare overpayments 

2. The Income Statement: Monitoring Operational Risk Over Time 

Unlike the balance sheet snapshot, the income statement tracks revenue and expenses over a specific period, such as a month or a fiscal year. The income statement puts a focus on total revenue and expenses, and the difference between them, while distinguishing between operating and non-operating items. Those two concepts are compared in the chart below. 

In an income statement, it’s important to distinguish between accrual-basis accounting (matching revenue to period it was earned) and cash-basis accounting (recording transactions only when money changes hands). 

Why Compliance Should Care: By comparing current monthly performance against previous years, compliance officers can spot outliers in revenue or sudden spikes in expenses that could indicate billing errors, “upcoding,” or improper financial arrangements under the Stark Law. 

3. The Cash Flow Statement: Ensuring Operational Sustainability 

The cash flow statement tracks the actual movement of cash into and out of the organization, categorized by: 

• Operating activities 
• Investing activities 
• Financing activities 

Why Compliance Should Care: Understanding cash flow is vital for making sure the organization has liquidity to maintain compliance standards even during times of financial strain. A significant discrepancy between reported net income and actual cash flow can signal deep-seated issues with revenue cycle integrity.  

Revenue Cycle as Regulatory Roadmap 

For a prepared healthcare compliance leader, the revenue cycle isn’t just a financial process; it’s a regulatory roadmap. From initial patient interaction to final collection, each step presents a unique set of compliance risks that can lead to audits, fines or loss of reimbursement if not managed with understanding. 

What Compliance “Trapdoors” to Watch for in the Revenue Cycle 

The revenue cycle is full of complexity, largely fueled by the impact of different hospital types (PPS, critical access, disproportionate share, and tribal hospitals) on Medicare and Medicaid rates. 

While the full revenue cycle has 14 distinct stages, compliance officers should pay particular attention to these “trapdoors” where financial operations must meet strict federal regulations: 

• Front-End Integrity (Scheduling and Registration): Accuracy is paramount to ensure Medicare and Medicaid reimbursements aren’t jeopardized by incorrect patient data or lack of prior authorization. 
• Clinical Documentation and Coding: This is a high-density risk area. Compliance must make sure that coding reflects the actual services provided to avoid allegations of “upcoding” or “unbundling,” which can trigger False Claims Act investigations. 
• 340B Drug Pricing Program: If an organization participates in 340B, the revenue cycle needs rigorous internal audits to establish compliance with drug diversion and duplicate discount prohibitions. The stakes will be even higher if the program undergoes potential changes regarding payment models. 
• Billing and Claims Submission: Errors in this stage directly impact the Clean Claim Rate. More importantly, consistent billing errors for federal healthcare programs can lead to significant liability under Anti-Kickback Statutes or the Stark Law if improper financial relationships are found. 

Monitoring Denial Management at Back End of Revenue Cycle 

A robust compliance program monitors the back end of the revenue cycle as closely as the front. Analyzing denials can reveal systemic issues in documentation or billing practices that, if left unaddressed, represent both financial loss and compliance vulnerability. 

What KPIs Should Compliance Watch as Part of Financial Oversight? 

For a healthcare compliance officer, financial data is more than just a reporting requirement. It’s a proactive tool for risk assessment. By monitoring specific KPIs, compliance teams can move from reactive auditing to strategic oversight and identify operational stressors before they escalate into violations. 

The “Big Four” Financial KPIs for Compliance Officers 

Comprehensive financial oversight should track these four metrics: 

• Operating Margin: This measures whether the organization’s core clinical mission is profitable after all operating and overhead costs are paid. A shrinking margin often leads to “cutting corners” in staffing or documentation, which directly increases compliance risk. 
• Days Cash on Hand: This indicates liquidity. How many days can an organization operate using its current cash reserves if all revenue stopped? Higher liquidity provides the financial “breathing room” to maintain compliance and quality standards even during economic downturns. 
• Clean Claim Rate (CCR): A high CCR (ideally 95% or higher) indicates that claims are being submitted without errors the first time. A low rate is a red flag for systemic billing or documentation errors that could trigger federal audits under the False Claims Act. 
• Payer Mix: It’s critical to understand the percentage of revenue coming from Medicare, Medicaid and private insurance. In many healthcare models, Medicare functions as a “break-even” payer, while Medicaid reimbursements often fall below the actual cost of care, placing additional pressure on revenue integrity. 

What to Know about Budgeting and Internal Controls 

Compliance officers should also distinguish between the Operating Budget (daily/annual clinical operations) and the Capital Budget (typically reserved for long-term investments or items over $10,000). 

To prevent fraud and ensure financial integrity, a compliance program must enforce strict segregation of duties. This assures that no single individual has control over all aspects of a financial transaction, serving as a primary defense against embezzlement and improper financial reporting. 

Using the SBAR Tool to Structure CFO and Compliance Communication 

The most effective healthcare compliance programs are those where the Chief Compliance Officer (CCO) and Chief Financial Officer (CFO) operate as strategic partners.  

However, communicating complex compliance risks in a way that aligns with financial priorities requires a structured approach. This is where the SBAR tool (Situation, Background, Assessment, Recommendation) becomes invaluable for justifying financial decisions and resource allocation. (Download a helpful SBAR template at the end of this article)

Four-Step Method for Financial Advocacy 

Use this four-step method to present compliance needs to your finance team: 

• Situation: Clearly state the immediate financial or regulatory issue.  
  Example: “We have identified a 15% discrepancy in our 340B drug pricing audits.” 

• Background: Provide the necessary context and data.  
  Example: Current Medicare reimbursement rates for these drugs are subject to strict transparency requirements. 
   
• Assessment: Offer your professional analysis of the risk.  
  Example: Failure to rectify this documentation gap poses a significant risk to operating margin and regulatory standing and could trigger a federal audit. 
   
• Recommendation: Propose a specific, data-backed solution.  
  Example: “I recommend an immediate investment in automated tracking software as part of the next capital budget cycle.” 

How Compliance Can Secure a “Seat at the Table” 

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  

Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.  

Ready to drive more compliance value? Reach out to see how YouCompli can help.  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  first appeared on YouCompli.

This Q&A with compliance expert, Lisa Herota, RHIA, CHC, CHIAP, CHPS, CCS covers best practices for a data-savvy compliance leader. Learn about realistic compliance metrics and how to share them effectively. Read more about Lisa’s background and experience at the end of this blog. 

Question 1 – How do you define value in the context of healthcare compliance? What kinds of value can compliance create? 

Lisa Herota – Compliance has a positive impact on financial, clinical and operational outcomes when we manage compliance well overall, not just by avoiding penalties.  

We help the organization safeguard the mission and reputation by: 

• Protecting revenue  
• Enabling ethical growth 
• Maintaining patient safety 

We do this all while also making our leaders feel more confident. They can make informed decisions through a compliance mindset, versus just worrying about how we’re going to avoid a penalty. 

Q 2 – Can you share examples of how you’ve created value or seen others do it? 

LH – One approach I’m proud of is strengthening organizational trust and reputation by developing a culture of compliance. This happens through:  

• Rounding and being present in the organization 
• Doing trainings  
• Partnering with leaders, medical staff, employees and even patients 

I’ve taken compliance teams from being the department where ideas go to die or the “Department of No” to being seen as a function that engages and supports. We became a resource that leaders want to bring to the table at the beginning of projects and discussions as a support versus just somebody to call when things go wrong. 

Q 3 – How do you measure and quantify compliance value?  

LH – I love data. I preach data, data, data to all compliance leaders. There are lots of different metrics we don’t think about, but many times, we just look at how we avoid fines. 

Actually, compliance has a lot of data for leaders to study. We can:  

• Look at percent of applicable regulations implemented on time.  
• Look at number and severity of audit findings or corrective action plans implemented.  
• Trend reported issues and how quickly those issues were resolved.  

Compliance Metric: Tracking the Near Misses 

Something that compliance leaders don’t think about often enough are the near misses. We usually think about these situations in patient safety and quality. But many times, compliance can help with close calls, and we should track those.  

Compliance Metric: Financial Value from Correct Regulation Implementation 

Common examples of financial value derived from correctly implementing new regulations include: 

• Reductions in external legal expenses 
• Decrease in denials and claw backs or repayments 
• Additional revenue capture  

Compliance Metric: Operations Staff Hours Saved 

You can talk to your operational leaders about how their team workloads benefit, especially if you have good regulatory change management tools with reporting and dashboards. Many times, I’ve tracked the number of hours saved that operational leaders don’t have to spend reading through regulations to decipher and interpret them.  

Department heads save valuable time when we provide them with tools like policy templates, implementation information, and the interpretation of the regulation itself. So, the hours compliance saves other department leaders is a good metric, too. 

Hard for Compliance to Quantify: Harm Avoidance  

It’s difficult for compliance professionals to quantify how they help the organization avoid harm. It’s definitely easier for revenue-generating departments to show their value, because they can measure the revenue they drive.  

But compliance often concentrates on how we avoid fines, and it’s hard to prove we’ve truly avoided something when the attitude is “Maybe we wouldn’t have gotten that fine anyway, regardless of what we do or don’t do.” That’s why I focus on other metrics. 

Q 4 – Who needs to know about the value that compliance creates, and how do you communicate that? 

LH – That’s a great question. There are various levels across any health system or organization that need to know the value that compliance has created, but the way you report it is going to look different based on whom you’re talking to.  

Talking to the Board 

When I’m presenting to my board or board committees, I target risk mitigation trends, assuring them we’ve got this. I use heat maps that show risk rankings, prioritization and key regulatory risk areas. I use implementation rates or key issues identified and resolved. When I’m talking to my board, I highlight how compliance work aligns with the strategic priorities of the organization.  

Talking to the Executive Team 

But when I’m talking to my executive team, I might get a little more granular with how many reduced denials or repayments or how many claw backs we avoided. Also, that metric about saving frontline leaders’ time, because that affects their operational teams as well as alignment with patient safety, quality and patient experience goals. A key metric is showing executive leaders how compliance ties into all the other objectives that the organization is trying to accomplish.  

Talking to Operational Leaders and Frontline Teams 

It’s a very different story when I’m talking to operational leaders or frontline staff.  With them, I focus on how I’m helping them succeed:  

• Fewer surprises related to regulations that apply to them 
• Reduced fire drills from reactive implementations versus steady, methodical implementation of regulatory change. 
• With good policies, procedures and training 

With frontline staff, it’s all about what compliance does. Proving compliance value is about showing them how we:  

• Impact their day-to-day reality. 
• Make changes to protect them and their patients. 
• Help make their work easier and safer. 

Really, it’s all about how we help support them and affect their day-to-day work. 

Tie Compliance Work to Strategic Goals for Value Recognition 

To overcome compliance reporting roadblocks, I go back to tying compliance’s work directly to the organization’s strategic goals. Just connect what we do to what the organization is focused on. Show how what we do impacts quality, CMS, star ratings, financial stability, the growth of new service lines and innovation.  

We need to connect what we do to optimizing and streamlining those goals and processes. 

Q 5 – What feedback have you had about compliance metrics and value? 

LH – One of the stories I love to share is about the day I was presenting a regulatory change management dashboard to my board. The very first time, I showed them that over the course of a year, the compliance team had touched over 535 regulations. It was the height of Covid, and when I presented that dashboard, board members just sit back in their chairs almost with a collective sigh.  

And they said, with the data you present, we can see what’s happened to the organization. We’re not just hoping we’re compliant. Now we can prove it. We can show that the organization truly is operating in a compliant manner. That was one of my biggest takeaways from frontline leaders.  

Other feedback I’ve received includes: 

• “I feel like compliance is supporting and partnering with me, not just telling me no or being a barrier.” 
• “When we streamlined compliance tools, that really helped support compliance functions.” 
• “Compliance saves us time and work by not having to review, interpret and decipher complicated regulations.” 

Leaders feel confident knowing we’re not missing anything and that they’re being supported. 

Be a Confident, Data-Driven Compliance Leader 

Wouldn’t you like to feel the same way about your compliance program? Reach out and we’ll show you some of the compliance management tools mentioned in this blog. 

About the Author 

Lisa Herota is a seasoned healthcare executive with over two decades of experience leading high-impact initiatives in compliance, privacy and health information management (HIM). She brings a strategic, data-driven approach to safeguarding organizational integrity. 

Throughout her career, Lisa has held pivotal leadership roles at several medical systems. Her expertise spans the full spectrum of healthcare operations, from managing complex ICD-9 and CPT coding systems, to overseeing departmental budgets and navigating rigorous accreditation standards. 

Lisa is a recognized expert in regulatory change management and is passionate about transforming compliance from a “policing” function into a proactive business partner. She holds an impressive array of professional certifications that underscore her deep technical knowledge, including: 

• RHIA: Registered Health Information Administrator 
• CHC: Certified in Healthcare Compliance 
• CHIAP: Certified Healthcare Internal Audit Professional 
• CHPS: Certified in Healthcare Privacy and Security 
• CCS: Certified Coding Specialist 

Beyond her technical skills, Lisa is a dedicated advocate for building a culture of compliance. She leverages her background in research and data compilation to provide executive leadership with insights to make informed, ethical and growth-oriented decisions.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?  first appeared on YouCompli.

Why Managing Compliance Risk Is Like Eating Spinach 

The overwhelming pace and complexity of healthcare regulatory change have become so routine that the constant grind now poses a distinct compliance risk to the organization it’s intended to protect. 

Yet, many hospitals still treat regulatory change as a routine monitoring activity, failing to adopt the systems thinking and discipline necessary to truly mitigate the risk.  

This article by a top healthcare compliance expert explains what it takes to make that transformation. (She also explains what spinach has in common with compliance risk assessment.) 

Beyond Spinach: A Systems Thinking View of Regulatory Change  

’Tis the season! Compliance risk assessment season, that is.  

Many healthcare organizations are in the middle of this annual “eat your spinach” preventative exercise, with compliance folks wandering the halls asking executives what keeps them up at night.  

This year, a CFO for one of my hospital clients raised a significant risk that is so ever-present it’s often treated as a constant rather than a risk. The pace and complexity of regulatory change in healthcare are so familiar that they’re easy to overlook as a distinct risk.  

Regulatory Change Complexity as Permanent Risk  

For those who do recognize and record risk, this one almost certainly hits near the top of the scoring index. Regulatory change in healthcare isn’t an occasional disruption. It’s a permanent condition of the operating environment.  

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity rather than applying systems thinking. Updates are tracked. Summaries are circulated.  

But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

Systems Thinking Brings Structure to Reducing Compliance Risk 

From a systems-thinking perspective, this is a structural failure, not an execution problem.  

A persistent, high-scoring risk should not rely on individual effort, institutional memory, or ad hoc judgment calls to be managed effectively. It should be supported by infrastructure that reliably converts inputs into outputs.  

In this case, the input is regulatory change. The needed outputs are: 

• Applicability analysis 
• Operational decisions 
• Documented rationale 
• Accountable follow-through 

Failing to Operationalize Compliance Leaves You Open to Risk 

That’s where many regulatory compliance programs feel the strain. The risk isn’t failing to notice regulatory change. The risk is failing to operationalize it in a consistent, defensible way, especially across multiple departments, leaders, and decision points.  

From Effort-Based Compliance to System-Based Compliance 

Coming out of risk assessment season, this creates an opportunity to ask a more fundamental question: Do we actually have a system for managing regulatory change, or do we just know it’s a problem?  

Seen this way, the value isn’t the technology itself. It’s the shift from effort-based compliance to system-based compliance. And with systems and technology, you can do all this in a way that is repeatable and reviewable.  

In short, “eating your spinach” and doing annual assessments is good discipline. Relying on systems is how you stay healthy the rest of the time.  

About the Author 

As principal for AlloImpact LLC, Lisa Estrada provides Strategic Interim Compliance Leadership to hospitals, health systems, health industry vendors, and other healthcare organizations when a leadership vacancy or transition creates an inflection point—turning the moment into an opportunity to pivot, strengthen, and systematize.  

Whether bridging a CCO gap, stabilizing during mergers or growth, responding to heightened regulatory scrutiny, or modernizing a program that’s outgrown its practices, she helps teams build frameworks and cultures that endure. 

Lisa’s work centers on building systems that make compliance durable. By designing and helping teams implement repeatable, resilient processes that scale and stand under scrutiny, Lisa helps organizations move beyond heroics, so compliance keeps working even when key people change. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post From Manual to Scalable: How to Manage Healthcare Compliance Risk  first appeared on YouCompli.