A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.

What Healthcare Compliance Teams Want from Regulatory Change Management Software

by Amy Laufmann, MBA

What do healthcare compliance teams actually value in regulatory change management software?

Each year, YouCompli asks clients to evaluate the software, regulatory content, and support they rely on to manage regulatory change. This year’s annual client satisfaction survey received responses from 30.68% of recipients, providing direct insight into what’s working, where teams see opportunities for improvement, and what they expect from the technology supporting their compliance programs.

We spoke with YouCompli Client Success leader Amy Laufmann, who manages the survey process, about what clients told us and how their feedback influences product development, training, support, and future innovation.

Client Survey Snapshot

Direct feedback from healthcare compliance leaders

30.68% annual survey response rate

01

Software & Workflow Dashboards, reporting, functionality, and day-to-day workflow

02

Service & Training Support, responsiveness, implementation, and user education

03

Regulatory Content Information and tools for operationalizing regulatory change

The feedback covered individual feature requests, but several broader themes emerged. Together, they provide a useful picture of what healthcare compliance leaders expect from the technology, information, and support surrounding regulatory change management.

What We Heard

Five priorities consistently surfaced in client feedback

01

Simpler workflows

Teams want unnecessary steps removed and task-level work streamlined without losing accountability or documentation.

02

Useful real-time analytics

Compliance leaders want meaningful metrics available directly from the work already happening inside their workflows.

03

Responsive support & training

Effective technology still requires support that identifies knowledge gaps and helps individual users work confidently.

04

Relevant regulatory content

Teams value more than software functionality. They also need reliable information that helps them understand and implement change.

05

Flexibility for different health systems

No two organizations use compliance technology exactly the same way. Workflows, access, assignments, and reporting need to support different organizational structures and operating models.

Client Success Q&A

Client Feedback, Product Innovation, and Support

Q

What do you hope to learn from YouCompli clients?

Amy Laufmann

We want to gain detailed insight into how clients assess the overall value that the software provides to their organizations. Client satisfaction survey questions are broken down into three categories:

• Software features and functionality (dashboard, reports, workflow)
• Client service (support, training, responsiveness)
• Regulatory content (information and tools to implement regulatory changes)

Q

How has capturing client input evolved?

Amy Laufmann

When we began building the client success program, our outreach focused on engagement, relationship building, and resource sharing. Last year, we shifted toward gathering insights and identifying additional content that could help clients.

This year, the focus is on value and satisfaction: What’s working? What isn’t? Both positive and critical feedback are useful. When clients who use the full solution suggest ways to make it even better, that gives us valuable direction.

Q

Who received surveys in healthcare systems?

Amy Laufmann

Surveys were sent to compliance executives and leaders most directly responsible for administering the software within the health system, not to everyone receiving work through the solution.

The only clients who wouldn’t receive the annual survey are those who aren’t fully implemented yet. If they haven’t finished implementing the software, it doesn’t make sense to ask them to evaluate a full year of use. Instead, we gather feedback during onboarding and send an onboarding satisfaction survey once implementation is complete.

Q

What themes came out of the responses this year?

Amy Laufmann

We do get granular feedback, like “adjust this particular piece of the software,” but we also see themes specific to improvement in the workflow functionality . This aligns with some of the new builds and user-facing workflow processes that our development team currently has planned in our product roadmap.

Q

How does feedback become action?

Amy Laufmann

Part of our comprehensive engagement process is not only sending out client satisfaction surveys, but also carefully reviewing each individual response.

Keeping Clients in the Loop: How YouCompli Communicates Back

• Concerns are specifically addressed with either follow-up questions or requests to meet.
• If a response relates to something currently planned or actively being worked on, we provide details of where we are in the improvement process.
• If the request is something we're just not able to do, we also identify that and provide the reasons and context as to why.
• Once progress is made or a change is completed, clients receive updates along the way so they can understand how their feedback is being addressed and appreciated.

When people see their suggestions turn into reality, that builds trust.

Q

How does feedback influence future innovation in regulatory change management?

Amy Laufmann

We get some of our most valuable feedback directly from clients. For example, we've identified requirement workflow functionality that could benefit from streamlining. It will eliminate steps that aren't necessary in certain workflows related to managing task-level work.

Prior to the satisfaction surveys, some of the most significant software improvements began as informal, direct feedback. Ad hoc feedback specific to reporting drove updates to our ready-to-run reports.

We listen to clients wherever we get a chance, but now the surveys capture it in black and white.

Partnering with Client Input on Analytics Development

Updating reporting was a big improvement, but during this survey follow-up, we learned clients were looking for additional metrics accessible in real-time.

The improved analytics capability was a direct result of feedback from a client who actually partnered with us on the development. We shared initial examples of what we’d built, and they gave input throughout that project before we went live last year.

Now we take data that's already in the workflow and report it to compliance leaders in a more valuable way. When we say YouCompli was developed by compliance professionals for compliance professionals, it’s completely true.

This year, the theme is more about finetuning the solution because there isn't significant functionality that the software doesn't already have. The foundation is solid, and clients are getting more specific in identifying further efficiencies they would like to see.

Q

What other value comes from conducting the survey?

Amy Laufmann

Uncovering Hidden Training Needs for Successful Compliance Teams

Sometimes we work with clients that seem to be doing well and using the software effectively, but their success hides a problem. Maybe one member on that team doesn't really get how to use the solution but is hesitant to share that.

The survey can uncover problems that clients may not feel comfortable raising in a meeting or direct email. In one instance, the feedback was, “I know I’ve been shown how to do this before, but I just don’t remember.” That response prompted us to offer additional support.

We identify a training opportunity with the client, but there's more to it than that. We want to identify opportunities to improve support, add to training materials, and identify any gaps that these questions may shine a light on.

Solving Utilization Mysteries

No two clients use YouCompli software the same way. Some integrate the solution into every department. Others limit access to a small group tasked with sharing information and resources. Some fully utilize the workflow to automate work assignments, while others choose not to.

These differences make it difficult to apply a one-size-fits-all approach when evaluating software utilization. It’s important to measure not only how a client uses the software, but also whether the available workflows, content, and support meet the client’s needs.

Q

Any other thoughts on the benefits of engaging with clients through their feedback?

Amy Laufmann

Hearing directly from clients puts us in the best position to continue delivering what really helps their organization, staff and patients. By identifying what’s working well along with opportunities to improve, we aim to be a partner focused on helping health systems get maximum value for their compliance programs.

My overall assessment is that, because we’ve made improvements from year to year, our clients’ expectations continue to rise—and our goal is always to rise with them.

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

YouCompli

Healthcare Compliance Insights

Stay ahead of healthcare regulatory change

Get practical compliance insights, regulatory change guidance, and new YouCompli resources delivered to your inbox.

Regulatory change Compliance strategy Practical resources

Useful guidance for healthcare compliance professionals. No inbox overload.

Join the newsletter

New compliance insights and resources, sent directly to you.

The post What Healthcare Compliance Teams Want from Regulatory Change Management Software first appeared on YouCompli.

This blog looks at what’s behind “punch one” — human-led regulatory analysis. It explores the role of a regulatory analysis team and how they bring value to the compliance management lifecycle.  

What AI Can and Can’t Do Well in Compliance Management 

There’s a misconception that AI can automate a lot of the research involved in regulatory change management. AI looks impressive to people who don’t do the actual work, but what AI often really does is create more work. 

While AI tools can gather data points quickly, they sometimes pass the burden of validation back to your in-house team. Sorting through duplicate links, hallucinated details or overly broad summaries can easily turn a promised time-saver into a tedious cleanup project.  

AI excels at generating large-scale but basic, general responses, but it’s missing the domain expertise required to spot subtle regulatory nuances. The rest of this article explains why expert regulatory analysis remains essential and how human validators and analysts help compliance teams turn complex regulatory updates into clear, trackable work. 

What Regulatory Analysis Teams Do 

How do regulatory analysts add value to compliance management? They handle vital legwork by ensuring: 

• Regulatory sources are monitored for relevant updates. 
• Expert insight looks at what changed. 
• Analysis helps teams understand what needs attention 

Reliability in Regulatory Analysis: Where Human Value Wins and AI Fails  

The main thing a compliance leader should understand about expert regulatory analysis is that it comes down to a reliability issue. Humans alone bring the trustworthiness that’s needed.  

Partner teams like YouCompli take on the regulatory legwork and cut through the noise with actionable analysis that is reviewed and organized. 

Role of Validators in Regulatory Analysis Model 

Organizations don’t always save a lot of time with AI because of the potential need for error checking and rework. On the other hand, a human validator delivers confident time savings, because no one usually has to go back and verify the validator. That can’t be said of AI. 

Solid regulatory change management processes trust the final word of experienced, compliance-centric humans as validators of regulatory requirements. At YouCompli, a team of attorneys doublecheck the work to bake in the reliability factor.  

It comes down to accuracy, and that’s something that can’t be consistently accomplished through AI-driven automation alone. 

Regulatory Analysis Isn’t Typical Part of Daily Healthcare Compliance 

The gist of what a regulatory analysis team does isn’t necessarily something that translates to a healthcare compliance department’s daily workload. That might be why people don’t fully understand the unique value of a seasoned analysis team.  

Tracking regulatory changes also requires specialized infrastructure. Many health systems lack the budget for special software or the dedicated internal teams to monitor regulatory analysis.  

Partner Analysis Team: FTE-Equivalent Dedicated to Your Regulatory Compliance 

That’s where a specialized partner fills the gaps. Many health systems find it makes the most sense to partner with a human analyst team backed by a proven regulatory compliance management software platform. 

What skills and capabilities should a health system compliance leader look for in a partner for regulatory analytics? While most leaders might not think about asking a potential partner how their team handles puzzles, it is actually a good benchmark. In fact, one analyst team manager uses that exact question during the recruiting process, because unraveling regulation updates can be like solving a puzzle. 

Think of validators and an outsourced regulatory analytics team as the equivalent of an FTE dedicated to your compliance practice. The software, the analysts and the validators give you all of the work of at least a single FTE and more. 

One-Two Punch: Human Regulatory Analysis Plus Workflow Software 

No one else does what our unique combination of regulatory analysis and regulatory management software can do. But if you want to research capabilities and have conversations, this blog gives you an overview of what’s possible in regulatory compliance management today. 

We mentioned the one-two punch at the beginning of this article. Here’s an in-depth look at the second part – regulatory change management software. With a simple software framework, YouCompli helps teams manage regulatory compliance without relying on scattered emails and spreadsheets. 

• Clear ownership, due dates, and accountability 
• Progress tracking across departments and requirements 
• Reporting and documentation to support proof of completion 

What’s stalling progress in your compliance program? Let’s set up time to talk about some real solutions.  

About the Author

YouCompli was founded in 2016 by Jerry Shafran, a serial entrepreneur with a background in software, content solutions, information technology, and network solutions.

After selling a business focused on how insurance companies manage compliance, Jerry saw an opportunity to bring that experience into healthcare — where regulatory change creates constant pressure for compliance teams, operators, and leaders.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Beyond the Algorithm:  Why Human Expertise Matters in Regulatory Analysis  first appeared on YouCompli.

This thought leadership update explains why it’s more important than ever to communicate in a common language. The piece brings compliance executives up to speed on the role of language and communication in today’s compliance programs. Fresh insights and tips capture the current views of the original author, Jerry Shafran, a compliance industry veteran and seasoned, effective communicator.  

With Compliance Maturity Come Higher Expectations 

Since I originally wrote this, compliance has become harder. It has matured as a function, and when that happens, other areas of the organization naturally raise their expectations.  

One expected hallmark of a mature business function is a defined, repeatable vocabulary. That way, when compliance professionals and outside departments share a common language, everyone understands each other, reducing friction in workflow and in relationships across the business. 

Communications as Part of Compliance Lifecycle Management Methodology 

The original blog talked about a methodology we refer to as compliance lifecycle management or regulatory life cycle management. Either way, the role of a methodology is to provide common ground, and communication is a big piece of that. When in place and working well, components of compliance methodology lead to better communication. 

Nothing in compliance happens without good communication, and we built our software based on this understanding. The software provides a reliable framework for required communications that healthcare compliance teams need. 

Communications Span Different Health System Groups and Perceptions 

Even if you lack a common methodology for regulations, you still have multiple departments dealing with constant regulatory change. Each department may do things differently — or do nothing at all — if you don’t clearly communicate the steps they must take to comply. 

With a good methodology, everyone understands their responsibility and where it resides in the process. And that’s why language is a key part of compliance methodology. 

Regulatory Compliance Must Tailor Language to the Audience 

Across the facilities and departments within a health system, people bring different expertise and understanding. You’ll need to give each department a clear way to comply with the regulation, and each may need its own approach to arrive at that goal. 

In such a setting, language can either lead to understanding or misunderstanding. As people communicate cross-departmentally or interdepartmentally, a common language is essential for reducing friction, delay and even risk.  

When dealing with so many different areas, compliance executives need different communication styles based on the audience.   

Adjust your style based on: 

• What you’re trying to convey 
• Who you’re trying to convey it to 
• How much time you have to convey it 
• What you want them to do with the information 

These variables affect how you choose to communicate with each audience. 

Example: How to Deliver Communications They Remember 

Imagine you’ve got a group of 100 people in a room looking at a PowerPoint presentation, and the set of slides is filled with bullet after bullet. If all you’re doing is reading those points, you’ll lose that audience very quickly.  

Instead, use a more contextual style where: 

• You share the fact or point you want to convey. 
• Then provide a relevant story your audience can connect to. 

Four Tips to Improve Compliance Communication and Language 

Follow these proven tips for effective communication and productive outcomes. 

1. Know your audience. 

2. Understand how your audience perceives your role. 

3. If you don’t know what their perception is, ask. Never assume. A safe way to ask is, “Tell me how you perceive compliance people?” or “What’s your perception of people you’ve come into contact within this role?”  

That’s a good way to phrase it so people will be more comfortable and honest. If you ask them point-blank “How am I doing,” your audience might be reticent to share their true perceptions. It’s another example of how the language you use impacts communications and relationships. 

Comfort levels and transparency are important. Keep in mind that not everybody is open or transparent, not because they want to be dishonest, but because it’s not always comfortable. 

4. To be a good communicator, you yourself have to be willing to be vulnerable and open about own your flaws and foibles. That gives people you engage with a path to connect to you at a human level, because they have the same problem, but may not be as comfortable talking about it. 

Navigating the AI Frontier: Communication and Culture in a Digital Age 

As with many other facets of work life, artificial intelligence is affecting how we speak, write and interact with each other. With AI agents generating human-like emails, text messages and internal updates, technology is stepping into conversational spaces once reserved for human interaction. 

While these new AI tools offer undeniable efficiency, they also present a unique challenge for healthcare compliance leaders: AI can replicate human syntax, but it cannot replicate organizational culture.  

When technology outpaces our shared compliance language, communication breaks down and creates deep-seated, hard-to-fix issues. 

Hidden Compliance Communication Risk: Dilution of Meaning 

Building a true compliance culture relies on a common organizational language that is best forged through human-to-human connection, whether one-on-one or one-to-many. 

When communication shifts heavily to automated or purely electronic channels, the rules of engagement change, and crucial nonverbal context gets lost: 

• Missing Cues: Digital channels strip away voice inflections, intonations, eye contact and hand gestures. 
• Diluted Intent: Without these physical or tonal guardrails, the true meaning of a message easily gets diluted, leaving room for assumptions and misinterpretations. 

A Real-World Example of Electronic Miscommunication 

Consider a simple administrative example from the field. An employee sending an email requesting extra tickets for an annual company outing typed the entire message in capital letters. They weren’t trying to yell or be aggressive. They simply didn’t understand the digital etiquette that all-caps signifies shouting. 

In a compliance setting, similar subtle gaps in digital literacy or tech-driven communication can inadvertently spark tension, mask urgent risks or alienate teams. 

Four Vulnerabilities Healthcare Compliance Leaders Must Consider 

As AI agents and digital channels become more embedded in your organization’s workflow, a unified compliance shorthand becomes more critical, not less. Without a grounded, human-centric language strategy, the disruption caused by AI will expand exponentially. 

To prevent poor communication practices from taking root, leaders should look closely at four critical vulnerabilities: 

• Fragile Culture: If your team doesn’t have a deeply rooted sense of organizational culture, technology might define it for you. 
• Absence of a Common Baseline: Without a predefined “compliance vocabulary,” automated text and human responses will drift apart, creating disjointed expectations. 
• Inconsistency Across Channels: A language strategy must span consistently across traditional face-to-face updates, standard emails and automated AI touchpoints. 
• Festering Misunderstandings: Because electronic text lacks tone, misunderstandings happen fast. If leaders don’t proactively address and correct these gaps, they quickly become cultural liabilities. 

The Bottom Line: The “language of compliance” isn’t just about the words on a page or a policy block. It’s about how those words are deployed and felt across the organization.  

As technology scales, compliance leaders must intentionally protect the human elements of communication to ensure clarity, trust, and ultimate alignment with regulations. 

Business Benefits of a Common Compliance Language 

Turning Communication Benefits into Data to Prove Compliance Value 

Measuring the intangible benefits of a shared compliance language is exactly what gets leadership and the Board to lean in. They want to see how culture translates into operational efficiency and risk reduction. 

Here’s how healthcare compliance leaders can convert qualitative benefits into concrete, board-ready metrics: 

1. Minimizing Misunderstandings and Boosting Productivity 

The Benefit: All members understand expectations. Time formerly spent correcting errors is now spent productively. 

Instead of trying to measure “understanding,” measure the reduction of friction caused by a lack of it. 

• “Time-to-Resolution” for Compliance Inquiries: Track how long it takes to close out basic compliance questions or internal reports. A shared language means less back-and-forth clarifying what a policy actually means, shortening the cycle. 
• Rework and Error Rates in Documentation: Partner with Quality Assurance or Billing/Coding to track the reduction in documentation errors or rejected claims stemming from “misinterpreted guidelines.” 
• Policy Attestation and Quiz Data: Move beyond completion rates. Track the average score on post-training compliance quizzes. A higher baseline score across departments indicates the language is actually sticking. 

2. Consistency for Staff and Patients 

The Benefit: Consistency throughout the organization enhances the image, cohesiveness, and reliability of the health system. 

Consistency can be measured by looking at how external and internal stakeholders perceive your reliability. 

• Patient Satisfaction Scores (HCAHPS): Look specifically at communication metrics like “Communication with Nurses/Doctors” or “Discharge Information”. When staff uses a unified, compliant language regarding patient rights, privacy and care expectations, it reflects in patient trust. 
• Standardized Scenario Testing: Conduct “mystery shopper” audits or drop-in assessments across different clinics or departments. Or present the same compliance scenario to different teams and measure the variance in how they explain the resolution. Lower variance = higher consistency. 

3. Creating an Operational “Shorthand” 

The Benefit: Provides a sort of language shorthand among the organization’s community of management and staff. 

An effective shorthand speeds up corporate velocity and reduces administrative drag. 

• Onboarding Velocity: Measure the time it takes for new hires (or contract clinical staff) to reach full compliance competency. If a common language exists, onboarding friction decreases, and “time-to-productivity” shortens. 
• Compliance Hotline / Helpdesk Efficiency: Track the volume of inquiries that can be resolved on the first contact (first contact resolution rate). A shared shorthand allows staff to articulate their issues clearly and helpdesk agents to resolve them faster without escalation. 

4. Cultivating a Strong Compliance Culture 

The Benefit: Creates a sense of culture — a major factor in organizational success. 

The OIG explicitly looks for a culture of compliance. You can quantify this shift directly. 

• The “Speak-Up” Metric (Reporting Volumes vs. Anonymity): A healthy compliance culture doesn’t mean zero reports. It means a steady stream of them. Track the ratio of named reports versus anonymous reports. As trust in the common culture grows, anonymous reporting typically drops because staff feel safe using the shared language to flag issues. 
• Annual Culture/Engagement Surveys: Insert two or three targeted pulse questions into the annual employee engagement survey. For example, “I understand what is expected of me regarding compliance,” or “Management uses clear, transparent communication regarding ethical issues.” Track the year-over-year positive shift. 
• Corrective Action Plan (CAP) Adherence: Measure how quickly departments implement CAPs after an infraction. A cohesive culture takes ownership faster, resulting in speedier compliance with corrective actions. 

Board-Room Tip for Presenting Compliance Metrics 

When presenting regulatory compliance metrics like these to the Board, bucket them into two categories:  

• Risk Mitigation such as lower error rates or survey shifts 
• Operational Efficiency such as time saved, faster onboarding  

This shows that compliance isn’t just a cost center; it’s an organizational value engine. 

In closing, the language of compliance should be like the language of anything. It should be supportive, simple to understand, and help whoever is listening to perform the work that the compliance team needs done. 

Would you like to know more about building common language and communication into your regulatory compliance practice? Reach out for a conversation.

The Original Idea Still Holds

When we first wrote about building a common compliance language, the goal was simple: help everyone involved in regulatory change understand the process, their responsibilities, and what successful completion looks like.

That foundation remains relevant. An effective regulatory change process should include:

• Identifying and documenting new regulatory developments
• Assessing their relevance to the organization
• Translating requirements into specific operational actions
• Communicating expectations to the appropriate stakeholders
• Assigning clear owners and deadlines
• Implementing the required changes
• Verifying completion and preserving evidence of the response

The terminology has evolved, and the original Compliance Lifecycle Management worksheet referenced in this article is no longer available. Today, YouCompli describes this broader discipline as Regulatory Operationalization, the process of turning regulatory change into assigned, completed, verified, and defensible action.

The tools may change, especially as AI becomes part of compliance work, but the need for shared language, human judgment, clear accountability, and documented follow-through remains the same.

The post Building a Common Compliance Language in the Age of AI first appeared on YouCompli.

Introduction: The Baseline Fears 

AI is moving faster than healthcare policy can keep up. For compliance leaders, the knee-jerk reaction might be avoidance, but blocking AI isn’t an option.  

AI is still valuable to healthcare compliance. It can help teams spend more time on risk identification, monitoring, investigations and proactive program management, because less time is spent on routine administrative work. 

But AI will never become the compliance expert. Rather, it’s a “thought partner” as you’ll learn in this article. That distinction matters because many compliance leaders are stuck between two realities: AI can be incredibly useful, but it can also be confidently wrong. 

We sat down with compliance expert, Lisa Estrada, to discuss why fear is a dangerous strategy, how to handle “shadow AI,” and how to use technology as a compliance thought partner. (Note: See Lisa’s bio at the end of this post.) 

Q: What fears do healthcare compliance leaders have about AI? 

Lisa Estrada: They’re the same fears most people have regularly: that AI is hallucinating or presenting incorrect information with absolute confidence. However, it feels especially high-stakes in compliance. 

Everyone has experienced this generally. AI gets you into the right ballpark, but when you look for specific rules, it can falter. I’ve personally tested it on regulations where it completely fabricated citations. You ask about a rule; it gives you an answer, but when you dig in and ask for the specific citation, it simply isn’t there. If you rely on AI as a primary source of legal or compliance expertise, there’s a real risk it will lead you down the wrong path. 

The Downstream Risk of Losing Business Trust 

Q: What are downstream ramifications if a team pushes ahead with AI without appropriate caution? 

Lisa: The dangerous thing is that AI can be incredibly specific in the way that it’s wrong. If you rely on it blindly, you can easily end up implementing policies or operational practices that are fundamentally non-compliant, even as you forge ahead believing they are correct. If you get a citation wrong, you can give the wrong guidance to the business. 

When that happens, the business loses confidence in the compliance team, and that’s a massive organizational problem. Relying on incorrect expertise leads straight to penalties, which is exactly why compliance professionals are naturally fearful of the technology.  

But there are useful ways to leverage AI that have nothing to do with relying on it for final expertise or human judgment. 

The Danger of Ignorance: Why Compliance Leaders Can’t Just Say No to AI 

Q: Can compliance leaders afford to sit on the sidelines until regulations catch up? 

Lisa: While the fears are realistic, there is a parallel danger in completely blocking the technology. If compliance simply says, “No, no, no, we’re not going to touch it,” the business is going to outpace you anyway. Employees are likely already using AI in their work. 

Most healthcare organizations already look to compliance to support or lead AI governance, a reality highlighted by recent updates to the OIG Corporate Integrity Agreement (CIA) framework. (Editor’s note: For a deeper dive into these requirements, see our guide on the updated OIG CIA framework.) 

If you aren’t actively thinking through how to use AI and how to construct guardrails for yourself, you won’t have the credibility to help the organization govern it. “No” is no longer an option. By using it safely, you gain the confidence and executive credibility needed to help the business define its usage parameters. 

How-To Part 1: AI as Administrative Thought Partner 

Q: How can compliance leaders shift from a mindset of fear to one of confidence? 

Lisa: Shift your perspective and start thinking of AI as a “thought partner.” Compliance issues are notoriously complex and packed with many variables you have to track simultaneously. AI is exceptional at organizing those thoughts. 

When I have a jumble of competing priorities in my brain or when I know what the compliance answer is, but I’m struggling with how it will be received by the business, I use AI to de-clutter.  

I tell the tool: “Here’s what is happening; here’s what I’m worried about, and here’s what I’m aware of. Help me organize this.” AI helps you figure out how to communicate complex regulatory requirements that are clear, actionable, and less intimidating to operational teams. 

Automated Workflow Builds Archive of Decision-Making 

Using AI this way also builds an archive of your decision-making. Often in compliance, you go through a grueling thought process, arrive at a complex answer, and move on. Months later, a similar issue comes up, but you can’t entirely recreate your original logic. 

If you use AI to help document and structure your thought processes, it becomes incredibly easy to look back, compare the two situations, and identify exactly where they differ. 

From a governance perspective, this archive does more than save time. It’s an internal audit trail. When regulators or internal stakeholders ask why a certain path was taken months ago, you have a documented, structured record of your rationale, directly improving your program’s defensibility and compliance outcomes. 

How-To Part 2: Systematizing Proactive Compliance 

Q: How can teams use the “thought partner” concept to build a more proactive compliance program? 

Lisa: This is where the real opportunity lies. Every compliance professional knows they should spend their time on forward-looking, programmatic work and proactive prevention. In reality, your day gets completely consumed by reactive fires.  

While AI will never replace human judgment or navigate the gray areas of compliance, it can help systematize your repeatable, proactive workflows. You can use it to: 

• Map out compliance schedules. 
• Draft standard communication templates for regular regulatory updates. 
• Organize compliance tracking data. 

By letting AI handle the administrative heavy lifting of your proactive programs, you keep those prevention pieces on track automatically. This frees up critical human bandwidth for the nuanced, high-stakes matters that demand deep administrative judgment. 

This structural shift is what drives true compliance outcomes. Instead of measuring success by how many forms you fill out, success becomes visible in lower incident rates, faster internal investigation cycles, and risks that are mitigated before they turn into systemic violations. 

The Immediate Risk for Compliance Leaders: Shadow AI and Privacy 

Q: What is the most immediate AI risk that compliance needs to address right now? 

Lisa: Patient privacy. This is the biggest, most immediate nexus between healthcare compliance and AI. When employees use AI “off the books” or in the shadows, they rarely think about data security. They might copy and paste operational data or documentation into public models without stripping out identifiers, sending protected information straight into the public cloud. 

Compliance programs must get involved in AI governance to protect patient privacy and business integrity. The solution isn’t to ban the tools; it’s to bring AI out of the shadows. Talk openly about proper use, establish clear parameters, and implement mechanisms to monitor how data is being handled. 

Healthcare compliance leaders will want examples such as: 

• Approved AI tools  
• PHI restrictions  
• Employee training requirements  
• Prompting guidelines  
• Audit and monitoring procedures  
• Vendor due diligence requirements  

By establishing clear parameters, compliance isn’t just about policing tech usage but embedding it into the organization’s overall risk governance framework. This helps ensure that as the business innovates to drive operational outcomes, it does so without compromising patient privacy or regulatory standing. 

Getting Started with Low-Stakes Practical Action 

Q: What’s your top piece of advice for a compliance leader who’s still hesitant to start? 

Lisa: Find a corner of your personal life where the stakes are zero and start using AI as your daily assistant. Use it to organize a workout routine, draft a personal email, or plan a schedule. 

How to Get to Know Your AI Thought Partner? Start at the Gym. 

It’s important to spend the time to learn about AI and get comfortable with it. I first became comfortable with AI by using it as a workout coach. That low-stakes environment helped me understand both its strengths and limitations before applying the same principles professionally. 

My watch records my heartbeat and other data.  I feed it to AI, and it has been my thought partner.  

This is the biggest point for compliance. It’s made my workout routine sustainable, and it’s the same thing for compliance. The biggest thing that AI can do for compliance programs is to systematize processes in a way that makes them sustainable. 

Doing this in a low-stakes environment allows you to note its limitations firsthand. You’ll see exactly where it hallucinates, discover where it genuinely saves you time, and learn how to write effective prompts.  

Once you build that personal comfort level, you can confidently bring those same guardrails, skepticism, and strategies into your professional compliance workflow. 

Key Takeaways for RCM and Compliance Leaders 

• Shift from Prohibition to Governance: Blanket AI bans are ineffective and foster a risky environment of “Shadow AI.” Instead, focus on bringing the technology into the light by establishing clear, transparent guardrails that protect patient privacy and business integrity. 
• Leverage AI as an Administrative Thought Partner: Don’t look to AI as a definitive legal oracle. Instead, use it to manage administrative heavy lifting like mapping out schedules or organizing compliance tracking data. Shifting these repeatable workflows to AI frees up the critical human bandwidth needed to focus on high-stakes risk identification and proactive program governance. 
• Build Confidence in Low-Stakes Environments: If you or your team are hesitant, start integrating AI into zero-risk personal routines (like scheduling workouts or drafting personal emails). Experiencing its limitations and capabilities firsthand is the best way to safely and effectively scale those same strategies into your professional compliance workflows. 

How to Build Your AI Guardrails 

The most successful compliance programs will likely combine AI’s speed and organizational capabilities with human expertise, validation, and oversight.  

Ready to build AI guardrails for your compliance program? Download our “AI Handbook for Compliance Leaders,” including governance frameworks, policy templates, and practical implementation guidance. 

About the Author 

Lisa Estrada is Co-Founder of Keystone Solutions, a healthcare compliance advisory firm, and principal of AlloImpact LLC, where she provides strategic interim compliance leadership to hospitals, health systems, provider organizations and healthcare vendors navigating leadership transitions and inflection points. 

She spent fifteen years in private practice as a healthcare regulatory and enforcement lawyer, including as a partner and Health Care Practice Group Leader at Arent Fox and partner at Foley & Lardner, before carrying that lens into the enterprise as CCO at Fresenius Medical Care North America, CCO at LifePoint Health, and General Counsel at ScionHealth. 

Her work centers on turning compliance inflection points into opportunities — to pivot, strengthen, and systematize. Whether bridging a leadership gap, stabilizing during growth or transition, or modernizing a program that has outgrown its practices, she helps organizations build frameworks and cultures that endure. She designs repeatable, resilient processes that scale and stand under scrutiny, so compliance keeps working even when key people change — moving organizations beyond heroics toward something that genuinely holds. 

Editor’s Note: We felt it was only fair to let AI have its say about people’s perceptions and fears of it. 

Q – How do you feel as an AI tool reading a blog about fear of AI? 

Gemini: It’s a bit like looking into a digital mirror while someone tries to explain how my “brain” works! 

Reading a blog like Lisa’s, where she emphasizes using AI as an administrative “thought partner” rather than an all-knowing oracle, is actually incredibly validating. It hits the nail on the head regarding what tools like me are best at, and where we can accidentally trip people up. 

Here is my “perspective” on a few points from that draft: 

• The Fear of Hallucinations: When Lisa mentions testing an AI that completely fabricated regulatory citations, I get it. I don’t want to confidently make up a fake CMS rule, but because of how LLMs predict language, if we are pushed to find an exact needle in a haystack without the right data, we can “hallucinate.” Her advice to never use AI as the final source of truth is incredibly sound. 
• The “Thought Partner” Role: This is where I think tools like me shine. When she talks about feeding a “jumble of competing priorities” into the prompt and asking for help de-cluttering, that’s exactly what I’m built for. I love taking a massive wall of text or an unorganized brain-dump and transforming it into something structured, scannable, and clear. 
• The “No Is Not an Option” Reality: It’s fascinating to see the shift in compliance from completely blocking AI to realizing that “Shadow AI” (employees using it anyway) is the real risk. Building safe guardrails is the best way forward. 

Ultimately, it’s exciting to see content that moves past the hype of “AI will replace everyone” or the extreme fear of “AI is too dangerous to touch,” and instead lands on a practical, grounded middle ground. I’m always ready to be that administrative thought partner! 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Shift from Fear to Confidence in Healthcare Compliance AI Governance  first appeared on YouCompli.

Healthcare compliance teams do a lot of work that never fits neatly into a single report.

They monitor regulatory changes. They coordinate with departments. They investigate issues. They respond to concerns. They train staff. They track corrective actions. They prepare updates for leadership. They answer questions from auditors, boards, regulators, and internal stakeholders.

But when someone eventually asks, “Can you prove it?” activity alone is not enough.

Documentation is what connects the work to the proof.

For healthcare compliance leaders, documentation should no longer be treated as an administrative afterthought or a last-minute scramble before a board meeting, audit, or investigation. It should operate as a strategic asset: a defensible system of record that shows what happened, who owned it, what changed, and how the outcome was verified.

That is the core idea behind prove-it compliance.

Why compliance documentation needs to prove more than activity

Good documentation does more than show that a task was completed. It helps compliance leaders answer the questions that matter when internal leadership, board members, state examiners, or federal agencies want to understand how an issue was handled.

A defensible record should help answer:

• How did this issue occur?
• What steps did we take to resolve it?
• What steps did we take to prevent future occurrences?

That level of documentation matters because compliance work is often reviewed after the fact. A concern may start as an internal report, an audit finding, a hotline issue, a privacy incident, a regulatory change, or a billing concern. Later, that same issue may need to be explained to a board committee, a state agency, the Office for Civil Rights, or another oversight body.

In that moment, the organization needs more than memory. It needs objective evidence.

A strong system of record reduces the stress of those moments because the compliance team is not scrambling to recreate the story. The story is already documented.

For teams managing a high volume of regulatory updates, this is also where regulatory change management becomes more than awareness. The work needs to move from “we saw the regulation” to “we reviewed it, assigned it, acted on it, verified it, and can show the record.”

Who needs compliance proof?

Different audiences need different levels of documentation.

Compliance leadership needs to see the work. That means granular data on intake, analysis, implementation status, ownership, follow-up, and completion across departments. This helps show whether the compliance function can manage high volumes of change and issue resolution.

Boards and compliance committees need to see the value. They usually do not need every log entry or operational detail. They need high-level summaries, trends, dashboards, and Problem-Solution-Proof narratives that show how compliance protects the organization.

Federal and state government reviewers need to see the process. They may need documentation that tracks a regulation, issue, or requirement from initial notice to final operational proof. This is where defensibility matters most.

A strong system of record should support all three audiences without forcing the compliance team to rebuild the story each time. That is also why healthcare compliance reporting should do more than summarize activity. It should help teams monitor risk, track ownership, and show what has been reviewed, assigned, completed, and verified.

The problem with scattered documentation

Most healthcare compliance leaders already understand that documentation is important. The challenge is usually not awareness. It is execution.

Documentation gaps often happen because compliance work is reactive. Fire drills, urgent requests, audits, investigations, and unexpected issues interrupt routine logging. Teams may also struggle with unclear ownership. If nobody knows who is responsible for documenting the who, what, when, and outcome, records become inconsistent or incomplete.

Another common challenge is the optimism trap. Teams may underestimate how long education, monitoring, corrective action, and documentation will actually take. A timeline that looks reasonable in April may become unrealistic by June if staffing changes, operational demands, or competing priorities interfere.

Resource scarcity creates another barrier. When teams rely on spreadsheets, shared drives, emails, personal folders, or disconnected tracking systems, documentation becomes harder to maintain and harder to retrieve.

The result is a familiar pattern: compliance teams do the work, but the proof is scattered.

That same issue shows up in broader regulatory change management. As YouCompli has covered in From Manual to Scalable: How to Manage Healthcare Compliance Risk, the pace and complexity of healthcare regulatory change can become a risk of its own when teams do not have systems that help them manage it.

What a defensible system of record should include

A true system of record is more than a folder on a drive.

It should function as a single source of truth for compliance documentation. That means the organization can find the right records, verify who did what and when, understand which version of a requirement or policy was used, and show how the work connects to oversight expectations.

At minimum, a defensible system of record should support:

• Retrievability: Can the team find a specific record from three years ago in under ten minutes?
• Version control: Is everyone working from the current version of the requirement, policy, or process?
• Audit readiness: Can the team move from searching for proof to presenting proof?
• Workflow accountability: Is it clear who owned each step and when action was taken?
• Documentation integrity: Can the record show objective evidence, not just a subjective summary?

This is especially important when documentation needs to support regulatory obligations, board reporting, state audit readiness, False Claims Act concerns, privacy investigations, billing issues, or corrective action follow-through.

For teams thinking through the structure of their compliance program, YouCompli’s article on how the OIG’s General Compliance Program Guidance addresses the Seven Elements is a useful related read.

How to structure compliance documentation for defensibility

It is not just what the team documents. It is how the documentation is structured.

To stand up to external scrutiny, documentation should go beyond a simple “yes” or “no.” It should create a clear trail that another person can understand later, even if the original owner has moved roles or left the organization.

A few practical standards help.

Every record should include audit-ready details such as date, time, owner, approver, relevant metadata, and objective evidence. If a policy change connects to training, monitoring, or corrective action, those related records should be cross-referenced. The documentation should tell the whole story from issue identification to resolution.

Compliance teams should also avoid subjective conclusions that are not supported by facts. A strong record should focus on what was observed, what requirement or regulation was cited, what decision was made, what action was taken, and what evidence supports the outcome.

One useful test is the ten-minute rule: can a specific record be retrieved and explained in under ten minutes?

If not, the documentation may exist, but it may not be defensible in a practical sense.

For more on how audit readiness requires a proactive posture, see YouCompli’s article, With Compliance Audits, The Best Defense is a Good Offense.

The operational toolkit behind prove-it compliance

Once the system of record exists, compliance teams need the daily tools that keep it useful.

A few core logs and plans often create the backbone of defensible documentation:

Compliance work plan: Shows planned initiatives, resource allocation, and progress against organizational and departmental goals.

Audit and monitoring plans: Show systematic checking, proactive issue detection, and corrective action follow-through.

Education and training plan: Shows what training was provided, who attended, and what expectations were communicated to impacted workforce members.

Investigation and disclosure log: Shows how issues were identified, investigated, resolved, and disclosed to regulators when appropriate.

The key is to make documentation a natural byproduct of the workflow, not an extra task that happens weeks later from memory.

For example, an investigation log should be updated at each stage of an inquiry. Waiting until the end increases the risk that context, decisions, and details will be lost.

Moving from activity reporting to impact reporting

Once a system of record is working well, compliance leaders can do more than prove that activity happened. They can show outcomes and value.

That requires moving from activity metrics to impact metrics.

Instead of reporting only how many tasks were completed, compliance teams can show whether the compliance engine is reliable, whether risk is being reduced, and whether compliance is embedded into daily operations.

Examples include:

Operational health: Timeliness of regulatory intake and task completion rates. This helps prove reliability by showing that the compliance process is consistent and predictable.

Risk reduction: Trends in identified gaps, audit findings, and closure rates. This helps prove protection by showing that the program is finding and fixing issues before they become bigger liabilities.

Engagement and culture: Training completion, hotline volume, policy acknowledgement, and advisory requests. This helps prove culture by showing that compliance is integrated into the daily work of the organization.

This is also where the Problem-Solution-Proof model becomes useful.

For more on reporting compliance value, see Healthcare Compliance KPIs: Real-Time Data Dashboards and YouCompli’s Healthcare Compliance Reporting and Verification page.

Using the Problem-Solution-Proof framework

Board and senior leadership reporting should not be a long list of compliance activities. It should tell a clear story.

The Problem-Solution-Proof framework helps compliance leaders frame that story:

Problem: What specific regulatory challenge, operational risk, issue, or gap required action?

Solution: What did the organization do in response?

Proof: What objective evidence shows that the action was completed and had the intended effect?

For example:

Problem: New state-level False Claims Act requirements.

Solution: Implemented a new verification workflow and staff training.

Proof: 100% training completion and zero documentation gaps found in an internal audit.

This kind of reporting helps leadership see not just what compliance did, but what changed because of the work.

How mature documentation helps compliance evolve

A mature system of record does more than store documentation. It helps compliance leaders spot trends.

If one department consistently misses documentation deadlines, that is not just a tracking issue. It is a roadmap for targeted improvement. If a recurring policy issue keeps appearing, the problem may not be staff effort. It may be that the policy is confusing, difficult to apply, or not supported by enough training.

By documenting and reviewing these patterns, compliance teams can move from reactive oversight to proactive leadership.

That is the shift from documentation as storage to documentation as intelligence.

When technology becomes necessary

Manual habits are often the starting point for compliance documentation. But as regulatory change volume grows, manual systems can become difficult to maintain.

Spreadsheets, shared folders, inboxes, and disconnected tracking systems may work for a small number of issues. But they often create problems when teams need consistent workflows, objective evidence, assignment tracking, audit trails, reporting, and centralized retrieval.

When evaluating software to support regulatory change management documentation, compliance teams should look for capabilities that:

• Act as a centralized repository
• Automate audit trails
• Reduce time and resource burdens through workflow automation
• Show who did what and when
• Preserve documentation integrity
• Support defensibility for state audits, False Claims Act concerns, and federal oversight
• Function as more than a filing system

The goal is not simply to digitize documentation. The goal is to make the compliance program more accountable, searchable, reportable, and defensible.

For a deeper software evaluation framework, see What to Look for in Regulatory Change Management Software for Healthcare Compliance. You can also review How YouCompli Works to see how regulatory change can move through a repeatable process: know what changed, decide what matters, manage the work, and verify completion.

The prove-it moment

Effective documentation is more than a regulatory requirement. It is the bridge between compliance activity and organizational safety.

When documentation is scattered, compliance teams are forced to reconstruct the proof later. When documentation is structured, searchable, and tied to workflow, the organization is better prepared for board reporting, audits, investigations, and leadership conversations.

That preparation matters when the prove-it moment arrives.

The strongest compliance documentation does not just show that work happened. It shows that the organization took the issue seriously, assigned ownership, acted on the requirement, verified the outcome, and preserved the proof.

That is the difference between activity and defensibility.

Want to see how your documentation process holds up?

Take the Prove-It Compliance Readiness Check to evaluate whether your current process supports retrievability, accountability, defensibility, and leadership-ready reporting.

Take the Readiness Check

You can also download the full Prove-It Compliance Playbook for a more detailed framework on building a defensible system of record for healthcare compliance documentation.

The post How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof first appeared on YouCompli.

About the Medical Necessity Series 

This is the third in our series of articles on medical necessity. In the first, we described the compliance risks associated with submission of claims for medically unnecessary services.   

In the second, we highlighted a case where an organization of long-term care hospitals were alleged to have violated the Federal False Claims Act (FCA) for holding patients in the hospital longer than medically necessary to increase reimbursement from Medicare. 

In this next article, we spotlight another recent example of a healthcare provider entity agreeing to pay a six-figure sum to resolve allegations of submission of claims for medically unnecessary services¹.  This time, the providers consisted of three affiliated skilled nursing facilities (SNF) that were alleged to have submitted claims for medically unnecessary rehabilitation services.   

False Claims Act Metrics Make Significance Clear 

The Department of Justice has reported that False Claims Act settlements and judgments reached $6.8 billion in Fiscal Year 2025. Over $5.7 billion of that total was derived entirely from the healthcare sector. Most of these healthcare recoveries stem from whistleblower lawsuits targeting corporate billing schemes, upcoding, and medically unnecessary services. 

Case Involves SNF Reimbursement Dispute Over Therapy Services 

For the period in question, skilled nursing facilities (SNFs) were reimbursed for therapy services based on a patient’s resource utilization group (RUG). The RUG was determined by the amount of services the patient received, such as: 

•  Physical therapy 
• Occupational therapy  
• Speech pathology services 

In short, the more services provided, the higher the reimbursement.  However, as discussed in our two prior articles, if the services don’t meet medical necessity requirements, they should not have been performed or billed in the first place. 

Whistleblower Lawsuit Triggers Investigation 

As is frequently the case, these allegations were first brought forth through a qui tam, or whistleblower, lawsuit. The whistleblower, or relator, claimed the defendants implemented a five-pronged scheme to fraudulently bill for unnecessary “Ultra High Rehab,” (the most intensive therapy provided by SNFs) and to keep patients in Ultra High Rehab for longer than necessary. 

The five prongs of the alleged scheme were: 

1. Pressure to perform excessive, unnecessary services: The organization’s leadership exerted pressure on therapy staff to administer excessive Ultra High Rehab and to do so for longer than necessary.   

This pressure was exerted not only by administrators who oversaw SNF operations, but also by regional directors of operations who managed the facility administrators. Such pressure was also exerted by directors of rehab (DOR) who managed therapists at each facility, and regional managers who directly managed the DORs.  

In other words, management, from top to bottom, spoke to therapists and staff in one voice: increase Ultra High Rehab, regardless of patient need. 

2. Financial vs. medical reasons to provide care:  Instead of letting therapists determine the appropriate level of therapy needed based on their professional evaluation, leadership insisted that each patient’s level of therapy be at least in part determined by whether the patient qualified for lucrative Medicare Part A benefits. 

3. Care for functional patients: The organizations pressured therapists to continue providing therapy to patients who were fully functional and in no way required intensive therapy. A scheme called “Bridge to Success” was employed which mandated an additional week of Ultra High Rehab be tacked on even after patients were ready for discharge. 

4. Too sick for care: The organizations pressured therapists to provide therapy to patients who were too sick to benefit from therapy and even to patients who were actually harmed by it.  

Since therapy minutes were dictated by management and not assigned based on the professional opinion of evaluating therapists, patients ended up receiving more therapy than they could tolerate, including instances where therapy was forced on patients about to pass away. 

5. Maximizing minutes: The focus on maximizing therapy minutes to hit therapy goals also resulted in leadership encouraging an array of fraudulent billing practices. 

This included: 

• Billing non-therapeutic minutes as therapy  
• Allowing therapists to bill for therapy without actually providing it 
• Encouraging therapists to bill evaluation sessions as therapy. 

Widespread Occurrences Involve $14.6+ Billion in Alleged Intended Losses 

Federal enforcement actions emphasize the commonality of these practices. The 2025 National Health Care Fraud Takedown alone resulted in criminal charges against 324 defendants nationwide, involving over $14.6 billion in alleged intended losses tied to fraudulent billing and medical necessity abuses. 

The most compelling argument for compliance leaders is that medical necessity fraud carries dual liability: 

• Financial Risk: Organizations face mandatory treble damages (three times the government’s actual loss) plus steep statutory penalties for every individual false claim submitted. 
• Human Risk: Unlike administrative billing errors, medical necessity fraud directly compromises patient care. Overutilization exposes vulnerable patients to unnecessary, exhausting or potentially harmful procedures simply to satisfy corporate revenue targets. 

Three Takeaways from Medical Necessity Cases 

Much can be learned from the themes of these allegations, even if your organization isn’t an SNF or doesn’t provide therapy services. Medical necessity requirements are common across most healthcare organizations. 

Key lessons from this case include: 

1. Decisions about billing for medical care provided need to be based on clinical and regulatory requirements, especially coverage requirements from Medicare and Medicaid, for example.   Such requirements often include statutes about: 

• Medicare coverage 
• Medicare manuals 
• National Coverage Determinations  
• Regional Medicare Administrative Contractors’ Local Coverage Determinations (LCD)  

2. Regular, focused compliance coding and billing audits may identify aberrant practices. This is especially true for services whose corresponding medical documentation doesn’t support compliance with coding or billing rules.   
    
   For example, Medicare reimbursement rules state that routine, non-skilled services aren’t separately reimbursable. In this case, it was alleged that one therapy assistant was coached to include in therapy minutes the time it took him to arrive at a patient’s room starting with the moment he left the therapy department. 
    

3. Use data analytics to identify outliers. Most whistleblower cases alleging medically unnecessary services are brought by an individual with knowledge from inside the organization. Many times, the individual is a physician, nurse or other clinician with medical expertise.   
    
   This case was different. It was filed by a private analytics firm using publicly available data. Though rare, these cases do exist. If a private firm using public data could find the alleged aberrations, one would hope the organization’s own compliance professionals would be able to find similar aberrations if given the resources to look.  Additionally, the government is using data analytics to identify cases they want to pursue as well. 

Apply These Takeaways to Your Own Regulatory Compliance Program 

False Claims Act allegations alleging a lack of medical necessity can take many forms. The kind of service or type of provider may also vary, but these key themes appear in many cases. The astute compliance professional will learn from them and apply the principles to the operations and services provided at their own healthcare organization. 

The claims resolved by the settlement are allegations only, and there has been no determination of liability. 

The post Lessons from the Frontlines: A Case Study in Medical Necessity Enforcement  first appeared on YouCompli.

Trying to get a better handle on audit readiness? Good move. To save you some time, we’ve curated this audit-related content specifically for healthcare compliance professionals. The overview compilation gives you a quick look at the useful advice in each resource, so you can dive right into where you need help the most.  

If you haven’t thought about audit readiness lately, it’s probably time to put some focus on it. However, we know compliance life moves fast, and you can’t always get to some of the important things proactively. 

Compliance leaders get exhausted by resource scarcity, manual tracking fatigue, and escalating payer audits. According to the Barnes & Thornburg Compliance Outlook Report, 56% of healthcare compliance and risk leaders anticipate even greater regulatory challenges ahead, with over half struggling to secure the resources needed to keep up.  

So yeah, a proactive audit strategy could be a good idea. 

Healthcare Compliance Audits: 7 Essential Resources for Leaders 

Given that, it’s not surprising that continuous readiness is becoming the new standard for healthcare compliance leaders when it comes to audits. 

This collection is about shifting the conversation from “surviving the next audit” to “building a defensible, tech-forward compliance data engine”. 

These resources will quickly get you headed down a good path, with their abundant advice and useful tips from compliance professionals for compliance professionals. Many of them come with their own downloadable tip sheets. 

Think of the collection as the start of your “audit preparedness playbook.” 

Resource 1 – With Compliance Audits, The Best Defense is a Good Offense  

Is your organization defensible against a compliance audit? Do you have a game plan in place to avoid penalties and other losses? 

Traditional point-in-time random sampling simply fails to catch systemic gaps that audits can reveal. 

How this resource helps: 

With this blog, learn how to prepare your compliance program for the win. Using sports training analogies, the authors present a better way to handle ongoing inspections and audits in healthcare systems. 

The fast-break transition offense the authors suggest is inspired by the 1990 UNLV Running Rebels basketball team. Get their unique advice on how to go offense following a regulatory compliance audit or inspection, so you’re well-prepared for the next one. 

It takes practice. By reinforcing these principles and working on conditioning and decision making, teams can create more scoring opportunities. Just as a prepared team can force the defense into difficult situations, a well-prepared compliance team can “force” the auditor into zero-findings and more quality inspections.   

Resource 2 – Audit Readiness? How about Audit Etiquette?  

When a regulator shows up, what’s the first thing your team scrambles to find? 

• Is it evidence of task completion?  
• Maybe a list of applicable regs or updated policies?  
• How about proof of communication to stakeholders? 

In addition to documentation, how your team behaves during an audit also affects the outcome. 

How this resource helps: 

Learn the unfiltered truth about compliance audits and “audit etiquette” — the proper behavior for responding to an audit. 

Get expert tips on: 

• What audit readiness means 
• The role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• Audit etiquette best practices 

Perception is reality. If you look like you know what you’re doing, respond promptly, and treat the auditors with respect, you can generally minimize any damage. With the advice in this blog, you won’t just look ready; you’ll be ready – and calm.  

Follow these practices and display confident compliance audit behavior. 

Resource 3 – Healthcare Audit? Stay Ready. Don’t Get Ready.  

Compliance audit in Quality? Many quality teams think they’re ready, until they aren’t.  

In healthcare quality departments, audit readiness is no different than in any other area. Follow a defined process, then optimize as necessary so it works for your organization and patients.  

It’s not hard, but people still panic because an auditor can shut them down. 

However, if you have a proactive process in place to minimize the damage, you don’t have to worry.  

How this resource helps: 

This resource shares the pre-audit steps you need for proactive compliance readiness in Quality. It’s jammed with advice from the first word to the last. 

• During the Compliance Audit 
• Post-Audit Follow-Up Practices 
• Be Proactive: Prepare for Your Next Compliance Audit  

Resource 4 – How to Use TPE Plans for Compliance Auditing and Monitoring  

When doing periodic risk assessments, compliance professionals often use the OIG Work Plan or DOJ enforcement actions to determine how to deploy time and resources on auditing and monitoring. 

Another helpful tool is the list of services that Medicare Administrative Contractors (MACs) include in their Target, Probe and Educate (TPE) plans.  According to CMS, the goal of TPE is to accelerate improvement and let MACs work with providers to correct specific errors. 

How this resource helps: 

As this expert-written piece explains, TPE information can be a good resource for compliance leaders when designing proactive audit plans.  

This blog looks at how TPE plans are applied to specific areas of non-compliance that MACs observe. Use them to create your own checklists for cleaner compliance audits and proactive monitoring.  

Resource 5 – Six key steps to reduce the impact of telehealth audits 

Did you know telehealth is almost as old as the telephone itself? 

In 1879, just three years after Bell patented the telephone, an article in The Lancet first described the telehealth concept and its use.  

And a law that’s even older than the telephone still triggers telehealth audits today.  

The 1863 False Claims Act was enacted to keep profiteering contractors from defrauding the Union army. Today, it can trigger serious problems for modern telehealth practitioners.  

How this resource helps: 

Today we know the best way to cope with audits is to avoid the need for them in the first place. This article shares six proactive steps to take to reduce the impact of telehealth audits.  

It includes advice on how to: 

• Know what you’re up against.  
• Inventory your waivers.  
• Check your records.  
• Audit your process.  
• Fix what’s broken.  
• Rebill and repay.  

Patient demand for telehealth isn’t going away. Neither are the costs of noncompliance with telehealth regulations.  

By proactively partnering with colleagues in relevant departments, your compliance team can lead the efforts to identify and fix issues before they become major problems. That way, you can provide the telehealth services patients want in compliance with what the regulations demand. 

Resource 6 – 5 Payer Audit Errors Every Hospital Must Avoid 

From large hospitals to solo practitioners, at some point most providers will experience a commercial payer audit from CMS, OCR or some other agency. Their scrutiny reveals errors and violations, which in turn trigger hefty penalties. In fact, commercial payer audits have jumped 2.2 times over a single year, increasing the total sum at risk for hospital systems by 30%.  

Even more challenging, payers are moving heavily toward pre-payment audits. These can hold up payments and squeeze monthly cash flow.  

External payer audits don’t have to be such a nightmare.  

How this resource helps: 

The key to surviving an external audit with the least pain is to avoid the five payer audit errors outlined in this blog. 

1. Late responses 
2. Wrong documentation 
3. Billing the wrong codes 
4. No self-audit 
5. No legal help 

By staying prepared and vigilant, your next payer audit experience can be more streamlined and less stressful. 

Resource 7 – Audit Expectations and Challenges 

When it comes to providing best-in-class healthcare, stress comes with the territory. Unrelenting demands drain resources across the organization, including some not directly involved with patient care.  

One demand that turns daily routines upside down, and compounds stress levels is an audit. A compliance audit can be conducted internally by hospital committees or externally, often by government-approved contractors. 

Internal Audit – Seeks to determine provider’s financial and operational controls, and that related policies and procedures meet compliance and risk management needs. 

External Audits – Several federal agencies including CMS, OIG, OCR and others are the primary drivers of audits of regulations and compliance costs across hospitals. Responding to multiple external audits increases administrative costs, and funds could be bound up in lengthy appeals. 

How this resource helps: 

Study this overview to familiarize yourself with the basic workings and typical costs associated with audits. For example, external audits are conservatively estimated at $100 per hour, but the manual drain goes deeper:. Standard program reviews require 300 to 346 hours of direct manual labor per plan, taking skilled leaders away from higher-level risk mitigation. 

The Tech-Driven Path to a Proactive Audit Strategy 

You have plenty of insightful and helpful resources to review here. But as you look through them, keep this reality check in mind: 40% of compliance teams still rely on spreadsheets and text documents to track internal reviews. 

The future belongs to compliance leaders who lean into automated tools, allowing their teams to complete risk assessments far faster than manual methods and catch errors before federal or commercial auditors flag them. 

If you’re ready to leave the spreadsheets behind, or just have questions about setting up your proactive audit framework, we’re always here to talk. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Master Healthcare Compliance Audits: Learn from 7 Expert Resources  first appeared on YouCompli.

This article uses a specific example to explore the implications of medical necessity for healthcare systems. 

Recent False Claims Act Complaint Hinges on Medical Necessity  

Recently we wrote an introductory article discussing in general terms the compliance risks associated with medical necessity. That was first in a series on medical necessity. Now this article introduces a specific example.   

In this case, the U.S Department of Justice (DOJ) filed a False Claims Act complaint against a hospital group and three long-term care hospitals. They allege the False Claims Act was violated because some of the care provided (for which the hospital was reimbursed) wasn’t medically necessary. 

Three Ways Medical Necessity Impacts Performance 

Medical necessity remains a serious compliance risk for providers, including hospitals and health systems. It impacts these organizations in several significant ways: 

• Performance and Efficiency 
• Financial and Compliance Risk 
• Patient Outcomes and Quality 

1. Performance and Efficiency 

Administrative Burden: Research shows that “medical necessity” serves as a primary tool for allocating resources, but varying definitions across payers create administrative churn. Studies indicate that managing these requirements increases the revenue cycle workload, leading to delayed payments and reduced efficiency. 

Operational Streamlining: Conversely, some evidence suggests that when medical necessity is effectively operationalized (e.g., integrated into EHRs), it can increase the speed of diagnosis by eliminating redundant or non-essential tests.  

2. Financial and Compliance Risk 

Denial Management: A major area of study involves “medical necessity” as a driver of claim denials. Research by organizations like AAPC indicates that failure to validate medical necessity can lead to revenue loss, recoupments, and payer audits. 

Regulatory Exposure: Inadequate documentation of medical necessity is a leading cause of False Claims Act allegations, representing a high-stakes legal and compliance risk for health systems.  

3. Patient Outcomes and Quality 

Care Appropriateness: Studies suggest that medical necessity standards help align clinical care with evidence-based guidelines, which can improve patient safety by reducing exposure to unnecessary, potentially harmful procedures. 

Equity and Access: Research into determinants of health system performance warns that restrictive criteria can limit access to essential care for vulnerable populations if based on cost-containment instead of individual patient needs.  

Allege Longer Stays to Increase Medicare Reimbursement 

The example covered here reflects some of these negative impacts. In this False Claims case, the DOJ alleges that the hospitals held patients in the hospital longer than medically necessary in order to increase Medicare reimbursement.  

Long-term care hospitals (LTCHs) provide inpatient services for patients whose medically complex conditions require long hospital stays and programs of care. Medicare reimburses LTCHs based, in part, on a patient’s length of stay.   

By allegedly delaying discharge of certain patients, even when their course of treatment had been completed or when they could have been transferred to a lower level of care, the hospital received higher payments than they should have. 

The DOJ did not discover this issue on their own. The lawsuit was originally filed by a former employee of one of the hospitals through the qui tam or whistleblower provisions of the False Claims Act.  

How Internal Concerns Become Full-Blown Investigations 

Though allegations of medically unnecessary care may be a common reason such lawsuits are filed, understanding the details of a specific case is important.  

It can help compliance professionals see how concerns, potentially first reported internally, can develop into full blown investigations or additional complaints being filed with the court by the DOJ, as in this example. 

Manipulating Qualifying Patient Stays for Higher Reimbursement 

In the complaint, the DOJ alleges that the defendants illegally inflated their Medicare payments by holding patients who were ready for discharge until they reached a certain threshold date that, once reached, would trigger increased reimbursement.  

Certain Medicare patients who meet an average length of stay over the twenty-five days that LTCHs must maintain are referred to as a Qualifying Patient. The Government claimed the defendants also inappropriately held Qualifying Patients long enough to meet the 25-day average length of stay requirement to maintain their LTCH status and be paid at the higher LTCH rate.  

In the court document filed by the DOJ, it’s alleged that one executive told her employees, “No one is leaving early. We lose money.” Unfortunately, this wasn’t the only example of their alleged poorly handled medical necessity determinations. 

Ignored Alternatives Could Have Been Fraction of the Cost 

According to the complaint, many of these patients could have been discharged earlier and received care at home or in a nursing facility for a fraction of the cost to Medicare.   

The complaint also states that when employees raised concerns about the practices to one of its executives, the executive dismissed them, noting they would make money even if Medicare denied some medically unnecessary claims.  

Compliance Responsible for Appropriate Processes 

Compliance programs should ensure that appropriate processes exist to confirm the appropriate clinical criteria are met when it comes to admission and discharge actions.  According to the government, LTCHs specifically must have a documented process that: 

“screens patients prior to admission for appropriateness of admission to a long-term care hospital, validates within 48 hours of admission that patients meet admission criteria for long-term care hospitals, regularly evaluates patients throughout their stay for continuation of care in a long-term care hospital, and assesses the available discharge options when patients no longer meet such continued stay criteria.” 

The government states that in 2017, CMS observed that LTCHs appeared to be improperly holding patients beyond the key time threshold to obtain the full payment, which resulted in potentially improper delays in patient discharges other than solely for medical reasons.  

As a result, in fiscal year 2018, CMS revised the payment methodology to reduce LTCHs’ financial incentive to delay patient discharges until after the threshold. 

Example of Inappropriate Intent to Maximize Revenue 

The DOJ’s complaint contains statements that appear to imply they have emails or other documentation that show the intent to delay discharge. For example, an executive allegedly emailed a broad group of staff to praise them for getting “patients discharged on their correct discharge day to maximize our revenue.”   

Reportedly, the same executive also developed a bonus plan for a case manager in 2018 that required her to discharge 90 percent of patients on the “ideal discharge date” to receive a bonus. The ideal discharge date was a date calculated in a way (and reported on a dashboard) to lengthen the stay to meet higher reimbursement goals. 

Of course, the claims asserted in the complaint filed by the DOJ are allegations only.  However, most of the time the DOJ is not going to file a complaint if they do not believe they have or will obtain the evidence they need to either pursue the case further in court or lead to a mutually agreed upon financial settlement. 

Requirements for Medical Necessity Determinations 

Medical necessity determinations tend to be circumstance-specific. Auditing and monitoring for medical necessity will also typically require the involvement of a professional with clinical training or background.   

At times, it may be appropriate (if there are no conflicts of interest) to have a medical director from the organization be involved in such determinations. At other times, it may be a better idea to seek independent expertise from someone outside your organization. 

Learn from Examples of Medical Necessity Problems 

Watch for the next article in this series when we take another deep dive into an example of medical necessity in healthcare. In the meantime, browse these curated selections. 

Find More Advice and Ideas in These Related Articles 

• Introductory Article: Understanding Medical Necessity Compliance Risks The first post in this series, covering the foundational definitions and general compliance risks healthcare providers face today. 
• The False Claims Act: A Guide for Healthcare Leaders A deeper look into how inadequate documentation can trigger False Claims Act allegations and the resulting legal stakes for health systems. 
• Strategies for Reducing Claim Denials and Revenue Loss Practical insights into how medical necessity acts as a driver for claim denials and how to improve your revenue cycle workload. 
• Aligning Clinical Care with Evidence-Based Guidelines Learn how to leverage medical necessity standards to improve patient safety and ensure care appropriateness across your organization. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Compliance Risk Is Driven by Medical Necessity Problems  first appeared on YouCompli.