Durable Medical Equipment (DME) billing remains a significant target of the government with regard to compliance risks. The insights and strategies in this blog offer guidance to help health systems avoid exposure and losses from DME fraud. 

Recently, CMS announced that 11 DME companies have been barred from receiving future Medicare Advantage (MA) Part C and D payments. The CMS decision is based on suspected fraudulent billing to the tune of $3.4 billion. 

The suspicious activity was based on the following where the company: 

• Submitted no claims prior to 2025 
• Used improper billing practices for their claims 
• Billed for medical equipment to patients who were already deceased 
• Supplied equipment to patients who either never requested it or received it 

The companies are known as DMEPOS suppliers: durable medical equipment, prosthetics, orthotics and supplies.   

These 11 organizations and the resulting issues aren’t the only examples of DME dollars at risk of fraud, waste and abuse.  

Health Systems Not Immune to Exposure from DME Risks 

While DME fraud often originates with third-party suppliers, health systems are subject to direct operational and financial exposure. Compliance leaders who actively combat these schemes protect organizational revenue, preserve physician credentials, and prevent costly administrative disruptions.  

Proactive fraud mitigation ensures seamless patient care while shielding health systems from aggressive federal audit scrutiny. It involves many goals that are already within the compliance mission: 

• Protecting physician credentials and NPI integrity 
• Fulfilling strict recordkeeping and order requirements 
• Safeguarding patient care and trust 
• Reducing downstream audit burden 
• Ensuring Medicare Advantage network integrity 

For example, fraudulent suppliers routinely harvest physician National Provider Identifiers (NPI) to generate fake orders for items like catheters, orthotics and glucose monitors. Proactive oversight prevents unauthorized order generation using health system provider credentials and protects clinicians from CMS sanction lists. 

Other Areas of Government Focus: Catheter Audit Example 

In addition to wide sweeping announcements like the one above about the 11 DME companies, other government agencies are focusing on specific types of supplies that might be vulnerable to fraud, waste and abuse.   

For example, the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) published the results of an audit they performed related to Medicare payments for intermittent urinary catheters.   

Intermittent urinary catheters are covered under the Medicare Part B benefit for prosthetic devices for people who have permanent impairment of urination (i.e., permanent urinary incontinence), involuntary loss of urine, or permanent urinary retention (inability to voluntarily empty the bladder or pass urine). A treating practitioner orders catheters for an enrollee, and a supplier fulfills the order. 

OIG Audit Finds $35+ Million in Improper Catheter Payments 

OIG audited a period during which Medicare paid $303 million for these types of catheters. Based on the error rate in the sample used for the audit, OIG estimated that Medicare improperly paid $35.1 million for the catheters.   

They cited examples where medical records didn’t support enrollees’ eligibility for curved-tip catheters or sterile catheter kits. For other claims in their sample, suppliers didn’t meet Medicare requirements for catheter refills, proof of delivery, or a standard written order. 

Stopping Medical Device Scams at the Patient Level 

Beyond this auditing work, OIG also issued a Consumer Fraud Alert for Urinary Catheter Scams. The fraud alert informs patients that scammers are targeting Medicare enrollees through phone calls, internet ads, and text messages with offers of free services, medical equipment, or gift cards after confirming their personal information and eligibility for specific Medicare services.  

Often, the enticement for the individual is that they are “qualified” for items “at no cost” or “free.” Once the scammers obtain the enrollee’s personal information, monthly billing to Medicare will begin for medically unnecessary urinary catheters that may or may not actually be sent to the enrollee. 

Three Areas to Monitor to Avoid DMEPOS Fraud 

OIG has demonstrated their commitment to addressing fraud, waste and abuse challenges in the DME sector. In this white paper, “The Nation’s Challenge to Combat Durable Medical Equipment Fraud in Medicare,” OIG presents actions that CMS and others can take to stop bad actors from exploiting Medicare.   

It focuses on three key elements that bad actors need to commit DMEPOS fraud: 

1. Medicare-enrolled DMEPOS supplier 

2. Physician order for DMEPOS product

3. Medicare enrollee’s identification number 

1. How to Combat Medicare-enrolled DMEPOS Supplier Fraud 

Maintaining strict referral standards prevents regulatory non-compliance and protects payer contract relationships. Health systems and affiliated provider networks must screen against the CMS Preclusion List and verify supplier enrollment. 

Actions that OIG suggests CMS should take: 

• Strengthen on-site inspections to prevent bad actors from enrolling in Medicare. 

This could include additional unannounced on-site inspections to ensure bad actors can’t predict when site visits will occur. 

• Improve detection of unreported changes of ownership and straw owners. This might include using AI or other technologies on an ongoing basis to identify changes in ownership that have not been reported to CMS. 
• Ban suppliers from using paper applications to circumvent oversight. 
• Increase oversight of newly enrolled DMEPOS suppliers. This could include CMS implementing a period of enhanced oversight of newly enrolled DMEPOS suppliers and those that recently changed ownership. 
• Reassess and potentially update surety bond requirements to better deter fraud. 
• Require all DMEPOS suppliers that bill Medicare Advantage to enroll in Medicare. 

2. How to Combat Fraud in Physician Orders for DMEPOS  

When CMS or OIG audits target improper supplier claims, health systems must produce matching clinical documentation to avoid administrative claw backs and penalties. Federal regulations require ordering physicians to maintain clinical records supporting medical necessity for seven years. 

Actions that OIG suggests CMS should take: 

• Engage ordering physicians in fraud-fighting efforts. CMS could develop an electronic verification method for physicians to confirm orders before certain claims are paid. Or CMS could issue reports to physicians detailing the DMEPOS they ordered and request that physicians review the information and report any fraudulent billing. 
• Harness new technologies and analytic tools to better detect and stop payments for fraudulent DMEPOS claims. OIG recommends that CMS explore the potential for using AI in this area. 
• Enhance the use of payment suspensions. 
• Expand medical reviews to prevent fraud. 
• Work with secondary payers to stop fraudulent billing. CMS recently began sharing payment suspension information with secondary payers to help them prevent payments to potentially fraudulent suppliers. 
• Require Medicare Advantage organizations to submit the identification number for physicians who order DMEPOS. 

3. How to Combat Fraud in Medicare Enrollee ID Numbers 

Schemes that target patients with unsolicited, unnecessary or low-quality equipment disrupt care plans and harm patient trust. Robust compliance workflows ensure discharge planners and care coordinators connect patients exclusively with legitimate, Medicare-enrolled suppliers. 

Actions that OIG suggests CMS should take: 

• Discontinue or better protect enrollee lookup tools. 
• Prohibit DMEPOS suppliers from all types of unsolicited contact with enrollees. 
• Partner with social media companies to prevent sale of enrollee identification numbers on their platforms. 
• Engage Medicare enrollees in the fight against fraud. 

Needless to say, DME is an area fraught with fraud, waste and abuse risk, and government enforcement agencies are focusing more on DME, not less. If your organization participates in this space, make sure your compliance program is preparing against the various DME compliance risks we’ve talked about here and others as they arise. 

Download Free Checklist

About the author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post What Health Systems Need to Know about DME Billing Fraud:  Three Areas to Watch  first appeared on YouCompli.

Everyone has someone they report to, and for the OIG, one of those bosses is the U.S. Congress. Twice a year, the OIG submits a report to “the boss”, summarizing some of their significant activities and tooting their own horn, so to speak.  

OIG Reveals Impressive Return in Expected Recoveries and Receivables 

In a recent report, the OIG announced a $12.70 return in expected recoveries and receivables for every $1 invested, an ROI any of us would love to have.

For the most recent six-month period, OIG also reported substantial financial and enforcement activity to Congress.

Report Reveals Advance Insights into OIG Game Plan

The report also provides insight into areas OIG may plan to target. These four areas are especially worth watching for compliance professionals.

1. Criminal and Civil Enforcement Highlights 

OIG highlighted many cases, but a couple are especially likely to catch compliance professionals’ attention: 

Wound Graft False Claims Fraud Results in Prison, Restitution and Settlement 

The owners of several wound graft companies were sentenced to prison, ordered to pay restitution, and agreed to pay a settlement to resolve False Claims Act liabilities. OIG reported that these individuals ran a nationwide scheme targeting Medicare patients that resulted in orders for medically unnecessary, oversized skin grafts. They also accepted millions of dollars in illegal kickbacks and directed nurse practitioners to apply unwarranted grafts, resulting in more than $1.2 billion in fraudulent claims submitted to Federal health care programs.  

Convicted Physician Excluded from Federal Health Programs for 50 Years 

A rheumatologist was excluded from participating in Federal health care programs for 50 years after being convicted of health care fraud involving more than $118 million in false claims. Specifically, the OIG reported that the doctor falsely diagnosed patients with chronic illnesses to bill for tests and treatments that were medically unnecessary. These false diagnoses led patients to receive unnecessary treatments, including injections, infusions and X-rays.  

2. OIG Financial Integrity Efforts Target Improper Payments 

Knowing the possible OIG focus areas helps compliance professionals when they are performing risk assessments, auditing and monitoring. You can get a sense of where OIG is looking and where you might need to assess and prepare.  

Relating to financial integrity, the OIG highlighted areas of their work designed to prevent and detect improper payments. Noteworthy examples included: 

Autism Services 

OIG determined that two states (Maine and Colorado) made improper Medicaid payments for applied behavior analysis (APA), which is a behavioral therapy often used to help individuals with autism.  

Maine made an estimated $45.6 million ($28.7 million Federal share) in improper payments and an estimated $22.4 million ($14.2 million Federal share) in potentially improper payments. Colorado made an estimated $77.8 million ($42.6 million Federal share) in improper payments and an estimated $207.4 million ($112.5 million Federal share) in potentially improper payments.  

Durable Medical Equipment (DME) 

OIG looked at payments for a 7-year period for durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) that were provided during inpatient stays. They found that $22.7 million in Medicare payments to suppliers should not have been paid.  

The overpayments were a result of system edits to CMS’s claims processing system for Medicare Parts A and B that were not working properly to prevent or detect such overpayments.   

Managed Care Enforcement 

OIG continues to emphasize concerns with potential overpayments in Medicare Managed Care. In addition to their publishing the Industry Segment-Specific Compliance Program Guidance for Medicare Advantage, they also highlighted two large settlements. 

The first was a $556 million settlement with five Kaiser Permanente affiliates to resolve False Claims Act allegations that they systematically submitted invalid diagnosis codes for Medicare Advantage enrollees to receive inflated payments.   

The second settlement was with Aetna, which agreed to pay $117.7 million to resolve allegations under the False Claims Act that it submitted, or failed to retract inaccurate Medicare Advantage diagnosis codes to inflate payments from CMS. The insurer certified and maintained false and unsupported patient diagnoses, including for morbid obesity and chart review coding, resulting in overpayments.  

3. Patient Safety Gets Continued Emphasis in OIG Plan 

Compliance professionals know that over recent years, the OIG has emphasized patient safety in much of their guidance. In their report to Congress, OIG again highlights activities around protecting people from harm.  

Examples 

• A physician in Michigan who was excluded from participating in Federal health care programs for 60 years based on convictions of criminal sexual misconduct. 
• Work overseeing improper use of antipsychotic medications in nursing homes. 
• 64% of nursing homes received a serious deficiency within three years of graduating from the CMS Special Focus Facility program, which is supposed to address quality problems at the poorest performing nursing homes with track records of serious noncompliance.  
• Nursing home owners in New Jersey were excluded from Federal health care programs for cost-cutting activity that resulted in facility residents being neglected, abused, receiving inadequate medical care and residing in unsanitary conditions. 
• A nursing facility CEO was sentenced to prison for diverting funds for personal enrichment when those funds were intended for resident care. With the resulting lack of funds for care, the facility was understaffed and unsafe. 

4. Integrity of Grants and Contracts Puts Millions at Risk 

HHS offers a significant number of grants and enters into many contracts, and OIG is looking at compliance with requirements associated with grants and contracts.  

Examples 

• Compliance With Federal Contracting Requirements–Administration for Children and Families (ACF) 
• Gaps in National Institutes of Health (NIH) oversight put millions in funding for “Other Transactions” at greater risk of fraud, waste or abuse. 
• A cancer institute agreed to pay $15 million to settle False Claims Act allegations that it caused the submission of false claims to NIH related to scientific grants. The institute admitted that between 2014 and 2024, it used NIH funding to support cancer research publications containing misrepresented, duplicated, rotated, magnified or stretched images, often depicting different experimental conditions or timepoints across 14 journal articles tied to six NIH grants.  

Compliance Leaders Can Find Clues in OIG Plan 

As you assess your organization’s compliance risks, look for clues in these four areas and others included in the OIG plan submitted to Congress. With their impressive return on investment, the OIG is likely to continue to receive the resources they need to prevent, detect and enforce compliance, and their plan likely shares some of their roadmap. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Where Does the Recent OIG Plan Focus? Highlights of Note  first appeared on YouCompli.

New compliance professionals benefit from a variety of resources to ramp up their knowledge and value. If you’re new to the healthcare compliance field (or know someone who is), save and share this article 

Getting Started for Early-Career Compliance Professionals 

The 20+ foundational resources that follow were curated from the YouCompli resource library. This set is tailored specifically for early-career compliance professionals. Start reading for ideas to build your: 

• Leadership skills 
• Operational credibility 
• Cross-departmental influence 

Read Expert-Sourced Content Designed for Professional Development 

Written for (and sometimes directly by) healthcare compliance executives, the information is practical and easy to understand. 

The articles focus on a variety of important topics: 

• Communication and Professional Growth for New Leaders 
• Operational and Audit Fundamentals for Building Compliance Expertise 
• Technology and Strategic Planning for Regulatory Change Management 
• Compliance Program Building and Oversight 
• Video Hub: Expert Guidance for Healthcare Compliance Professionals 
• Downloadable Tip Sheets for Quick Ideas and Actions 
   

Pick where you need help most today and dive in. (A few resources fall into multiple categories, so you get double the return when you read them.) 

Communication and Professional Growth for New Leaders 

From soft skills to dollar signs, these articles cover areas that sometimes get neglected in more formal compliance leader training. These expert resources cover aspects of compliance communications you might not find anywhere else. Learn about the persuasive communication skills that are the secret superpowers behind strong compliance leaders.  

Aggressive vs Assertive Communication: What New Healthcare Compliance Officers Need to Know  

Get advice tailored for new leaders on building authority and articulating compliance risks without creating unnecessary friction. New compliance executive can learn how to speak with authority and assertiveness without damaging cross-departmental relationships.  

This article covers:  

• Key differences between two common communication styles  
• How assertive communication benefits the compliance program  
• Strategies to help you master this skillset 

Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Being aware of how we do our own work is paramount for an effective compliance program and incorporating self-awareness into your healthcare compliance program can enhance its effectiveness. For example, it improves your ability to empathize with the challenges operational leaders face when adjusting a process to meet a regulatory requirement. To help build awareness, explore these 18 actionable tips for compliance officers. 

Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  

For effective healthcare compliance leaders, financial literacy isn’t optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  Explains key financial concepts so business newcomers can align compliance goals with executives’ organizational priorities.  

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.   

Operational and Audit Fundamentals for Building Compliance Expertise 

Business operations are essential partners in a good compliance program, and audits are foundational to healthcare compliance in those areas. These resources drill down into both, explaining how to reduce friction and frustration through proactive partnerships and education.  

Audit Readiness? How about Audit Etiquette?  

In this blog, experts offer the real scoop on audit readiness in healthcare. It outlines crucial operational protocols and relationship dynamics for leading teams through smooth, defensible audits. Learn the unfiltered truth about compliance audits and what audit etiquette means. Get essential tips on: 

• Preparing for audits 
• Role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• What does audit readiness mean? 

Healthcare Quality Leadership: How to Be an Operational Partner, Not a Roadblock  

In every organization, there’s a moment where the quality department becomes either the trusted operational partner or the operational roadblock. The difference between the two comes from how you communicate, assign responsibility and how you follow through. This blog explains how to adopt the OG style for more effective quality programs in healthcare, with “Three Ways to Partner like a Pro.” Direct the strategies that shift compliance from a gatekeeper to a strategic business enabler. 

Three Tips for Strong Compliance Education Practices  

Compliance orientation educates new staff members about company policies, procedures, and various regulations that govern their specific roles. Ongoing compliance training ensures that as regulations evolve, all employees are appropriately educated on implications and requirements. With its emphasis on risk management, compliance training protects both employees and organizations from legal and ethical pitfalls.  

A good understanding of compliance helps employees safeguard the company against lawsuits and reputational damage. Get core principles and three tips for clear, memorable staff training programs that drive actual behavioral change. Two experts – one in education and one in compliance – share advice and analogies to improve your compliance education practices.    

Technology and Strategic Planning for Regulatory Change Management 

Technology and strategy have a lot in common. We expect both to be versatile and responsive, while at the same time, they have to hold up and carry the organization over the long term. These selections explore ideas that will help novice leaders leverage technology to drive strategy and value.  

What to Look for in Regulatory Change Management Software for Healthcare Compliance 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation, dashboard details and insights into completed work. Get a practical checklist to help new leaders evaluate software capabilities for tool selection. Learn six non-negotiables for regulatory change management software and processes. 

AI Guide for Healthcare Compliance Leaders  

From Manual to Scalable: How to Manage Healthcare Compliance Risk 

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity. Updates are tracked. Summaries are circulated.  But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

From a systems-thinking perspective, this is a structural failure, not an execution problem.  In this piece, Lisa Estrada explores systems-thinking strategies to move beyond manual processes and build a scalable regulatory compliance process.  

Compliance Program Building and Oversight 

During your compliance career, you may have opportunities to build a program or at least manage one. Using the metrics and collaboration-building practices covered in these resources will set you on the path. 

5 Strategies for Compliance Accountability Across the Organization  

While supporting operational teams in finding compliant solutions is part of your role, becoming the de facto fixer of what constitutes “operationally friendly” is beyond your scope. That piece must be owned by operations.  The challenge becomes how to get operational leaders to take ownership to resolve their own compliance challenges. 

These five strategies will help you encourage your operational leaders to take responsibility for their particular compliance issues, while preserving your role as a trusted advisor. Respected compliance professional Jay Anstine outlines methods for instilling shared ownership of compliance requirements across clinical and administrative business units.  

Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track? 

How Slowing Down Makes for a More Productive Compliance Program  

As regulations change or investigations are needed, we often get pushed to work faster, meet tighter deadlines, and juggle multiple tasks simultaneously.  

While this approach might seem efficient on the surface, it often leads to serious downsides: 

• Burnout 
• Decreased productivity 
• Decline in the quality of work  

This interesting piece focuses on transitioning from reactive firefighting to building deliberate, repeatable compliance processes. You’ll get five solid tips to help you and your compliance team slow things down in a good way. 

Video Hub: Expert Guidance for Healthcare Compliance Professionals 

While we can’t go into all of them here, the YouCompli video library is packed with useful visual learning materials.  Explore the full catalog, featuring expert interviews and practical strategies. 

Real Conversations. Practical Compliance Insights. 

Where do you need ideas and advice? 

• Compliance Leadership & Mindset 
• Influence, Trust & Seat at the Table 
• Operationalizing Compliance  
• Efficiency, Clarity & Saving Time 
• Customer Perspectives & Real‑World Experience 

Hear directly from compliance leaders who understand the realities of the work. These short videos share honest perspectives on simplifying regulatory requirements, building trust with the business, and turning compliance into a strategic advantage. 

Downloadable Tip Sheets for Quick Ideas and Actions 

For the compliance leader on the go (isn’t that all of us?) the Tip Sheet Library offers quick, useful information. Explore the collection and start downloading tip sheets to start your own handy idea file. 

• Compliance Career Tips 
• Compliance Culture 
• Compliance & Business Strategy 
• Healthcare Quality 
• Industry Trends 
• Rev Cycle 
• Rules and Regulations 

Need More Specialized Support for Your Healthcare Compliance Program? 

Not only does YouCompli have educational resources to help compliance professionals, we also human resources who can help. If you’d like to speak to someone to answer any questions, just reach out. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Resources to Accelerate New Healthcare Compliance Careers  first appeared on YouCompli.

What Does the Final Rule Mean for Your Organization? 

This release updates Medicare payment rates and policies for acute care and long-term care hospitals, with some starting as soon as January 1, 2027, so it’s definitely time to start paying close attention. 

1: Expansion of Comprehensive Care for Joint Replacement (CJR) Model 

The original CJR Model ran from April 2016 through December 2024 and according to CMS, it produced the needed results. The most recent evaluation of performance years six and seven (2021-2023) showed that the CJR Model produced an estimated $112.7 million in net savings while maintaining quality of care. 

Now, the CMS Innovation Center is expanding the model nationally, including in U.S. Territories, starting January 1, 2028. The expanded model, called CJR-X, will focus on improving care and reducing spending for Medicare beneficiaries undergoing lower extremity joint replacement (LEJR) procedures.  

CJR-X Mandatory Requirements for Some Acute Care Hospitals 

Participating hospitals will be held accountable for spending and quality of care during an inpatient stay or hospital outpatient procedure and for the 90 days following hospital discharge.  With some exceptions, the CJR–X Model will be mandatory for acute care hospitals paid under IPPS and Outpatient Prospective Payment Systems (OPPS).  

Multiple Modifications to CJR Model 

CJR–X also includes modifications to the CJR Model. The Final Rule confirms multiple policies for CJR-X.  These include: 

• January 1, 2028 start date 
• Acute care hospitals as participant and accountable entity 
• LEJR as the episode of care 
• Five quality measures and a composite quality score (CQS) to assess quality performance  
• Regional risk-adjusted target prices that include capped normalization and trend factors 
• Pricing-specific policies for certain hospitals, such as low-volume and safety net hospitals 
• Provider and beneficiary overlap permitted with most models 
• Allows participant hospitals to have financial arrangements 
• Waives certain Medicare program requirements 
• Permits beneficiary-identifiable and regional aggregated data sharing 
• Options for Alternative Payment Model (APM) participation  

Though compliance professionals aren’t likely to be named the implementation lead of these efforts at their hospital, they should still be aware of how these changes will affect reimbursement, quality reporting and allowances for financial arrangements. 

To learn more now and in the future about the CJR-X Model, stay tuned at https://www.cms.gov/priorities/innovation/innovation-models/cjr-x 

2: Organ Acquisition Costs 

Compliance professionals working in or with organizations providing organ acquisition services need to be aware of these changes and ensure policies, procedures and any auditing activity is adjusted accordingly. 

• The Final Rule outlines payment policies for organ acquisition and reasonable cost, as well as reimbursement appeals for Independent Organ Procurement Organizations (IOPOs) and Histocompatibility Laboratories (HCLs).   
• The Final Rule solidifies the proposal to clarify and codify certain longstanding policies on allowable costs under Medicare’s reasonable cost principles for all provider types, including public education for organ procurement organizations.  
• Additionally, it finalizes the proposal to clarify and codify Medicare’s longstanding policies for allocating overhead costs across all provider types.  
• Lastly, the final rule codifies the CMS administrator’s discretionary review of reimbursement appeals for IOPOs and HCLs.  

As HHS OIG states in their General Program Compliance Guidance, “One of the best ways to identify fraud and abuse risks is to follow the money.” Understanding the flow of money related to organ acquisition is one of those areas to add to the list for “following the money.” 

3. Quality, Quality, Quality. 

Quality of care is another area that the HHS OIG has been shining a light on for compliance professionals in recent years. Though it’s unlikely compliance professionals will take over quality of care programs in hospitals, OIG expects tight partnerships. Also expected is a general understanding by compliance departments of the work that hospitals’ quality of care teams perform. 

Specifically, OIG said, “Entities should incorporate quality and patient safety oversight into their compliance programs. Integrating quality and patient safety oversight into compliance processes can alert the entity of quality and patient safety concerns and enable the entity to mitigate risk of patient harm.” 

Quality Reporting and Compliance Impact 

The IPPS Final Rule has a lot to say about quality reporting. Although compliance professionals aren’t on the front line for some changes, they should ensure quality teams are aware and have a plan to address any potential impact.  

Quality-related highlights include: 

1. Adoption of three new measures: 

• Excess Days in Acute Care After Hospitalization for Diabetes measure beginning with the FY 2029 payment determination 
• Hospital Harm-Postoperative Venous Thromboembolism electronic clinical quality measure (eCQM) beginning with the FY 2030 payment determination 
• Advance Care Planning eCQM beginning with the FY 2030 payment determination 

2. Removal of three measures, beginning with FY 2030 payment determination:  

• Venous Thromboembolism Prophylaxis eCQM 
• Intensive Care Unit Venous Thromboembolism Prophylaxis eCQM 
• Discharged on Antithrombotic Therapy eCQM 

3. Modifications to three measures beginning with the FY 2028 payment determination. All are related to Excess Days in Acute Care after Hospitalization for: 

• Acute Myocardial Infarction 
• Heart Failure 
• Pneumonia 

4. Five modified mortality measures beginning with the FY 2028 payment determination.  Each relates to the Hospital 30-Day, All-Cause, Risk-Standardized Mortality Rate following: 

• Acute Myocardial Infarction Hospitalization  
• Heart Failure Hospitalization 
• Pneumonia Hospitalization  
• Chronic Obstructive Pulmonary Disease Hospitalization  
• Coronary Artery Bypass Graft Surgery  

4: Promoting Interoperability of Certified Electronic Health Record Technology 

The Medicare Promoting Interoperability Program encourages eligible hospitals and critical access hospitals to adopt, implement, upgrade and demonstrate meaningful use of certified electronic health record technology (CEHRT). 

In this Final Rule, CMS confirmed policies to: 

• Remove and revise certain criteria to align with proposals made by the Office of the National Coordinator for Health IT 
• Remove certain attestations  
• Delay removal of the following two measures: (i) Support Electronic Referral Loops by Sending Health Information and (ii) Support Electronic Referral Loops by Receiving and Reconciling Health Information  
• Modify the Electronic Prior Authorization measure as an optional bonus measure for the EHR reporting period in CY 2027 and mandatory beginning with the EHR reporting period in CY 2028 
• Add the Unique Device Identifiers for Implantable Medical Devices measure  
• Adopt two new eCQMs beginning with the FY 2030 payment determination in alignment with the Hospital Inpatient Quality Reporting Program 
• Remove three eCQMs beginning with the FY 2030 payment determination in alignment with the Hospital Inpatient Quality Reporting Program  

Build Business Knowledge to Anticipate Non-Compliance Risks 

Most compliance professionals are unlikely to be the assigned project lead on any of these announcements within their individual hospitals. But good compliance professionals need to understand their organization’s business lines and operations to anticipate where non-compliance could most likely occur. 

For those working with or for hospitals, the Hospital IPPS Final Rule is always a good place to review upcoming changes to hospital reimbursement, government policies and data reporting requirements.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Stay Informed on Medical Necessity and More 

Read other blogs by Dr. CJ Wolf on YouCompli to stay current on information compliance leaders need. He covers these and other topics:  

• Regulatory and Enforcement Updates: Breaks down OIG Work Plan priorities, CMS policy updates, and healthcare regulatory changes. 
• Compliance Auditing and Risk: Offers practical advice on risk assessments, internal auditing, and building effective compliance programs. 
• Billing and Documentation Integrity: Examines compliance strategy related to coding integrity, medical necessity, and operational oversight. 

Here are a couple of articles to get you started. 

Don’t Let Pain Injections Cause Regulatory Compliance Pain 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.   

Four Areas of Noncompliance in SI Joint Injection Procedures  

Below are four categories of noncompliance and indications of unmet requirements: How SI Joint Injections Are Covered 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

Ensuring medical necessity for services or supplies is a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders.  

This piece explains the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Four Things to Know About the FY 2027 IPPS Final Rule  first appeared on YouCompli.

The HHS OIG recently released an audit report in which they concluded that for a recent one-year period, Medicare improperly paid physicians approximately $15.2 million for sacroiliac joint (SI) injections (see: https://oig.hhs.gov/reports/all/2026/medicare-improperly-paid-physicians-an-estimated-152-million-for-sacroiliac-joint-injections/).  

SI injections can help some patients improve their spinal mobility as well as relieve pain. Medicare covers these injections under certain conditions but not others. That’s where confusion can create painful compliance risks. 

Most Recent Audit in Series Related to Spinal Pain Management Services 

This was the most recent audit in a series of audits related to spinal pain management services which the OIG has been performing over many recent years.  

In prior audits of similar spinal services, the OIG found, for example, that Medicare improperly paid physicians for facet-joint interventions for more than 50 percent of sampled services that didn’t comply with one or more of the Medicare requirements:  

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-an-estimated-30-million-for-spinal-facet-joint-interventions/ 
• https://oig.hhs.gov/documents/audit/9596/A-09-20-03003-Complete%20Report.pdf 
• https://oig.hhs.gov/documents/audit/9602/A-09-20-03010-Complete%20Report.pdf  

They also reported finding improper payments associated with epidural steroid injections: 

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-for-epidural-steroid-injection-sessions/ 

Audits Continue in Therapeutic Spinal Pain 

In addition, last year, they published audit findings that said Medicare could have saved an estimated $17.7 Million if CMS oversight had prevented at-risk payments for anesthesia administered during spinal pain management procedures: 

• https://oig.hhs.gov/reports/all/2025/medicare-could-have-saved-an-estimated-177-million-if-cmss-oversight-had-prevented-at-risk-payments-for-anesthesia-administered-during-spinal-pain-management-procedures/  

Consequently, it should come as no surprise to healthcare compliance professionals that the audits in the therapeutic spinal pain space continue with the recent report about SI joint injections. 

Background on Crucial SI Joints 

The SI joints connect the lower portion of the spine to the pelvis. 

They support upper-body weight and play an important role in walking and changes in posture or position, such as moving from standing to sitting. These joints become painful for various reasons, including sacroiliac joint dysfunction, which occurs when the joint moves too much or too little, often due to injury, pregnancy or osteoarthritis.  

To improve movement and relieve lower back pain, a physician may administer an SI joint injection. A diagnostic injection is first used to determine whether the SI joint is the source of the pain. Significant immediate pain relief following the injection strongly suggests that the SI joint is responsible.  

(Image from page 2 of the OIG report) 

Once the SI joint is confirmed as the pain source, a therapeutic injection may be administered, with pain relief potentially lasting up to six months. 

How SI Joint Injections Are Covered 

Medicare Part B covers SI joint injections when medically reasonable and necessary. Five of seven Medicare Administrative Contractors (MACs) have local coverage determinations (LCDs) outlining requirements for  

• Pain indications 
• Imaging and pain assessment 
• Coverage limits  
• Diagnostic and therapeutic injections 

These LCDs limit coverage to two diagnostic and four therapeutic injection sessions within a rolling 12-month period, whether performed unilaterally or bilaterally.  

Billing and Coding for SI Joint Injection Procedures 

Each MAC also issued billing and coding guidance stating that physicians must add the “KX” modifier to each claim line for diagnostic injections to distinguish them from therapeutic injections. (Appendix C of the OIG Audit report summarizes the MACs, the states they cover, and the specific LCD number and LCD Reference article pertinent to their audit.) 

CPT code 27096 is used for injections made directly into the sacroiliac joint, while CPT code 64451 is used for injections targeting the nerves that innervate the sacroiliac joint. 

OIG Selects 100 Random Samples out of 186,000+ Procedural Sessions 

For the audit report, the OIG selected a random sample of 100 SI joint procedural sessions from a population of 186,842 sessions paid for by five MACs in a one-year period. They requested physicians’ supporting documentation to determine if the claims met Medicare requirements including LCD and LCD Reference Articles.   

Of the 100 sampled sessions, 28 complied with Medicare requirements, and 75 complied with Medicare billing guidance. However, the remaining 72 sessions didn’t comply with Medicare requirements, and 25 didn’t comply with Medicare billing guidance.  

Seventy-two sampled sessions didn’t comply with one or more of the requirements. The OIG report summarizes the noncompliant sessions by the type of noncompliance observed: 

(The total exceeds 72 sessions because 41 sessions had more than one deficiency.) 

Estimated Improper Payments of $15.2 Million in Sample Universe 

OIG then extrapolated their findings across the entire population of 186,842 sessions and calculated overpayments to determine their estimated improper payment amount of $15.2 million for the universe of sessions sampled for the one-year period. 

OIG found that although CMS had systems to identify some billing errors, it didn’t provide enough additional oversight or education to help physicians understand and follow Medicare requirements. CMS relied on MACs to educate physicians, but this wasn’t sufficient.  

As a result, some physicians may not have fully understood the requirements and billing rules. Physicians with billing errors said that more frequent and consistent training would have helped them understand the rules and avoid future errors. 

Other Improper Payments Assumed, Potentially Pushing Total Higher 

As mentioned, the sample universe of SI joint procedural sessions was limited to the five of the seven MACs that had issued LCDs. The other two MACs that didn’t have LCDs paid physicians $12.3 million for sacroiliac joint injection sessions. That accounts for approximately 36 percent of total Medicare payments for sacroiliac joint injections nationwide.   

Since these sessions were excluded from the audit, OIG wrote that this set of payments to physicians may also include improper payments. If true, the estimated $15.2 million in improper payments could potentially be higher. 

Four Areas of Noncompliance in SI Joint Injection Procedures 

Below are four categories of noncompliance and indications of unmet requirements: 

1 – Indications of Pain Requirements Not Met 

• At least three positive findings with provocative maneuvers 
• Low back pain below the L5 vertebra without radiculopathy 
• Low back pain that persists despite a minimum of four weeks of conservative therapies 
• Clinical findings and imaging studies that do not suggest any other diagnosed or obvious cause of the lumbosacral pain such as tumor and fracture 
• Low back pain for at least three months 
• Moderate to severe low back pain primarily experienced over the anatomical location of the sacroiliac joints between the upper level of the iliac crests and the gluteal fold 

2 – Imaging and Pain Assessments Requirements Not Met 

• The sacroiliac joint primary pain level must be measured prior to the injection at the beginning of the session. 
• The post procedure pain level must be measured at the end of the session. 
• The injections must be performed under computed tomography (CT) or fluoroscopy image guidance with contrast unless the patient has a documented contrast allergy so that ultrasound guidance without contrast may be considered. 

3 – Diagnostic or Therapeutic Sacroiliac Joint Injections Requirements Not Met 

• A diagnostic injection must have provided a minimum of 75 percent relief of primary pain before a therapeutic injection is administered 
• A subsequent therapeutic injection is not reasonable and necessary when the prior therapeutic injection did not result in at least 50 percent consistent pain relief or functional improvement for at least three months 

4 – Limitation of Coverage Requirements Not Met 

• Administer other musculoskeletal injections in the lumbosacral spine during the same session as sacroiliac joint injections 
• Perform multiple injections (e.g., epidural steroid injections, facet-joint injections, and trigger point injections) during the same session as sacroiliac joint injections and during the period when the physician is evaluating whether the injection reduced pain (i.e., efficacy assessment period) 

The Audit Details Smart Compliance Professionals Look For 

Like most medical claims’ audits, the “devil is in the details”. To avoid problems, wise compliance professionals will: 

1. Monitor the most recent LCDs from their MAC 
2. Maintain a process to review the LCDs and implement processes to ensure compliance 
3. Perform records audits for both coding and medical necessity  

Some coders might have the requisite medical knowledge to audit for medical necessity. However, it usually requires a clinical background as well as an understanding of Medicare billing requirements such as LCDs. 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Here are other resources to check out next: 

How to Avoid False Claims Related to Medical Necessity 

This expert blog gives compliance readers actionable steps to avoid civil monetary penalties and False Claims Act scrutiny resulting from documented medical necessity failures. 

Physician Coding and Billing Errors Enforcement: Compliance 

Get more context on enforcement actions stemming from unbundling, modifier misuse, and improper billing during same-day procedures. 

Know the Compliance Risk for Certain Anesthesia Services 

Learn about another recent OIG audit targeting spinal injection procedures and associated anesthesia/sedation coverage limitations. 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

The linked article specifically discusses how MAC LCDs define medical necessity (such as requiring four weeks of conservative therapy prior to approving spinal injections)

The post Don’t Let Pain Injections Cause Regulatory Compliance Pain  first appeared on YouCompli.

A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.

What Healthcare Compliance Teams Want from Regulatory Change Management Software

by Amy Laufmann, MBA

What do healthcare compliance teams actually value in regulatory change management software?

Each year, YouCompli asks clients to evaluate the software, regulatory content, and support they rely on to manage regulatory change. This year’s annual client satisfaction survey received responses from 30.68% of recipients, providing direct insight into what’s working, where teams see opportunities for improvement, and what they expect from the technology supporting their compliance programs.

We spoke with YouCompli Client Success leader Amy Laufmann, who manages the survey process, about what clients told us and how their feedback influences product development, training, support, and future innovation.

Client Survey Snapshot

Direct feedback from healthcare compliance leaders

30.68% annual survey response rate

01

Software & Workflow Dashboards, reporting, functionality, and day-to-day workflow

02

Service & Training Support, responsiveness, implementation, and user education

03

Regulatory Content Information and tools for operationalizing regulatory change

The feedback covered individual feature requests, but several broader themes emerged. Together, they provide a useful picture of what healthcare compliance leaders expect from the technology, information, and support surrounding regulatory change management.

What We Heard

Five priorities consistently surfaced in client feedback

01

Simpler workflows

Teams want unnecessary steps removed and task-level work streamlined without losing accountability or documentation.

02

Useful real-time analytics

Compliance leaders want meaningful metrics available directly from the work already happening inside their workflows.

03

Responsive support & training

Effective technology still requires support that identifies knowledge gaps and helps individual users work confidently.

04

Relevant regulatory content

Teams value more than software functionality. They also need reliable information that helps them understand and implement change.

05

Flexibility for different health systems

No two organizations use compliance technology exactly the same way. Workflows, access, assignments, and reporting need to support different organizational structures and operating models.

Client Success Q&A

Client Feedback, Product Innovation, and Support

Q

What do you hope to learn from YouCompli clients?

Amy Laufmann

We want to gain detailed insight into how clients assess the overall value that the software provides to their organizations. Client satisfaction survey questions are broken down into three categories:

• Software features and functionality (dashboard, reports, workflow)
• Client service (support, training, responsiveness)
• Regulatory content (information and tools to implement regulatory changes)

Q

How has capturing client input evolved?

Amy Laufmann

When we began building the client success program, our outreach focused on engagement, relationship building, and resource sharing. Last year, we shifted toward gathering insights and identifying additional content that could help clients.

This year, the focus is on value and satisfaction: What’s working? What isn’t? Both positive and critical feedback are useful. When clients who use the full solution suggest ways to make it even better, that gives us valuable direction.

Q

Who received surveys in healthcare systems?

Amy Laufmann

Surveys were sent to compliance executives and leaders most directly responsible for administering the software within the health system, not to everyone receiving work through the solution.

The only clients who wouldn’t receive the annual survey are those who aren’t fully implemented yet. If they haven’t finished implementing the software, it doesn’t make sense to ask them to evaluate a full year of use. Instead, we gather feedback during onboarding and send an onboarding satisfaction survey once implementation is complete.

Q

What themes came out of the responses this year?

Amy Laufmann

We do get granular feedback, like “adjust this particular piece of the software,” but we also see themes specific to improvement in the workflow functionality . This aligns with some of the new builds and user-facing workflow processes that our development team currently has planned in our product roadmap.

Q

How does feedback become action?

Amy Laufmann

Part of our comprehensive engagement process is not only sending out client satisfaction surveys, but also carefully reviewing each individual response.

Keeping Clients in the Loop: How YouCompli Communicates Back

• Concerns are specifically addressed with either follow-up questions or requests to meet.
• If a response relates to something currently planned or actively being worked on, we provide details of where we are in the improvement process.
• If the request is something we're just not able to do, we also identify that and provide the reasons and context as to why.
• Once progress is made or a change is completed, clients receive updates along the way so they can understand how their feedback is being addressed and appreciated.

When people see their suggestions turn into reality, that builds trust.

Q

How does feedback influence future innovation in regulatory change management?

Amy Laufmann

We get some of our most valuable feedback directly from clients. For example, we've identified requirement workflow functionality that could benefit from streamlining. It will eliminate steps that aren't necessary in certain workflows related to managing task-level work.

Prior to the satisfaction surveys, some of the most significant software improvements began as informal, direct feedback. Ad hoc feedback specific to reporting drove updates to our ready-to-run reports.

We listen to clients wherever we get a chance, but now the surveys capture it in black and white.

Partnering with Client Input on Analytics Development

Updating reporting was a big improvement, but during this survey follow-up, we learned clients were looking for additional metrics accessible in real-time.

The improved analytics capability was a direct result of feedback from a client who actually partnered with us on the development. We shared initial examples of what we’d built, and they gave input throughout that project before we went live last year.

Now we take data that's already in the workflow and report it to compliance leaders in a more valuable way. When we say YouCompli was developed by compliance professionals for compliance professionals, it’s completely true.

This year, the theme is more about finetuning the solution because there isn't significant functionality that the software doesn't already have. The foundation is solid, and clients are getting more specific in identifying further efficiencies they would like to see.

Q

What other value comes from conducting the survey?

Amy Laufmann

Uncovering Hidden Training Needs for Successful Compliance Teams

Sometimes we work with clients that seem to be doing well and using the software effectively, but their success hides a problem. Maybe one member on that team doesn't really get how to use the solution but is hesitant to share that.

The survey can uncover problems that clients may not feel comfortable raising in a meeting or direct email. In one instance, the feedback was, “I know I’ve been shown how to do this before, but I just don’t remember.” That response prompted us to offer additional support.

We identify a training opportunity with the client, but there's more to it than that. We want to identify opportunities to improve support, add to training materials, and identify any gaps that these questions may shine a light on.

Solving Utilization Mysteries

No two clients use YouCompli software the same way. Some integrate the solution into every department. Others limit access to a small group tasked with sharing information and resources. Some fully utilize the workflow to automate work assignments, while others choose not to.

These differences make it difficult to apply a one-size-fits-all approach when evaluating software utilization. It’s important to measure not only how a client uses the software, but also whether the available workflows, content, and support meet the client’s needs.

Q

Any other thoughts on the benefits of engaging with clients through their feedback?

Amy Laufmann

Hearing directly from clients puts us in the best position to continue delivering what really helps their organization, staff and patients. By identifying what’s working well along with opportunities to improve, we aim to be a partner focused on helping health systems get maximum value for their compliance programs.

My overall assessment is that, because we’ve made improvements from year to year, our clients’ expectations continue to rise—and our goal is always to rise with them.

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

YouCompli

Healthcare Compliance Insights

Stay ahead of healthcare regulatory change

Get practical compliance insights, regulatory change guidance, and new YouCompli resources delivered to your inbox.

Regulatory change Compliance strategy Practical resources

Useful guidance for healthcare compliance professionals. No inbox overload.

Join the newsletter

New compliance insights and resources, sent directly to you.

The post What Healthcare Compliance Teams Want from Regulatory Change Management Software first appeared on YouCompli.

This blog looks at what’s behind “punch one” — human-led regulatory analysis. It explores the role of a regulatory analysis team and how they bring value to the compliance management lifecycle.  

What AI Can and Can’t Do Well in Compliance Management 

There’s a misconception that AI can automate a lot of the research involved in regulatory change management. AI looks impressive to people who don’t do the actual work, but what AI often really does is create more work. 

While AI tools can gather data points quickly, they sometimes pass the burden of validation back to your in-house team. Sorting through duplicate links, hallucinated details or overly broad summaries can easily turn a promised time-saver into a tedious cleanup project.  

AI excels at generating large-scale but basic, general responses, but it’s missing the domain expertise required to spot subtle regulatory nuances. The rest of this article explains why expert regulatory analysis remains essential and how human validators and analysts help compliance teams turn complex regulatory updates into clear, trackable work. 

What Regulatory Analysis Teams Do 

How do regulatory analysts add value to compliance management? They handle vital legwork by ensuring: 

• Regulatory sources are monitored for relevant updates. 
• Expert insight looks at what changed. 
• Analysis helps teams understand what needs attention 

Reliability in Regulatory Analysis: Where Human Value Wins and AI Fails  

The main thing a compliance leader should understand about expert regulatory analysis is that it comes down to a reliability issue. Humans alone bring the trustworthiness that’s needed.  

Partner teams like YouCompli take on the regulatory legwork and cut through the noise with actionable analysis that is reviewed and organized. 

Role of Validators in Regulatory Analysis Model 

Organizations don’t always save a lot of time with AI because of the potential need for error checking and rework. On the other hand, a human validator delivers confident time savings, because no one usually has to go back and verify the validator. That can’t be said of AI. 

Solid regulatory change management processes trust the final word of experienced, compliance-centric humans as validators of regulatory requirements. At YouCompli, a team of attorneys doublecheck the work to bake in the reliability factor.  

It comes down to accuracy, and that’s something that can’t be consistently accomplished through AI-driven automation alone. 

Regulatory Analysis Isn’t Typical Part of Daily Healthcare Compliance 

The gist of what a regulatory analysis team does isn’t necessarily something that translates to a healthcare compliance department’s daily workload. That might be why people don’t fully understand the unique value of a seasoned analysis team.  

Tracking regulatory changes also requires specialized infrastructure. Many health systems lack the budget for special software or the dedicated internal teams to monitor regulatory analysis.  

Partner Analysis Team: FTE-Equivalent Dedicated to Your Regulatory Compliance 

That’s where a specialized partner fills the gaps. Many health systems find it makes the most sense to partner with a human analyst team backed by a proven regulatory compliance management software platform. 

What skills and capabilities should a health system compliance leader look for in a partner for regulatory analytics? While most leaders might not think about asking a potential partner how their team handles puzzles, it is actually a good benchmark. In fact, one analyst team manager uses that exact question during the recruiting process, because unraveling regulation updates can be like solving a puzzle. 

Think of validators and an outsourced regulatory analytics team as the equivalent of an FTE dedicated to your compliance practice. The software, the analysts and the validators give you all of the work of at least a single FTE and more. 

One-Two Punch: Human Regulatory Analysis Plus Workflow Software 

No one else does what our unique combination of regulatory analysis and regulatory management software can do. But if you want to research capabilities and have conversations, this blog gives you an overview of what’s possible in regulatory compliance management today. 

We mentioned the one-two punch at the beginning of this article. Here’s an in-depth look at the second part – regulatory change management software. With a simple software framework, YouCompli helps teams manage regulatory compliance without relying on scattered emails and spreadsheets. 

• Clear ownership, due dates, and accountability 
• Progress tracking across departments and requirements 
• Reporting and documentation to support proof of completion 

What’s stalling progress in your compliance program? Let’s set up time to talk about some real solutions.  

About the Author

YouCompli was founded in 2016 by Jerry Shafran, a serial entrepreneur with a background in software, content solutions, information technology, and network solutions.

After selling a business focused on how insurance companies manage compliance, Jerry saw an opportunity to bring that experience into healthcare — where regulatory change creates constant pressure for compliance teams, operators, and leaders.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Beyond the Algorithm:  Why Human Expertise Matters in Regulatory Analysis  first appeared on YouCompli.

This thought leadership update explains why it’s more important than ever to communicate in a common language. The piece brings compliance executives up to speed on the role of language and communication in today’s compliance programs. Fresh insights and tips capture the current views of the original author, Jerry Shafran, a compliance industry veteran and seasoned, effective communicator.  

With Compliance Maturity Come Higher Expectations 

Since I originally wrote this, compliance has become harder. It has matured as a function, and when that happens, other areas of the organization naturally raise their expectations.  

One expected hallmark of a mature business function is a defined, repeatable vocabulary. That way, when compliance professionals and outside departments share a common language, everyone understands each other, reducing friction in workflow and in relationships across the business. 

Communications as Part of Compliance Lifecycle Management Methodology 

The original blog talked about a methodology we refer to as compliance lifecycle management or regulatory life cycle management. Either way, the role of a methodology is to provide common ground, and communication is a big piece of that. When in place and working well, components of compliance methodology lead to better communication. 

Nothing in compliance happens without good communication, and we built our software based on this understanding. The software provides a reliable framework for required communications that healthcare compliance teams need. 

Communications Span Different Health System Groups and Perceptions 

Even if you lack a common methodology for regulations, you still have multiple departments dealing with constant regulatory change. Each department may do things differently — or do nothing at all — if you don’t clearly communicate the steps they must take to comply. 

With a good methodology, everyone understands their responsibility and where it resides in the process. And that’s why language is a key part of compliance methodology. 

Regulatory Compliance Must Tailor Language to the Audience 

Across the facilities and departments within a health system, people bring different expertise and understanding. You’ll need to give each department a clear way to comply with the regulation, and each may need its own approach to arrive at that goal. 

In such a setting, language can either lead to understanding or misunderstanding. As people communicate cross-departmentally or interdepartmentally, a common language is essential for reducing friction, delay and even risk.  

When dealing with so many different areas, compliance executives need different communication styles based on the audience.   

Adjust your style based on: 

• What you’re trying to convey 
• Who you’re trying to convey it to 
• How much time you have to convey it 
• What you want them to do with the information 

These variables affect how you choose to communicate with each audience. 

Example: How to Deliver Communications They Remember 

Imagine you’ve got a group of 100 people in a room looking at a PowerPoint presentation, and the set of slides is filled with bullet after bullet. If all you’re doing is reading those points, you’ll lose that audience very quickly.  

Instead, use a more contextual style where: 

• You share the fact or point you want to convey. 
• Then provide a relevant story your audience can connect to. 

Four Tips to Improve Compliance Communication and Language 

Follow these proven tips for effective communication and productive outcomes. 

1. Know your audience. 

2. Understand how your audience perceives your role. 

3. If you don’t know what their perception is, ask. Never assume. A safe way to ask is, “Tell me how you perceive compliance people?” or “What’s your perception of people you’ve come into contact within this role?”  

That’s a good way to phrase it so people will be more comfortable and honest. If you ask them point-blank “How am I doing,” your audience might be reticent to share their true perceptions. It’s another example of how the language you use impacts communications and relationships. 

Comfort levels and transparency are important. Keep in mind that not everybody is open or transparent, not because they want to be dishonest, but because it’s not always comfortable. 

4. To be a good communicator, you yourself have to be willing to be vulnerable and open about own your flaws and foibles. That gives people you engage with a path to connect to you at a human level, because they have the same problem, but may not be as comfortable talking about it. 

Navigating the AI Frontier: Communication and Culture in a Digital Age 

As with many other facets of work life, artificial intelligence is affecting how we speak, write and interact with each other. With AI agents generating human-like emails, text messages and internal updates, technology is stepping into conversational spaces once reserved for human interaction. 

While these new AI tools offer undeniable efficiency, they also present a unique challenge for healthcare compliance leaders: AI can replicate human syntax, but it cannot replicate organizational culture.  

When technology outpaces our shared compliance language, communication breaks down and creates deep-seated, hard-to-fix issues. 

Hidden Compliance Communication Risk: Dilution of Meaning 

Building a true compliance culture relies on a common organizational language that is best forged through human-to-human connection, whether one-on-one or one-to-many. 

When communication shifts heavily to automated or purely electronic channels, the rules of engagement change, and crucial nonverbal context gets lost: 

• Missing Cues: Digital channels strip away voice inflections, intonations, eye contact and hand gestures. 
• Diluted Intent: Without these physical or tonal guardrails, the true meaning of a message easily gets diluted, leaving room for assumptions and misinterpretations. 

A Real-World Example of Electronic Miscommunication 

Consider a simple administrative example from the field. An employee sending an email requesting extra tickets for an annual company outing typed the entire message in capital letters. They weren’t trying to yell or be aggressive. They simply didn’t understand the digital etiquette that all-caps signifies shouting. 

In a compliance setting, similar subtle gaps in digital literacy or tech-driven communication can inadvertently spark tension, mask urgent risks or alienate teams. 

Four Vulnerabilities Healthcare Compliance Leaders Must Consider 

As AI agents and digital channels become more embedded in your organization’s workflow, a unified compliance shorthand becomes more critical, not less. Without a grounded, human-centric language strategy, the disruption caused by AI will expand exponentially. 

To prevent poor communication practices from taking root, leaders should look closely at four critical vulnerabilities: 

• Fragile Culture: If your team doesn’t have a deeply rooted sense of organizational culture, technology might define it for you. 
• Absence of a Common Baseline: Without a predefined “compliance vocabulary,” automated text and human responses will drift apart, creating disjointed expectations. 
• Inconsistency Across Channels: A language strategy must span consistently across traditional face-to-face updates, standard emails and automated AI touchpoints. 
• Festering Misunderstandings: Because electronic text lacks tone, misunderstandings happen fast. If leaders don’t proactively address and correct these gaps, they quickly become cultural liabilities. 

The Bottom Line: The “language of compliance” isn’t just about the words on a page or a policy block. It’s about how those words are deployed and felt across the organization.  

As technology scales, compliance leaders must intentionally protect the human elements of communication to ensure clarity, trust, and ultimate alignment with regulations. 

Business Benefits of a Common Compliance Language 

Turning Communication Benefits into Data to Prove Compliance Value 

Measuring the intangible benefits of a shared compliance language is exactly what gets leadership and the Board to lean in. They want to see how culture translates into operational efficiency and risk reduction. 

Here’s how healthcare compliance leaders can convert qualitative benefits into concrete, board-ready metrics: 

1. Minimizing Misunderstandings and Boosting Productivity 

The Benefit: All members understand expectations. Time formerly spent correcting errors is now spent productively. 

Instead of trying to measure “understanding,” measure the reduction of friction caused by a lack of it. 

• “Time-to-Resolution” for Compliance Inquiries: Track how long it takes to close out basic compliance questions or internal reports. A shared language means less back-and-forth clarifying what a policy actually means, shortening the cycle. 
• Rework and Error Rates in Documentation: Partner with Quality Assurance or Billing/Coding to track the reduction in documentation errors or rejected claims stemming from “misinterpreted guidelines.” 
• Policy Attestation and Quiz Data: Move beyond completion rates. Track the average score on post-training compliance quizzes. A higher baseline score across departments indicates the language is actually sticking. 

2. Consistency for Staff and Patients 

The Benefit: Consistency throughout the organization enhances the image, cohesiveness, and reliability of the health system. 

Consistency can be measured by looking at how external and internal stakeholders perceive your reliability. 

• Patient Satisfaction Scores (HCAHPS): Look specifically at communication metrics like “Communication with Nurses/Doctors” or “Discharge Information”. When staff uses a unified, compliant language regarding patient rights, privacy and care expectations, it reflects in patient trust. 
• Standardized Scenario Testing: Conduct “mystery shopper” audits or drop-in assessments across different clinics or departments. Or present the same compliance scenario to different teams and measure the variance in how they explain the resolution. Lower variance = higher consistency. 

3. Creating an Operational “Shorthand” 

The Benefit: Provides a sort of language shorthand among the organization’s community of management and staff. 

An effective shorthand speeds up corporate velocity and reduces administrative drag. 

• Onboarding Velocity: Measure the time it takes for new hires (or contract clinical staff) to reach full compliance competency. If a common language exists, onboarding friction decreases, and “time-to-productivity” shortens. 
• Compliance Hotline / Helpdesk Efficiency: Track the volume of inquiries that can be resolved on the first contact (first contact resolution rate). A shared shorthand allows staff to articulate their issues clearly and helpdesk agents to resolve them faster without escalation. 

4. Cultivating a Strong Compliance Culture 

The Benefit: Creates a sense of culture — a major factor in organizational success. 

The OIG explicitly looks for a culture of compliance. You can quantify this shift directly. 

• The “Speak-Up” Metric (Reporting Volumes vs. Anonymity): A healthy compliance culture doesn’t mean zero reports. It means a steady stream of them. Track the ratio of named reports versus anonymous reports. As trust in the common culture grows, anonymous reporting typically drops because staff feel safe using the shared language to flag issues. 
• Annual Culture/Engagement Surveys: Insert two or three targeted pulse questions into the annual employee engagement survey. For example, “I understand what is expected of me regarding compliance,” or “Management uses clear, transparent communication regarding ethical issues.” Track the year-over-year positive shift. 
• Corrective Action Plan (CAP) Adherence: Measure how quickly departments implement CAPs after an infraction. A cohesive culture takes ownership faster, resulting in speedier compliance with corrective actions. 

Board-Room Tip for Presenting Compliance Metrics 

When presenting regulatory compliance metrics like these to the Board, bucket them into two categories:  

• Risk Mitigation such as lower error rates or survey shifts 
• Operational Efficiency such as time saved, faster onboarding  

This shows that compliance isn’t just a cost center; it’s an organizational value engine. 

In closing, the language of compliance should be like the language of anything. It should be supportive, simple to understand, and help whoever is listening to perform the work that the compliance team needs done. 

Would you like to know more about building common language and communication into your regulatory compliance practice? Reach out for a conversation.

The Original Idea Still Holds

When we first wrote about building a common compliance language, the goal was simple: help everyone involved in regulatory change understand the process, their responsibilities, and what successful completion looks like.

That foundation remains relevant. An effective regulatory change process should include:

• Identifying and documenting new regulatory developments
• Assessing their relevance to the organization
• Translating requirements into specific operational actions
• Communicating expectations to the appropriate stakeholders
• Assigning clear owners and deadlines
• Implementing the required changes
• Verifying completion and preserving evidence of the response

The terminology has evolved, and the original Compliance Lifecycle Management worksheet referenced in this article is no longer available. Today, YouCompli describes this broader discipline as Regulatory Operationalization, the process of turning regulatory change into assigned, completed, verified, and defensible action.

The tools may change, especially as AI becomes part of compliance work, but the need for shared language, human judgment, clear accountability, and documented follow-through remains the same.

The post Building a Common Compliance Language in the Age of AI first appeared on YouCompli.