Revenue Cycle: Stop searching for payer updates. Have them brought to you instead.  

The Moving Target That Is Policy Tracking 

Commercial payers change requirements continuously and on their own schedules. That’s made policy tracking one of the most complex operational jobs in healthcare administration, with many variables to consider. This blog looks at some of those factors and how to manage them. 

Juggling the Variety of Patterns in Payer Update Frequencies 

Updates typically fall into these categories. 

Continuous & Monthly Bulletins 

Commercial payers regularly publish provider notices, email blasts and portal updates often on a rolling monthly basis. These communications introduce new rules, prior authorization lists or billing edits.  

Mid-Year & Unscheduled Revisions 

Standard medical coding sets follow predictable schedules (such as CPT updates every January and ICD-10 updates every October). Commercial carriers implement internal policy shifts, fee schedule adjustments and coverage revisions whenever they choose, often rolling out mid-year updates. 

High Volume 

Payers release tens of thousands of discrete policy adjustments and rule modifications annually across major national and regional commercial carriers. 

Areas of Frequent Change and Notifications 

 Commercial insurance plans issue various updates year-round. 

Prior Authorization & Utilization Management: Frequent additions or modifications to services requiring pre-certification, as well as updated step-therapy protocols.  

Reimbursement & Payment Methodologies: Shifts in bundling logic, fee schedules, modifier rules, and site-of-service payment calculations.  

Coverage & Medical Necessity: Tighter or revised clinical criteria governing whether specific diagnostic tests, procedures or specialized treatments qualify for payment. 

One Payer Notice. Multiple Departments. Different Responsibilities. 

A commercial payer changes a requirement. Who needs to know?

Revenue Cycle, of course, and what about: 

• Patient Access 
• Clinical Documentation 
• Nursing 
• Case Management 
• Compliance 

Depending on the requirement, the answer could be several of these areas or all of them. And that’s where things get complicated. Healthcare organizations are incredibly interconnected, but not always in a good way. A payer requirement doesn’t become less important just because it falls outside someone’s department. And the consequences of missing a notice rarely stay contained within one area. 

• A change to prior authorization requirements might affect the team scheduling a procedure. 
• A documentation change might require action from clinical staff. 
• An updated reimbursement policy might affect coding, billing and revenue integrity. 

Catch Critical Changes Before They Become Costly Problems 

Healthcare organizations face constantly changing payer requirements, from prior authorizations and documentation to billing and reimbursement policies. Missing a change can lead to claim denials, delayed reimbursement and operational disruption. 

The YouCompli platform addresses those concerns, and the goal is simple. Make it easier for healthcare organizations to understand what’s changing and get that information to the people responsible for responding. 

To support that need, we’ve expanded YouCompli capabilities to include monitoring, aggregating and analyzing third-party payer notices. Only relevant information gets distributed to the appropriate areas of your organization. 

How Payer Notice Monitoring Works  

Does your organization still have departments independently and manually monitoring payer communications? How do you ensure the right people know about a change when information is scattered across payer portals, emails, bulletins and departmental workflows? 

This is how YouCompli approaches those problems. Our process follows defined steps for consistency: 

• Mutually select sources – Together, we align on the list to monitor. You identify relevant payers and associated URLs, then we research notice locations.  
• Monitor and identify – We monitor agreed URLs for newly posted payer changes.  
• Summarize – We create a helpful summary of each identified notice.  
• Centralize and distribute – We publish the summary on the YouCompli platform and direct it to the departments designated to receive payer notices. 

What Does a Payer Notice Monitoring Partner Do? 

Commercial payers regularly publish changes affecting reimbursement, billing, prior authorization and claims processing. Keeping up with the changes requires constantly monitoring numerous payer websites and other information sources, and that’s part of what a payer monitoring partner would do. 

Organizations typically need a centralized, coordinated process across Revenue Cycle, Compliance, Patient Access and Clinical Documentation to catch these updates before they lead to unexpected claim denials or revenue leakage. As your partner, YouCompli automatically aggregates, analyzes, and distributes third-party payer notices to the appropriate departments across your organization. 

What Information Do You Get? 

Your organization identifies the commercial payers and payer URLs that you want monitored, with no limit on the number of payers you can include. YouCompli can assist with identifying additional URLs when needed. Together, we review and agree on the final URL list before monitoring begins. 

Depending on what those selected sources publish, your payer notices may address:  

• Reimbursement and payment policies  
• Billing and coding updates  
• Prior authorization requirements  
• Claims processing and documentation  
• Payer administrative requirements  
• Other notices on agreed monitoring pages 

Payer Monitoring Delivers Operational Value for Revenue Cycle  

What does work look like when payer requirement notices aren’t a burden, and relevant updates are brought to you? 

• Reduced manual monitoring: Spend less time revisiting multiple payer notice pages to look for updates.  
• Improved visibility: Bring identified payer changes and summaries into a centralized location instead of multiple sources.  
• Timely awareness: Help relevant teams learn about published changes that may affect claims, reimbursement, authorization or documentation.  
• Simplified internal communication: Distribute notices faster to designated departments, so Revenue Cycle isn’t solely responsible for forwarding updates.  

How Much Time Could You Get Back?  

Payer requirements will always change, but staying ahead of them doesn’t have to be a complicated process.  

Your team was meant to focus on managing revenue cycle operations. Constantly searching payer websites for new notices was never part of the plan, and it doesn’t have to be part of the workload anymore.  

Let’s connect if you’d like to see how that could work. YouCompli makes payer notice monitoring centralized, consistent and easy to share across the organization. 

Another Resource for Compliance and Revenue Cycle Leaders 

Whitepaper: The 4 Healthcare Revenue Cycle Hot Spots Compliance Leaders Should Watch 

About the author 

Rocky D. Kimbrell II is a Senior Account Executive at YouCompli, where he works with healthcare executives and compliance leaders to address the operational challenges of regulatory change management. Rocky brings an enterprise-level perspective to the intersection of healthcare compliance, operational efficiency, and technology, with a particular focus on helping health systems reduce administrative burdens while maintaining organizational oversight. His work focuses on helping healthcare organizations improve visibility, strengthen cross-departmental accountability, and translate evolving regulatory requirements into coordinated action. 

Rocky.Kimbrell@youcompli.com  | (501) 722-3748  

The post Relieving the Burden of Third-Party Payer Notice Monitoring   first appeared on YouCompli.

In this blog, she explains what healthcare compliance leaders should know to effectively help their organizations build and operate robust AI governance frameworks.  

QUICK TAKE

Compliance should help coordinate AI governance, not serve as its sole owner. Start by identifying where AI is being used, establishing clear accountability across departments, and applying risk assessment and ongoing monitoring.

Compliance Programs and AI Governance: What’s Similar? 

Compliance programs have always been about paying attention to what can go off the rails before it does. 

AI governance is the same. Organizations need to be thinking in a systematic way about: 

• Where could this go wrong? 
• Who would get hurt? 
• How would we know? 
• What do we do about it? 

Assurance Is a Common Requirement  

“An assurance framework gives boards and management teams confidence grounded in evidence that controls exist and work as intended,” Estrada explained. “It’s not a policy. It’s the ongoing cycle of identifying the risk, assigning an owner, testing the control, reporting the results to leadership, and fixing what you find.” 

That model, which typically includes risk assessments and monitoring plans, is very familiar to compliance officers. It’s exactly how most compliance programs are structured. And, according to Estrada, the same model can be applied to AI governance. 

“Compliance officers know how to build and maintain assurance frameworks; they know how to conduct risk assessments and develop monitoring plans,” Estrada said. “This makes them an obvious choice when boards and organizational leaders ask for assurances around how AI is being used.” 

How Are Compliance Programs and AI Governance Different? 

Estrada noted important distinctions between the risks managed by typical compliance programs and those presented by AI: 

Speed and scale of change. AI can change things quickly, and its risks can scale across an organization just as rapidly. Something that used to take months to spread can now hit every claim overnight. As a result, an annual risk assessment, the common standard for compliance programs, is probably inadequate in the world of AI. 

Probabilistic, not deterministic. Healthcare compliance programs are rule- or standards-based. The same facts get the same answer, so a point-in-time audit tells you something lasting. By contrast, AI is probabilistic. Passing a test once doesn’t mean it will pass the next time. For confident governance, AI monitoring must be continuous, not point-in-time. 

Opacity: Compliance programs run on root cause analysis. When we find a problem, we don’t just fix it. We dig in to figure out why it happened. With AI, we often can’t get there alone. We can see the output was wrong, but was it the data, the model, a vendor update, or how someone used it? Compliance can’t answer that. Neither can data science on its own. It may take the data people, the clinicians, the vendor, and the people using the tool every day to find answers. That’s why AI governance must be multidisciplinary. It’s how you get to root cause. 

Who Should Own AI Governance in Healthcare? 

Next Steps for Compliance Leaders 

Estrada shared three important tactics to help compliance leaders get their arms around AI governance in healthcare. 

1. Learn the language. 

“Seek out AI educational opportunities,” Estrada says. “AI has its own vocabulary and concepts, and if you don’t know them, you can’t be effective in the conversation.” 

Estrada recently earned the Artificial Intelligence Governance Professional (AIGP) certification available through the International Association of Privacy Professionals (IAPP). It’s a resource that compliance leaders can invest in to build necessary AI governance and strategy skills. 

The training focuses on: 

• Foundations of artificial intelligence governance 
• How laws, standards, and frameworks apply to AI (such as EU AI Act) 
• How to govern AI development 
• How to govern AI deployment 

About a third of the exam involves scenario-based questions tied to applied judgment in real-world case studies. 

2. Take Action. Drive Action. Lead Action. 

Compliance doesn’t have to own AI governance. But it does have to make sure the right people are governing it together. Depending on the organization, that might include 

• Operations 
• Clinical (in healthcare) 
• Information Technology and Security 
• Legal and Regulatory 
• Operations 
• Risk Management 
• Internal Audit 

“Act as a convener,” Estrada says. “Don’t wait to be asked and don’t try to own it alone.” 

3. Start with an AI inventory 

“You can’t assess or monitor risks you can’t see,” she explained. 

Take inventory of: 

• Where AI is already being used 
• For what purpose 
• By whom 
• With what data 
• Through which vendors 

“Then get the right people in the room and bring the assurance framework, because that’s what compliance officers know better than anyone.” 

Compliance Must Deal with AI Boom 

AI governance is no longer an issue compliance leaders can watch from the sidelines. The question is how quickly and how effectively they will engage. These practical steps can help leaders prepare their teams, bring the right functions together, and give their organizations confidence in how AI is being used and governed. 

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.  

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.   

Ready for More? 

Here’s another resource to guide good AI governance strategies for your healthcare organization: “Compliance Leader’s Guide to Getting Started with AI.” Cut through the hype and confidently implement AI with proven strategies. This clear, tactical guide will help you save time, reduce risk, and future-proof your compliance processes. 

Download to learn: 

• Five Practical Ways to Use AI in Compliance Work 
• Six Critical Considerations When Adopting AI for Healthcare Compliance 
• Five Things to Know to Leverage AI for Process Improvement 

The post AI Governance in Healthcare: What Compliance Leaders Should Know first appeared on YouCompli.

An assigned regulatory task has stopped moving. The owner says it is under review, the due date is approaching, and another reminder produces the same update.

Before asking for status again, find out what is preventing the next action. Uncertainty about a requirement, disputed responsibility, and a scheduling conflict each need a different response.

Find the specific blocker

Ask the owner what needs to happen before the work can proceed. If the answer is “We are waiting on another department,” identify the exact input or decision that department owes.

Then match the response to the problem. Unclear requirements need clarification from the appropriate compliance, legal, or subject matter resource. Disputed ownership needs a decision from someone authorized to assign responsibility. A capacity problem needs a discussion about priorities and resources.

Jay Anstine’s article on compliance accountability recommends approaching operational leaders with curiosity and helping them solve problems while preserving their responsibility for the work. That approach is especially useful when a task appears inactive but the reason is unclear.

Agree on the next action

Once the blocker is understood, replace “still in progress” with a specific commitment. Record the next action, the person responsible, and when they will provide a result or raise an unresolved issue.

For work involving several departments, make the dependency visible. If training cannot begin until a revised procedure is approved, track the approval separately from the training. Each owner should understand what they are waiting for and what others need from them.

Keep internal checkpoints distinct from the regulatory deadline. Revising the project plan does not change when the underlying requirement takes effect.

Work through a blocked assignment

Consider a hypothetical hospital preparing a registration process change after reviewing a new requirement. Patient Access owns implementation, but progress has stopped because two locations use different forms.

A follow-up conversation reveals that Patient Access needs a decision about whether both locations can use one revised form. The designated approver agrees to review the proposed form by Tuesday. Patient Access then schedules its workflow update and staff instruction around that decision.

At Tuesday’s checkpoint, the team checks whether the approval occurred and whether implementation can proceed. The overall assignment stays open until the remaining work is completed and the designated reviewer checks the supporting records.

Escalate the decision that is needed

If the owner cannot resolve the blocker within their authority, use your organization’s escalation process. Explain the unresolved question, its effect on the implementation schedule, and the decision or resource needed from the recipient.

For example, a leader may need to decide which department owns a shared process or whether another project must move to make staff available. Naming that choice gives the leader a concrete way to help.

Lisa Estrada’s systems approach to regulatory change emphasizes operational decisions, documented rationale, and accountable follow-through. Preserve the escalation decision with the assignment so the owner can act on it and later reviewers can understand the response.

Use recurring blockers to improve the process

Review stalled assignments for patterns. Repeated approval delays may call for an earlier review checkpoint. Frequent ownership disputes may signal that shared processes need clearer decision authority.

Lisa Herota’s guidance on compliance metrics recommends tracking implementation and resolution, with reporting suited to the audience. For operational leaders, consider showing blocked assignments, how long each has been waiting, and the decision needed to move it forward.

Start with one stalled assignment at your next review. Identify the blocker, agree on the next action, and set a checkpoint that leaves time to respond before the deadline.

Practical compliance insights

Useful articles and resources, delivered to your inbox.

Sign up for the newsletter

Open the subscription form

The post How to Move Stalled Regulatory Work Forward first appeared on YouCompli.

Durable Medical Equipment (DME) billing remains a significant target of the government with regard to compliance risks. The insights and strategies in this blog offer guidance to help health systems avoid exposure and losses from DME fraud. 

Recently, CMS announced that 11 DME companies have been barred from receiving future Medicare Advantage (MA) Part C and D payments. The CMS decision is based on suspected fraudulent billing to the tune of $3.4 billion. 

The suspicious activity was based on the following where the company: 

• Submitted no claims prior to 2025 
• Used improper billing practices for their claims 
• Billed for medical equipment to patients who were already deceased 
• Supplied equipment to patients who either never requested it or received it 

The companies are known as DMEPOS suppliers: durable medical equipment, prosthetics, orthotics and supplies.   

These 11 organizations and the resulting issues aren’t the only examples of DME dollars at risk of fraud, waste and abuse.  

Health Systems Not Immune to Exposure from DME Risks 

While DME fraud often originates with third-party suppliers, health systems are subject to direct operational and financial exposure. Compliance leaders who actively combat these schemes protect organizational revenue, preserve physician credentials, and prevent costly administrative disruptions.  

Proactive fraud mitigation ensures seamless patient care while shielding health systems from aggressive federal audit scrutiny. It involves many goals that are already within the compliance mission: 

• Protecting physician credentials and NPI integrity 
• Fulfilling strict recordkeeping and order requirements 
• Safeguarding patient care and trust 
• Reducing downstream audit burden 
• Ensuring Medicare Advantage network integrity 

For example, fraudulent suppliers routinely harvest physician National Provider Identifiers (NPI) to generate fake orders for items like catheters, orthotics and glucose monitors. Proactive oversight prevents unauthorized order generation using health system provider credentials and protects clinicians from CMS sanction lists. 

Other Areas of Government Focus: Catheter Audit Example 

In addition to wide sweeping announcements like the one above about the 11 DME companies, other government agencies are focusing on specific types of supplies that might be vulnerable to fraud, waste and abuse.   

For example, the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) published the results of an audit they performed related to Medicare payments for intermittent urinary catheters.   

Intermittent urinary catheters are covered under the Medicare Part B benefit for prosthetic devices for people who have permanent impairment of urination (i.e., permanent urinary incontinence), involuntary loss of urine, or permanent urinary retention (inability to voluntarily empty the bladder or pass urine). A treating practitioner orders catheters for an enrollee, and a supplier fulfills the order. 

OIG Audit Finds $35+ Million in Improper Catheter Payments 

OIG audited a period during which Medicare paid $303 million for these types of catheters. Based on the error rate in the sample used for the audit, OIG estimated that Medicare improperly paid $35.1 million for the catheters.   

They cited examples where medical records didn’t support enrollees’ eligibility for curved-tip catheters or sterile catheter kits. For other claims in their sample, suppliers didn’t meet Medicare requirements for catheter refills, proof of delivery, or a standard written order. 

Stopping Medical Device Scams at the Patient Level 

Beyond this auditing work, OIG also issued a Consumer Fraud Alert for Urinary Catheter Scams. The fraud alert informs patients that scammers are targeting Medicare enrollees through phone calls, internet ads, and text messages with offers of free services, medical equipment, or gift cards after confirming their personal information and eligibility for specific Medicare services.  

Often, the enticement for the individual is that they are “qualified” for items “at no cost” or “free.” Once the scammers obtain the enrollee’s personal information, monthly billing to Medicare will begin for medically unnecessary urinary catheters that may or may not actually be sent to the enrollee. 

Three Areas to Monitor to Avoid DMEPOS Fraud 

OIG has demonstrated their commitment to addressing fraud, waste and abuse challenges in the DME sector. In this white paper, “The Nation’s Challenge to Combat Durable Medical Equipment Fraud in Medicare,” OIG presents actions that CMS and others can take to stop bad actors from exploiting Medicare.   

It focuses on three key elements that bad actors need to commit DMEPOS fraud: 

1. Medicare-enrolled DMEPOS supplier 

2. Physician order for DMEPOS product

3. Medicare enrollee’s identification number 

1. How to Combat Medicare-enrolled DMEPOS Supplier Fraud 

Maintaining strict referral standards prevents regulatory non-compliance and protects payer contract relationships. Health systems and affiliated provider networks must screen against the CMS Preclusion List and verify supplier enrollment. 

Actions that OIG suggests CMS should take: 

• Strengthen on-site inspections to prevent bad actors from enrolling in Medicare. 

This could include additional unannounced on-site inspections to ensure bad actors can’t predict when site visits will occur. 

• Improve detection of unreported changes of ownership and straw owners. This might include using AI or other technologies on an ongoing basis to identify changes in ownership that have not been reported to CMS. 
• Ban suppliers from using paper applications to circumvent oversight. 
• Increase oversight of newly enrolled DMEPOS suppliers. This could include CMS implementing a period of enhanced oversight of newly enrolled DMEPOS suppliers and those that recently changed ownership. 
• Reassess and potentially update surety bond requirements to better deter fraud. 
• Require all DMEPOS suppliers that bill Medicare Advantage to enroll in Medicare. 

2. How to Combat Fraud in Physician Orders for DMEPOS  

When CMS or OIG audits target improper supplier claims, health systems must produce matching clinical documentation to avoid administrative claw backs and penalties. Federal regulations require ordering physicians to maintain clinical records supporting medical necessity for seven years. 

Actions that OIG suggests CMS should take: 

• Engage ordering physicians in fraud-fighting efforts. CMS could develop an electronic verification method for physicians to confirm orders before certain claims are paid. Or CMS could issue reports to physicians detailing the DMEPOS they ordered and request that physicians review the information and report any fraudulent billing. 
• Harness new technologies and analytic tools to better detect and stop payments for fraudulent DMEPOS claims. OIG recommends that CMS explore the potential for using AI in this area. 
• Enhance the use of payment suspensions. 
• Expand medical reviews to prevent fraud. 
• Work with secondary payers to stop fraudulent billing. CMS recently began sharing payment suspension information with secondary payers to help them prevent payments to potentially fraudulent suppliers. 
• Require Medicare Advantage organizations to submit the identification number for physicians who order DMEPOS. 

3. How to Combat Fraud in Medicare Enrollee ID Numbers 

Schemes that target patients with unsolicited, unnecessary or low-quality equipment disrupt care plans and harm patient trust. Robust compliance workflows ensure discharge planners and care coordinators connect patients exclusively with legitimate, Medicare-enrolled suppliers. 

Actions that OIG suggests CMS should take: 

• Discontinue or better protect enrollee lookup tools. 
• Prohibit DMEPOS suppliers from all types of unsolicited contact with enrollees. 
• Partner with social media companies to prevent sale of enrollee identification numbers on their platforms. 
• Engage Medicare enrollees in the fight against fraud. 

Needless to say, DME is an area fraught with fraud, waste and abuse risk, and government enforcement agencies are focusing more on DME, not less. If your organization participates in this space, make sure your compliance program is preparing against the various DME compliance risks we’ve talked about here and others as they arise. 

Download Free Checklist

About the author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post What Health Systems Need to Know about DME Billing Fraud:  Three Areas to Watch  first appeared on YouCompli.

Everyone has someone they report to, and for the OIG, one of those bosses is the U.S. Congress. Twice a year, the OIG submits a report to “the boss”, summarizing some of their significant activities and tooting their own horn, so to speak.  

OIG Reveals Impressive Return in Expected Recoveries and Receivables 

In a recent report, the OIG announced a $12.70 return in expected recoveries and receivables for every $1 invested, an ROI any of us would love to have.

For the most recent six-month period, OIG also reported substantial financial and enforcement activity to Congress.

Report Reveals Advance Insights into OIG Game Plan

The report also provides insight into areas OIG may plan to target. These four areas are especially worth watching for compliance professionals.

1. Criminal and Civil Enforcement Highlights 

OIG highlighted many cases, but a couple are especially likely to catch compliance professionals’ attention: 

Wound Graft False Claims Fraud Results in Prison, Restitution and Settlement 

The owners of several wound graft companies were sentenced to prison, ordered to pay restitution, and agreed to pay a settlement to resolve False Claims Act liabilities. OIG reported that these individuals ran a nationwide scheme targeting Medicare patients that resulted in orders for medically unnecessary, oversized skin grafts. They also accepted millions of dollars in illegal kickbacks and directed nurse practitioners to apply unwarranted grafts, resulting in more than $1.2 billion in fraudulent claims submitted to Federal health care programs.  

Convicted Physician Excluded from Federal Health Programs for 50 Years 

A rheumatologist was excluded from participating in Federal health care programs for 50 years after being convicted of health care fraud involving more than $118 million in false claims. Specifically, the OIG reported that the doctor falsely diagnosed patients with chronic illnesses to bill for tests and treatments that were medically unnecessary. These false diagnoses led patients to receive unnecessary treatments, including injections, infusions and X-rays.  

2. OIG Financial Integrity Efforts Target Improper Payments 

Knowing the possible OIG focus areas helps compliance professionals when they are performing risk assessments, auditing and monitoring. You can get a sense of where OIG is looking and where you might need to assess and prepare.  

Relating to financial integrity, the OIG highlighted areas of their work designed to prevent and detect improper payments. Noteworthy examples included: 

Autism Services 

OIG determined that two states (Maine and Colorado) made improper Medicaid payments for applied behavior analysis (APA), which is a behavioral therapy often used to help individuals with autism.  

Maine made an estimated $45.6 million ($28.7 million Federal share) in improper payments and an estimated $22.4 million ($14.2 million Federal share) in potentially improper payments. Colorado made an estimated $77.8 million ($42.6 million Federal share) in improper payments and an estimated $207.4 million ($112.5 million Federal share) in potentially improper payments.  

Durable Medical Equipment (DME) 

OIG looked at payments for a 7-year period for durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) that were provided during inpatient stays. They found that $22.7 million in Medicare payments to suppliers should not have been paid.  

The overpayments were a result of system edits to CMS’s claims processing system for Medicare Parts A and B that were not working properly to prevent or detect such overpayments.   

Managed Care Enforcement 

OIG continues to emphasize concerns with potential overpayments in Medicare Managed Care. In addition to their publishing the Industry Segment-Specific Compliance Program Guidance for Medicare Advantage, they also highlighted two large settlements. 

The first was a $556 million settlement with five Kaiser Permanente affiliates to resolve False Claims Act allegations that they systematically submitted invalid diagnosis codes for Medicare Advantage enrollees to receive inflated payments.   

The second settlement was with Aetna, which agreed to pay $117.7 million to resolve allegations under the False Claims Act that it submitted, or failed to retract inaccurate Medicare Advantage diagnosis codes to inflate payments from CMS. The insurer certified and maintained false and unsupported patient diagnoses, including for morbid obesity and chart review coding, resulting in overpayments.  

3. Patient Safety Gets Continued Emphasis in OIG Plan 

Compliance professionals know that over recent years, the OIG has emphasized patient safety in much of their guidance. In their report to Congress, OIG again highlights activities around protecting people from harm.  

Examples 

• A physician in Michigan who was excluded from participating in Federal health care programs for 60 years based on convictions of criminal sexual misconduct. 
• Work overseeing improper use of antipsychotic medications in nursing homes. 
• 64% of nursing homes received a serious deficiency within three years of graduating from the CMS Special Focus Facility program, which is supposed to address quality problems at the poorest performing nursing homes with track records of serious noncompliance.  
• Nursing home owners in New Jersey were excluded from Federal health care programs for cost-cutting activity that resulted in facility residents being neglected, abused, receiving inadequate medical care and residing in unsanitary conditions. 
• A nursing facility CEO was sentenced to prison for diverting funds for personal enrichment when those funds were intended for resident care. With the resulting lack of funds for care, the facility was understaffed and unsafe. 

4. Integrity of Grants and Contracts Puts Millions at Risk 

HHS offers a significant number of grants and enters into many contracts, and OIG is looking at compliance with requirements associated with grants and contracts.  

Examples 

• Compliance With Federal Contracting Requirements–Administration for Children and Families (ACF) 
• Gaps in National Institutes of Health (NIH) oversight put millions in funding for “Other Transactions” at greater risk of fraud, waste or abuse. 
• A cancer institute agreed to pay $15 million to settle False Claims Act allegations that it caused the submission of false claims to NIH related to scientific grants. The institute admitted that between 2014 and 2024, it used NIH funding to support cancer research publications containing misrepresented, duplicated, rotated, magnified or stretched images, often depicting different experimental conditions or timepoints across 14 journal articles tied to six NIH grants.  

Compliance Leaders Can Find Clues in OIG Plan 

As you assess your organization’s compliance risks, look for clues in these four areas and others included in the OIG plan submitted to Congress. With their impressive return on investment, the OIG is likely to continue to receive the resources they need to prevent, detect and enforce compliance, and their plan likely shares some of their roadmap. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Where Does the Recent OIG Plan Focus? Highlights of Note  first appeared on YouCompli.

New compliance professionals benefit from a variety of resources to ramp up their knowledge and value. If you’re new to the healthcare compliance field (or know someone who is), save and share this article 

Getting Started for Early-Career Compliance Professionals 

The 20+ foundational resources that follow were curated from the YouCompli resource library. This set is tailored specifically for early-career compliance professionals. Start reading for ideas to build your: 

• Leadership skills 
• Operational credibility 
• Cross-departmental influence 

Read Expert-Sourced Content Designed for Professional Development 

Written for (and sometimes directly by) healthcare compliance executives, the information is practical and easy to understand. 

The articles focus on a variety of important topics: 

• Communication and Professional Growth for New Leaders 
• Operational and Audit Fundamentals for Building Compliance Expertise 
• Technology and Strategic Planning for Regulatory Change Management 
• Compliance Program Building and Oversight 
• Video Hub: Expert Guidance for Healthcare Compliance Professionals 
• Downloadable Tip Sheets for Quick Ideas and Actions 
   

Pick where you need help most today and dive in. (A few resources fall into multiple categories, so you get double the return when you read them.) 

Communication and Professional Growth for New Leaders 

From soft skills to dollar signs, these articles cover areas that sometimes get neglected in more formal compliance leader training. These expert resources cover aspects of compliance communications you might not find anywhere else. Learn about the persuasive communication skills that are the secret superpowers behind strong compliance leaders.  

Aggressive vs Assertive Communication: What New Healthcare Compliance Officers Need to Know  

Get advice tailored for new leaders on building authority and articulating compliance risks without creating unnecessary friction. New compliance executive can learn how to speak with authority and assertiveness without damaging cross-departmental relationships.  

This article covers:  

• Key differences between two common communication styles  
• How assertive communication benefits the compliance program  
• Strategies to help you master this skillset 

Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Being aware of how we do our own work is paramount for an effective compliance program and incorporating self-awareness into your healthcare compliance program can enhance its effectiveness. For example, it improves your ability to empathize with the challenges operational leaders face when adjusting a process to meet a regulatory requirement. To help build awareness, explore these 18 actionable tips for compliance officers. 

Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  

For effective healthcare compliance leaders, financial literacy isn’t optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  Explains key financial concepts so business newcomers can align compliance goals with executives’ organizational priorities.  

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.   

Operational and Audit Fundamentals for Building Compliance Expertise 

Business operations are essential partners in a good compliance program, and audits are foundational to healthcare compliance in those areas. These resources drill down into both, explaining how to reduce friction and frustration through proactive partnerships and education.  

Audit Readiness? How about Audit Etiquette?  

In this blog, experts offer the real scoop on audit readiness in healthcare. It outlines crucial operational protocols and relationship dynamics for leading teams through smooth, defensible audits. Learn the unfiltered truth about compliance audits and what audit etiquette means. Get essential tips on: 

• Preparing for audits 
• Role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• What does audit readiness mean? 

Healthcare Quality Leadership: How to Be an Operational Partner, Not a Roadblock  

In every organization, there’s a moment where the quality department becomes either the trusted operational partner or the operational roadblock. The difference between the two comes from how you communicate, assign responsibility and how you follow through. This blog explains how to adopt the OG style for more effective quality programs in healthcare, with “Three Ways to Partner like a Pro.” Direct the strategies that shift compliance from a gatekeeper to a strategic business enabler. 

Three Tips for Strong Compliance Education Practices  

Compliance orientation educates new staff members about company policies, procedures, and various regulations that govern their specific roles. Ongoing compliance training ensures that as regulations evolve, all employees are appropriately educated on implications and requirements. With its emphasis on risk management, compliance training protects both employees and organizations from legal and ethical pitfalls.  

A good understanding of compliance helps employees safeguard the company against lawsuits and reputational damage. Get core principles and three tips for clear, memorable staff training programs that drive actual behavioral change. Two experts – one in education and one in compliance – share advice and analogies to improve your compliance education practices.    

Technology and Strategic Planning for Regulatory Change Management 

Technology and strategy have a lot in common. We expect both to be versatile and responsive, while at the same time, they have to hold up and carry the organization over the long term. These selections explore ideas that will help novice leaders leverage technology to drive strategy and value.  

What to Look for in Regulatory Change Management Software for Healthcare Compliance 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation, dashboard details and insights into completed work. Get a practical checklist to help new leaders evaluate software capabilities for tool selection. Learn six non-negotiables for regulatory change management software and processes. 

AI Guide for Healthcare Compliance Leaders  

From Manual to Scalable: How to Manage Healthcare Compliance Risk 

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity. Updates are tracked. Summaries are circulated.  But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

From a systems-thinking perspective, this is a structural failure, not an execution problem.  In this piece, Lisa Estrada explores systems-thinking strategies to move beyond manual processes and build a scalable regulatory compliance process.  

Compliance Program Building and Oversight 

During your compliance career, you may have opportunities to build a program or at least manage one. Using the metrics and collaboration-building practices covered in these resources will set you on the path. 

5 Strategies for Compliance Accountability Across the Organization  

While supporting operational teams in finding compliant solutions is part of your role, becoming the de facto fixer of what constitutes “operationally friendly” is beyond your scope. That piece must be owned by operations.  The challenge becomes how to get operational leaders to take ownership to resolve their own compliance challenges. 

These five strategies will help you encourage your operational leaders to take responsibility for their particular compliance issues, while preserving your role as a trusted advisor. Respected compliance professional Jay Anstine outlines methods for instilling shared ownership of compliance requirements across clinical and administrative business units.  

Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track? 

How Slowing Down Makes for a More Productive Compliance Program  

As regulations change or investigations are needed, we often get pushed to work faster, meet tighter deadlines, and juggle multiple tasks simultaneously.  

While this approach might seem efficient on the surface, it often leads to serious downsides: 

• Burnout 
• Decreased productivity 
• Decline in the quality of work  

This interesting piece focuses on transitioning from reactive firefighting to building deliberate, repeatable compliance processes. You’ll get five solid tips to help you and your compliance team slow things down in a good way. 

Video Hub: Expert Guidance for Healthcare Compliance Professionals 

While we can’t go into all of them here, the YouCompli video library is packed with useful visual learning materials.  Explore the full catalog, featuring expert interviews and practical strategies. 

Real Conversations. Practical Compliance Insights. 

Where do you need ideas and advice? 

• Compliance Leadership & Mindset 
• Influence, Trust & Seat at the Table 
• Operationalizing Compliance  
• Efficiency, Clarity & Saving Time 
• Customer Perspectives & Real‑World Experience 

Hear directly from compliance leaders who understand the realities of the work. These short videos share honest perspectives on simplifying regulatory requirements, building trust with the business, and turning compliance into a strategic advantage. 

Downloadable Tip Sheets for Quick Ideas and Actions 

For the compliance leader on the go (isn’t that all of us?) the Tip Sheet Library offers quick, useful information. Explore the collection and start downloading tip sheets to start your own handy idea file. 

• Compliance Career Tips 
• Compliance Culture 
• Compliance & Business Strategy 
• Healthcare Quality 
• Industry Trends 
• Rev Cycle 
• Rules and Regulations 

Need More Specialized Support for Your Healthcare Compliance Program? 

Not only does YouCompli have educational resources to help compliance professionals, we also human resources who can help. If you’d like to speak to someone to answer any questions, just reach out. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Resources to Accelerate New Healthcare Compliance Careers  first appeared on YouCompli.

What Does the Final Rule Mean for Your Organization? 

This release updates Medicare payment rates and policies for acute care and long-term care hospitals, with some starting as soon as January 1, 2027, so it’s definitely time to start paying close attention. 

1: Expansion of Comprehensive Care for Joint Replacement (CJR) Model 

The original CJR Model ran from April 2016 through December 2024 and according to CMS, it produced the needed results. The most recent evaluation of performance years six and seven (2021-2023) showed that the CJR Model produced an estimated $112.7 million in net savings while maintaining quality of care. 

Now, the CMS Innovation Center is expanding the model nationally, including in U.S. Territories, starting January 1, 2028. The expanded model, called CJR-X, will focus on improving care and reducing spending for Medicare beneficiaries undergoing lower extremity joint replacement (LEJR) procedures.  

CJR-X Mandatory Requirements for Some Acute Care Hospitals 

Participating hospitals will be held accountable for spending and quality of care during an inpatient stay or hospital outpatient procedure and for the 90 days following hospital discharge.  With some exceptions, the CJR–X Model will be mandatory for acute care hospitals paid under IPPS and Outpatient Prospective Payment Systems (OPPS).  

Multiple Modifications to CJR Model 

CJR–X also includes modifications to the CJR Model. The Final Rule confirms multiple policies for CJR-X.  These include: 

• January 1, 2028 start date 
• Acute care hospitals as participant and accountable entity 
• LEJR as the episode of care 
• Five quality measures and a composite quality score (CQS) to assess quality performance  
• Regional risk-adjusted target prices that include capped normalization and trend factors 
• Pricing-specific policies for certain hospitals, such as low-volume and safety net hospitals 
• Provider and beneficiary overlap permitted with most models 
• Allows participant hospitals to have financial arrangements 
• Waives certain Medicare program requirements 
• Permits beneficiary-identifiable and regional aggregated data sharing 
• Options for Alternative Payment Model (APM) participation  

Though compliance professionals aren’t likely to be named the implementation lead of these efforts at their hospital, they should still be aware of how these changes will affect reimbursement, quality reporting and allowances for financial arrangements. 

To learn more now and in the future about the CJR-X Model, stay tuned at https://www.cms.gov/priorities/innovation/innovation-models/cjr-x 

2: Organ Acquisition Costs 

Compliance professionals working in or with organizations providing organ acquisition services need to be aware of these changes and ensure policies, procedures and any auditing activity is adjusted accordingly. 

• The Final Rule outlines payment policies for organ acquisition and reasonable cost, as well as reimbursement appeals for Independent Organ Procurement Organizations (IOPOs) and Histocompatibility Laboratories (HCLs).   
• The Final Rule solidifies the proposal to clarify and codify certain longstanding policies on allowable costs under Medicare’s reasonable cost principles for all provider types, including public education for organ procurement organizations.  
• Additionally, it finalizes the proposal to clarify and codify Medicare’s longstanding policies for allocating overhead costs across all provider types.  
• Lastly, the final rule codifies the CMS administrator’s discretionary review of reimbursement appeals for IOPOs and HCLs.  

As HHS OIG states in their General Program Compliance Guidance, “One of the best ways to identify fraud and abuse risks is to follow the money.” Understanding the flow of money related to organ acquisition is one of those areas to add to the list for “following the money.” 

3. Quality, Quality, Quality. 

Quality of care is another area that the HHS OIG has been shining a light on for compliance professionals in recent years. Though it’s unlikely compliance professionals will take over quality of care programs in hospitals, OIG expects tight partnerships. Also expected is a general understanding by compliance departments of the work that hospitals’ quality of care teams perform. 

Specifically, OIG said, “Entities should incorporate quality and patient safety oversight into their compliance programs. Integrating quality and patient safety oversight into compliance processes can alert the entity of quality and patient safety concerns and enable the entity to mitigate risk of patient harm.” 

Quality Reporting and Compliance Impact 

The IPPS Final Rule has a lot to say about quality reporting. Although compliance professionals aren’t on the front line for some changes, they should ensure quality teams are aware and have a plan to address any potential impact.  

Quality-related highlights include: 

1. Adoption of three new measures: 

• Excess Days in Acute Care After Hospitalization for Diabetes measure beginning with the FY 2029 payment determination 
• Hospital Harm-Postoperative Venous Thromboembolism electronic clinical quality measure (eCQM) beginning with the FY 2030 payment determination 
• Advance Care Planning eCQM beginning with the FY 2030 payment determination 

2. Removal of three measures, beginning with FY 2030 payment determination:  

• Venous Thromboembolism Prophylaxis eCQM 
• Intensive Care Unit Venous Thromboembolism Prophylaxis eCQM 
• Discharged on Antithrombotic Therapy eCQM 

3. Modifications to three measures beginning with the FY 2028 payment determination. All are related to Excess Days in Acute Care after Hospitalization for: 

• Acute Myocardial Infarction 
• Heart Failure 
• Pneumonia 

4. Five modified mortality measures beginning with the FY 2028 payment determination.  Each relates to the Hospital 30-Day, All-Cause, Risk-Standardized Mortality Rate following: 

• Acute Myocardial Infarction Hospitalization  
• Heart Failure Hospitalization 
• Pneumonia Hospitalization  
• Chronic Obstructive Pulmonary Disease Hospitalization  
• Coronary Artery Bypass Graft Surgery  

4: Promoting Interoperability of Certified Electronic Health Record Technology 

The Medicare Promoting Interoperability Program encourages eligible hospitals and critical access hospitals to adopt, implement, upgrade and demonstrate meaningful use of certified electronic health record technology (CEHRT). 

In this Final Rule, CMS confirmed policies to: 

• Remove and revise certain criteria to align with proposals made by the Office of the National Coordinator for Health IT 
• Remove certain attestations  
• Delay removal of the following two measures: (i) Support Electronic Referral Loops by Sending Health Information and (ii) Support Electronic Referral Loops by Receiving and Reconciling Health Information  
• Modify the Electronic Prior Authorization measure as an optional bonus measure for the EHR reporting period in CY 2027 and mandatory beginning with the EHR reporting period in CY 2028 
• Add the Unique Device Identifiers for Implantable Medical Devices measure  
• Adopt two new eCQMs beginning with the FY 2030 payment determination in alignment with the Hospital Inpatient Quality Reporting Program 
• Remove three eCQMs beginning with the FY 2030 payment determination in alignment with the Hospital Inpatient Quality Reporting Program  

Build Business Knowledge to Anticipate Non-Compliance Risks 

Most compliance professionals are unlikely to be the assigned project lead on any of these announcements within their individual hospitals. But good compliance professionals need to understand their organization’s business lines and operations to anticipate where non-compliance could most likely occur. 

For those working with or for hospitals, the Hospital IPPS Final Rule is always a good place to review upcoming changes to hospital reimbursement, government policies and data reporting requirements.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Stay Informed on Medical Necessity and More 

Read other blogs by Dr. CJ Wolf on YouCompli to stay current on information compliance leaders need. He covers these and other topics:  

• Regulatory and Enforcement Updates: Breaks down OIG Work Plan priorities, CMS policy updates, and healthcare regulatory changes. 
• Compliance Auditing and Risk: Offers practical advice on risk assessments, internal auditing, and building effective compliance programs. 
• Billing and Documentation Integrity: Examines compliance strategy related to coding integrity, medical necessity, and operational oversight. 

Here are a couple of articles to get you started. 

Don’t Let Pain Injections Cause Regulatory Compliance Pain 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.   

Four Areas of Noncompliance in SI Joint Injection Procedures  

Below are four categories of noncompliance and indications of unmet requirements: How SI Joint Injections Are Covered 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

Ensuring medical necessity for services or supplies is a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders.  

This piece explains the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems.

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Four Things to Know About the FY 2027 IPPS Final Rule  first appeared on YouCompli.

The HHS OIG recently released an audit report in which they concluded that for a recent one-year period, Medicare improperly paid physicians approximately $15.2 million for sacroiliac joint (SI) injections (see: https://oig.hhs.gov/reports/all/2026/medicare-improperly-paid-physicians-an-estimated-152-million-for-sacroiliac-joint-injections/).  

SI injections can help some patients improve their spinal mobility as well as relieve pain. Medicare covers these injections under certain conditions but not others. That’s where confusion can create painful compliance risks. 

Most Recent Audit in Series Related to Spinal Pain Management Services 

This was the most recent audit in a series of audits related to spinal pain management services which the OIG has been performing over many recent years.  

In prior audits of similar spinal services, the OIG found, for example, that Medicare improperly paid physicians for facet-joint interventions for more than 50 percent of sampled services that didn’t comply with one or more of the Medicare requirements:  

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-an-estimated-30-million-for-spinal-facet-joint-interventions/ 
• https://oig.hhs.gov/documents/audit/9596/A-09-20-03003-Complete%20Report.pdf 
• https://oig.hhs.gov/documents/audit/9602/A-09-20-03010-Complete%20Report.pdf  

They also reported finding improper payments associated with epidural steroid injections: 

• https://oig.hhs.gov/reports/all/2023/medicare-improperly-paid-physicians-for-epidural-steroid-injection-sessions/ 

Audits Continue in Therapeutic Spinal Pain 

In addition, last year, they published audit findings that said Medicare could have saved an estimated $17.7 Million if CMS oversight had prevented at-risk payments for anesthesia administered during spinal pain management procedures: 

• https://oig.hhs.gov/reports/all/2025/medicare-could-have-saved-an-estimated-177-million-if-cmss-oversight-had-prevented-at-risk-payments-for-anesthesia-administered-during-spinal-pain-management-procedures/  

Consequently, it should come as no surprise to healthcare compliance professionals that the audits in the therapeutic spinal pain space continue with the recent report about SI joint injections. 

Background on Crucial SI Joints 

The SI joints connect the lower portion of the spine to the pelvis. 

They support upper-body weight and play an important role in walking and changes in posture or position, such as moving from standing to sitting. These joints become painful for various reasons, including sacroiliac joint dysfunction, which occurs when the joint moves too much or too little, often due to injury, pregnancy or osteoarthritis.  

To improve movement and relieve lower back pain, a physician may administer an SI joint injection. A diagnostic injection is first used to determine whether the SI joint is the source of the pain. Significant immediate pain relief following the injection strongly suggests that the SI joint is responsible.  

(Image from page 2 of the OIG report) 

Once the SI joint is confirmed as the pain source, a therapeutic injection may be administered, with pain relief potentially lasting up to six months. 

How SI Joint Injections Are Covered 

Medicare Part B covers SI joint injections when medically reasonable and necessary. Five of seven Medicare Administrative Contractors (MACs) have local coverage determinations (LCDs) outlining requirements for  

• Pain indications 
• Imaging and pain assessment 
• Coverage limits  
• Diagnostic and therapeutic injections 

These LCDs limit coverage to two diagnostic and four therapeutic injection sessions within a rolling 12-month period, whether performed unilaterally or bilaterally.  

Billing and Coding for SI Joint Injection Procedures 

Each MAC also issued billing and coding guidance stating that physicians must add the “KX” modifier to each claim line for diagnostic injections to distinguish them from therapeutic injections. (Appendix C of the OIG Audit report summarizes the MACs, the states they cover, and the specific LCD number and LCD Reference article pertinent to their audit.) 

CPT code 27096 is used for injections made directly into the sacroiliac joint, while CPT code 64451 is used for injections targeting the nerves that innervate the sacroiliac joint. 

OIG Selects 100 Random Samples out of 186,000+ Procedural Sessions 

For the audit report, the OIG selected a random sample of 100 SI joint procedural sessions from a population of 186,842 sessions paid for by five MACs in a one-year period. They requested physicians’ supporting documentation to determine if the claims met Medicare requirements including LCD and LCD Reference Articles.   

Of the 100 sampled sessions, 28 complied with Medicare requirements, and 75 complied with Medicare billing guidance. However, the remaining 72 sessions didn’t comply with Medicare requirements, and 25 didn’t comply with Medicare billing guidance.  

Seventy-two sampled sessions didn’t comply with one or more of the requirements. The OIG report summarizes the noncompliant sessions by the type of noncompliance observed: 

(The total exceeds 72 sessions because 41 sessions had more than one deficiency.) 

Estimated Improper Payments of $15.2 Million in Sample Universe 

OIG then extrapolated their findings across the entire population of 186,842 sessions and calculated overpayments to determine their estimated improper payment amount of $15.2 million for the universe of sessions sampled for the one-year period. 

OIG found that although CMS had systems to identify some billing errors, it didn’t provide enough additional oversight or education to help physicians understand and follow Medicare requirements. CMS relied on MACs to educate physicians, but this wasn’t sufficient.  

As a result, some physicians may not have fully understood the requirements and billing rules. Physicians with billing errors said that more frequent and consistent training would have helped them understand the rules and avoid future errors. 

Other Improper Payments Assumed, Potentially Pushing Total Higher 

As mentioned, the sample universe of SI joint procedural sessions was limited to the five of the seven MACs that had issued LCDs. The other two MACs that didn’t have LCDs paid physicians $12.3 million for sacroiliac joint injection sessions. That accounts for approximately 36 percent of total Medicare payments for sacroiliac joint injections nationwide.   

Since these sessions were excluded from the audit, OIG wrote that this set of payments to physicians may also include improper payments. If true, the estimated $15.2 million in improper payments could potentially be higher. 

Four Areas of Noncompliance in SI Joint Injection Procedures 

Below are four categories of noncompliance and indications of unmet requirements: 

1 – Indications of Pain Requirements Not Met 

• At least three positive findings with provocative maneuvers 
• Low back pain below the L5 vertebra without radiculopathy 
• Low back pain that persists despite a minimum of four weeks of conservative therapies 
• Clinical findings and imaging studies that do not suggest any other diagnosed or obvious cause of the lumbosacral pain such as tumor and fracture 
• Low back pain for at least three months 
• Moderate to severe low back pain primarily experienced over the anatomical location of the sacroiliac joints between the upper level of the iliac crests and the gluteal fold 

2 – Imaging and Pain Assessments Requirements Not Met 

• The sacroiliac joint primary pain level must be measured prior to the injection at the beginning of the session. 
• The post procedure pain level must be measured at the end of the session. 
• The injections must be performed under computed tomography (CT) or fluoroscopy image guidance with contrast unless the patient has a documented contrast allergy so that ultrasound guidance without contrast may be considered. 

3 – Diagnostic or Therapeutic Sacroiliac Joint Injections Requirements Not Met 

• A diagnostic injection must have provided a minimum of 75 percent relief of primary pain before a therapeutic injection is administered 
• A subsequent therapeutic injection is not reasonable and necessary when the prior therapeutic injection did not result in at least 50 percent consistent pain relief or functional improvement for at least three months 

4 – Limitation of Coverage Requirements Not Met 

• Administer other musculoskeletal injections in the lumbosacral spine during the same session as sacroiliac joint injections 
• Perform multiple injections (e.g., epidural steroid injections, facet-joint injections, and trigger point injections) during the same session as sacroiliac joint injections and during the period when the physician is evaluating whether the injection reduced pain (i.e., efficacy assessment period) 

The Audit Details Smart Compliance Professionals Look For 

Like most medical claims’ audits, the “devil is in the details”. To avoid problems, wise compliance professionals will: 

1. Monitor the most recent LCDs from their MAC 
2. Maintain a process to review the LCDs and implement processes to ensure compliance 
3. Perform records audits for both coding and medical necessity  

Some coders might have the requisite medical knowledge to audit for medical necessity. However, it usually requires a clinical background as well as an understanding of Medicare billing requirements such as LCDs. 

The regulatory compliance landscape around SI joint injections is dynamic and significant. It’s worth paying attention to those devilish details.  

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Here are other resources to check out next: 

How to Avoid False Claims Related to Medical Necessity 

This expert blog gives compliance readers actionable steps to avoid civil monetary penalties and False Claims Act scrutiny resulting from documented medical necessity failures. 

Physician Coding and Billing Errors Enforcement: Compliance 

Get more context on enforcement actions stemming from unbundling, modifier misuse, and improper billing during same-day procedures. 

Know the Compliance Risk for Certain Anesthesia Services 

Learn about another recent OIG audit targeting spinal injection procedures and associated anesthesia/sedation coverage limitations. 

Medical Necessity: A Guide for Healthcare Compliance Leaders 

The linked article specifically discusses how MAC LCDs define medical necessity (such as requiring four weeks of conservative therapy prior to approving spinal injections)

The post Don’t Let Pain Injections Cause Regulatory Compliance Pain  first appeared on YouCompli.

A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.