Healthcare Compliance: All You Need To Know

As a multi-trillion-dollar industry focused on patient care and safety, it should come as no surprise that healthcare is highly regulated, and penalties for noncompliance are steep. There are regulations for just about everything: protecting confidential health information, following safety protocols when dispensing medications or performing procedures, documenting care accurately and completely, coding and billing accurately, and much, much more.

What is compliance in healthcare?

Healthcare compliance refers to the process of abiding by all legal, professional, and ethical compliance standards in healthcare. Basically, it’s about following the rules, and in healthcare, there are plenty of them. These rules are highly complex, and they change frequently, often requiring operational and workflow changes, ongoing education, revision of existing policies and procedures, internal audits, health IT compliance updates, and more.

An important point to remember: healthcare compliance pertains to all healthcare organizations, both large and small. It’s a part of the holistic approach called healthcare governance, risk management, and compliance (GRC), which is crucial to creating a safe, high-performing, high-reliability environment. 

What is the primary purpose of compliance in healthcare? 

The primary purpose of compliance in healthcare is to ensure that organizations and professionals adhere to federal, state, and industry regulations that protect patient safety, privacy, and quality of care. Effective healthcare compliance programs help prevent fraud, waste, and abuse while promoting ethical practices, data security, and accurate billing. By maintaining compliance, healthcare organizations build trust, reduce legal risks, and uphold the highest standards of patient care and operational integrity. 

Who regulates healthcare compliance?

The Department of Health and Human Services (HHS) Office of the Inspector General (OIG) protects against fraud by auditing healthcare organizations to help reduce fraud, waste, and abuse of healthcare dollars. The OIG publishes Work Plan monthly updates to announce specific topics that it intends to target that year and beyond, giving organizations a “heads up” on the types of audits they could face. The OIG has also released The General Compliance Program Guidance as a healthcare compliance reference guide, with an updated version issued in 2023. The HHS OIG also provides wide-ranging educational materials so healthcare organizations can strive to proactively comply with healthcare rules and regulations.

Additional federal and state agencies aid in governing healthcare compliance. For example, the Drug Enforcement Administration (DEA) and the Food and Drug Administration (FDA) both regulate the creation and distribution of medication. They ensure the safety and efficacy of medications, biological products, and medical devices. The FDA also provides the public with accurate, science-based information.   

Other important entities are focused on compliance as well. For example, The Joint Commission (TJC) accredits and certifies organizations, mostly hospitals and healthcare systems, that meet certain compliance standards in healthcare for patient care quality and safety. The National Association for Healthcare Quality (NAHQ) fulfills a role similar to TJC’s, but primarily for health plans and credentialing verification organizations. The Centers for Medicare & Medicaid Services (CMS) and other payers have also implemented various quality initiatives to promote high-quality health care through accountability and public disclosure. These measures play an important role in quality improvement, pay-for-performance models, and public reporting. In addition, the Agency for Healthcare Research and Quality (AHRQ) provides a host of resources to help healthcare organizations provide safe, high-quality care. The Office for Civil Rights (OCR) is responsible for enforcing HIPAA Privacy and Security Rules, ensuring that covered entities uphold the privacy and security of health information. 

While not a regulation, the OIG’s seven elements of an effective compliance program are crucial in healthcare for establishing a culture of ethical and legal behavior. These elements serve as a framework for healthcare organizations to prevent fraud, waste, and abuse, and to promote the delivery of high-quality patient care. Adherence to these elements can significantly reduce legal risks and improve the overall care provided to patients. 

What laws and regulations should healthcare providers be aware of in relation to healthcare compliance?  

There are many regulations with which healthcare organizations must comply—and too many to list here. However, some of the most significant statutes follow:

• The Social Security Act governs funding and requirements for Medicare, Medicaid, the Children’s Health Insurance Program, and more.
• The Health Insurance Portability and Accountability Act (HIPAA) of 1996 that protects patient privacy and requires organizations to keep patients’ medical records secure. 
• The Health Information Technology for Economic and Clinical Health (HITECH) Act enacted in 2009 expands HIPAA, and provides certain health IT compliance standards for the adoption of electronic health records (EHR).
• The False Claims Act makes it illegal for providers to file a false claim to a federal payer. It includes a qui tam provision that allows people who are not affiliated with the government (otherwise known as relators or whistleblowers) to sue the wrongdoer on behalf of the U.S. government.
• The Anti-Kickback Statute prohibits organizations and providers from receiving a financial benefit for patient referrals if the federal government may be charged for all or part of the cost of these services. 
• Likewise, the Physician Self-Referral Law (Stark Law) prohibits physicians from referring patients with Medicare or Medicaid to a provider or entity with whom the physician or a member of the physician’s immediate family has a financial relationship.
• The Patient Protection and Affordable Care Act implemented new requirements for insurance, Medicaid, and more. 
• In addition, the Centers for Medicare & Medicaid Services (CMS) passed the Interoperability and Patient Access Final Rule that provides patients with greater access and control of their electronic health information. 
• CMS’ Hospital Price Transparency Final Rule that requires hospitals to disclose prices negotiated with health plans.
• More recently, the No Surprises Act protects patients from unexpected medical bills and regulates cost transparency, dispute resolution, and notice requirements. 

Why is compliance important in healthcare?

Healthcare compliance is critical because the stakes are high. In some scenarios, the consequences are life or death. Seemingly small mistakes can have dire consequences on patient outcomes, care coordination, and patient safety. Organization-wide healthcare compliance ensures that everyone follows proper procedures and understands expectations—all with the goal of providing high-quality and safe patient care.

How can healthcare organizations ensure compliance?

On a macro level, the first step is to create a culture of compliance. This means taking steps to ensure that everyone in the organization understands how their actions contribute to overall healthcare compliance—and they strive to abide by all rules and regulations every day. 

When mistakes occur, organizations with a culture of compliance seek to understand the root cause and put measures in place to prevent those mistakes from happening again.

Creating a culture of compliance doesn’t happen overnight. It takes time, training, and a series of trial and error steps to get it right. And getting it right requires an ongoing effort with the help of a compliance officer and a department dedicated to healthcare compliance. It also requires executive leadership buy-in. Leaders set the tone and encourage ethical behavior, from the top down.

Who is responsible for healthcare compliance within a healthcare organization? 

Within a healthcare organization, the responsibility for healthcare compliance typically falls on the compliance officer and the compliance department, as well as the organization’s board. They oversee the organization’s compliance with laws, regulations, professional standards, and accepted business practices.

What is a compliance program in healthcare?

To become healthcare compliant, organizations need an effective compliance program, including written policies, procedures, and standards of conduct. The OIG suggests hospitals focus on risk areas (e.g., billing for services not rendered, upcoding, unbundling, and duplicate billing), claim development and submission process, medical necessity, anti-kickback and self-referral concerns, bad debts, credit balances, record retention, and more. 

An effective compliance program should also take into account areas of vulnerability based on internal audits, monitoring activity, and risk assessments, as well as results of Comprehensive Error Rate Testing (CERT). The CERT program calculates a national improper payment rate and contractor- and service-specific improper payment rate based on a statistically valid random sample of Medicare fee-for-service claims. Organizations can use this information to identify potentially high-risk areas and then conduct a risk analysis to ensure healthcare compliance. 

In addition, the Department of Justice provides an in-depth resource on how to create an effective compliance program. Although this document is meant to assist prosecutors in making informed decisions as to whether, and to what extent, an organization’s compliance program was effective at the time of the offense, organizations can also use it to proactively improve their compliance programs. 

Organizations must also ensure ongoing auditing and monitoring. Healthcare compliance software can greatly assist, because it can proactively assess and communicate operational and financial risk enterprise-wide, in real time. Regardless of whether an organization uses software, though, the key is to perform ongoing auditing, monitoring, and assessment. An organization won’t know whether it’s compliant unless it probes into actual workflows to see whether employees are following written policies and procedures. Organizations may conduct annual audits on specific risk areas, or they may choose to audit more frequently (e.g., quarterly or monthly) to keep closer tabs on performance. When an auditor identifies that a person, process or department is noncompliant, they should create a corrective action plan (CAP) to remediate. Remediation may include refresher training, policy updating, or root cause analysis. Enforcing compliance standards in healthcare through well-publicized disciplinary guidelines is equally as important. If someone continually doesn’t follow the rules, for example, they might face temporary suspension or even termination. That goes for everyone within the organization from the top down. No one should be exempt from disciplinary action for persistent noncompliant behavior. 

What are some potential penalties or risks for non-compliance in healthcare? 

If organizations violate laws, they can be subject to   lawsuits, fines, recoupments, or settlement agreements. They could even lose their ability to contract with payers. Individual providers could also lose their medical licenses. There’s also a reputational aspect of noncompliance. When patients discover that an organization isn’t safe or that it doesn’t follow the rules, they may be less likely to seek care there. That has a negative financial impact on the organization, which can take years to repair. 

As healthcare organizations forge ahead into an uncertain future, healthcare compliance should be at the forefront of every decision they make—regardless of whether it pertains to information exchange and access, health information technology implementation, education and training, and more. A compliant organization is an empowered one. It’s a confident one. It’s a safe one. And it’s an organization that patients turn—and return—to for their healthcare needs.