The Seven Elements of an Effective Compliance Program
The HHS Office of Inspector General groups an effective healthcare compliance program into seven elements, most recently in its 2023 General Compliance Program Guidance. Here is what each element means in practice, and the scaled-down version OIG suggests for small physician practices.
The seven elements, as OIG names them
- 1Written policies and proceduresA code of conduct and the policies that apply it to your risks
- 2Compliance leadership and oversightA compliance officer (or contact), a committee, and leadership attention
- 3Training and educationTraining everyone on the program and on the rules for their job
- 4Effective lines of communicationWays to raise concerns, including anonymously, without retaliation
- 5Enforcing standardsConsequences for violations and incentives for doing it right
- 6Risk assessment, auditing, and monitoringFinding problems before an auditor does
- 7Responding to detected offensesInvestigating, fixing, reporting, and preventing a repeat
Elements 1 to 4: Building the Program
1. Written policies and procedures
Start with a short code of conduct, then write policies for the risks you actually have: billing and coding, HIPAA privacy and security, referral arrangements, and exclusion screening. OIG's guidance expects policies to be reviewed and kept current, not written once. Our HIPAA policy template covers the privacy and security part.
2. Compliance leadership and oversight
Someone has to own the program. Larger organizations name a compliance officer and a compliance committee with board oversight. For small practices, OIG suggests naming one person as the compliance contact. That person should not handle legal services for the practice, should stay out of billing and coding where possible, and, absent a board, should report at least quarterly to the owner or CEO, who remains ultimately responsible.
3. Training and education
Everyone gets training on the compliance program itself, and people who bill, code, or handle PHI get training on the rules for their job. New staff get it when they join, and everyone gets periodic updates. Track it in a training log.
4. Effective lines of communication
Staff need a safe way to raise a concern. A large organization runs a hotline; OIG says a small practice may not need a formal disclosure program, but it should make its commitment to non-retaliation clear, for example with an open-door policy to the compliance contact, and have a written requirement to report issues in good faith.
Elements 5 to 7: Keeping It Working
5. Enforcing standards: consequences and incentives
Put the discipline policy in place before anything goes wrong, and apply it the same way to everyone. OIG suggests the policy should also say that failing to report a known violation can itself lead to discipline, and that practices consider rewarding good compliance work.
6. Risk assessment, auditing, and monitoring
OIG recommends that small entities assess their compliance risks at least once a year, and says a risk assessment does not have to be complicated. Pair it with regular billing and coding audits and monitoring of high-risk areas. A HIPAA audit checklist and a billing compliance checklist cover two of the biggest areas.
7. Responding to detected offenses and corrective action
When something is found, investigate promptly, fix it, report and repay where required, and work out the root cause so it does not happen again. Write each fix down as a corrective action plan. If money is owed to Medicare or Medicaid, the overpayment rule at 42 CFR 401.305 sets a 60-day deadline from identification, with a limited suspension during a timely investigation.
Is a compliance program required?
A Seven-Element Program for a Small Practice
You do not need a department. A practice with a handful of staff can cover all seven elements with a few documents and a calendar:
- A two-page code of conduct and your core policies (element 1).
- One named compliance contact with a quarterly report to the owner (element 2).
- Annual training plus training at hire, logged (element 3).
- An open-door rule and a no-retaliation statement posted in the break room (element 4).
- A written discipline policy that everyone signs (element 5).
- A yearly risk assessment and a small sample of claims audited each quarter (element 6).
- A corrective action plan for every finding, reviewed until closed (element 7).
Put each recurring task on an annual compliance work plan and walk through the open items at each compliance meeting. Referral and payment arrangements carry their own risks; see the Stark Law and Anti-Kickback guide.