Building a Practical Compliance Program for a Small Healthcare Organization

A compliance program does not need a large department to be effective. HHS-OIG’s General Compliance Program Guidance, issued in November 2023, describes seven elements of an effective program and includes a section on adapting them for small entities. The guidance is voluntary, but it is a useful framework.

The seven elements, sized for a small organization

1. Written policies and procedures. A short code of conduct and policies that reflect actual operations.
2. Compliance leadership and oversight. In a small organization, a designated compliance contact with clear authority may be appropriate.
3. Training and education. Regular, role-specific training, documented.
4. Effective lines of communication. A way for staff to raise concerns, including anonymously, without fear of retaliation.
5. Enforcing standards. Consistent consequences, and recognition for good compliance behavior.
6. Risk assessment, auditing, and monitoring. Periodic review of your highest-risk areas, such as billing, documentation, and privacy.
7. Responding to detected offenses. A process to investigate issues, correct them, and evaluate whether reporting or repayment obligations apply.

Practical additions

Screen employees and contractors against the OIG List of Excluded Individuals/Entities, maintain a current HIPAA security risk analysis, and keep a vendor and contract inventory.

Make it sustainable

Put a simple annual calendar in place: policy review, risk assessment, training, and exclusion screening. A program that runs reliably on a small scale is better than an ambitious one that stalls.