Healthcare compliance has to work beyond the policy binder

When I look at a healthcare compliance process, I want to know what happens on an ordinary workday. Who recognizes the issue? Who decides what to do? What record shows the task was completed? A policy can describe the right goal while leaving the people responsible for it without a workable process.

My professional history includes healthcare legal work, corporate governance and enterprise risk, along with nonprofit healthcare operations. That background supports a practical focus on how regulatory expectations reach the people doing the work. The legal analysis and the implementation need to connect.

Begin with a defined process rather than an ambition to review everything at once. An organization might examine how it updates a program record, checks a credential or escalates a billing concern. Identify the applicable requirement, the person responsible, the information needed and the evidence the organization expects to retain. Counsel and the appropriate compliance professionals should confirm the governing requirements.

Then test the handoff. Consider a hypothetical employee who notices that a record is out of date. Does the employee know where to report it? Is someone assigned to evaluate and correct it? Can the organization tell whether the issue was resolved? Training should help staff carry out the process, including what to do when the usual contact is unavailable.

The federal 340B program illustrates why operational detail matters. HRSA's program-requirements page identifies obligations for participating covered entities that include maintaining accurate program information, annual recertification, preventing diversion and duplicate discounts, and keeping auditable records. [4] Those requirements call for specific operational work. This example does not determine whether an organization qualifies for 340B or resolve its particular compliance questions.

I would also examine how a process responds to change. A new service, location, partner or technology may affect an existing workflow. Assign a way to flag changes for review instead of assuming that last year's policy answers this year's question. Record the source and date supporting a requirement, then have the appropriate reviewer decide what needs updating.

A discussion about compliance should begin with a description of the process and the concern, shared through a suitable professional channel. Patient records, billing details and other sensitive information do not belong in public chat or a general website form. An organization can identify the broad issue before arranging a secure way to provide the materials needed for advice.

Good implementation gives staff a usable path, gives leadership information and gives reviewers a record they can evaluate. The policy binder should support that work. It should not be the only evidence that the organization has thought about it.