This is Part One of our Three-Part series: “Right Sizing Your Compliance Program.”
“We’re a small organization. Does the OIG really expect us to have the same compliance program as a large health system?”
No. But it does expect your program to work.
For smaller healthcare organizations, compliance rarely gets the luxury of standing alone. The person responsible may also manage staff, coordinate operations, or oversee other administrative functions, in one day. With limited time and resources, the real challenge is deciding where compliance efforts will have the greatest impact.
The Office of the Inspector General’s (OIG) General Compliance Program Guidance recognizes these constraints and offers practical adaptations for small entities. The guidance is voluntary and nonbinding; separate laws, contracts, or a Corporate Integrity Agreement may impose specific requirements. Still, its central message is straightforward: the structure may scale to the organization, but the essential functions cannot disappear.
Scale the structure and preserve the function
A small organization may designate a compliance contact when a full-time compliance officer is not feasible. The OIG recommends that this person have no responsibility for legal services and, whenever possible, no involvement in billing, coding, or claims submission. In a lean organization, some overlap may be unavoidable, but your organization must factor in conflicts of interest. Combining duties should be a deliberate decision, not an accident of the org chart.
Designating someone is only the first step. That person also needs clear responsibilities, protected time, access to relevant information, and a budget for outside expertise when needed. An outside consultant might assess risks or review billing, but internal leaders must own the response and act on the findings.
A paper program will not cut it. A reporting policy accomplishes little if employees don’t know where to report, and nobody reviews what comes in. A workable program connects each priority risk to an accountable person, a practical review process, and follow-up that confirms whether the response actually worked.
Build independence before a concern arises
Even with those responsibilities assigned, maintaining independence can be difficult. A small organization may lack a separate investigations department, and the person reviewing a concern may supervise the employee involved or have approved the practice under scrutiny. That doesn’t make an objective review impossible, but it makes controls and guardrails essential.
Before a concern arises, policies and procedures should establish when a reviewer must step aside and who will take over. A concern about an owner’s clinical documentation might go to an independent outside peer reviewer; a concern involving the compliance contact could go to a designated board member or another independent recipient.
The escalation process should also identify who can authorize outside help, receive findings, and require corrective action. Naming an alternate contact isn’t enough; that person needs the authority, access, and resources to respond.
Treat close relationships as a compliance risk
Independence is only part of the challenge. In a small workplace, close working relationships can also discourage people from speaking up. Employees may fear upsetting a supervisor, damaging a colleague’s reputation, or being identified from the details of a concern. These pressures should inform the organization’s risk assessment and the design of its reporting channels.
The OIG acknowledges that anonymity can be difficult to protect in small entities and emphasizes reporting without fear of retribution. Even an anonymous reporting service cannot prevent coworkers from inferring who raised an issue. That is why confidentiality, anti-retaliation safeguards, and careful follow-up matter as much as the reporting channel itself.
At a minimum, provide a reporting option that bypasses anyone implicated in the concern. Restrict access to reports, explain how concerns will be handled, and check for retaliation after an investigation. Don’t mistake silence for success. Few reports may reflect low confidence rather than an absence of problems.
Make board oversight an active safeguard
Reporting channels and independent review only work when leaders take them seriously. In a small organization, leadership’s response to a single concern can influence the culture. Staff notices whether owners welcome difficult questions, whether high performers receive special treatment, and whether corrective action is adequately resourced.
Your organization’s board can provide an essential check on those decisions. The OIG recommends regular compliance reporting to the board and direct access for the compliance officer. For a smaller organization, the report does not need to be elaborate.
- A concise update can prompt meaningful questions including: What risks need attention?
- Which corrective actions are overdue?
- Has anyone interfered with a review?
- Does the compliance contact need additional help?
Board members should also review evidence to ensure that problems were resolved, not just discussed, and make space for concerns involving senior leadership. Where there is no board, the OIG recommends that the compliance contact report at to the owner or CEO at least quarterly. If that leader is implicated, an established route to independent review becomes especially important.
A practical place to start:
Name the owner: Identify who is responsible for each priority compliance risk.
Create the back-up route: Decide who receives a concern when the usual reviewer has a conflict.
Test the reporting process: Confirm that employees know how to raise an issue and what happens next.
Close the loop: Document corrective action and verify that it resolved the underlying problem.
A smaller healthcare organization doesn’t need a miniature version of a health system’s compliance department, but it does need clear responsibility, access to independent judgment, credible reporting options, and leaders who follow through. One useful test is to walk a realistic concern from its initial report through resolution. The gaps you uncover will reveal more about the program’s effectiveness than its policy manual alone.
Ready to strengthen your compliance program?
Our healthcare attorneys help organizations translate the OIG’s guidance into practical, right-sized compliance solutions. Whether you need an independent review of your current program, help addressing a specific risk, or guidance building workable policies and reporting processes, we can help identify gaps and prioritize next steps. Contact our firm to discuss your organization’s compliance goals.
For further information, contact:
Juliette Stancil [email protected]