A compliance program is more than a binder: the seven OIG elements, built for a behavioral health program of 20 to 200 staff

A new compliance lead at a 60-staff program inherits the binder. It holds a code of conduct last revised three years ago, a training sign-in sheet from the last all-staff meeting, and a hotline number that turns out to ring the owner's cell phone. Nothing in it is wrong, exactly. Then a managed care plan's annual attestation asks the program to describe its compliance program. A month later, a former billing coordinator alleges that groups were billed for patients who had left early. The binder cannot answer either one. What answers them is whether anyone audited group attendance, whether staff knew how to raise a concern, and whether there is a record of what happened when they did. This piece is about building that program, organized around the seven elements HHS-OIG uses to describe an effective compliance program.

What the seven elements are, and why they apply to you

In November 2023, HHS-OIG published its General Compliance Program Guidance, a reference for anyone in health care who touches federal health care programs. It restates the seven elements OIG has long treated as the core of an effective program:

1. Written policies and procedures.
2. Compliance leadership and oversight.
3. Training and education.
4. Effective lines of communication with the compliance officer, and disclosure programs.
5. Enforcing standards through consequences and incentives.
6. Risk assessment, auditing and monitoring.
7. Responding to detected offenses and developing corrective action initiatives.

The guidance is voluntary, but in practice it is the yardstick. Sooner or later something goes wrong: a qui tam complaint, a post-payment review that becomes an overpayment demand, or a state Medicaid investigation. When it does, the question is whether the program had a functioning compliance program and whether it acted on what that program found. Some state Medicaid programs and managed care contracts also require a compliance program and an attestation to it, so read your own contracts and state rules.

The guidance says programs should be scaled to the size, complexity and resources of the organization. A 25-person practice is not expected to have a compliance department. It is expected to have the seven functions covered by someone, with a record that they were performed.

Start with the risk map, not the policy manual

Programs that start by writing policies tend to write generic ones: a code of conduct copied from a hospital, or a HIPAA policy from a template site. Start instead with an honest list of where a program like yours actually gets into trouble. Then every policy, training module and audit has a reason to exist. For addiction treatment and mental health programs, these risks recur:

• Referrals and inducements. This covers anything of value exchanged for patient referrals, including arrangements with recovery residences, marketers and toxicology labs. Federal anti-kickback law applies to federal program business. The Eliminating Kickbacks in Recovery Act extends kickback liability to recovery homes, clinical treatment facilities and laboratories regardless of payer. Offering patients free travel, housing or cash raises its own inducement issues.
• Who delivered the service. Services billed under a clinician who was not licensed, enrolled or supervised as required on the date of service. See the credentialing piece.
• Billable days and units. PHP, IOP and residential days billed when attendance fell short, the authorization had lapsed, or the attendance record and the note disagree.
• Drug testing. Testing frequency and medical necessity, standing orders that are not individualized, and financial relationships with labs.
• Documentation integrity. Cloned notes, group notes that do not individualize, and late edits to signed records. See cloned notes and medical necessity and late entries and amendments.
• Privacy and Part 2. Disclosures of substance use disorder records without a qualifying consent, and access by staff with no reason to look. See 42 CFR Part 2, explained for operators.
• Excluded individuals. Employing or contracting with someone excluded from federal health care programs.
• Patient billing. Balances billed that the contract or plan does not permit, and credits never refunded.

Rank each risk by two questions: how likely is it here, and how bad would it be? A program with no drug testing drops that line. A program with three marketing contractors and two sober living partners puts referral relationships at the top. The ranked list becomes the backbone of element six. Rewrite it at least once a year.

Element 1: Written policies and procedures

Policies tell staff what to do. They also show a reviewer that the organization decided the standard before anything went wrong. A policy nobody follows can be worse than none, because it documents that you knew the standard and did not meet it.

• A code of conduct. Two or three plain-language pages that every employee and contractor signs at hire and annually. It commits to billing only for services delivered and documented, no payments for referrals, privacy, and no retaliation against reporters.
• Policies tied to your risk map. Cover referral and marketing relationships, documentation timeliness and amendments, group documentation, billable-day criteria by level of care, drug testing orders, exclusion screening, Part 2 consent, record access, overpayments and refunds, and patient balances.
• Procedures where a policy is not enough. "Notes are completed within the documentation window" is a policy. Who checks, how often, and what happens to the claim when a note is late is a procedure, and staff need it.

At 25 staff, one manual of fifteen to twenty short policies is reasonable. At 150 staff across levels of care, some policies will differ by level of care. Every policy carries an owner, an effective date, a review date and a version history. Keep prior versions, because if a reviewer asks about services from eighteen months ago, the policy in force then is the one that counts. The evidence for this element is a signed code of conduct for every current workforce member, a policy index with no passed review dates, and the retained prior versions.

Element 2: Compliance leadership and oversight

Someone has to own the program, and leadership has to be able to show it was paying attention. The guidance describes three layers.

The compliance officer

The guidance favors a compliance officer who reports to the top of the organization, has access to the governing body, and has the authority and resources to act. It cautions against placing the role under legal or finance. At 200 staff this can be a dedicated position. At 30 staff it is usually a part-time duty held by a clinical or operations director, which the guidance allows for smaller entities. Be honest about conflicts: a billing manager who is also compliance officer is auditing their own work. Keep the title outside billing and bring in an external reviewer for claim audits. Write down who holds the role and how much time it gets.

The compliance committee

Four to six people is enough: the compliance officer, the clinical director, the billing lead, an operations or HR lead, and for MAT programs the medical director. The committee meets on a set schedule, at least quarterly and monthly while the program is being built. Its minutes record what was reviewed, what was decided and who owns each follow-up. Minutes that say "discussed compliance" are not evidence of anything.

The board or owners

Owner-operated programs still need recorded oversight. The compliance officer reports at least quarterly on the risk assessment, audit results, reporting-line activity, investigations and corrective actions. The governing body's minutes should show it received the report and asked questions.

Element 3: Training and education

An annual all-staff slideshow with a sign-in sheet is easy to run and hard to defend. It shows people were in a room, not that the content matched their role. Build two layers:

• General training for everyone. Cover the code of conduct, how to report, non-retaliation, privacy, and the Part 2 basics every workforce member at an SUD program needs. Deliver it at hire, before the person touches records, and then on a regular cycle.
• Role-specific training. Clinicians need documentation standards, group note individualization, amendments and billable-day criteria. Billing staff need payer rules, overpayment handling and how to escalate a claim that should not go out. Admissions and marketing staff need to know what they may and may not offer a prospective patient. Prescribers need controlled substance and PDMP requirements.

Use your own findings. If last quarter's audit found group notes repeating the same response line, show the anonymized pattern and the corrected version, because staff remember examples from their own chart. For evidence, keep a per-person file showing each module, the date, the content version and any score, plus the curriculum as delivered. When a reviewer asks for the training record of the clinician who signed the notes in question, you should produce that one file without rebuilding it from emails.

Element 4: Lines of communication and reporting

Your best early warning is a staff member who noticed something. It might be the tech who saw a group start forty minutes late, the biller asked to change a date of service, or the admissions coordinator told that a marketer is paid per admit. Those people need a way to tell someone who will act, without risk to their job.

• More than one channel. Offer direct access to the compliance officer, a route that bypasses the supervisor chain, and an anonymous option such as a third-party line or a form that does not capture identity. The line must not ring the person most likely to be implicated.
• A written non-retaliation policy, repeated in training and enforced visibly when tested.
• A log of every report, anonymous ones included, with the date, category, investigator, finding and closure.
• A way to answer questions. Much of the traffic at a well-run program is "is this allowed?" That is a sign the channel is trusted.

Exit interviews are underused. A clinician who left in March may say on the way out what they never said while employed. Ask directly about billing, documentation and referrals, and log the answer. A concern raised at exit and ignored is exactly the kind of fact that later appears in a complaint.

Element 5: Enforcing standards, with consequences and incentives

Standards without consequences are suggestions. Tie compliance failures to the progressive steps HR already uses, and escalate for intent. A clinician chronically late on notes gets coaching, then a written plan, then restricted scheduling. Falsifying a signature or billing a session that did not happen is a different case. Apply consequences consistently. If the top-billing clinician gets a pass for conduct a newer clinician was written up for, the records will show your standards are negotiable.

The guidance also asks organizations to consider incentives, so look at what your pay systems reward. Admissions staff paid per admit, or clinicians judged only on billable hours, face pressure that runs against compliance. Referral-based pay carries legal risk that counsel should review. Put documentation quality and audit results into performance reviews, and recognize the person who raised an issue early.

Exclusion screening belongs here too. Screen every employee, contractor and vendor against the OIG List of Excluded Individuals/Entities before hire and on a recurring schedule. Also check your state Medicaid exclusion list where one exists, and any lists your contracts require. Federal health care programs generally will not pay for items or services furnished, ordered or directed by an excluded person, so an excluded employee can taint claims they never billed. Keep dated results, clean ones included.

Element 6: Risk assessment, auditing and monitoring

This element turns documents into an operating function. It has three parts that are often confused.

Risk assessment

This is the ranked risk map, revisited on a cycle, which many organizations run annually. Revisit it also whenever something material changes: a new level of care, payer, referral partner or acquisition, or an enforcement trend in your sector. Its output is the year's audit plan.

Auditing

Audits are periodic, sampled, documented reviews against a defined standard. A practical plan at this size includes:

• Documentation audits. Take a recurring sample of notes per clinician. Check each against the service billed: delivered, documented, signed on time, individualized and tied to the treatment plan.
• Billing audits. Trace sampled paid claims back through the note, attendance, authorization and the provider's credentials on that date. This is the same trace an external reviewer does, as the payer audit playbook describes.
• Billable-day audits for PHP, IOP and residential, checked against the payer contract and your own policy.
• Access audits. Check who viewed which records and whether they had a reason, especially records of staff who are also patients.
• Referral relationship reviews. For every marketing, referral and lab arrangement, confirm a written agreement reviewed by counsel, compensation that does not vary with referrals, and evidence that services were delivered.

Decide who performs each audit. Self-audit is weak evidence. Rotate peer reviewers, use supervisors, or contract an external coder for the billing sample. For reviews that may uncover significant liability, ask counsel whether they should direct the work.

Monitoring

Monitoring is the continuous signal between audits. It covers documentation timeliness by clinician, denial reasons by category, near-identical notes, expiring authorizations and credentials, and unusual access patterns. It tells you where to point the next audit. A rising count of denials for one reason is a monitoring finding, and the sampled review of why it is happening is the audit.

Element 7: Responding to problems and corrective action

Every working compliance program finds problems. A reviewer weighs what happened next. Run the same procedure every time:

1. Contain. Stop ongoing conduct, hold affected claims and preserve records. Do not alter or delete anything, including notes you now think are inadequate.
2. Investigate. Assign someone uninvolved and define the scope and period. Bring in counsel early when fraud, kickbacks, a significant overpayment or a reportable breach is possible.
3. Find the cause. Decide whether this was one person, a broken procedure, a training gap, a system setting, or pay-driven pressure.
4. Quantify and repay. Calculate the overpayment and return it through the payer's process. Medicare's rule at 42 CFR 401.305 sets a deadline for reporting and returning identified overpayments. Medicaid and commercial contracts carry their own requirements, so confirm each with the payer and counsel.
5. Disclose where appropriate. OIG maintains a Health Care Fraud Self-Disclosure Protocol. Whether to use it is a decision for counsel.
6. Correct. Update policy, retrain, apply discipline consistently, and change the workflow that allowed the problem.
7. Verify. Re-audit the area after the fix has had time to work. A corrective action plan without a follow-up audit is a promise.

Take a hypothetical 80-staff program whose quarterly audit finds IOP days billed in full for patients who signed out early. The sign-out sheet lived at the front desk, and billing built claims from the scheduled roster. Nobody intended it, but the program billed time it did not deliver. The response holds open claims and sets the look-back period with counsel. It returns the overpayments, moves early departures onto the attendance record that drives the claim, retrains front desk and billing, and adds billable-day review to the next two audits. The minutes record each step, so if a payer later finds the issue, the program can show it found and fixed it first.

How the program scales from 25 to 180 staff

The elements stay fixed while staffing and cadence change. Three hypothetical programs show the range:

• A 25-staff outpatient and IOP practice. A part-time compliance officer has the role written into their job description, and a three-person committee meets quarterly. There is one manual, annual general training plus clinician and billing modules, and a third-party anonymous line. Peer documentation audits run on a rolling sample, an external billing review happens at least yearly, and exclusion screening is recurring.
• An 80-staff program with residential, PHP and IOP. The compliance officer has a substantial dedicated share of the role, is separate from billing, and reports to the board. The committee meets monthly in year one and includes medical and nursing leadership. Policies are separated by level of care, monitoring is monthly, documentation, billing and access audits are quarterly, and referral relationships are reviewed annually.
• A 180-staff multi-site organization with MAT. A dedicated compliance officer works with support staff, often alongside a separate privacy officer. Site liaisons report into the central program, and the audit plan is stratified by site so a strong site cannot hide a weak one. Prescriber monitoring covers controlled substances, PDMP checks and dosing, and the board receives a written quarterly report.

A first-year build calendar

• Month 1. Designate the compliance officer in writing, form the committee, and hold the first minuted meeting. Screen the entire workforce and all vendors for exclusions.
• Months 1 to 3. Complete and rank the risk assessment, draft the code of conduct, and stand up the anonymous channel and log. Write policies for the top risks first, with counsel reviewing the referral, overpayment and Part 2 policies.
• Months 3 to 6. Deliver general training, collect signed codes of conduct, and begin role-specific training. Run the first documentation and billing audits on a modest sample and report the results to the governing body.
• Months 6 to 9. Act on findings through the element seven procedure. Review every referral arrangement and run the first access audit.
• Months 9 to 12. Re-audit corrected areas, refresh the risk assessment, set next year's audit plan, and deliver an annual compliance report.

The evidence file

When a payer, accreditor, investigator or buyer's diligence team asks you to show your compliance program, they will want documents. Keep these current and versioned:

• The compliance officer designation and the committee charter.
• Committee and board minutes showing reports received and decisions made.
• Each year's risk assessment and the audit plan it produced.
• The policy index with versions, owners and review dates.
• Signed codes of conduct and per-person training files.
• Dated exclusion screening results for every person and vendor.
• The reporting log and each report's resolution.
• Audit reports, investigation files, overpayment calculations and proof of repayment.
• Corrective action plans and the re-audits that verified them.
• Access reviews and records of permission changes.

Retention periods vary by regulation, payer contract and state law. Set a retention schedule with counsel, and do not keep these files only on the compliance officer's laptop.

Where your systems help, and where they cannot

No software is a compliance program. The governing body's attention, the investigator's judgment and the decision to repay a payer are human work. Systems can make the evidence a by-product of normal operations. Late notes become visible the day they go late. Credential lapses block scheduling instead of surfacing on a denial. Access is logged automatically rather than reconstructed from memory.

Test your own tools against the evidence file above: can each item be produced on demand from systems you control? In Unisona Health, for example, every view, edit, signature, export and permission change is written to an append-only activity log that an administrator can filter and export for an access audit. Role-based compliance training is assigned and recorded per staff member in the training library. Wherever your setup cannot produce a record, put that gap on next year's risk assessment. If someone asks what your compliance program did last quarter, the answer should be a stack of dated records with names on them, ready by the end of the day.

Frequently asked questions