Compliance Deconstructed

Healthcare fraud can take many forms, and some are much easier to recognize than others. 

In this episode of Compliance Deconstructed, Jessica Zeff, Lorie Davis, and Elvan Baker examine the nature of fraud in healthcare, starting with the traditional understanding of fraudulent billing and moving into less obvious situations involving inaccurate claims, inflated services, and misrepresentation. 

They also explore how the understanding of healthcare fraud has evolved, particularly in the aftermath of the COVID-19 pandemic, and why healthcare organizations need to pay close attention to how fraud, compliance, and contractual obligations can intersect.

This conversation takes a closer look at what happened during COVID-19 and how providers were forced to make decisions while dealing with unprecedented patient volumes, changing regulations, limited information, and emergency circumstances. 

Jessica, Elvan, and Lorie raise important questions about how organizations should evaluate potential fraud when providers were trying to deliver care with the information available at the time, particularly when documentation, billing practices, telehealth, disaster recovery plans, and other processes changed rapidly.

The episode also examines how government agencies, health plans, and compliance teams can identify potential fraud through whistleblower reports, data mining, claims analysis, and artificial intelligence. Healthcare organizations generate enormous amounts of claims and clinical data, creating opportunities to identify unusual billing patterns, coding trends, utilization patterns, and activity that differs significantly from peers. 

The discussion emphasizes why organizations should pay attention when a payer raises concerns about billing patterns and why smaller healthcare practices still need processes for auditing, monitoring, documentation, and responding to potential compliance issues.

Key Takeaways From This Episode

• Healthcare fraud can involve much more than billing for services that were never provided. Misrepresentation, inaccurate claims, inflated services, cloned records, copied signatures, and failure to fulfill contractual compliance requirements can create significant compliance concerns.
• The COVID-19 pandemic created complex compliance challenges because healthcare organizations had to operate under rapidly changing conditions while treating patients, adapting to new rules, expanding telehealth, and working within emergency circumstances. Organizations now face questions about how those decisions should be evaluated after the fact.
• Data analytics and artificial intelligence have changed how healthcare fraud can be detected. Government agencies, health plans, and other organizations can analyze claims data to identify unusual patterns, billing behavior, utilization trends, and activity that differs from comparable providers.
• Smaller healthcare practices still need effective compliance monitoring even when they cannot support a full internal compliance department. Electronic medical records, revenue cycle management systems, periodic external reviews, and qualified compliance consultants can provide additional oversight and help organizations identify potential issues.
• Healthcare organizations should understand the compliance requirements contained in their contracts with Medicare, Medicaid, health plans, and other payers. When an organization agrees to maintain specific compliance processes and then fails to implement them, that gap can create exposure beyond the underlying operational issue.

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

Healthcare compliance and legal teams often work in the same areas, but knowing when an issue belongs with compliance, when legal counsel should be involved, and when both teams need to work together can create confusion. 

In Episode 33 of Compliance Deconstructed, Jessica Zeff, Lorie Davis, Elvan Baker, and special guest Gabby Morella, Managing Partner at Morella & Associates, explore the relationship between healthcare compliance and legal counsel and explain why collaboration between these functions matters when organizations face regulatory, contractual, operational, and legal issues.

The conversation begins by breaking down the different forms of compliance that healthcare organizations encounter, including contract compliance and operational compliance. The group also discusses how compliance professionals help organizations monitor whether policies, procedures, agreements, and regulatory requirements actually work in practice, while legal professionals bring specialized knowledge to contractual interpretation, regulatory interpretation, liability, and legal risk.

Another major focus is attorney-client privilege and the misconceptions that often surround it. Gabby explains that the client holds the privilege, that privilege does not automatically apply to every conversation with an attorney, and that involving additional people in certain communications can affect whether privilege applies. 

This in-depth episode also emphasizes that organizations should understand the limits of attorney-client privilege and should not treat it as a blanket protection for decisions or conduct that may create legal or regulatory problems.

Key Takeaways From Episode 33:

• Compliance covers ongoing risk management, auditing, policies, contracts, and regulatory requirements
• Involve legal early when an issue could create significant liability, contractual, regulatory, or reporting risk
• Compliance oversees implementation and day-to-day adherence, while legal provides legal advice and risk guidance
• The level of legal involvement should reflect the organization, situation, and potential risk
• Attorney-client privilege has specific boundaries and can be affected by who is included in communications
• Strong collaboration between compliance, legal, and operations supports better decisions and stronger compliance outcomes

Connect with Gabby on her website

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

Medical billing and coding is one of the most complex operational areas in healthcare, with providers and billing organizations required to navigate hundreds of codes, modifiers, reimbursement rules, payer requirements, and changing regulations. 

In Episode 32 of Compliance Deconstructed, Jessica Zeff, Lorie Davis, and special guest Nancy Worthy of Worthy Billing and Consulting discuss the medical billing and coding challenges that can create compliance risks, reimbursement problems, claim denials, and audit exposure for healthcare organizations.

Nancy draws on more than 35 years of medical billing experience to explain how seemingly small details can affect whether a claim gets paid correctly, including time-based codes, telehealth place of service codes, modifiers, units, provider credentialing, and payer-specific requirements. 

The discussion highlights how frequently billing and coding rules can change and why healthcare providers need processes that help them monitor those changes and apply the correct requirements to each claim, particularly in areas such as mental health and telehealth.

Medical records and prior authorizations also play an important role in supporting accurate healthcare billing, because the services represented on a claim need appropriate documentation and required approvals. 

This episode provides practical insight into how billing teams, compliance professionals, healthcare providers, and health plans can work together to identify billing errors, correct claims, monitor recurring issues, and build processes that reduce unnecessary risk while supporting accurate reimbursement.

Key Takeaways From This Episode:

• Medical billing and coding requires ongoing attention because codes, modifiers, reimbursement rates, payer requirements, and billing rules can change throughout the year
• Time-based billing requires accurate documentation, including the appropriate amount of service time and, when required, start and stop times that support the code billed
• Telehealth billing can create additional complexity because place of service codes and modifiers depend on where the patient receives the service and payer requirements can change over time
• Incident-to billing, supervision billing, and billing for interns or pre-licensed providers have specific requirements, and healthcare organizations should verify the rules for each applicable payer before submitting claims
• Healthcare providers serving Medicaid patients in Pennsylvania may need to consider county-specific managed care arrangements and verify that the provider participates with the appropriate plan before billing
• Accurate medical records, prior authorizations, credentialing, claim forms, codes, modifiers, and reimbursement rates all contribute to billing compliance, making collaboration between billing, compliance, clinical, operational, and leadership teams essential

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

The Office of Inspector General’s new Medicare Advantage Industry Segment-Specific Compliance Program Guidance (ICPG) provides healthcare organizations with a more focused framework for identifying and managing compliance risks within the Medicare Advantage sector. 

In this episode, Jessica Zeff, Elvan Baker, and special guest Brian Burton of Healthicity discuss how the new guidance fits alongside the OIG’s General Compliance Program Guidance and the seven elements that form the foundation of an effective healthcare compliance program.

While the Medicare Advantage ICPG does not carry the force of a regulation, the guidance provides a blueprint for the compliance activities the OIG expects organizations to consider, particularly when evaluating enforcement matters and Corporate Integrity Agreements. The discussion examines why Medicare Advantage has received increased attention, including its growth to more than half of all Medicare enrollment in 2025 and the significant number of beneficiaries now receiving coverage through Medicare Advantage plans.

The conversation also explores the organizations and individuals who may need to understand the Medicare Advantage compliance guidance, including Medicare Advantage organizations, healthcare providers, vendors, first-tier downstream and related entities, brokers, marketers, and investors. 

Jessica, Elvan, and Brian also examine specific areas of compliance risk identified by the OIG, including risk adjustment and data integrity, utilization management and prior authorization, marketing and enrollment, network adequacy, claims and payment integrity, quality of care, and vertically integrated or financially motivated ownership structures.

Key Takeaways:

• The Medicare Advantage ICPG works alongside the OIG’s General Compliance Program Guidance and provides sector-specific direction for organizations operating within the Medicare Advantage environment
• Medicare Advantage compliance guidance addresses a broad range of participants, including health plans, providers, vendors, first-tier downstream and related entities, brokers, marketers, and investors
• Risk adjustment and data integrity require close attention to diagnosis coding, documentation, health risk assessments, and potential overpayments, making ongoing monitoring an important part of Medicare Advantage compliance
• Utilization management, prior authorization, and artificial intelligence create compliance considerations involving medical necessity, access to care, claims decisions, and the appropriate use of technology in clinical and reimbursement processes
• Marketing and enrollment, network adequacy, provider directories, claims and payment integrity, quality of care, and financially motivated ownership structures represent additional risks identified within the Medicare Advantage ICPG

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

California Medicaid, known as Medi-Cal, is one of the largest and most complex Medicaid programs in the United States, serving approximately 15 million members across diverse geographic and socioeconomic communities. 

In this Part 2 episode of Compliance Deconstructed, Jessica Zeff, Elvan Baker, Lorie Davis, and special guest Marwan Kanafani continue to explore what makes California Medicaid unique, how its managed care model operates, and why organizations entering this market must understand both regulatory expectations and operational realities.

The discussion examines how California has become a leader in developing innovative healthcare delivery models by addressing Social Drivers of Health alongside traditional medical services. The conversation highlights how federal waiver programs allow Medi-Cal to invest in interventions that improve long-term patient outcomes while helping healthcare organizations reduce avoidable utilization and improve the overall quality of care.

Jessica, Elvan, Lorie, and Marwan also take a closer look at Enhanced Case Management (ECM) and the operational challenges that come with delivering high-touch, community-based care. From workforce development and documentation requirements to liability considerations and care coordination, the episode explains why implementing these programs requires thoughtful planning and collaboration across clinical, operational, and compliance teams.

The conversation also explores what organizations should expect when entering the California Medicaid market, including rigorous regulatory oversight, vendor accountability, annual audits, and NCQA accreditation requirements. Whether you are a healthcare executive, compliance professional, managed care organization, or healthcare vendor, this episode provides practical insight into building sustainable operations while meeting the evolving expectations of California Medicaid.

Key Takeaways

• California Medicaid serves approximately 15 million beneficiaries through one of the nation's largest and most complex managed care systems
• Social Drivers of Health continue to shape Medi-Cal's approach to improving patient outcomes through upstream, community-based interventions
• Enhanced Case Management requires significant operational planning, workforce investment, and cross-functional coordination to deliver high-touch care effectively
• Healthcare vendors performing delegated functions are held to the same rigorous compliance expectations as the managed care organizations they support
• Annual audits, NCQA accreditation, and comprehensive documentation remain fundamental components of operating successfully within the California Medicaid environment
• County-level differences, regional demographics, and local healthcare infrastructure all influence how organizations should approach expansion within California Medicaid

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

California's Medicaid program, Medi-Cal, serves more than 14 million residents and continues to shape how managed care, compliance, and healthcare delivery evolve across the country. 

In this episode of Compliance Deconstructed, Jessica Zeff, Elvan Baker, and special guest Marwan Kanafani explore how Medi-Cal operates, why California's regulatory environment is so complex, and what healthcare organizations need to understand to successfully navigate one of the nation's largest Medicaid programs.

The conversation examines the role of the California Department of Health Care Services (DHCS), the state's managed care model, and the extensive oversight health plans experience through ongoing audits and regulatory reviews. The trio also dives into how federal waivers allow California Medicaid to test innovative care models while balancing accountability, operational demands, and patient access across a diverse population.

Medi-Cal addresses social determinants of health by supporting initiatives that extend beyond traditional medical care, including housing stability, food security, environmental improvements, and transition planning for justice-involved populations. From a compliance standpoint, these programs require healthcare organizations, health plans, community partners, and government agencies to work together while demonstrating measurable outcomes that support continued funding and regulatory approval.

Additionally, Jessica, Elvan, and Marwan also discuss the operational challenges created by carve-outs, data sharing, NCQA accreditation, and the continued integration of Medicare and Medi-Cal programs for dual-eligible populations. Whether you work in healthcare compliance, managed care, health plan operations, or provider leadership, this conversation offers practical insight into the regulatory expectations, implementation challenges, and collaborative strategies that help organizations succeed within California's evolving Medicaid landscape.

Key Takeaways

• Medi-Cal's managed care structure delegates responsibility to private health plans while remaining under the oversight of the California Department of Health Care Services
• California health plans often operate in a continuous audit environment and how organizations prepare for overlapping regulatory reviews
• Medicaid waivers allow California to develop innovative programs that address Social Determinants of Health and improve long-term patient outcomes
• Housing support, nutrition assistance, environmental interventions, and reentry programs contribute to better health while creating new compliance and operational considerations
• Hear practical recommendations for strengthening compliance through data-sharing agreements, outcome measurement, NCQA readiness, and planning for Medicare and Medi-Cal integration

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

GLP-1 medications continue to reshape healthcare delivery, creating new opportunities for patient care while introducing significant compliance responsibilities for providers, telehealth organizations, pharmacies, and health plans. 

In this episode of Compliance Deconstructed, Jessica Zeff is joined by co-hosts Elvan Baker and Lorie Davis to examine the regulatory and operational challenges surrounding GLP-1 prescribing, including telehealth evaluations, compounded medications, fraud, waste, and abuse risks, prior authorization requirements, and practical compliance oversight.

The reality is that organizations often focus on patient demand without fully evaluating how their operational processes support compliant prescribing practices. Jessica, Elvan, and Lorie discuss why synchronous telehealth visits, thorough clinical documentation, provider licensure verification, and informed patient conversations all play an important role in reducing regulatory risk while supporting appropriate access to care.

From a compliance standpoint, GLP-1 oversight extends well beyond the prescription itself. The conversation explores FDA scrutiny surrounding compounded GLP-1 medications, the role of pharmacy benefit managers, documentation expectations for medical necessity, and how financial incentives, prescribing trends, and marketing practices can create fraud, waste, and abuse concerns when organizations fail to implement appropriate safeguards.

In practice, compliance requires ongoing monitoring rather than one-time policy development. Jessica, Elvan, and Lorie share practical strategies for incorporating GLP-1 medications into annual compliance risk assessments through documentation audits, claims monitoring, pharmacy verification, marketing reviews, and cross-functional collaboration that helps organizations balance regulatory expectations with sustainable patient care.

Key takeaways:

• Understand how synchronous and asynchronous telehealth models create different compliance obligations for patient evaluation, informed consent, documentation, and provider accountability.
• Review GLP-1 prescribing workflows to verify provider licensure, patient identity, clinical necessity, and complete medical documentation before prescriptions are issued.
• Evaluate how your organization manages compounded GLP-1 medications, including pharmacy sourcing, FDA marketing requirements, and communications regarding product equivalency.
• Monitor prior authorization processes, diagnosis coding, and supporting documentation to reduce compliance risks associated with medical necessity and reimbursement.
• Assess fraud, waste, and abuse risk by reviewing prescribing patterns, refill activity, provider compensation structures, refund policies, and potential kickback concerns.
• Incorporate GLP-1 medications into your compliance audit program with regular risk assessments, claims reviews, marketing audits, and collaboration across compliance, operations, clinical, legal, and pharmacy teams.

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

In this episode of Compliance Deconstructed, Jessica Zeff and Elvan Baker sit down with Denise Lord to explore the realities of managing healthcare compliance in a critical access hospital. Denise shares firsthand insights into balancing multiple responsibilities, building effective compliance programs with limited resources, and creating sustainable processes that support both regulatory requirements and patient care.

This in-depth conversation examines the unique structure of critical access hospitals, where compliance leaders often oversee quality, risk management, infection prevention, patient experience, and privacy responsibilities simultaneously. Denise explains how this broad oversight can provide valuable visibility into organizational operations, helping healthcare leaders identify trends, address risks proactively, and strengthen collaboration across departments.

Jessica, Elvan, and Denise also discuss the importance of fostering a culture of shared ownership for compliance. They highlight the role of executive leadership, compliance committees, department managers, and frontline staff in creating an environment where ethical decision-making, regulatory adherence, and patient safety become part of everyday operations rather than isolated compliance activities.

Key Takeaways:

• Critical access hospital compliance leaders often oversee multiple functions, creating opportunities to identify risks and trends across the organization.

• Strong compliance programs depend on collaboration between leadership, clinical teams, operations, legal counsel, information technology, and frontline staff.

• Compliance committees become more effective when members actively participate in discussions and help identify organizational priorities.

• A just culture approach helps organizations address incidents fairly while encouraging staff to report concerns and potential compliance issues.

• Privacy and HIPAA training become more meaningful when employees understand how compliance directly impacts patients, families, and their local communities.

• Successful compliance management requires flexibility, strategic prioritization, strong communication with leadership, and a willingness to adapt when unexpected challenges arise.

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

Information security plays a critical role in healthcare compliance, risk management, and organizational resilience. In this episode of Compliance Deconstructed, Jessica Zeff, Lorie Davis, and special guest Joe Wynn, Founder & CEO of Seiso, break down the foundational elements of an effective information security program and explain why protecting sensitive data requires a structured approach that extends beyond technology solutions.

This in-depth conversation explores the importance of conducting comprehensive risk assessments to identify vulnerabilities, evaluate threats, and prioritize security efforts based on potential impact. The hosts also discuss practical safeguards such as multi-factor authentication, data backups, software patching, access controls, and employee training that help healthcare organizations strengthen their security posture and reduce exposure to cybersecurity risks.

Jessica, Lorie, and Joe also address common misconceptions surrounding HIPAA compliance, SOC 2 reports, and security attestations while highlighting emerging concerns related to website tracking technologies and third-party data sharing. After consuming this episode, you’ll gain actionable insights into building a sustainable information security strategy that supports regulatory compliance, protects patient information, and promotes long-term organizational success.

Key Takeaways:

• Risk assessments provide the foundation for identifying security gaps, evaluating threats, and prioritizing remediation efforts across the organization.

• Multi-factor authentication, secure backups, regular software updates, access management, and employee education remain essential components of a strong security program.

• Healthcare organizations should understand that there is no official HIPAA certification and that compliance requires ongoing oversight and accountability.

• SOC 2 reports evaluate security controls and can support broader compliance initiatives when paired with regulatory assessments.

• Website cookies, tracking scripts, and third-party marketing tools can create privacy and compliance risks when organizations do not fully understand how data is collected and shared.

• Information security requires continuous evaluation, process improvement, and cross-functional collaboration to protect sensitive information and maintain regulatory compliance.

Connect with Joe Wynn

Website | LinkedIn

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

In this episode of Compliance Deconstructed, Jessica Zeff joins co-hosts Elvan Baker and Lorie Davis to unpack one of the most operationally complex areas of healthcare compliance: Medicaid and the realities of navigating state-specific healthcare programs. The reality is Medicaid is not a single national program with standardized rules, and organizations often underestimate how much variation exists between states when it comes to eligibility, benefits, managed care structures, provider enrollment, and compliance obligations.

Jessica, Elvan, and Lorie explore how Medicaid differs from Medicare and private insurance while discussing why compliance professionals, providers, and health plans cannot rely on assumptions when entering new Medicaid markets. From a compliance standpoint, this becomes especially important when organizations expand across state lines and discover that processes tied to credentialing, appeals, grievances, staffing, reporting, and oversight may look completely different depending on the state administering the program.

The conversation also examines the balance between federal oversight from the Centers for Medicare & Medicaid Services and the flexibility states have to design their own Medicaid programs through waivers, managed care arrangements, and operational structures. On paper, this may sound straightforward. But operationally, this becomes challenging when organizations attempt to align compliance, legal, IT, clinical operations, and leadership teams around requirements that are often layered across contracts, appendices, policy manuals, and state guidance documents.

Jessica, Elvan, and Lorie also share practical strategies for approaching Medicaid compliance in a structured and sustainable way, including conducting detailed gap analyses, building operational playbooks, mapping information flow, and training teams on state-specific requirements. A lot of organizations struggle with treating Medicaid compliance like a one-time implementation project, when in practice it requires ongoing monitoring, collaboration, and operational adaptability to manage risk effectively while supporting patient access and organizational stability.

Key takeaways from this episode:

• Medicaid programs vary significantly from state to state, including eligibility rules, covered services, managed care structures, and provider participation requirements.
• Compliance professionals should avoid assuming that experience in one Medicaid program automatically translates to another state’s program.
• CMS provides federal oversight, but states maintain substantial flexibility through waiver programs, managed care models, and operational design decisions.
• Provider enrollment, credentialing, appeals and grievances, staffing requirements, and reporting obligations often differ substantially across states.
• Conducting a detailed gap analysis helps organizations identify operational, compliance, staffing, and technology requirements before entering a Medicaid market.
• Successful Medicaid compliance requires collaboration across compliance, operations, legal, clinical, IT, and leadership teams to ensure policies translate into day-to-day operational execution.

Don't miss this year's HCCA Conference in Pittsburgh! Click here for all the info.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.