During the past few weeks, I’ve been reflecting on my path through healthcare over the last 20 years. What we’re seeing politically and economically feels unprecedented… and in many ways it is, but in other ways, it reminds me of the landscape during the early 2000s when I first stepped into healthcare.
At that time, compliance as a role was still emerging in many organizations. As clinicians, we did the best we could. We served patients and yes, we theoretically wanted to follow the rules, but sometimes we didn’t even know what the rules were. (Remember, this was before most of us used Google and regulatory agencies may or may not have even had websites up. We still shared progress note templates on a floppy disk.)
I remember when the organization I worked for hired its first Compliance Officer. We thought we were being proactively punished. We quietly chattered in the background wondering what this person was even going to do. Would they follow us around making sure we complied with every single rule? Were they going to tell us exactly how to do our jobs? There was absolutely nothing about the title “Compliance Officer” that made us feel warm or fuzzy.
Of course, as an industry, we’ve come a long way. Most of us now understand the Compliance Officer to be the lifeguard, not the police officer. Still, I have to wonder if we’re backsliding in some ways.
The Early 2000s: A Climate of Fear
When I began my career in community mental health, I was quickly swept into the world of documentation reviews and audit preparation. HIPAA had just been enacted, electronic medical records were coming online, and CMS audits loomed large.
At that time, CMS audits were often punitive and highly focused on payment recovery. CMS was known for combing through documentation, finding any gap they could, and recouping payments, sometimes to the tune of millions. In Oregon, there was a highly publicized demand for millions in repayment from a large community mental health provider. This was a well-established organization with a good reputation. You can imagine the fear this created for smaller providers.
Meanwhile, state CMS offices were reluctant to provide official guidance on certain topics and rarely put anything in writing. For providers, it often felt like CMS was the enemy. This climate of fear is what spurred many organizations to finally establish compliance programs and create compliance officer roles.
Two Decades of Progress
We’ve come a long way as an industry. Compliance and quality improvement are now well established professions that are embedded in most healthcare organizations. Nationally, we’ve seen gains in quality and patient outcomes, improved compliance infrastructure, and a major shift toward value-based purchasing. That doesn’t mean healthcare is perfect. Some things are very broken (AI-driven claims denials just off the top of my head). And the regulatory and payment landscape has only grown more complex (we want to think this improves the quality of care, but that’s not always the case – a topic for another post perhaps).
Now we’re entering an era where healthcare organizations are tightening their belts. Understandably, there’s scrutiny on non-revenue-generating positions. Recently, I even heard a high-level leader question whether a Compliance Officer was necessary.
At the same time, today’s administration is focused on reducing healthcare costs and improper payments across Medicare and Medicaid are drawing renewed scrutiny. CMS estimates tens of billions in improper payments each year, much of it tied to insufficient documentation. (Understand that you may have provided a high-quality service, but you’re not entitled to payment if you didn’t document it appropriately.)
In times of economic and political pressure, enforcement tends to shift back toward recovering money.
The Real Cost of Compliance
So, when I hear organizations today asking whether they really need a Compliance Officer, I have two reactions. First, the compliance professional in me wants to grab the federal sentencing guidelines and point out all the reasons the answer is yes.
But second, I remember what it was like before compliance was part of the culture: fear, uncertainty, and a constant sense that a single audit could literally shut us down. Compliance has a cost, but so does non-compliance. History suggests the cost of non-compliance is about to rise.