Health Care Law

Older versions of OIG's guidance framed this element as designating a compliance officer and a compliance committee. The current General Compliance Program Guidance frames it as compliance leadership and oversight, which brings the governing body into the element and puts the focus on where the compliance function sits within an organization.

A solo practitioner does not need a full-time compliance officer, and OIG has never suggested otherwise. In a small practice, the role is typically assigned to an existing employee as a defined portion of their workload, or handled with outside support. What does not scale down is the expectation that someone is identifiably responsible, that the responsibility is written down, and that the person has the time and authority to do it. “The practice manager handles compliance, among other things” is not an answer if the organization has not defined what “handling compliance” means.

Larger organizations have the resources to have dedicated compliance departments and compliance committees, and the composition is what makes them work.  An effective compliance committee brings in not only the compliance department, but also privacy, information technology, clinical leadership, human resources, revenue cycle, operations, and legal, the functions that own the risks and that will have to implement any fix. OIG has also emphasized that the committee should include people responsible for quality assurance and patient safety and should receive regular reports on those topics, reflecting a view that quality failures and compliance failures are not separable categories.

Independence is the harder part. OIG’s position is that the compliance officer should be independent, with direct access to the chief executive and the governing body, and should not lead or report through the organization’s legal or financial functions. That cuts against how a great many providers are organized. In smaller organizations, the general counsel or the chief financial officer often wears the compliance hat, and in larger ones compliance may report up through legal.

OIG’s concern is that legal and finance departments have institutional interests that pull against a compliance finding. Counsel’s job includes defending the organization. The finance function owns the revenue that an audit finding may require the organization to give back. To the extent that the compliance function is housed within finance or legal, it is important that the compliance officer have a mechanism to bring compliance issues directly to the CEO or board.

Recent corporate integrity agreements have made this enforceable. A pharmaceutical manufacturer's 2026 CIA expressly required that its compliance officer not report through legal or finance and have direct board access.

The board oversees; it does not administer. Board members are not expected to run the compliance program. Instead, the government expects that board members ensure the effectiveness of the compliance function, which requires receiving regular, substantive reports and being equipped to ask about them. The board should see the risk assessment, the audit work plan, what the audits found, what was done about it, and what remains open, and the minutes should show that it did.

Document the architecture. Organizations should maintain a written job description for the compliance officer, a committee charter identifying membership and meeting frequency, a defined reporting line, and compliance committee minutes describing the work conducted.

Closing Thoughts

• Write the compliance officer’s job description, however small the role, and define what portion of the person’s time it occupies.
• Examine your reporting line honestly. If compliance reports to legal or finance, that cuts against current OIG guidance and has become an express obligation in recent corporate integrity agreements.
• Give the board something substantive to oversee, and make sure the minutes reflect engagement.

Kaufman & Canoles' Health Care Practice Group represents health care providers in compliance, regulatory, and transactional matters, with experience working with all types of healthcare organizations. Please reach out to Colin McCarthy or any member of the Health Care Practice Group with any questions.