Interest in GLP-1 medications has grown rapidly, and with that growth has come an increase in organizations offering prescriptions through online platforms. GLP-1 telehealth has created new opportunities for patients to access care, particularly for those who face transportation barriers or limited provider availability. The reality is that convenience should never come at the expense of patient safety, regulatory compliance, or sound clinical judgment.

Healthcare organizations are increasingly using technology to streamline referrals, improve care coordination, and reduce administrative burden. This article highlights how responsible compliance professionals must balance these benefits with how they influence referral patterns and financial relationships between parties.

California has adopted its first comprehensive hospice licensing regulations, which include a sweeping set of operational requirements that touch everything from staffing ratios and administrator qualifications to geographic service areas and response times. Here's why compliance professionals across the country should be paying attention.

When organizations talk about strengthening compliance, the conversation often begins with policies, training requirements, audits, and reporting structures. Those elements matter, but they are rarely what determines whether a compliance program succeeds or struggles. The reality is that compliance culture is built through relationships.

When healthcare organizations discuss compliance, the conversation often centers around regulations, policies, audits, and corrective action plans. Those elements are important, but compliance programs ultimately succeed or struggle based on something much more fundamental: trust. The reality is that employees are far more likely to raise concerns, ask questions, and report potential issues when they trust the people leading compliance efforts.

One of the most common conversations I have with healthcare organizations, vendors, and business associates revolves around a simple question: "How do we become HIPAA certified?" The reality is that HIPAA certification does not exist in the way many organizations believe it does.

When organizations talk about Information Security, the conversation often turns immediately to software, cybersecurity tools, firewalls, and monitoring platforms. While technology certainly plays an important role, the reality is that Information Security is fundamentally a management and governance issue before it becomes a technology issue.

When healthcare organizations operate across multiple states, one of the first realities they encounter is that Medicaid is rarely a one-size-fits-all program.

We’re in the middle of a records retention clean-up project—one of those dusty, backroom compliance jobs where nobody gets excited until someone discovers a red flag. In our case? It was this deceptively simple question: “How do we confirm whether a patient is deceased so we can apply our retention policy?” You’d think it would be easy. But in practice, determining a patient’s date of death isn’t always straightforward—especially when there’s no family notification, no claim

Fraud schemes rarely rely on a single bad actor. A recent DOJ case shows how proxy entities—marketers, telemedicine platforms, and suppliers—can be layered to create the appearance of legitimacy while obscuring accountability. For compliance teams, the real risk often lives between organizations. Understanding how inter-entity relationships operate, and where oversight breaks down, is critical to detecting fraud before regulators do.

Phishing simulations are a critical awareness tool—but repeated failures raise an uncomfortable compliance question. At what point does a teachable moment become a real risk indicator? As regulators continue to focus on reasonable safeguards and workforce behavior, organizations must decide how to respond to repeat simulation failures. Doing nothing can signal tolerance for risk, while overreaction can undermine culture. The challenge is finding a defensible, documented middl

Federal EMTALA enforcement is back in focus. A recent DOJ settlement reinforces that hospitals remain accountable for screening, stabilization, and transfer decisions, especially when capacity exists. Regulators are closely examining how EMTALA obligations are handled in real time, not just in policy. For organizations, compliance now depends on whether workflows, documentation, and escalation processes hold up under scrutiny.

Proof of delivery is a nonnegotiable requirement for DME POS claims billed to Medicare—but it remains one of the most common causes of audit denials. CMS requires clear documentation showing the beneficiary (or designee) actually received the item, with specific elements and long-term retention expectations. This post breaks down what valid POD requires, where suppliers often fall short, and how to reduce audit risk.

Same-day E/M services by multiple providers can be compliant—or problematic—depending on specialty designation, documentation, and how claims are submitted. Medicare rules allow separate E/M billing in some situations, but the distinctions are easy to miss in practice. This post explains how CMS treats same-day E/M services, where organizations get tripped up, and what compliance teams should reinforce to reduce audit and denial risk.

Smart speakers like Alexa and Google Nest are common in both offices and home workspaces—but they introduce real HIPAA risk. Because voice assistants continuously listen for activation, patient information can be captured unintentionally during calls, charting, or telehealth visits. This post explains why smart speakers create compliance exposure, how HIPAA applies, and what a clear smart device policy should include.

Attribution lists are common in value-based care—but they’re often misunderstood. Being “attributed” to a provider does not automatically create a treatment relationship or grant access to a patient’s clinical record. This post explains where organizations go wrong, why pre-engagement record access creates real HIPAA risk, and how to structure outreach, role-based access, and documentation so compliance keeps pace with population health goals.

OIG has released new Industry Segment-Specific Compliance Program Guidance for Medicare Advantage — the first major update since 1999. While nonbinding, the ICPG signals enforcement priorities across risk adjustment, utilization management, marketing, FDR oversight, and access to care. For MA organizations and partners, this guidance serves as a blueprint for strengthening compliance governance before the next audit arrives.

Federal enforcement of 42 CFR Part 2 is now aligned with HIPAA, meaning substance use disorder records are fully within OCR’s enforcement authority. Organizations that handle SUD treatment data must understand how Part 2 differs from traditional HIPAA PHI and what this enforcement shift means for policies, consent, training, and technical safeguards. The deadline has passed. The risk is no longer theoretical.c

QR codes are increasingly used to provide access to the HIPAA Notice of Privacy Practices—but convenience alone doesn’t guarantee compliance. While digital access can support modernization, HIPAA still requires the NPP to be prominent, accessible, and available to all patients. This post explains when QR codes help, where they fall short, and how organizations can meet both the letter and spirit of the Privacy Rule.

Requests for access to a deceased patient’s medical records are common—but often misunderstood. HIPAA protections continue for 50 years after death, and disclosure depends on legal authority and specific regulatory pathways. This post explains when records may be released, what documentation is required, how state law factors in, and why organizations should approach these requests with both empathy and clear compliance guardrails.