Healthcare Compliance Risk Assessment and Management

Don’t Wait for an Audit to Surface Unseen Risks

In fiscal year 2024, healthcare-related False Claims Act settlements and judgments exceeded $1.67 billion, the largest share of all federal recoveries. Some of the largest recoveries came from Anti-Kickback and Stark Law violations, the kind of arrangements a risk assessment is built to surface.

Every healthcare organization carries compliance risk. Your organization has likely already identified and controlled many of those risks. Others may remain unseen, unranked, or undocumented: the billing pattern that draws a payer audit, the physician arrangement that trips the Stark Law, the privacy gap that becomes a breach.

Strategic Management Services helps your organization see where risks are hiding and turn uncertainty into a ranked, defensible picture:

• Give your team a documented picture it can act on  
• Identify exposure across HIPAA, billing and coding, physician arrangements, and internal controls
• Rank every risk by impact and probability

The Risks We Evaluate

We focus on the regulatory and non-compliance exposure specific to healthcare organizations:

• HIPAA Privacy and Security: Where protected health information is exposed across systems, access, and vendor relationships.
• Billing and Coding: Claims development and submission patterns that invite payer audits and overpayment liability.
• Physician Arrangements: Compensation and referral relationships measured against the Stark Law and the Anti-Kickback Statute.
• Referral Sources: Inbound and outbound referral practices reviewed for regulatory exposure.
• Internal Controls: Gaps in policies, procedures, and oversight that let risk go undetected.

How It Works

A Proven Process for Identifying and Prioritizing Risk

• Assessment
  Strategic Management Services identifies compliance risks through a separate, in-depth review of each regulatory area, including referral sources, HIPAA privacy and security, and claims development and submission. Each area is assessed individually. The firm also interviews senior staff and distributes surveys to capture their insight.The phase concludes with an impact and probability analysis and a risk scoring framework that ranks each exposure and sets priorities.
• Remediation
  High-risk areas are addressed through a prioritized remediation roadmap that puts policies, procedures, and controls in place. We also train your Compliance Department to recognize what causes risk and how to manage it.
• Risk Reporting
  We prepare a formal, board-level report for the board of directors and executive management, which includes the high-risk areas identified and how each could be addressed through remediation, monitoring, and auditing.