What Behavioral Health Leaders Should Review Between Compliance Audits

Ongoing compliance monitoring and formal auditing serve related but different purposes.

An audit typically evaluates defined areas against established criteria at a particular point in time. Routine monitoring is part of the organization's day-to-day visibility into whether known risks and controls continue to operate as expected.

HHS Office of Inspector General guidance reinforces this distinction. Its General Compliance Program Guidance discusses routine monitoring of ongoing risks, monitoring the effectiveness of controls and remediation, and periodically reassessing whether monitoring remains effective and appropriately timed. Importantly, OIG describes the GCPG as voluntary, nonbinding guidance, not a universal legal mandate.

For behavioral health leaders, that means monitoring should help reveal whether:

• responsibilities remain clear;
• policies still match current operations;
• staff are following expected processes;
• exceptions are being detected;
• corrective actions are being completed;
• recurring problems are becoming visible; and
• new risks are entering the organization.

This should not become continuous “mock auditing.” The objective is useful evidence that helps leadership identify where attention is needed.

Organizations preparing specifically for an audit have a different question to answer. JLA’s separate compliance audit checklist addresses that pre-audit intent rather than trying to turn routine monitoring into audit preparation.

A compliance responsibility is not fully operationalized simply because it appears in a job description, policy, committee charter, or organizational chart.

Leadership should be able to identify who owns the responsibility in practice.

Depending on the issue, that may mean knowing:

• who performs the activity;
• who monitors whether it occurred;
• who receives exceptions or concerns;
• who decides what happens next;
• who escalates unresolved risk;
• who owns corrective action;
• who verifies completion; and
• who communicates material issues to leadership.

Those responsibilities frequently cross departments. Clinical leadership may own one portion of a process while compliance, billing, HR, IT, quality, or operations owns another.

That makes transitions especially important. Vacancies, new locations, rapid hiring, reorganizations, new vendors, technology changes, and service expansion can create accountability gaps even when the underlying policy has not changed.

OIG’s current guidance places significant emphasis on compliance leadership and accountability, follow-through, and access to information about compliance risks. The specific structure will vary by organization, but the operating principle is useful: responsibility should be identifiable rather than assumed.

For leaders looking more specifically at governance weaknesses that may surface during formal review, John Lynch & Associates’ addresses that separate question in its behavioral health compliance audit guidance.

Policies can remain technically current on paper while operations move around them.

A clinic changes its intake process. A new EHR template is implemented. Telehealth expands. A vendor assumes part of a workflow. Responsibilities move from one position to another. Staff develop workarounds because the documented procedure no longer fits the operational reality.

Over time, the organization may end up with two versions of the process: the process described in policy and the process employees actually perform. That gap deserves attention as part of broader healthcare compliance oversight.

A practical between-audit review should consider whether applicable policies continue to align with:

• current workflows;
• staff roles;
• forms and templates;
• EHR configuration;
• documentation practices;
• escalation procedures;
• vendor processes; and
• supervisory structures.

OIG guidance similarly recommends that organizations consider how policy changes affect compliance and risk mitigation, and that policies and procedures remain accessible and maintained.

Again, these recommendations should be understood within the GCPG’s voluntary, nonbinding status and alongside any requirements that independently apply to the organization.

A useful leadership question is straightforward: Does the policy describe what actually happens today?

If the answer is unclear, reviewing the policy alone may not resolve the problem. Leadership may need to follow the workflow from beginning to end.

Training documentation answers an important question: Did the person complete the training?

It does not necessarily answer: Did the person understand it and consistently apply it?

Behavioral health leaders should look beyond completion reports when recurring operational issues suggest a gap between education and practice.

Useful questions include whether staff:

• understand the responsibilities associated with their roles;
• know where and how to report concerns;
• recognize situations that require escalation;
• understand process changes; and
• consistently follow expected workflows.

OIG’s voluntary compliance guidance recommends that training reflect an organization's risks and that targeted education be based on roles and responsibilities. It also recommends using findings from monitoring, audits, and investigations to help shape training content.

But repeated problems after training should not automatically result in another training session.

If employees continue to make the same mistake, leadership should ask whether the underlying cause is actually:

• an unclear policy;
• a poorly designed workflow;
• inadequate supervision;
• a technology or configuration problem;
• insufficient role-specific compliance training; or
• unclear ownership.

Recurrence is information. When the same behavior continues after education, it may be telling leadership that the problem sits somewhere deeper in the operating model.

Individual incidents matter, but patterns often tell leadership more.

Behavioral health organizations generate compliance-related signals across multiple parts of the business. Depending on the organization, those signals may include privacy or security incidents, patient complaints, documentation exceptions, internal monitoring findings, billing issues, authorization concerns, vendor problems, access concerns, hotline reports, supervision problems, or overdue compliance activities.

Some are lagging indicators evidence that a significant problem has already occurred. Examples can include an audit finding, serious complaint, confirmed breach, or formal corrective action.

Others may provide earlier warning:

• repeated minor exceptions;
• increasing overdue tasks;
• inconsistent documentation;
• repeated retraining on the same issue;
• unresolved ownership;
• informal workarounds; or
• recurring questions from staff about the same process.

OIG notes that employee compliance questions can help identify potential risks and determine whether policy or process changes are needed. Its guidance also discusses using operational data and trends to identify potential risk areas.

The goal is not simply to count incidents. It is to determine whether different pieces of information are pointing toward the same weakening control.

A single documentation exception may be isolated. Ten similar exceptions across multiple staff members may suggest something else entirely.

That is where monitoring becomes useful to leadership: not just recording what happened, but recognizing what may be developing.

One of the easiest ways to create false compliance confidence is to equate a completed task with a resolved risk.

A corrective-action tracker may show that an item is closed. Leadership should still be able to answer:

• What problem was identified?
• Who owned the correction?
• What changed?
• Was the change actually implemented?
• Was implementation verified?
• Did the problem recur?

Administrative closure is not the same as risk resolution.

OIG’s guidance on corrective action emphasizes identifying root causes and taking steps designed to prevent recurrence. It specifically discusses policy or process changes and strengthening areas of vulnerability when noncompliance is identified.

That distinction matters operationally.

If a documentation issue is followed by retraining, but the same problem returns, leadership may need to look beyond staff education. The root cause could be the EHR template, workflow design, supervisory process, policy language, staffing model, or ownership structure.

Compliance risk does not change only when a regulation changes.

The organization itself changes.

New services, locations, acquisitions, payer relationships, vendors, staffing structures, technologies, EHR workflows, telehealth models, or operational processes can change how existing requirements must be carried out.

A control that worked for yesterday’s organization may not be adequate for today’s organization.

OIG’s General Compliance Program Guidance recommends watching for new risks between formal risk assessments, including legal and regulatory changes, enforcement developments, acquisitions, new strategies, and new organizational initiatives.

HIPAA provides a useful example. For organizations subject to the HIPAA Security Rule, HHS OCR states that security risk analysis should be an ongoing process and that the rule does not prescribe one universal frequency. OCR specifically points to developments such as new technology, ownership changes, turnover in key staff, and changing business operations as circumstances that can affect risk.

Behavioral health organizations also experienced a recent example with the updated 42 CFR Part 2 rule. HHS required persons subject to the regulation to comply with applicable requirements of the 2024 Final Rule by February 16, 2026.

For affected organizations, the leadership task was not simply knowing that the regulation changed; it was determining whether 42 CFR Part 2 operational controls were reflected in actual patient notices, consent and disclosure workflows, systems, staff practices, third-party processes, and oversight.

For any material operational or regulatory change, leaders should ask whether corresponding updates were needed to:

• policies;
• workflows;
• systems;
• training;
• communications;
• documentation;
• monitoring; or
• ownership.

Regulatory change tracking has limited value if the organization cannot demonstrate that the change reached daily operations.

More compliance data does not automatically create better oversight. A lengthy report can still leave leadership unable to answer the questions that matter.

Useful reporting should help executives identify:

• the most important current risks;
• emerging or recurring patterns;
• unresolved issues;
• overdue corrective actions;
• significant incidents;
• unclear ownership;
• relevant operational or regulatory changes;
• corrective-action status; and
• decisions that require leadership involvement.

For organizations with governing boards, OIG’s voluntary guidance recommends that boards receive and review information needed to understand compliance risk and that compliance leadership provide regular reporting about compliance activities and risks.

The exact report, dashboard, and cadence should reflect the organization and any requirements that apply to it. What matters is whether the information supports decisions.

A useful leadership report should help answer six questions:

1. What changed?
2. What matters?
3. Who owns it?
4. What action is underway?
5. Is the issue improving or recurring?
6. Does leadership need to intervene?

Reporting should also provide enough context to distinguish isolated events from persistent weaknesses.

That is what turns behavioral health compliance monitoring from an administrative activity into an executive management tool.

The strongest evidence of a functioning compliance program is not simply how many policies an organization possesses.

It is whether leadership can see how expectations are being carried out, monitored, corrected, and sustained during normal operations.

A deeper compliance review may be appropriate when leadership cannot confidently determine:

• who owns important responsibilities;
• whether policies match current workflows;
• why the same issues continue recurring;
• whether staff training is producing consistent practice;
• whether exceptions are being tracked;
• whether corrective actions are actually effective;
• whether organizational changes have created new risk; or
• whether compliance reporting provides enough information to make decisions.

The issue is not that every uncertainty automatically represents noncompliance.

The issue is that leadership cannot manage risk it cannot clearly see.

A structured HIPAA & Compliance Risk Assessment can help identify gaps in policies, oversight, training, documentation, monitoring, risk processes, and corrective-action priorities and translate those findings into a practical next-step roadmap. JLA's current assessment specifically evaluates those areas.

Request a Compliance Assessment Discussion when leadership needs a clearer view of where compliance controls are working, where operating gaps remain, and which issues deserve attention first.