Services
Healthcare Compliance Consulting for Practices
Healthcare compliance consulting builds the program federal guidance describes in seven elements, from written policies to corrective action. OIG's guidance asks even individual and small-group physician practices to assess their compliance risks and run at least one audit every year. We develop, implement and update that program with you.
The short answer
What does healthcare compliance consulting include?
A compliance program on OIG’s seven elements, kept on a calendar: screen staff against exclusion lists monthly; review policies, train staff, assess risks and audit at least once a year; and report and return a Medicare or Medicaid overpayment within 60 days of identification. The Advixor Group develops, implements and updates that program with you, and conducts internal compliance reviews, mock surveys and risk assessments.
SourcesOIG compliance guidance (Nov 2023)OIG exclusion list42 CFR 401.305
Seven Elements
What healthcare compliance consulting builds: OIG’s seven elements
OIG’s November 2023 guidance adapts each element for small practices.
- Written policies and procedures fitted to your risks, including an exclusion-screening policy: who screens, how a possible match is verified, what happens on a match.
- Leadership and oversight: a compliance contact with no legal duties and, where possible, no part in billing, coding or claims, reporting to the owner.
- Training and education at hire, with periodic reminders; licensed staff also complete what their board requires.
- Lines of communication: an open-door policy, an anonymous route such as a drop box, no retaliation, and the OIG Hotline posted where anonymity isn’t possible.
- Enforcing standards: discipline rules set before any violation and applied alike at every level.
- Risk assessment, auditing and monitoring: the yearly cycle below.
- Responding to detected offenses: one named person decides whether a violation exists and the fix: a corrective action plan, repayment, a report to the agency or a disclosure to OIG.
“OIG’s longstanding belief is that an entity’s leadership should commit to implementing all seven elements to achieve a successful compliance program.”
Calendar and Records
Your compliance management system: the calendar and the records
| Task | How often or how fast | Rule |
|---|---|---|
| Screen staff, contractors and vendors against OIG’s LEIE and state Medicaid exclusion lists | Monthly | OIG p. 58 |
| Florida Medicaid providers: add SAM and AHCA’s final-order database | Monthly; report a hit at once | Agreement (5)(r) |
| Check licenses and certifications | Regularly | OIG p. 58 |
| Compliance contact reports to the owner | At least quarterly | OIG p. 65 |
| Review policies and procedures | At least yearly | OIG p. 36 |
| Train staff, contractors and medical staff | At least yearly; new staff at hire | OIG pp. 46, 66 |
| Risk assessment; audit | At least once a year each | OIG pp. 68–69 |
| Report credible evidence of misconduct | 60 days from that finding | OIG p. 61 |
| Report and return a Medicare or Medicaid overpayment | 60 days from identification | 42 CFR 401.305; OIG p. 63 |
| Tell AHCA of a Medicare suspension or disenrollment | 5 business days | Agreement (5)(q) |
| Report and refund Florida Medicaid money paid in error or in excess | 90 days from receipt | Agreement (5)(g) |
Sources HHS-OIG compliance guidance (Nov 2023); 42 CFR 401.305; Florida Medicaid Non-Institutional Provider Agreement (Dec 2023).
Which deadline governs a given refund (60 days from identification or the agreement’s 90 days from receipt) is a question for your attorney.
Keep proof of each task for an auditor:
- Screening: your screening records, plus a contractor’s if it screens for you; OIG says you stay responsible for any overpayment or penalty either way.
- Disclosure log: each concern, however it arrived: date received, reviewer, findings, corrective action, policy changes, date resolved and any referral to authorities.
- Investigation file: the allegation, the steps taken, interview notes, key documents, a witness log, the result and any discipline.
We help maintain these records, including training records, competency validations and audit records.
Yearly Cycle
The annual compliance risk assessment and audit
Start with your own claim denials, medical-necessity challenges and patient-safety data such as falls and complaints, then OIG’s Work Plan and the risk areas it names: billing, coding, sales, marketing, quality of care, patient incentives and arrangements with referral sources.
- The audit samples what the assessment ranks highest. Internal or external auditors with health care expertise can run it, with medical-necessity review by an appropriately credentialed clinician.
- Fixes mean repaying overpayments, changing a process or retraining staff; for a possible systemic issue, OIG says to consider an expanded audit or outside help.
- Between assessments, watch for shifts in claim rejections, high-level survey findings, illogical or atypical ordering patterns and unusual code use.
HIPAA adds a required security risk analysis (45 CFR 164.308(a)(1)(ii)(A); see HIPAA risk assessment). We conduct internal compliance reviews, mock surveys and risk assessments to find what needs corrective action.
Overpayments
Medicare compliance: reporting and returning an overpayment
Under 42 CFR 401.305, amended effective January 1, 2025, you have identified an overpayment once you “knowingly” receive or retain it, in the False Claims Act’s sense: actual knowledge, deliberate ignorance or reckless disregard (31 U.S.C. 3729(b)(1)(A)), with no proof of specific intent to defraud required ((b)(1)(B)). The deadline is the later of 60 days after identification or the cost report’s due date. It pauses for up to 180 days during a timely, good-faith investigation of related overpayments, and from the moment OIG’s or CMS’s self-disclosure protocol acknowledges your submission or you request an extended repayment schedule. Money kept past the deadline becomes a False Claims Act “obligation,” and the rule covers overpayments identified within 6 years of receipt.
OIG’s Self-Disclosure Protocol, reissued October 15, 2026, applies at least a 1.5 multiplier to what the programs paid, sets a $20,000 minimum settlement ($100,000 for kickbacks) and presumes no integrity agreement; findings are due 90 days after the first submission. Whether and where to disclose is your attorney’s call.
Penalties
Healthcare regulatory compliance: what a violation costs per claim
The civil money penalty law adds up to 3 times the amount claimed or, for an excluded person whose work isn’t billed separately, 3 times what employing them cost you in salary, benefits and taxes (42 CFR 1003.210(b)); the False Claims Act adds 3 times the damages.
In Florida, s. 409.913(15)(e) lists breaking the Medicaid provider agreement among the grounds for sanctions, and Rule 59G-9.070(7)(e) sets $1,000, $2,500 and $5,000 per claim for a first, second and third or later offense. Those fines are capped, offense by offense, at 20%, 40% and 50% of any overpayment the violations produced; without one, at $20,000 and $50,000 for a first and second offense, with no cap after that (Rule 59G-9.070(4)).
OIG’s October 9, 2026 exclusion list holds 84,093 exclusions, 9,146 (10.9%) with a Florida address: 2,126 in Miami and 296 in Hialeah.
Sources 45 CFR 102.3, Table 1 (2025 amounts, kept for 2026 under OMB memo M-26-11); 28 CFR 85.5.
Our Services
Regulatory compliance consulting: what our healthcare compliance services cover
We provide compliance consulting and coordination, not legal advice: contract, entity and “is this allowed” questions go to your own attorney.
Healthcare compliance services
We give guidance on the federal, state, local, payer and licensing rules your practice answers to, and we:
- Develop and update policies, procedures, the compliance program and patient documents: consents, intake forms, acknowledgments and notices
- Develop and coordinate staff training, from HIPAA, OSHA and fraud, waste and abuse to infection control and patient rights (compliance training)
- Prepare you for accreditation surveys and coordinate them (accreditation)
- Help with inspections, audits, investigations and corrective action plans (audit readiness, documentation audits)
- Guide you on digital compliance: communications, CMS requirements, accessibility and advertising rules (marketing compliance)
- Develop staff standards of conduct and guide corrective action (HR and staff training)
- Track changes in regulations, accreditation standards and payer rules, and tell you what to update
In this section
HIPAA compliance
HIPAA compliance services for medical and mental health practices: policies, patient notices, staff training, compliance reviews and rule updates.
Learn moreAccreditation
Accreditation consulting for Joint Commission, CARF, AAAHC and ACHC: readiness reviews, mock surveys and plans of correction.
Learn moreCompliance training
Healthcare compliance training: HIPAA, OSHA bloodborne pathogens and hazard communication, and fraud, waste and abuse, with records.
Learn moreMarketing compliance
Healthcare advertising and website compliance: HIPAA marketing rules, testimonials, tracking pixels, Florida ad rules and the 2027 accessibility dates.
Learn moreAudit readiness
CMS audit readiness for Medicare and Medicaid: who audits Florida practices, the 45- and 30-day records windows, RAC, UPIC and TPE, and what follows.
Learn moreQuick answers
Healthcare compliance consulting: what practice owners ask
Voluntary guidance, template plans, exclusion screening, Florida regulators and who answers for compliance. Raise anything else in a consultation.
Why does healthcare compliance matter if OIG's guidance is voluntary?
Can we use a template compliance plan?
How do I screen staff for Medicare and Medicaid exclusions?
Who regulates healthcare compliance for a Florida practice?
Who is responsible for compliance in a medical practice?
Talk to an advisor
You care for patients. Who’s taking care of the business?
Tell us where your practice is today. We will tell you what we would do first.
Official sources
All read Oct 17 to 19, 2026.
- HHS-OIG: General Compliance Program Guidance (Nov 2023), Self-Disclosure Protocol (Oct 15, 2026) and the exclusion list file of Oct 9, 2026
- eCFR, current as of Oct 15, 2026: 42 CFR 401.305, 42 CFR 1003.210, 45 CFR 102.3, 45 CFR 164.308, 28 CFR 85.5; 31 U.S.C. 3729
- OMB memo M-26-11 (Apr 17, 2026); DOJ, False Claims Act statistics, fiscal year 2025 (Jan 16, 2026)
- Florida: Medicaid Non-Institutional Provider Agreement (Dec 2023), s. 409.913 (2026) and Rule 59G-9.070