Relevant to: Chief Compliance Officer | Chief Data Officer | Chief Quality Officer | Chief Medical Officer | VP, Revenue Cycle
Healthcare compliance programs have never been more sophisticated. Most large health systems operate mature regulatory frameworks: dedicated compliance officers, robust audit programs, third-party monitoring arrangements, and board-level oversight structures that would satisfy even the most demanding OIG reviewer. The investment in compliance infrastructure is real, and in most organizations, it is substantial.
And yet, regulatory exposure in healthcare is not decreasing. It is compounding. CMS audit activity is expanding. False Claims Act enforcement remains at historically elevated levels. State-level Medicaid integrity programs are becoming more data-sophisticated. Office for Civil Rights investigations into HIPAA violations are increasing in frequency and financial consequence. The Department of Justice continues to prioritize healthcare fraud as a civil and criminal enforcement area.
For executive leaders who have invested heavily in compliance programs, this trajectory raises a question that deserves direct examination: if the compliance infrastructure is sound, where is the exposure coming from?
In a growing number of health systems, the honest answer is the same: the data.
The Compliance-Data Gap That Most Organizations Have Not Closed
Traditional compliance program design is built around policies, procedures, training, and auditing. These are the components that OIG guidance has emphasized for decades, and health systems have responded accordingly. What has not kept pace is the recognition that in a modern healthcare enterprise, virtually every compliance obligation, including billing accuracy, quality reporting, HIPAA privacy, Stark Law compliance, and conditions of participation, is ultimately executed through data systems.
When those data systems contain errors, inconsistencies, or gaps, the compliance program built on top of them is compromised, regardless of how well the policy framework is designed.
This is the compliance-data gap: the structural disconnect between an organization’s formal compliance infrastructure and the underlying data quality and governance that determine whether compliance obligations are met in practice.
The enforcement record makes this concrete. In fiscal year 2023, DOJ recovered $2.68 billion from healthcare fraud enforcement, with the majority involving billing and coding irregularities traceable to data system failures rather than deliberate fraud (DOJ FY2023 False Claims Act Statistics). OCR resolved 56 HIPAA investigations in 2023 with cumulative settlements exceeding $20 million, with inadequate risk analysis and access control failures as the dominant findings (HHS OCR Annual Report, 2023). CMS imposed price transparency civil monetary penalties against 730 hospitals between 2022 and 2025, with the majority citing machine-readable file accuracy deficiencies rather than the absence of posting. OIG Work Plans for 2024 and 2025 each identified CDI data integrity and quality measure data reliability as priority audit targets.
This framework is distinct from the two established governance models that health systems already operate. The OIG’s seven-element compliance program — written standards, compliance officer designation, training, communication channels, monitoring and auditing, disciplinary standards, and response to detected problems — addresses organizational compliance infrastructure and remains essential. The DAMA-DMBOK data management framework addresses enterprise data governance across the full data lifecycle. The compliance-data governance framework presented here occupies the intersection of those two: it targets the specific data systems that execute regulatory obligations. Organizations with mature OIG-compliant programs and robust DAMA-aligned governance can still carry significant regulatory exposure if that intersection is unmanaged.
The Billing Accuracy Exposure That Lives in Charge Capture and Coding Data
False Claims Act liability is the most financially consequential compliance risk that most health systems carry. In fiscal year 2023 alone, DOJ recovered over $1.8 billion from healthcare-related False Claims Act settlements and judgments, the FCA-specific component of the $2.68 billion in total healthcare fraud recoveries reported in the DOJ FY2023 False Claims Act Statistics release; the difference reflects non-FCA enforcement actions, including criminal prosecutions and administrative exclusions. The pattern of cases that generate this exposure is consistent: billing for services not rendered, upcoding, unbundling, and failure to refund identified overpayments.
What the enforcement record also consistently reveals is that the root cause of most billing compliance failures is not fraudulent intent: it is data system dysfunction. Charge capture configuration errors that systematically generate incorrect codes. CDI workflows that produce documentation inconsistencies at scale. Revenue cycle systems that apply outdated payer rules because the data governance process for updating them has broken down. Overpayment identification processes fail because the analytics infrastructure for detecting them is inadequate.
For the Chief Compliance Officer, the question is not whether the compliance policy on accurate billing is well-drafted. It is whether the data systems that execute billing are generating output that the policy can govern.
AI-assisted coding and CDI tools compound this risk in ways most compliance programs have not formally addressed. When AI coding assistants generate charge recommendations from incomplete or inconsistent clinical documentation, the compliance exposure is not contained to a single miscoded claim. It is systematically replicated across every encounter the model processes. The DOJ has signaled its intent to apply the False Claims Act to AI-influenced billing outputs where organizations failed to implement adequate validation controls, most directly through the DOJ’s 2023 Artificial Intelligence and the False Claims Act guidance memorandum and Deputy Attorney General Lisa Monaco’s October 2023 remarks on AI governance and corporate compliance programs, which identified AI-generated billing outputs as an area of active prosecutorial interest when adequate human oversight and validation controls are absent. An AI tool operating on poor-quality source data does not reduce billing compliance risk. It scales it.
A compliance program cannot audit its way out of a systematic data quality problem. When the underlying charge and coding data are unreliable, sampling-based audit approaches miss patterns of exposure that only become visible through enterprise-level data analysis.
Quality Reporting Obligations and the Data Integrity Risk
Health systems are subject to an expanding array of mandatory quality reporting obligations: CMS inpatient and outpatient quality measures, HEDIS performance metrics for value-based contracts, The Joint Commission accreditation standards, state-level public reporting requirements, and increasingly, quality metrics embedded in commercial payer contracts that carry direct financial consequences.
Every one of these obligations depends on the accuracy and completeness of the underlying clinical data. When EHR documentation is incomplete, when diagnosis and procedure coding do not accurately reflect clinical severity, when patient attribution logic is inconsistent, the quality metrics produced from that data are unreliable, and the organization is submitting reports that may not accurately reflect its actual performance.
The regulatory exposure here operates in two directions. Underreported quality performance creates financial penalties under value-based payment programs. Overreported quality performance, specifically submitting metrics that overstate clinical outcomes, creates False Claims Act exposure under the theory that inflated quality data supports fraudulent claims for quality-based payment bonuses.
For the Chief Quality Officer and Chief Medical Officer, this means that quality improvement and data governance are not parallel workstreams. They are the same workstream. You cannot improve what you are not measuring accurately, and you cannot meet your regulatory reporting obligations on data you cannot trust.
AI-driven quality analytics tools introduce a specific compounding risk here. Health systems increasingly use machine learning models to generate quality measure calculations, flag documentation gaps, and predict value-based incentive performance. When those models are trained on or operate against historically incomplete or miscoded clinical data, their outputs carry forward the underlying data quality failure, and may do so invisibly, appearing as authoritative calculations while systematically misrepresenting performance. For the Chief Quality Officer evaluating AI-assisted quality programs, model input data quality is not a technical prerequisite. It is a compliance prerequisite.
HIPAA Privacy and Security: The Data Governance Obligation That Enforcement Is Catching Up To
HIPAA compliance has traditionally been managed as a privacy policy and security controls program: notice of privacy practices, business associate agreements, access controls, and workforce training. These remain necessary components of an adequate HIPAA program.
What is changing is OCR’s enforcement focus. Recent enforcement actions and resolution agreements reveal a shift toward examining the data governance infrastructure that underlies HIPAA compliance, specifically whether organizations have adequate visibility into where protected health information lives, how it flows across systems and third parties, and whether access controls are enforced in practice.
For health systems that have grown through M&A, the challenge is acute. Acquired entities bring their own data environments, their own system landscapes, and their own histories of PHI management that the acquiring organization may have limited visibility into. When OCR investigates, it investigates the enterprise, not just the originating entity.
The Chief Data Officer and Chief Compliance Officer need a shared answer to a question that OCR is increasingly likely to ask: where is your PHI, who has access to it, and how do you know?
The emergence of ambient AI documentation tools has added a new and underappreciated dimension to this challenge. In April 2026, a class-action lawsuit, Washington et al v. Sutter Health, was filed in the U.S. District Court for the Northern District of California, alleging that two healthcare organizations used ambient AI-based tools to record and transmit patient audio conversations without prior consent. The complaint claims that highly sensitive medical information was wrongfully captured and shared through a third-party AI platform, violating California consumer privacy laws and the federal Wiretap Act. Notably, the AI vendor had executed business associate agreements with its health system clients, yet the litigation proceeded on state law and wiretap grounds, illustrating that HIPAA-compliant contracting is necessary but not sufficient when deploying AI tools that capture protected conversations. As of 2026, eleven U.S. states require all-party consent before recording a conversation, a requirement that applies equally to ambient AI scribes. Health systems deploying these tools must ensure that patient consent workflows are robust, documented, and enforced at the point of care, not just addressed in vendor contracts.
Stark Law and Anti-Kickback: The Arrangements That Live in Your Data Systems
Physician compensation compliance under the Stark Law and Anti-Kickback Statute is one of the most structurally complex regulatory obligations a health system manages. The legal framework is demanding. The documentation requirements are extensive. And the financial exposure for non-compliant arrangements, which can include False Claims Act liability, exclusion from federal programs, and substantial civil monetary penalties, is among the most severe in healthcare regulation.
What is underappreciated in most health system compliance programs is the degree to which Stark Law compliance depends on data accuracy and data governance.
Fair market value analyses for physician compensation arrangements depend on reliable productivity data: wRVU counts, call coverage logs, and directorship hours. When the data systems that generate this information are unreliable, fair market value documentation is compromised, and the compensation arrangements built on that documentation are exposed. When physician productivity tracking systems are inconsistent across entities in a multi-hospital system, compensation decisions may diverge from documented FMV thresholds without anyone realizing it.
For the Chief Legal Officer managing Stark compliance, the audit question is not just whether compensation agreements are properly documented. It is whether the underlying data that those agreements are based on is accurate, consistently generated, and subject to governance controls that would survive regulatory scrutiny.
AI-assisted physician scheduling, productivity tracking, and compensation modeling tools are now widely deployed in health systems, and each introduces a Stark compliance data integrity risk. When AI-generated wRVU summaries or call coverage logs feed directly into compensation calculations without a human review and validation step, the organization may be building fair market value documentation on outputs it cannot fully audit or explain. In a Stark Law enforcement context, “the algorithm calculated it” is not a governance defense. The compliance program must demonstrate how the underlying productivity data was generated, validated, and reconciled against compensation thresholds, regardless of whether AI was involved in the calculation.
The Conditions of Participation Risk That Boards Are Not Discussing
Medicare and Medicaid Conditions of Participation represent the foundational regulatory requirements for health system participation in federal programs. CoP surveys, whether conducted by CMS directly or through accrediting organizations, assess compliance with an extensive set of clinical and operational standards. Deficiencies at the level of Immediate Jeopardy carry consequences that extend from directed plans of correction to termination from the Medicare program, an outcome that no health system board has adequately modeled as a going-concern risk.
What has changed in recent years is the degree to which CoP survey findings are driven by data. Surveyors are increasingly sophisticated in their use of administrative data, quality metrics, and documentation review to identify patterns of non-compliance that might not surface through observation and interview alone. Health systems whose clinical documentation is incomplete, whose quality tracking systems are unreliable, or whose incident reporting data is not being acted upon are creating a data trail that surveyor methodology is increasingly designed to find.
The enforcement pressure is intensifying at the federal level as well. In April 2026, CMS Administrator Mehmet Oz announced that CMS would require all states to submit, within 30 days, a plan outlining how they would verify that Medicaid providers are real, licensed, and delivering care, particularly in areas flagged as high-risk for fraud. This directive signals a significant expansion of Medicaid program integrity activity that will affect every health system participating in state Medicaid programs. For organizations with complex Medicaid billing profiles, multi-site delivery structures, or provider enrollment practices that have not been recently audited, this development warrants immediate attention from the Chief Compliance Officer and VP of Revenue Cycle.
The Conditions of Participation obligation is not just a clinical operations requirement. It is a data quality requirement. The documentation that surveyors review is data, and its accuracy, completeness, and consistency determine what surveyors find.
What a Compliance-Grade Data Governance Program Actually Looks Like
Closing the compliance-data gap does not require building a new compliance program or replacing existing technology infrastructure. It requires integrating data quality and governance into the compliance framework that already exists, specifically by extending compliance program oversight to the data systems that execute compliance obligations.
In practice, this means four things:
Data quality metrics as compliance KPIs
The compliance program’s monitoring and auditing function should include data quality indicators for the systems that generate compliance-sensitive outputs: charge and coding data quality, clinical documentation completeness rates, quality measure data reliability, and PHI inventory accuracy. These are not IT metrics. They are compliance metrics, and they belong in the compliance dashboard presented to the board.
Data ownership aligned with compliance accountability
For each data domain that carries regulatory significance, there should be a named data steward with compliance accountability, not just technical ownership. The person responsible for the accuracy of physician productivity data should be identifiable, accessible, and accountable when that data is used to support a Stark compliance analysis.
