Countdown to Compliance Week: Foundations of an Effective Compliance Program

The Community Health Center (CHC) Team at Powers Law is gearing up for Corporate Compliance & Ethics Week, November 1-7, 2026. We’ve got lots planned for that week, including our Compliance Program Essentials Workshop, our brand-new Compliance Program Workshop for New York Health Centers, and a few announcements that we know many of you have been waiting for…

To count down, we’re answering the questions we hear most often from health center Compliance Officers in a three-part series.  Today we’ll start with the foundation of an effective Compliance Program.

While there is no single federal rule that requires health centers to have a formal Compliance Program, several requirements health centers already follow align with the core Compliance Program elements, including:

• Medicaid: Under the Deficit Reduction Act of 2005, an entity that receives at least $5 million a year in Medicaid payments must maintain written policies educating its workforce about the False Claims Act and whistleblower protections. Some states, like New York, go further and require Medicaid providers to maintain full Compliance Programs and still others include requirements in payer contracts that align with the core Compliance Program elements, such as requiring Standards of Conduct or training on fraud, waste and abuse.
  
  
• HRSA: Many of the HRSA requirements align with the elements of a Compliance Program, including the requirements related to board oversight, conflict-of-interest standards, financial management and internal controls.
  
  
• OIG: While the HHS Office of Inspector General's General Compliance Program Guidance (GCPG) is voluntary, it sets the expectations that enforcement agencies use to judge whether an organization took compliance seriously.

Given the above, and the very many real compliance risks for health centers, implementing a Compliance Program is essential. 

The OIG's view is clear: the Compliance Officer should report directly to the CEO and have direct access to the board. The OIG also cautions against placing the Compliance Officer under, or combining the role with, the general counsel or the CFO, because those functions can pull in a different direction from compliance.

The OIG’s recommendation can be hard to achieve at a health center with a lean leadership team. Many Compliance Officers also serve as risk manager, privacy officer, HR director, or quality lead. Some dual roles are workable; others are not.

• Usually workable: Compliance plus privacy officer, risk management or grants management. Management should ensure the person has the time and budget to perform each role.
  
  
• Higher risk: Compliance combined with billing, revenue cycle, or finance leadership, given the Compliance Officer could end up auditing their own work or department.

In our experience, most health centers strive to meet the OIG’s expectations, working within the structure and resources they have. Health centers should document why the structure fits their size, what safeguards are in place, and how concerns are escalated.

The board has a fiduciary duty to oversee the Compliance Program. The OIG expects board members to be informed enough to ask hard questions. Given health center board members come from a variety of backgrounds, many Compliance Officers have to first teach board members about health center compliance risks so they can then ask the hard questions.

Compliance reports to the Board should contain:

• Program status, including progress against the annual compliance work plan and any changes to it. Compliance Officers might partner with HR and provide an update on compliance training completion rates or describe a new or revised policy developed in partnership with Operations.
  
  
• Risk assessment results, including the top risks identified and how the health center is responding. If responding to a risk requires additional resources, such as hiring an outside auditor, the Compliance Officer can explain the need directly to the board who approves the health center’s budget.
  
  
• Audits and monitoring, including explaining what is on the auditing plan, any findings, and what was corrected, including any repayments.
  
  
• Hotline and investigation details, including the volume and themes of reports (without names) and how matters were resolved. The Compliance Officer might describe how any increase in reports after a recent HIPAA training is a sign that employees took the training seriously, not that there are new compliance issues.
  
  
• Regulatory changes, including an overview of new HRSA, CMS, OIG, or state requirements that affect the health center. These reports can be co-led, with the Compliance Officer presenting the details of the regulatory change and the appropriate member of senior management describing how the health center is responding.

Compliance should be on the board calendar, not just on the agenda when something goes wrong. A standing report at least quarterly, plus annual board compliance training, builds a record that the board exercised oversight. Make sure the minutes reflect it.

Next week, we'll take on the risk-area questions we hear most, including how the Health Center Program Scope Manual finalized by HRSA in August 2026 changes what Compliance Officers should be watching.

For guidance on your health center's specific situation, contact a member of the Powers team.