OIG Compliance Program Checklist: How to Evaluate a Healthcare Compliance Program

They fail because policies are outdated, responsibilities are unclear, employees do not report concerns, audits do not address the highest risks, or corrective actions remain open long after a problem is identified.

The U.S. Department of Health and Human Services Office of Inspector General provides a framework that healthcare organizations can use to assess these weaknesses.

OIG’s General Compliance Program Guidance, or GCPG, applies broadly to individuals and entities participating in the healthcare industry. It covers major Federal fraud and abuse laws, the seven elements of a compliance program, adaptations for small and large organizations, and additional considerations such as quality, patient safety, ownership, and financial incentives. OIG describes the guidance as voluntary and nonbinding rather than a mandatory certification standard.

This article converts that guidance into a practical OIG compliance program checklist that compliance officers, healthcare executives, boards, legal teams, auditors, and department leaders can use to evaluate whether their program operates effectively.

The checklist is not an official OIG assessment and does not guarantee compliance with Federal or State law. It is an operational tool for identifying gaps, collecting evidence, assigning corrective actions, and improving oversight.

What is an OIG compliance program?

An OIG-aligned compliance program is a structured system for preventing, detecting, investigating, and correcting violations of healthcare laws, regulations, program requirements, and organizational policies.

The program should address the organization’s actual operations and risks. A hospital, physician group, nursing facility, laboratory, health plan, pharmaceutical manufacturer, behavioral health provider, and medical equipment supplier will not have identical risk profiles.

OIG’s General Compliance Program Guidance is therefore not presented as a single model that every organization should copy. OIG states that its guidance is not one-size-fits-all or all-inclusive. Organizations are expected to adapt the guidance to their size, resources, services, structure, and interaction with Federal healthcare programs.

Healthcare organizations should also review any applicable Industry Segment-Specific Compliance Program Guidance, known as an ICPG. As of July 2026, OIG has issued current ICPGs for nursing facilities and Medicare Advantage. Its public guidance page lists hospital, clinical laboratory, pharmaceutical manufacturer, and hospice guidance as forthcoming.

Why an OIG compliance program checklist matters

A written program can create a false sense of security.

An organization may have a code of conduct, hotline, annual training course, and compliance committee but still be unable to answer basic operational questions:

• Which compliance risks are currently highest?
• Which controls address those risks?
• When were the controls last tested?
• Who reviews high-risk financial arrangements?
• How quickly are concerns investigated?
• Are excluded individuals and entities being identified?
• Does the board receive useful compliance information?
• Are corrective actions validated before closure?
• How are quality and patient safety risks connected to compliance?
• Can the organization prove that employees understand their responsibilities?

A checklist helps move the assessment from general assurances to verifiable evidence.

For each requirement, the organization should document:

• Current status
• Responsible owner
• Supporting evidence
• Identified gap
• Required corrective action
• Target completion date
• Escalation requirements
• Validation and closure approval

The value of the assessment comes from the actions taken after weaknesses are identified, not from producing a high score.

Federal healthcare laws the program should address

The exact legal requirements will depend on the organization, but healthcare compliance programs commonly address several major Federal fraud and abuse laws.

OIG identifies five particularly important laws in its physician education materials:

1. The False Claims Act
2. The Federal Anti-Kickback Statute
3. The Physician Self-Referral Law, commonly called the Stark Law
4. Federal exclusion authorities
5. The Civil Monetary Penalties Law

Violations can result in repayment obligations, civil penalties, criminal consequences, exclusion from Federal healthcare programs, and other enforcement actions.

Healthcare organizations may also need to address HIPAA, Medicare and Medicaid billing requirements, licensing rules, quality standards, contractual obligations, State fraud and abuse laws, and industry-specific requirements.

An effective compliance program does not merely list these authorities. It converts them into operational policies, controls, approvals, training, monitoring, and reporting requirements.

The Seven Elements of an OIG Compliance Program

OIG’s current General Compliance Program Guidance organizes compliance program infrastructure around seven elements. OIG states that leadership should commit to implementing all seven elements for a successful program.

Element 1: Written policies and procedures

Written policies and procedures establish the organization’s compliance expectations and explain how employees, contractors, medical staff, managers, and other relevant individuals should perform their responsibilities.

OIG recommends that healthcare entities maintain both a code of conduct and detailed compliance policies.

The code of conduct should communicate the organization’s ethical standards, commitment to legal compliance, reporting expectations, and responsibilities of individuals working for or on behalf of the organization.

Detailed policies should address both:

• How the compliance program operates
• How the organization reduces specific legal and regulatory risks

Depending on the organization, policies may cover billing, coding, documentation, marketing, patient incentives, quality of care, physician arrangements, vendor relationships, referral sources, privacy, exclusions, overpayments, conflicts of interest, and record retention.

OIG recommends that organizations review policies and procedures at least annually and update them when laws, program rules, risks, or operational processes change. Policies should be accessible, understandable, and translated where appropriate.

A policy is not effective simply because it has been approved. The organization should be able to show that the policy was distributed, communicated, implemented, reviewed, and connected to the relevant workflow or control.

Element 2: Compliance leadership and oversight

An effective compliance program requires a qualified compliance officer, an active compliance committee, engaged senior leadership, and informed board oversight.

The compliance officer should have sufficient authority, independence, resources, and access to information. OIG cautions against assigning the compliance officer responsibilities that create conflicts, including direct responsibility for billing, coding, claims submission, or the delivery of healthcare services.

The officer should be able to review relevant documents and data, conduct or oversee investigations, communicate with executives, and access the board without interference.

The compliance committee should support the compliance officer by reviewing risks, coordinating resources, overseeing the compliance work plan, evaluating corrective actions, and assessing program performance. OIG recommends that the committee meet at least quarterly.

Board oversight should go beyond receiving a yearly presentation. OIG recommends that the board meet with the compliance officer regularly and no less than quarterly. The board should also reserve time for discussions with the compliance officer without non-board management present.

Useful board reporting may include:

• Changes in the compliance risk profile
• Hotline and investigation trends
• High-risk audit findings
• Overpayments and repayments
• Exclusion-screening results
• Open corrective actions
• Quality and patient safety concerns
• Regulatory changes
• Compliance staffing and resource limitations
• Significant third-party or financial-arrangement risks

Element 3: Training and education

Training should help people recognize risks and apply compliance requirements in their daily work.

OIG recommends an annual training plan that identifies the topics, audiences, timing, and delivery methods appropriate for the organization. All board members, officers, employees, contractors, and medical staff, where applicable, should receive compliance program and risk training at least annually.

General training may cover:

• The code of conduct
• Reporting channels
• Nonretaliation
• Federal and State fraud and abuse laws
• Individual compliance responsibilities
• Consequences of noncompliance

Role-specific training should address the risks employees encounter in their work.

For example:

• Billing teams need detailed coding, documentation, and claim-submission training.
• Physicians may need training on medical necessity, documentation, referrals, and financial relationships.
• Sales and marketing teams may need guidance on patient inducements and promotional activity.
• Procurement teams may need training on vendor due diligence and conflicts of interest.
• Managers need training on escalation, retaliation prevention, and disciplinary responsibilities.

Completion records alone do not show that training worked. Organizations should consider knowledge assessments, employee surveys, monitoring results, audit findings, reporting patterns, and observed behavior.

Element 4: Effective lines of communication and disclosure programs

Employees and other relevant individuals should have reliable ways to ask questions and report concerns.

At least one reporting route should be independent of operational management and permit anonymous reporting. Employees should understand that they can report suspected misconduct without retaliation.

Reporting options may include:

• Compliance hotline
• Online reporting portal
• Dedicated email address
• Direct access to the compliance officer
• Manager escalation
• Written reporting channel

The organization should track each concern from receipt through closure. The process should document triage, severity, investigator, actions taken, supporting evidence, outcome, disciplinary measures, corrective actions, and reporting obligations.

A low number of reports does not always mean the program is effective. It may indicate that employees do not know how to report, do not trust the process, or fear retaliation.

Compliance teams should assess reporting-channel awareness, employee confidence, response time, closure time, substantiation rates, retaliation allegations, repeat issues, and trends by department or location.

Element 5: Enforcing standards through consequences and incentives

Standards should be applied consistently.

OIG’s guidance addresses both consequences for noncompliance and incentives for compliant behavior.

Disciplinary measures should reflect the seriousness of the conduct and should apply across employment levels. Managers may also need to be held accountable when poor supervision, ignored warning signs, or failure to enforce controls contributes to a violation.

The organization should document:

• Types of disciplinary action
• Decision-makers involved
• Factors considered
• Treatment of similar cases
• Manager accountability
• Escalation and approval
• Records supporting the decision

Organizations should also consider positive incentives. Compliance can be reflected in performance evaluations, promotions, recognition, compensation, and leadership goals.

OIG notes that performance incentives should be reviewed for unintended consequences. Financial or productivity targets can create pressure to falsify documents, ignore quality concerns, or pursue arrangements that create fraud and abuse risk.

Element 6: Risk assessment, auditing, and monitoring

Risk assessment identifies where the organization is most exposed. Auditing tests selected activities. Monitoring provides recurring oversight of operations and controls.

OIG recommends that entities conduct a formal compliance risk assessment at least annually. The assessment should draw on internal and external information, evaluate identified risks, prioritize them, and influence the compliance work plan.

Risk sources may include:

• Regulatory changes
• OIG Work Plan items
• Government enforcement actions
• Internal audit findings
• Hotline reports
• Billing and coding data
• Overpayment records
• Quality events
• Patient complaints
• Employee surveys
• Business expansion
• New technology
• New service lines
• Acquisitions
• Third-party arrangements

The annual compliance work plan should then direct resources toward the highest-priority risks.

Audits should define the scope, population, sample, methodology, reviewers, findings, and required actions. Where possible, auditors should be independent of the activity being reviewed.

Monitoring may include recurring claim reviews, exclusion screening, policy review tracking, training compliance, contract monitoring, quality indicators, investigation aging, and corrective-action status.

OIG also recommends periodically assessing the effectiveness of the compliance program itself, including how well each of the seven elements operates.

Element 7: Responding to offenses and corrective action

Even a well-designed compliance program will identify problems.

The question is whether the organization investigates and corrects them quickly, consistently, and effectively.

When potential noncompliance is identified, the organization should:

1. Protect relevant records.
2. Conduct an appropriate investigation.
3. Determine the scope and cause.
4. Stop ongoing misconduct.
5. Calculate potential financial impact.
6. Obtain legal advice where necessary.
7. Make required repayments or disclosures.
8. Apply appropriate discipline.
9. Correct the failed process or control.
10. Test whether the corrective action worked.

OIG recognizes that compliance officers will receive audit findings, monitoring results, and reports that require investigation. If a compliance program produces no concerning information over time, OIG suggests that the organization assess whether the program is truly detecting problems.

Corrective actions should not be closed merely because a new policy was issued or an employee completed training.

Closure evidence may include:

• Revised controls
• Updated system settings
• Repayment confirmation
• Completed disciplinary action
• Follow-up testing
• Improved monitoring results
• Approval from compliance or internal audit
• Evidence that similar risks were reviewed elsewhere

Compliance considerations beyond the seven elements

Quality of care and patient safety

OIG states that healthcare organizations should incorporate quality and patient safety oversight into their compliance programs.

Poor quality can create patient harm, overpayments, medically unnecessary services, and potential False Claims Act exposure. OIG recommends regular board and compliance committee reporting on quality controls, patient safety, staffing, root-cause analysis, and corrective-action effectiveness.

Compliance should work closely with clinical leadership, quality teams, risk management, patient safety, and internal audit.

Warning signs may include:

• Repeated adverse events
• Inadequate staffing
• Failure to follow care plans
• High complaint levels
• Unnecessary services
• Services not provided as documented
• Weak incident reporting
• Repeated survey findings
• Corrective actions that do not reduce recurrence

Excluded individuals and entities

Organizations participating in Federal healthcare programs should have procedures for screening employees, contractors, vendors, medical staff, and other applicable parties against exclusion data.

Screening should occur before engagement and periodically afterward. Organizations should document the searches performed, matches reviewed, resolution of possible matches, and actions taken when an excluded party is identified.

Delegating screening to a third party does not eliminate the healthcare organization’s responsibility for the result. OIG’s guidance warns that entities may remain responsible for liability arising from excluded individuals or entities.

New services, technology, and ownership structures

New healthcare entrants may be unfamiliar with the restrictions that apply to healthcare arrangements. Practices that are common in other industries can create criminal, civil, or administrative risk in healthcare.

OIG advises new entrants and organizations entering new lines of business to understand applicable fraud and abuse requirements and build effective compliance programs.

OIG also emphasizes reviewing how money moves through healthcare arrangements. Ownership structures, private investment, compensation models, productivity targets, and payment incentives should be assessed for their effect on referrals, service utilization, patient care, and compliance decisions.

Final takeaway

An OIG-aligned compliance program is not defined by the number of policies an organization has.

It is defined by whether the organization can identify its risks, assign accountability, communicate expectations, detect problems, investigate concerns, correct failures, and demonstrate that those actions work.

The most useful question is not:

“Do we have a compliance program?” It is:

“Can we prove that our compliance program prevents, detects, and corrects the risks that matter most?”

Organizations that use the OIG compliance program checklist as an ongoing management tool, rather than a once-a-year documentation exercise, will be better prepared to identify weaknesses before they result in patient harm, repayment obligations, enforcement actions, or damage to organizational trust.

This article and checklist are provided for general informational purposes. They are not legal advice, an official OIG checklist, or a substitute for guidance from qualified healthcare counsel.

Start your 21-day free trial and experience how VComply helps you with your policy management and compliance maturity.

OIG Compliance Program Assessment Checklist

Use the following scoring scale for each item:

• 0: Not established
• 1: Partially established
• 2: Implemented but inconsistently followed
• 3: Implemented, documented, tested, and effective
• N/A: Not applicable based on documented risk

Every item scored 0, 1, or 2 should have an assigned owner, corrective action, due date, and required closure evidence.

1. Written policies and procedures

• The organization maintains a current code of conduct.

• Senior leadership and the board formally support the code.

• Compliance policies address the organization’s identified risk areas.

• Every policy has a named owner and approver.

• Policies include effective dates, review dates, and version histories.

• Policies are reviewed at least annually.

• Employees can easily locate current policies.

• Policies are available in appropriate languages and reading levels.

• Policy changes are communicated before related processes are implemented.

• Relevant employees and contractors complete required attestations.

• Policy exceptions are documented, approved, time-limited, and reviewed.

• The organization maintains procedures for screening excluded individuals and entities.

2. Compliance leadership and oversight

• A qualified compliance officer has been formally appointed.

• The compliance officer has sufficient authority and independence.

• The compliance officer does not own conflicting operational functions.

• Compliance has access to relevant records, systems, employees, and data.

• The compliance officer can communicate directly with the board.

• A multidisciplinary compliance committee is active.

• The compliance committee meets at least quarterly.

• Committee decisions, attendance, and actions are documented.

• The board meets with the compliance officer at least quarterly.

• The board holds private executive sessions with the compliance officer.

• The board reviews compliance staffing, budget, technology, and independence.

• Material compliance risks are escalated through defined channels.

3. Training and education

• The organization maintains an annual compliance training plan.

• Board members receive compliance and oversight training.

• Employees, contractors, officers, and medical staff receive annual training.

• Training is tailored to role-specific risks.

• Training addresses fraud and abuse laws relevant to the organization.

• Training covers reporting options and nonretaliation.

• New employees receive training within a defined period.

• Training completion is tracked and overdue items are escalated.

• Knowledge or understanding is assessed.

• Training is updated following audits, investigations, and regulatory changes.

• Training effectiveness is periodically evaluated.

4. Communication and reporting

• Employees have several ways to contact compliance.

• At least one reporting route permits anonymous reporting.

• Reporting channels are available to contractors and other relevant parties.

• The organization maintains a documented nonretaliation policy.

• Employees receive periodic reminders about reporting options.

• Reports are acknowledged and triaged promptly.

• High-risk complaints are immediately escalated.

• Investigation status and aging are tracked.

• Reporting data is analyzed by location, department, risk, and issue type.

• Retaliation allegations are separately tracked and investigated.

• Compliance reporting is protected from operational interference.

5. Enforcement and incentives

• Disciplinary standards are documented.

• Discipline is applied consistently across positions and departments.

• Managers can be disciplined for supervision failures.

• Similar cases are compared before disciplinary decisions are finalized.

• Compliance behavior is included in performance evaluations.

• Positive compliance contributions are recognized.

• Compensation plans are reviewed for incentives that may create compliance risk.

• Productivity targets are reviewed for potential effects on quality or billing.

• Disciplinary and incentive decisions are documented.

6. Risk assessment, auditing, and monitoring

• A formal compliance risk assessment is completed at least annually.

• The assessment uses internal and external risk information.

• Risks are scored using defined criteria.

• Identified risks are assigned owners.

• The compliance work plan reflects the highest-priority risks.

• The organization has a documented annual audit plan.

• Audit methodology, scope, sampling, and findings are retained.

• Auditors are sufficiently independent.

• Recurring monitoring is assigned to operational owners.

• Monitoring results are reviewed by compliance.

• New risks can be added to the work plan during the year.

• The board receives information about significant audit findings.

• The effectiveness of each compliance program element is periodically evaluated.

• Compliance data is analyzed for trends rather than reported only as activity totals.

7. Investigations and corrective actions

• Investigation procedures define roles, privilege, documentation, and escalation.

• Investigators are appropriately qualified and independent.

• Relevant evidence is preserved.

• Investigations determine the scope and root cause of the issue.

• Potential overpayments are identified and addressed promptly.

• Legal counsel is involved when appropriate.

• Government reporting or disclosure obligations are assessed.

• Corrective actions have owners and due dates.

• Overdue corrective actions are escalated.

• Similar risks are reviewed across other departments or locations.

• Corrective-action evidence is retained.

• Follow-up testing confirms whether remediation worked.

• Compliance or another independent function approves closure.

8. Quality and patient safety

• Quality and patient safety risks are included in the compliance risk assessment.

• Quality leadership participates in the compliance committee.

• Compliance receives reports on adverse events and significant quality concerns.

• Quality incidents are reviewed for billing and legal implications.

• Root-cause analyses are completed for significant events.

• Corrective actions are tracked through effectiveness testing.

• Staffing concerns are included in compliance and quality oversight.

• The board receives regular quality and patient safety reports.

• Patterns of unnecessary, insufficient, or undocumented care are investigated.

9. Third parties and financial arrangements

• Vendors and contractors are assessed before engagement.

• Financial arrangements are reviewed for fraud and abuse risks.

• Fair-market-value and commercial-reasonableness documentation is retained where relevant.

• Referral-source relationships receive appropriate review.

• Contract terms accurately describe the services provided.

• Payments are monitored against contract requirements.

• Third parties are screened against applicable exclusion lists.

• Conflicts of interest are disclosed and reviewed.

• High-risk third parties receive ongoing monitoring.

• Failed due-diligence findings are resolved before approval.

10. Program effectiveness

• The organization can show how its compliance program has changed after identified problems.

• Compliance metrics measure outcomes, not only activities.

• Employees know how to contact compliance.

• Employees believe they can report without retaliation.

• High-risk issues reach leadership and the board promptly.

• Audit and monitoring findings lead to corrective action.

• Repeat findings are investigated for systemic causes.

• Compliance has adequate staff, technology, data, and budget.

• The program is adapted to the organization’s size and risk profile.

• Applicable OIG industry-specific guidance is incorporated into the program.

How to use the checklist

Do not combine every answer into a single score and assume that the total reflects legal compliance.

A high average score can conceal a serious weakness in a high-risk area. For example, strong training and policy scores will not compensate for the failure to investigate credible billing concerns or repay an identified overpayment.

Prioritize gaps using:

• Potential patient harm
• Federal healthcare program exposure
• Likelihood of recurrence
• Financial impact
• Regulatory consequences
• History of similar findings
• Control dependency
• Number of affected locations or claims
• Time required to reduce the risk

The final assessment should produce a documented improvement plan.

For every priority gap, record:

• Risk statement
• Relevant requirement
• Existing controls
• Identified weakness
• Corrective action
• Responsible owner
• Required resources
• Target date
• Escalation date
• Closure evidence
• Effectiveness-testing method

Ready to strengthen policy management and compliance across your organization, Book a personalized demo with VComply and take the first step toward smarter compliance management.

Frequently Asked Questions (FAQs)

1. What is an OIG compliance program?

An OIG-aligned compliance program is a structured system for preventing, detecting, investigating, and correcting violations of healthcare laws, regulations, Federal healthcare program requirements, and organizational policies.

2. What are the seven elements of an OIG compliance program?

The seven elements are written policies and procedures, compliance leadership and oversight, training and education, effective reporting channels, enforcement and incentives, risk assessment and monitoring, and corrective action.

3. Is the OIG compliance program checklist mandatory?

No. OIG compliance guidance is voluntary and nonbinding. However, it provides an important framework for evaluating whether a healthcare compliance program is properly designed and operating effectively.

4. How often should a healthcare organization conduct an OIG compliance assessment?

A complete assessment should generally be performed at least annually. Additional reviews may be needed after significant incidents, audits, regulatory changes, acquisitions, new service lines, or repeated control failures.

5. Who should participate in the assessment?

The assessment should involve compliance, legal, internal audit, finance, billing, coding, clinical leadership, quality, human resources, information technology, operations, and relevant department owners. Material findings should also be reviewed by senior leadership and the board.

6. What evidence should support the checklist?

Evidence may include policies, risk assessments, training records, audit results, monitoring reports, hotline data, investigation files, board minutes, exclusion-screening records, corrective-action documentation, and quality or patient-safety reports.

7. Does an OIG-aligned compliance program prevent enforcement action?

No. Having a compliance program does not automatically prevent investigations, penalties, repayments, or enforcement action. Its design and effectiveness may, however, influence how regulators evaluate the organization’s conduct and response.

8. What should happen after a compliance gap is identified?

The organization should document the risk, assign an owner, define corrective actions, establish deadlines, retain supporting evidence, escalate delays, and test whether the remediation reduced the underlying risk before closing the issue.