Healthcare Compliance Policies & Procedures: The Complete Guide

When a healthcare organization faces an OIG audit, a payer credentialing review, or an accreditation survey, there is one document that is usually requested first: a current, documented set of compliance policies and procedures. Organizations that cannot produce one, or that produce one nobody has updated in years, start the process at a disadvantage before an auditor asks a single follow-up question

The Department of Health and Human Services Office of Inspector General names written policies and procedures as one of the elements of an effective compliance program. This guide covers what compliance policies and procedures are, the core categories every program needs, how to build or source them, and how to keep them current once they exist.

What Are Compliance Policies and Procedures?

Compliance policies are the formal, documented rules that define how a healthcare organization meets its legal and regulatory requirements. Procedures are the step-by-step instructions staff follow to put those policies into practice. Together, they form the foundation of the seven elements of an effective compliance program defined by the OIG.

Core categories include HIPAA privacy and security, billing and coding compliance, sanction screening, conflicts of interest, and compliance reporting. Every policy in the set should be reviewed at least annually, or sooner whenever the underlying regulation changes.

Policy vs. Procedure: What Is the Difference in Healthcare Compliance?

A policy answers what and why. A procedure answers how and who. A HIPAA privacy policy states the organization’s rule on protecting patient information. The breach-notification procedure lists the specific steps staff take when a breach occurs, including who is notified, in what timeframe, and through what channel.

Both documents are required together. A policy without a procedure gives staff no actionable path to follow it. A procedure without a policy has no stated authority behind it. Organizations that draft one without the other create a gap an auditor is likely to find.

The Seven Elements of an Effective Compliance Program

HHS OIG General Compliance Program Guidance sets out seven elements every effective compliance program should include:

1. Written policies and procedures
2. Compliance leadership and oversight
3. Training and education
4. Effective lines of communication with the compliance officer and disclosure programs
5. Enforcing standards: consequences and Incentives
6. Risk assessment, auditing, and monitoring
7. Responding to detected offenses and developing corrective action initiatives

Written policies and procedures sit first in that list for a reason. Every other element depends on them being current and accurate. Training cannot teach a policy that does not exist. Monitoring cannot check staff against a standard that was never written down. It is important to work from the 2023 GCPG, as that is the standard OIG investigators and auditors currently apply.

Core Policies Every Healthcare Compliance Program Should Include

Every healthcare compliance program should include, at minimum, the following:

HIPAA privacy and security, referencing the HIPAA Privacy and Security Rules directly rather than paraphrasing them.

Billing and coding compliance, covering claim accuracy, documentation standards, and the process for correcting and reporting errors.

Sanction screening, checking staff, contractors, and vendors against federal and state exclusion lists before hire and on an ongoing basis.

Conflicts of interest, requiring disclosure and defining how the organization manages disclosed conflicts.

Compliance reporting and non-retaliation, including a clear path to the organization’s compliance hotline and an explicit protection against retaliation for good-faith reports.

How to Develop and Write Compliance Policies and Procedures

Developing a policy and procedure set follows a consistent sequence: identify the specific regulatory requirement the policy addresses, draft the policy and its procedure in clear language, route both through legal and compliance review, publish and version the final document, and train staff on it before it takes effect.

Organizations skip steps in this sequence more often than they realize. A policy drafted without first identifying the regulatory requirement it addresses tends to be vague. A policy published without version control creates confusion about which draft staff is following. For a closer look at each step, read more about writing compliance policies and procedures for healthcare.

Compliance Policy Templates vs. Building From Scratch

Templates speed up the drafting process, but a template still requires review against the organization’s own risk areas, services, and state-specific requirements before it can be adopted. A template written for a hospital system will not fit a physician’s private practice without adjustment.

Building a policy set entirely from scratch gives full customization but takes considerably longer and requires deeper internal compliance expertise to execute well. Most organizations land somewhere between the two: starting from a vetted template and customizing it against their actual risk profile. For organizations weighing the two paths, compliance policy and procedure templates are worth reviewing before committing to either approach.

Training Staff on New and Updated Policies

A policy has no practical effect until staff knows it exists and understands what it requires of them. This is why the OIG’s second element, communication and training, ties directly back to the written policy set. A policy that sits in a binder or a shared drive without an accompanying training requirement is a policy in name only.

Training should be tied to specific policy updates, not delivered only as an annual, generic refresher. When a policy changes, the staff affected by that change should be retrained before the new version takes effect. Compliance training services can support this process for organizations building or expanding a training program.

Monitoring, Enforcement, and Review Cadence

Policies drift out of date without a scheduled review process. An annual review is the minimum for this process. Organizations facing frequent regulatory change, such as those in billing and coding, may need a more frequent cycle.

Enforcement consistency matters as much as the language of the policy itself. The Department of Justice’s Evaluation of Corporate Compliance Programs specifically examines whether an organization applies its policies consistently across staff levels, not only whether the policies are documented. An organization that enforces a policy against frontline staff but not against management creates exactly the kind of inconsistency the DOJ looks for. The policy adherence guide covers how to build monitoring and enforcement that holds up under that kind of scrutiny.

A Partner for Your Compliance Program

A documented, current policy and procedure set is an ongoing effort, requiring infrastructure that needs regular attention to hold up under an audit, a survey, or a DOJ review. Book a consultation with a compliance expert to assess where your current policy set stands.

Frequently Asked Questions

Subscribe to blog