CHC (CCB): The Risk Assessment Nobody Owned

The process was followed in form but failed in substance. Specific defects:

1. Stale inputs. The assessment carried forward last year's rankings (telehealth low, privacy high) without re-scoring against a 14-fold volume increase and a new messaging module. Risk assessment must reflect the current environment, not last year's.
2. Single-source scoring. The analyst alone set likelihood and impact. Operations, billing, and IT hold the facts that drive both dimensions - billing knows the modifier/POS complexity, IT knows the messaging routing architecture. Without them, the scores are guesses.
3. No linkage to change. A new law, a new EHR module, and a volume shift are exactly the triggers that should force re-scoring. The methodology had no 'change trigger' step.
4. Sign-off without challenge. The CO attested to process compliance, not to the reasonableness of the result. 'The process was followed' is not an assurance that the risk ranking is right.

The failure is a methodology and governance failure, not an analyst error. The fix is a risk-assessment process with cross-functional input, documented rationale for each score, explicit change triggers, and CO challenge of the output before sign-off.

A redesigned approach:

• Cross-functional scoring panel. Convene operations, billing/coding, IT/security, and clinical leadership to score each domain; document who provided input and the rationale for each likelihood/impact score. The analyst facilitates and records, not decides alone.
• Change-trigger register. Maintain a list of triggers (new law/regulation, new technology or EHR module, volume shift above a threshold, new payer contract, audit finding) that force re-scoring of affected domains. The telehealth parity law, the 2%→28% volume shift, and the new messaging module would each have triggered re-scoring.
• Evidence-based scoring. Tie scores to data: claim-edit reports, denial trends, audit results, help-desk tickets, incident logs. 'Telehealth billing' should have been scored against the actual modifier/POS error data, not intuition.
• Explicit linkage to controls and owners. Each high risk gets a named control owner and a monitoring plan, so the assessment drives action rather than sitting in a binder.
• CO challenge and sign-off with rationale. The CO reviews the output, challenges outliers, and signs off on the reasonableness of the ranking, documenting any adjustments.

This structure would have surfaced telehealth billing (volume + new rules) and portal messaging (new module + privacy impact) as elevated risks before the Q3 events.

Close the loop by making the incidents inputs to the next assessment and by fixing the controls now:

1. Re-score immediately. Update the risk assessment to reflect the telehealth and messaging findings; document the revised scores and the reason for the change.
2. Root-cause each finding. For telehealth: were the POS/modifier errors a knowledge gap, a system-edit gap, or both? For messaging: was the misrouting a configuration error, an identity-verification gap, or a workflow workaround? The control fix depends on the cause.
3. Assign owners and monitoring. Telehealth billing gets pre-bill edits and a periodic audit; messaging gets a routing/identity-verification control and monitoring. Each has an owner and a review cadence.
4. Feed the lessons into the methodology. Add 'post-incident re-score' as a standing step, and add the cross-functional panel and change-trigger register if not already adopted.
5. Report to the audit/compliance committee. Show the original ranking, the incidents, the revised ranking, the control fixes, and the methodology change - demonstrating that the program learns from events.

The test of a risk-assessment program is not whether it predicted everything; it is whether it updates when reality changes and whether the update drives action.