The Risk Assessment That Skipped the New Service Line
A regional health system completed its annual compliance risk assessment in March. In June it launched a new telehealth prescribing service for controlled substances across three states, staffed by contracted NPs, with a new e-prescribing vendor. The risk assessment scored 'telehealth' as low risk because the system had only a small existing tele-consult service. The compliance officer learns in October that the new service has generated 4,200 controlled-substance prescriptions, two state board inquiries, and one report of a patient obtaining overlapping prescriptions from two of the contracted NPs. Leadership says 'we'll fold it into next year's assessment.'
1. What went wrong with the risk assessment methodology, and why is waiting until next year unacceptable?
Read the worked answer
The methodology treated risk as static and service-line-specific rather than dynamic and process-based. The assessment scored 'telehealth' low based on a small tele-consult service, but the new service introduced materially different risks: controlled-substance prescribing (DEA/state registration, PDMP checks), multistate licensure, contracted prescribers, and a new vendor (e-prescribing integrity, access controls). A sound risk assessment evaluates inherent risk by activity and process, and it must be triggered by change - new service lines, new markets, new vendors, new workforce models. Folding it into next year ignores that the risk is live now.
Waiting is unacceptable because: (a) there are open state board inquiries requiring a response; (b) the overlapping-prescription report suggests a possible diversion/patient-safety event requiring immediate review; (c) continued prescribing without controls compounds exposure and may create an overpayment/regulatory violation; and (d) a documented, timely response is itself evidence of an effective program. Risk assessment is a continuous process, not an annual artifact.
2. Design an interim risk assessment and monitoring response for the new service.
Read the worked answer
Interim risk assessment (within days):
- Score the new service on inherent risk dimensions: patient harm, legal/regulatory (DEA, state boards, licensure), financial, reputational, and volume (4,200 scripts). Expect a high score.
- Map controls that should exist: prescriber DEA/state licensure verification, PDMP query requirements, identity verification for patients, prescribing limits, vendor access controls, and audit/monitoring.
- Identify gaps between expected and actual controls.
Monitoring response (immediate):
- Prescriber credentialing sweep. Verify each contracted NP's licensure in each state and DEA registration; confirm scope of practice.
- Prescription analytics. Run PDMP-style and internal analytics for overlapping prescriptions, high-volume prescribers, and geographic anomalies; review the two-NP overlap case first.
- Vendor review. Confirm the e-prescribing vendor's access controls, audit logging, and data-integrity safeguards; review the contract for compliance/audit rights.
- Respond to board inquiries through counsel, accurately and promptly.
- Governance. Add a 'change trigger' to the risk-assessment policy: new service lines, markets, vendors, or workforce models require an interim assessment before launch.
- Report interim findings and a remediation timeline to the compliance committee; schedule a follow-up audit in 90 days.