Compliance Committee Under Pressure After a Merger
Riverside Medical Group is a 240-physician, 18-clinic group that recently merged with a private-equity-backed management services organization (MSO). Its compliance officer has 1.5 FTE and reports to the CFO. The compliance committee is chaired by the CFO and meets quarterly; the COO, legal counsel, and two physicians attend. The board’s audit committee receives an annual compliance report but has no charter for compliance oversight. After the merger, the MSO proposes dissolving the standalone compliance committee and folding compliance into the finance/audit committee, and moving the hotline under Human Resources. The compliance budget is cut 20%. A physician committee member asks to review a billing concern involving a high-revenue service line, but the CFO says the committee should not create a paper trail because legal privilege may not apply. The compliance officer is asked to prepare a recommendation for the next board meeting.
1. Identify the governance deficiencies in this structure and explain the compliance risk each creates. Prioritize the three most urgent.
Read the worked answer
The core deficiencies are reporting line, committee independence, board charter, and resource erosion. A compliance officer reporting to the CFO creates a structural conflict because the CFO controls budget, revenue-cycle priorities, and financial statements that compliance may need to challenge. A CFO-chaired committee has the same problem: it can set the agenda and suppress concerns. Folding compliance into finance/audit and moving the hotline to HR removes independent access to the board and creates retaliation risk for hotline reporters, since HR may be involved in the conduct. The missing board charter means no defined oversight authority or reporting cadence. Prioritize: (1) restore a direct compliance reporting line to the board or audit committee, with administrative reporting to the CEO only; (2) reconstitute an independent compliance committee chaired by a non-executive or senior leader without revenue-cycle authority, with the COO as a non-voting member; (3) keep the hotline under compliance, not HR, and confirm anonymous reporting. The 20% budget cut matters because insufficient staff makes monitoring and investigation unreliable; document the resource gap to the board rather than accepting it silently.
2. The MSO argues that a separate compliance committee is redundant because the audit committee oversees risk. Draft the compliance officer’s response, including reporting lines, committee composition, and authority.
Read the worked answer
Respond with the program elements and the risk of dilution, not with turf. A separate committee is not inherently required, but effective oversight requires a charter; a chair without operational revenue authority; members with compliance, clinical, legal, audit, and operations expertise; authority to obtain records and ask questions; and a direct reporting line to the board. If the MSO insists on one committee, propose a compliance subcommittee of the audit committee with a written charter, quarterly executive sessions, and the compliance officer as a permanent attendee with direct access to the chair. The audit committee may oversee financial and enterprise risk but often lacks clinical billing and privacy expertise and may meet only four times a year. Reporting lines: the compliance officer should report functionally to the board or audit committee and administratively to the CEO, not the CFO. Authority: unrestricted access to records, personnel, and facilities; ability to commission audits; and a budget protected from revenue-cycle veto. Document the MSO’s proposal and the compliance officer’s response in board minutes. The goal is not to preserve a standalone committee but to preserve independent, informed oversight; a subcommittee can satisfy that if the charter and membership are real.
3. The physician requests the billing review. Explain how the compliance officer should handle the request, including privilege, documentation, and escalation, without impeding the board’s oversight.
Read the worked answer
The physician’s request is legitimate oversight, not a demand for legal advice. The compliance officer should not promise privilege that may not exist. Attorney-client privilege protects confidential legal communications, not business or compliance records created in the ordinary course; a committee’s review of a billing concern may be discoverable. The compliance officer should tell the physician and CFO that the committee can review the concern in a properly convened executive session; ask counsel to structure the review, if legal advice is genuinely needed, with a written engagement and clear labeling; create a separate compliance work file with factual findings, not legal conclusions, and preserve documents; avoid creating a misleading no-paper-trail dynamic, and ensure minutes record that the concern was raised and referred without privileged detail; and escalate to the board audit committee chair if the CFO attempts to block the review. Blocking a good-faith concern increases retaliation and concealment risk and may violate the program’s non-retaliation commitment. The compliance officer should also assess whether the billing concern requires a preliminary audit and whether an overpayment obligation may be triggered.