Healthcare Compliance Consulting Services
Healthcare compliance services are consulting work that helps a healthcare organization build, test and maintain the programs that keep it within the laws, regulations and contract terms that apply to it.
Integral Healthcare Solutions (IHS), founded in February 2002 by Thomas G. Goddard, JD, PhD, provides these services to health plans, pharmacies, providers, laboratories and digital health companies. IHS drafts the program documents, policies and assessment reports, and your compliance officer and leadership review and adopt them. The work is for organizations that must run a compliance program, answer to an audit or respond to a rule change. It is not for organizations whose only need is an accreditation decision, which is the work of accreditation consulting. It is not legal advice.
Last reviewed: October 2026
Dr. Goddard oversees IHS compliance engagements. Each service below links to a dedicated page.
What do IHS compliance services include?
Compliance programs: build one or test one
A compliance program is the set of written policies, a designated compliance officer, training, reporting channels, enforcement, auditing and corrective action that an organization runs to prevent, detect and correct violations. OIG describes seven elements of such a program in its 2023 General Compliance Program Guidance, which it states is voluntary. IHS builds programs to those elements and tests existing ones. For organizations where an outside officer is permitted, IHS provides fractional Chief Compliance Officer support during a program build.
- Build a compliance program against the OIG seven elements (compliance program FAQ)
- Fractional Chief Compliance Officer support during a program build (not available to Medicare Advantage organizations or Part D plan sponsors, whose compliance officer must be an employee)
- Test an existing program: regulatory readiness and gap assessment (gap assessment FAQ, gap assessment methodology guide)
- CMS Program Audit Readiness Consulting for Medicare Advantage and Part D Sponsors
- Corporate Integrity Agreement (CIA) Support Consulting
- Exclusion Screening Program Consulting: OIG LEIE, SAM.gov and State Medicaid Lists
- Medicare Advantage and Part D Compliance Program and FDR Oversight Consulting
- Section 1557 Nondiscrimination Compliance Consulting
Which core compliance service fits which organization?
Five core services sit under the compliance program line. Each page named below describes the work in full.
| Service | Who it is for | What IHS drafts or runs |
|---|---|---|
| Medicare Advantage and Part D compliance program and FDR oversight | Medicare Advantage organizations and Part D plan sponsors, which 42 CFR 422.503(b)(4)(vi) and 423.504(b)(4)(vi) require to adopt a compliance program. FDR stands for first tier, downstream and related entity. | An assessment of the program, then the program documents and FDR oversight procedures your compliance officer and counsel approve. |
| CMS program audit readiness | Medicare Advantage and Part D sponsors preparing for a CMS program audit. CMS describes these audits on its Program Audits page (page opened October 4, 2026). | A readiness gap assessment, universe preparation checks, drafted templates and a mock audit. |
| Exclusion screening | Providers, plans, pharmacies and vendors that bill or contract with federal health care programs and need to check staff, contractors and vendors against the exclusion lists. | A scope map of who is screened against which list, the written policy and monthly procedure, and templates for resolving and documenting matches. |
| Section 1557 nondiscrimination | Health programs that need written nondiscrimination policies, notices, language access and accessibility procedures, training and grievance handling under 45 CFR Part 92. | A map of your policies, notices and training to Part 92, with drafts for gaps. Your counsel decides what applies to you. |
| Corporate Integrity Agreement (CIA) support | Organizations operating under a CIA with the HHS Office of Inspector General (OIG). | A dated obligations register from your executed agreement, plus the policies, procedures, training materials and report templates it calls for. IHS is not your Independent Review Organization. |
340B and pharmacy compliance
Under the 340B statute, a covered entity may not request Medicaid payment for a drug that is subject to a Medicaid rebate, may not resell or otherwise transfer a 340B drug to a person who is not its patient, and must permit the Secretary and the manufacturer to audit its records on those two requirements (42 U.S.C. 256b(a)(5)(A)-(C)). IHS provides 340B mock audits, OPAIS remediation and ongoing compliance maintenance. For compounding pharmacies, IHS covers PCAB accreditation and USP chapters 795, 797 and 800.
Remote patient monitoring, telehealth and digital health
OIG reported in 2024 that about 43 percent of Medicare enrollees who received remote patient monitoring did not receive all three components of it, and recommended added safeguards on how RPM is ordered and billed. IHS builds RPM programs and audits existing ones for billing risk. For telehealth platforms, IHS prepares organizations for URAC Telehealth Accreditation.
Mental health parity for health plans
Since the Consolidated Appropriations Act, 2021, plans and issuers must perform and document comparative analyses of the design and application of their non-quantitative treatment limitations and provide them to regulators on request. IHS prepares health plans for URAC Mental Health / Substance Use Disorder Parity Accreditation.
Laboratory compliance in New York
New York's Clinical Laboratory Evaluation Program (CLEP) states that only laboratories holding a New York State clinical laboratory permit are authorized to test specimens originating from New York. IHS guides laboratories through the CLEP compliance lifecycle, starting with a gap assessment.
Healthcare AI governance
Healthcare organizations that deploy clinical decision support, predictive analytics and similar tools need documented governance for them. IHS builds AI governance programs that take account of FDA, ONC HTI-1, CMS and state-law requirements where they apply to the organization's role, and publishes a framework guide and a regulatory tracker.
Other compliance work scoped on a discovery call
IHS also takes on the following work, scoped on a free discovery session: state health plan mandate tracking, CMS regulatory change management, HIPAA compliance programs, and ongoing compliance monitoring and program oversight.
More compliance programs IHS supports
Assurance organizations
- CMS Deeming Authority Application Consulting for Accrediting Organizations
- ONC-ACB Authorization Consulting for Health IT Certification Bodies
- ONC-ATL Authorization Consulting for Health IT Testing Laboratories
- OTP Accrediting Body Approval Consulting (42 CFR Part 8)
Behavioral health and HCBS
Blood and biotherapies
Community and public programs
- Health Center FTCA Deeming Readiness Consulting
- Medicaid Reentry Section 1115 Facility and Provider Readiness Consulting
- NHSC Site Approval and Operating Alignment Consulting
- Ryan White Clinical Quality Management (CQM) Program Consulting
- School-Based Medicaid Services Program Consulting
- Title X Family Planning Program Alignment Consulting
Digital health and payment models
- Acute Hospital Care at Home Waiver Program Alignment
- FDA QMSR Document Control and Governance Support
- ONC Health IT Certification: Conditions and Maintenance of Certification Compliance
- TEFCA Participant Governance and Onboarding Consulting
Existing practice extensions
- 42 CFR Part 2 Compliance Consulting for Substance Use Disorder Records
- DMEPOS accreditation change management consulting
- DSCSA pharmacy compliance readiness consulting
- Federal IDR Entity Certification Consulting
- Multi-accreditation requirements register and evidence maintenance
Federal provider programs
- Community Mental Health Center (CMHC) Medicare Certification Consulting
- Comprehensive Outpatient Rehabilitation Facility (CORF) Certification Consulting
- Hospital Swing Bed Program Consulting
- ICF/IID Certification Readiness Consulting
- Independent Diagnostic Testing Facility (IDTF) Medicare Enrollment Readiness Consulting
- Organ Procurement Organization Governance and QAPI Consulting
- Outpatient Rehabilitation Agency Medicare Certification Consulting
- PACE Application Consulting for Initial Programs and Expansions
- Portable X-Ray Supplier Certification Consulting
- Psychiatric Residential Treatment Facility (PRTF) Medicaid Readiness Consulting
- Rural Emergency Hospital (REH) Conversion Readiness Consulting
- Rural Health Clinic (RHC) Certification Readiness Consulting
- Solid Organ Transplant Program Certification Readiness Consulting
Gaps from 2026 deals
- Buy-Side Healthcare Regulatory Due Diligence
- Pharmacy and DME Operations Expert Witness
- State licensing and certificate of need consulting for healthcare start-ups
- Youth Group Home Licensing
New finds (beachhead-discovery 2026-10-03)
- DMEPOS Competitive Bidding Program Round 2028 Bid Readiness
- Hospital Obstetrical Services CoP Readiness Consulting
- Information Blocking Compliance Program for Providers and Exchanges
- Medicaid Managed Care Operational Readiness Review Preparation
Payers and delegated organizations
- CMS-0057-F Prior Authorization Compliance Consulting
- D-SNP Integrated Operations Alignment Consulting
- Health Plan FDR Compliance Readiness Consulting
- New Jersey ODS Certification and Licensure Readiness Consulting
- New York PBM License Readiness Consulting
- Texas Third Party Administrator Certificate of Authority Consulting
Research organizations
- IRB Registration and Federalwide Assurance (FWA) Alignment
- Patient Safety Organization Formation and Listing Readiness
State program authorization
What triggers a compliance project?
Projects usually start with a requirement, an audit or a change. Each trigger below quotes or summarizes the authority that sets it.
You hold, or are applying for, a Medicare Advantage contract.
The regulation sets the compliance program as a condition of contracting. 42 CFR 422.503(b)(4)(vi) requires the organization to: “Adopt and implement an effective compliance program, which must include measures that prevent, detect, and correct non-compliance with CMS' program requirements as well as measures that prevent, detect, and correct fraud, waste, and abuse.”
Source: eCFR, 42 CFR 422.503 (opened 2 October 2026). IHS service: Medicare Advantage and Part D compliance program and FDR oversight and compliance program development.
You are building a program, or have one that has never been tested.
OIG's General Compliance Program Guidance (2023) states: “The GCPG is voluntary guidance that discusses general compliance risks and compliance programs. The GCPG is not binding on any individual or entity.” Its table of contents names seven elements: written policies and procedures, compliance leadership and oversight, training and education, effective lines of communication with the compliance officer and disclosure programs, enforcing standards, consequences and incentives, risk assessment, auditing and monitoring, and responding to detected offenses and developing corrective action initiatives.
Source: OIG, General Compliance Program Guidance, HHS-OIG-GCPG-2023 (opened 2 October 2026). IHS service: Compliance program development and regulatory readiness and gap assessment.
Your records may be audited under the 340B program.
42 U.S.C. 256b(a)(5)(C) provides: “A covered entity shall permit the Secretary and the manufacturer of a covered outpatient drug ... to audit at the Secretary's or the manufacturer's expense the records of the entity that directly pertain to the entity's compliance with the requirements described in subparagraphs (A) or (B) with respect to drugs of the manufacturer.”
Source: Cornell LII, 42 U.S.C. 256b (opened 2 October 2026). IHS service: 340B program integrity and audit readiness and audit preparation guide.
You are launching or billing remote patient monitoring.
OIG report OEI-02-23-00260 (19 September 2024) found: “About 43 percent of enrollees who received remote patient monitoring did not receive all 3 components of it, raising questions about whether the monitoring is being used as intended.”
Source: OIG, Additional Oversight of Remote Patient Monitoring in Medicare Is Needed (opened 2 October 2026). IHS service: Remote patient monitoring compliance and RPM billing guide.
Your health plan must document mental health parity analyses.
The Departments of Labor, HHS and the Treasury state that the Consolidated Appropriations Act, 2021 added a provision “that requires plans and issuers to perform and document comparative analyses of the design and application of their non-quantitative treatment limitations (NQTLs) to demonstrate parity,” and to provide those analyses to the Departments or an applicable state authority on request.
Source: U.S. Department of Labor, MHPAEA Comparative Analysis Report to Congress, July 2023 (opened 2 October 2026). IHS service: URAC mental health parity accreditation consulting.
Your laboratory tests specimens from New York.
The New York State Department of Health states: “Only laboratories that hold a New York State clinical laboratory permit are authorized to perform testing on specimens originating from New York.”
Source: NYSDOH Wadsworth Center, Clinical Laboratory Evaluation Program (opened 2 October 2026). IHS service: NYSDOH CLEP and LDT compliance.
You bill or contract with federal health care programs.
OIG maintains the List of Excluded Individuals/Entities (LEIE). Its exclusion background page states that no payment will be made for any items or services furnished, ordered or prescribed by an excluded individual or entity.
Source: OIG, Exclusions background (page opened October 4, 2026). IHS service: exclusion screening program.
You are operating under a Corporate Integrity Agreement.
OIG defines a Corporate Integrity Agreement as “an agreement between an entity and the Office of Inspector General (OIG) that outlines obligations to improve compliance and prevent fraud, often as part of a civil settlement.” OIG also states that the period of a CIA is five years.
Source: OIG, Corporate Integrity Agreements (page opened October 4, 2026). IHS service: Corporate Integrity Agreement support.
How does IHS deliver compliance services?
IHS drafts the program documents, policies and assessment reports for your compliance officer and leadership to review and adopt. The work runs in five steps.
- Identify the governing text: the regulation, contract term or agreement that sets the requirement, and the version in force.
- Assess what you have today against that text and list the gaps.
- Map your documents and evidence to each requirement.
- Draft the missing policies, procedures, registers and reports.
- Test the result with a mock audit or review where one applies, then support your team through readiness.
Your organization's named contact submits anything to a regulator or accreditor, and IHS drafts the text. Engagements begin with a free discovery session, after which IHS scopes the work.
What does a compliance engagement cost?
A compliance engagement has three cost parts: fees charged by an agency or accreditor where one is involved, the consulting fee, and your own staff time. Where an agency or accreditor charges a fee, that body sets it, so verify current fees with the body before budgeting. Your staff time depends on how many sites, systems and people the program touches. IHS sets a fixed fee for each engagement after a free discovery session, because scope, number of sites and the condition of your existing program change the work. This page quotes no IHS fees.
What is compliance consulting not?
IHS is a consulting firm, not a law firm. It does not provide legal opinions, and that includes opinions on Stark Law or Anti-Kickback Statute questions, which belong with your counsel.
IHS is not an accrediting body and does not grant or influence an accreditation decision.
IHS does not communicate with a regulator or accreditor for you. IHS drafts, and your organization's named contact submits.
IHS does not guarantee the outcome of an audit, review or agency decision.
How do the three practice lines fit together?
Compliance Services is one of three IHS practice lines. Accreditation Consulting takes an organization through an accreditor's standards to a decision. Maureen Plumstead leads NCQA accreditation and recognition engagements. Program Development builds new programs and standards from scratch. Compliance Services keeps an existing program aligned with the requirements that apply to it. A compliance engagement can run alongside an accreditation project.
Frequently asked questions
What are healthcare compliance services?
Healthcare compliance services are consulting work that helps an organization build, test and maintain the programs that keep it within the laws, regulations and contract terms that apply to it. IHS drafts the program documents and assessment reports. Your organization decides and adopts them.
What is a healthcare compliance program, and is one required?
A compliance program is the set of written policies, a designated compliance officer, training, reporting channels, enforcement, auditing and corrective action an organization runs to prevent, detect and correct violations. Federal regulation requires one of Medicare Advantage organizations (42 CFR 422.503(b)(4)(vi)) and of Part D plan sponsors (42 CFR 423.504(b)(4)(vi)). Whether one is required of your organization depends on the programs it participates in and the contracts it holds. OIG's 2023 General Compliance Program Guidance describes seven elements and states that it is voluntary and not binding.
How is compliance consulting different from accreditation consulting?
Accreditation consulting is project-based and runs from kickoff to an accreditation decision. Compliance consulting addresses the regulatory requirements that continue between accreditation cycles, during organizational change and when a rule changes. Some organizations use both.
Who needs which of the five core compliance services?
Medicare Advantage organizations and Part D plan sponsors need the compliance program, FDR oversight and CMS audit readiness work. Organizations that bill federal health care programs need exclusion screening. Health programs subject to 45 CFR Part 92 need Section 1557 work. Organizations under a Corporate Integrity Agreement need CIA support. The table above sets out each.
Can IHS act as our compliance officer?
Not for a Medicare Advantage organization or a Part D plan sponsor. 42 CFR 422.503(b)(4)(vi)(B)(1) provides that the compliance officer “must be an employee of the MA organization, parent organization or corporate affiliate,” and may not be an employee of its first tier, downstream or related entity. 42 CFR 423.504(b)(4)(vi)(B)(1) says the same for Part D plan sponsors. IHS therefore does not serve as that officer on an interim, fractional or any other basis. IHS drafts the position description, policies and training and supports onboarding of the employee you designate. For other organizations, IHS provides fractional Chief Compliance Officer services during a program build and structures the role so it can move to a permanent employee. Whether an outside officer is permitted depends on the rules and contract terms that apply to you, so confirm that with your counsel.
Who submits to and speaks with the regulator or accreditor?
Your organization's named contact submits it and speaks with the regulator or accreditor. IHS drafts the text.
Does IHS give legal opinions?
No. IHS is a consulting firm, not a law firm, and does not provide legal opinions. That includes Stark Law and Anti-Kickback Statute opinions. Questions about whether a specific arrangement is lawful belong with your counsel.
How much does a compliance engagement cost?
The cost has three parts: agency or accreditor fees where they apply, the consulting fee and your own staff time. Verify current agency and accreditor fees with the body that sets them. IHS sets a fixed fee for each engagement after a free discovery session, because scope, number of sites and the condition of your existing program change the work. This page quotes no IHS fees.
Who is this not for?
Compliance services are not for an organization whose only need is an accreditation decision, which is accreditation consulting. They are not for an organization looking for a legal opinion or for someone to represent it before a regulator. IHS does neither.
How does an engagement start?
With a free discovery session. Describe your organization, the regulation or event that prompted the call and what you have in place. IHS then scopes the work.
Schedule a discovery session
Describe the requirement, audit or change that prompted the question.