In this episode of Compliance Deconstructed, Jessica Zeff and Elvan Baker sit down with Denise Lord to explore the realities of managing healthcare compliance in a critical access hospital. Denise shares firsthand insights into balancing multiple responsibilities, building effective compliance programs with limited resources, and creating sustainable processes that support both regulatory requirements and patient care.

This in-depth conversation examines the unique structure of critical access hospitals, where compliance leaders often oversee quality, risk management, infection prevention, patient experience, and privacy responsibilities simultaneously. Denise explains how this broad oversight can provide valuable visibility into organizational operations, helping healthcare leaders identify trends, address risks proactively, and strengthen collaboration across departments.

Jessica, Elvan, and Denise also discuss the importance of fostering a culture of shared ownership for compliance. They highlight the role of executive leadership, compliance committees, department managers, and frontline staff in creating an environment where ethical decision-making, regulatory adherence, and patient safety become part of everyday operations rather than isolated compliance activities.

Key Takeaways:

• Critical access hospital compliance leaders often oversee multiple functions, creating opportunities to identify risks and trends across the organization.

• Strong compliance programs depend on collaboration between leadership, clinical teams, operations, legal counsel, information technology, and frontline staff.

• Compliance committees become more effective when members actively participate in discussions and help identify organizational priorities.

• A just culture approach helps organizations address incidents fairly while encouraging staff to report concerns and potential compliance issues.

• Privacy and HIPAA training become more meaningful when employees understand how compliance directly impacts patients, families, and their local communities.

• Successful compliance management requires flexibility, strategic prioritization, strong communication with leadership, and a willingness to adapt when unexpected challenges arise.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

Information security plays a critical role in healthcare compliance, risk management, and organizational resilience. In this episode of Compliance Deconstructed, Jessica Zeff, Lorie Davis, and special guest Joe Wynn, Founder & CEO of Seiso, break down the foundational elements of an effective information security program and explain why protecting sensitive data requires a structured approach that extends beyond technology solutions.

This in-depth conversation explores the importance of conducting comprehensive risk assessments to identify vulnerabilities, evaluate threats, and prioritize security efforts based on potential impact. The hosts also discuss practical safeguards such as multi-factor authentication, data backups, software patching, access controls, and employee training that help healthcare organizations strengthen their security posture and reduce exposure to cybersecurity risks.

Jessica, Lorie, and Joe also address common misconceptions surrounding HIPAA compliance, SOC 2 reports, and security attestations while highlighting emerging concerns related to website tracking technologies and third-party data sharing. After consuming this episode, you’ll gain actionable insights into building a sustainable information security strategy that supports regulatory compliance, protects patient information, and promotes long-term organizational success.

Key Takeaways:

• Risk assessments provide the foundation for identifying security gaps, evaluating threats, and prioritizing remediation efforts across the organization.

• Multi-factor authentication, secure backups, regular software updates, access management, and employee education remain essential components of a strong security program.

• Healthcare organizations should understand that there is no official HIPAA certification and that compliance requires ongoing oversight and accountability.

• SOC 2 reports evaluate security controls and can support broader compliance initiatives when paired with regulatory assessments.

• Website cookies, tracking scripts, and third-party marketing tools can create privacy and compliance risks when organizations do not fully understand how data is collected and shared.

• Information security requires continuous evaluation, process improvement, and cross-functional collaboration to protect sensitive information and maintain regulatory compliance.

Connect with Joe Wynn

Website | LinkedIn

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.

In this episode of Compliance Deconstructed, Jessica Zeff joins co-hosts Elvan Baker and Lorie Davis to unpack one of the most operationally complex areas of healthcare compliance: Medicaid and the realities of navigating state-specific healthcare programs. The reality is Medicaid is not a single national program with standardized rules, and organizations often underestimate how much variation exists between states when it comes to eligibility, benefits, managed care structures, provider enrollment, and compliance obligations.

Jessica, Elvan, and Lorie explore how Medicaid differs from Medicare and private insurance while discussing why compliance professionals, providers, and health plans cannot rely on assumptions when entering new Medicaid markets. From a compliance standpoint, this becomes especially important when organizations expand across state lines and discover that processes tied to credentialing, appeals, grievances, staffing, reporting, and oversight may look completely different depending on the state administering the program.

The conversation also examines the balance between federal oversight from the Centers for Medicare & Medicaid Services and the flexibility states have to design their own Medicaid programs through waivers, managed care arrangements, and operational structures. On paper, this may sound straightforward. But operationally, this becomes challenging when organizations attempt to align compliance, legal, IT, clinical operations, and leadership teams around requirements that are often layered across contracts, appendices, policy manuals, and state guidance documents.

Jessica, Elvan, and Lorie also share practical strategies for approaching Medicaid compliance in a structured and sustainable way, including conducting detailed gap analyses, building operational playbooks, mapping information flow, and training teams on state-specific requirements. A lot of organizations struggle with treating Medicaid compliance like a one-time implementation project, when in practice it requires ongoing monitoring, collaboration, and operational adaptability to manage risk effectively while supporting patient access and organizational stability.

Key takeaways from this episode:

• Medicaid programs vary significantly from state to state, including eligibility rules, covered services, managed care structures, and provider participation requirements.
• Compliance professionals should avoid assuming that experience in one Medicaid program automatically translates to another state’s program.
• CMS provides federal oversight, but states maintain substantial flexibility through waiver programs, managed care models, and operational design decisions.
• Provider enrollment, credentialing, appeals and grievances, staffing requirements, and reporting obligations often differ substantially across states.
• Conducting a detailed gap analysis helps organizations identify operational, compliance, staffing, and technology requirements before entering a Medicaid market.
• Successful Medicaid compliance requires collaboration across compliance, operations, legal, clinical, IT, and leadership teams to ensure policies translate into day-to-day operational execution.

Learn more about Healthcare Compliance and discover how Simply Compliance can help your company at simplycomplianceconsulting.com.