Rewriting Internal Guidelines: What We Kept, What We Killed

Rewriting Internal Guidelines: What We Kept, What We Killed

Article Reference Code: NAMAS.09.11.2026

Written by: Stephanie Thebarge, CPC, CPCO, CPMA, CPPM, CPB, CEMC, CHONC

In my line of work, I’m always looking at the bigger picture. As auditors and compliance professionals, we spend our days identifying risk, questioning processes, and challenging assumptions. One phrase, however, has never belonged in a successful compliance program: “We’ve always done it this way.” 

Healthcare is constantly evolving, regulations change, payer scrutiny shifts, technology advances, enforcement priorities move from one area to the next. Yet many organizations continue operating under internal guidelines that were written to address yesterday’s risk, not today’s. 

Private practices like mine are facing an increasingly complex compliance landscape. Targeted payer audits, pre-payment reviews, artificial intelligence, data analytics, and heightened scrutiny of medical necessity are no longer isolated events, they’re becoming the new normal. Waiting until an audit letter arrives is no longer a compliance strategy; it’s damage control. 

It’s time to rewrite our internal guidelines with intention. Not because a regulation requires another policy and boy how much we love our policies, but because our compliance programs should reflect the risks our organizations face today. Every policy, audit plan, and educational initiative should answer one simple question: Does this help us identify, reduce, or prevent meaningful risk? 

Sometimes strengthening a compliance program isn’t about adding more, it starts by deciding what to keep, what to revise, and what to let go. 

In looking at my “big picture” scenario, you can’t just jump into the deep end without a life preserver.   

Twenty years ago, many compliance plans focused on meeting the seven elements of an effective compliance program. Today, the strongest programs still include those elements, but they also ask:

• Where are we financially vulnerable? 
• What are payers denying today? 
• What is the OIG focusing on? 
• Where is AI introducing new risk? 
• Which internal processes create the greatest compliance exposure? 

From there you can rewrite your internal guidelines to align with your initiatives, here are some examples. 

What We Kept: 

• Medical necessity  
• Risk adjustment accuracy  
• Drug administration documentation  
• Financial risk  
• OIG priorities  
• Patient safety documentation  

Depending on your industry, the principles that never go out of style are medical necessity, documentation integrity and ethical billing.  In my field of Oncology, auditing medical necessity is key, since it is an identified risk area. We cross-reference administered drugs against FDA-approved labeling, the NCCN Clinical Practice Guidelines in Oncology (NCCN Guidelines) and verify the clinical chart documentation substantiates patient diagnosis and stage. 

What we Killed: 

• “Gotcha” audits  
• Point deductions for insignificant errors  
• Chasing 100% perfection  
• Outdated policies 
• Metrics that are checking a box 

Outdated policies feel like playing Rick Astley song on repeat, “Never Gonna Give You Up”.  They lost their meaning 10 years ago, the original reason for the rule is gone, it’s time to drop the fluff. Stop meaningless audits, redundant education, checking boxes instead of evaluating risk. If you take one thing away from this it is your compliance plan should be relevant to now. Stop auditing every provider the same way, risk-based auditing is much more sophisticated. Monitor your payer trends before the payer recoups or refuses to pay for the services rendered (i.e. up-tick in external audits on modifier 25, vial size wastage audits). Perform data analytics on denials to understand where the deficiency lies (i.e. prior authorization, off-label usage). Provide education to providers that focuses on why instead of what. Since Oncology revenue cycle management is heavily scrutinized due to high-cost therapeutics, we need to refocus our lens to identify compliance issues early. 

Compliance has matured and so should your audits, instead of every provider gets 10 E/M audits annually, audit based on:

• New providers  
• High utilization patterns  
• Outlier billing  
• New service lines  
• New regulations  
• Prior audit findings  
• External payer focus  

Retire outdated policies, instead of reviewing 200 policies every 3 years simply because the calendar says so, does the policy still solve a problem? Retire policies because: 

• They referenced obsolete regulations  
• They duplicated another policy  
• They existed only because “we’ve always had one”  

Having metrics within your organization will help you achieve results as long as they are meaningful. For example, we ask providers to tell the patient’s story in their documentation to support the cancer diagnosis, stage, intent and drug ordered. I could have a metric for 100% staging on all cancer patients, however that’s only checking a box. The new mindset is to be clinically meaningful to an outside oncologist reading the note rather than checkbox driven. Can another oncologist understand: 

• Why treatment changed  
• Why therapy continues  
• Why a high-cost drug remains medically necessary  
• Why supportive medications are needed  
• Disease response  
• Toxicities  
• Treatment intent  

Most providers don’t think in coding terms, we must teach them the why behind change. Education should become collaborative instead of punitive. I recommend providing education utilizing real-world cases, reviewing medical necessity and incorporate peer reviews. Kill the phrase because CMS says so. Providers respond much better when they understand: 

• Why documentation protects them  
• Why diagnoses must be supported  
• Why medical necessity matters  
• Why payers deny claims  

Keep curiosity as this catches more compliance issues than checklists. 

• Instead of: Is the note signed? 

Ask: Does this documentation make clinical sense? 

• Instead of: Is there an ICD-10 code? 

Ask: Does the documentation support this diagnosis? 

• Instead of: Was chemotherapy billed correctly? 

Ask: Should chemotherapy have been administered at all based on what’s documented?

Those questions uncover the issues that truly matter for your organization and can drive your workplan. 

The strongest compliance programs aren’t the ones with the thickest policy manuals or the longest audit checklists. They’re the ones willing to edit themselves. Every outdated policy retired, every meaningless metric abandoned, and every unnecessary rule removed creates room to focus on what matters most: accurate documentation, ethical billing, patient care, and meaningful compliance. Sometimes the most important thing a compliance leader can do isn’t write another policy, it’s having the courage to delete one.

---

Connect with Stephanie on LinkedIn by Clicking her Name Below:

Stephanie Thebarge

---

NAMAS BLOG Disclaimer:

The NAMAS Blog features content written by both NAMAS staff and guest contributors. Guest contributors may present opinions or perspectives that differ from those officially instructed or encouraged by NAMAS. We believe in providing space for a range of informed viewpoints to foster dialogue, reflection, and deeper understanding within the auditing and compliance community.

Some contributors may use artificial intelligence (AI) tools in the development of their content. The decision to incorporate AI is left to the discretion of the author and does not reflect an endorsement or directive from NAMAS.

If you have questions, comments, or concerns about a specific blog post, we encourage you to contact the individual author directly. Their name and contact information are provided at the end of each post.