Using OIG General Compliance Program Guidance to Build an Audit-Ready Compliance Program in 2026

In November 2023, the HHS Office of Inspector General (OIG) published its General Compliance Program Guidance (GCPG), a reference guide for the healthcare compliance community. The GCPG applies to all individuals and entities involved in the healthcare industry, from large health systems to small physician practices, and it serves as the foundation for a new series of industry segment-specific compliance program guidance documents (ICPGs).

In 2026, the GCPG is more relevant than ever. Federal healthcare enforcement has reached record levels. The Department of Justice reported more than $5.7 billion in healthcare-related False Claims Act settlements and judgments in fiscal year 2025, and the 2026 National Health Care Fraud Takedown charged 455 defendants. CMS has expanded payment suspensions, revocations, and real-time data analytics through its Fraud Defense Operations Center. Executive Order 14395 established the White House Task Force to Eliminate Fraud, which emphasizes audits and compliance monitoring.

In this environment, an effective compliance program is not only a best practice. It is one of the most practical ways to prevent problems, detect them early, and respond in a way that demonstrates good faith. This article explains what the GCPG is, the seven elements of an effective compliance program, how to adapt the guidance to organizations of different sizes, and how to use it to build a compliance program that is ready for audits.

What Is the OIG General Compliance Program Guidance?

OIG has published voluntary compliance program guidance since 1998, with documents directed at segments such as hospitals, home health agencies, clinical laboratories, third-party billing companies, durable medical equipment suppliers, hospices, Medicare Advantage organizations, nursing facilities, physician practices, ambulance suppliers, and pharmaceutical manufacturers.

In 2023, OIG announced a modernized approach:

• First, a General Compliance Program Guidance that applies to all individuals and entities in the healthcare industry. OIG describes the GCPG as addressing key federal legal authorities, the seven elements of a compliance program, adaptations for small and large entities, other compliance considerations, and OIG processes and resources.

• Second, industry segment-specific compliance program guidance documents, tailored to the fraud and abuse risk areas of each industry subsector, beginning in 2024.

OIG has since published ICPGs for nursing facilities and Medicare Advantage. OIG describes each ICPG as working together with the GCPG as its updated and centralized source of voluntary compliance program guidance for that segment.

OIG emphasizes that its compliance guidance is voluntary and does not constitute a model compliance program. Instead, it sets out guidelines and risk areas that organizations should consider when developing, implementing, or evaluating a compliance program.

Key Federal Laws Covered in the GCPG

The GCPG summarizes the federal laws most relevant to healthcare compliance, including:

• The federal Anti-Kickback Statute.

• The physician self-referral law, often called the Stark Law.

• The False Claims Act.

• The Civil Monetary Penalties Law.

• OIG's exclusion authorities.

• HIPAA privacy and security rules.

• Criminal health care fraud statutes.

Understanding these laws helps leaders and staff recognize risk areas and understand why compliance policies matter.

The Seven Elements of an Effective Compliance Program

The GCPG discusses seven elements of an effective compliance program that apply across the healthcare industry.

Element 1: Written Policies and Procedures

Written policies and procedures establish the rules employees follow to meet federal healthcare program requirements. An audit-ready program typically includes:

• A code of conduct that communicates the organization's commitment to compliance.

• Policies addressing key risk areas, such as billing and coding, documentation, medical necessity, referral relationships, exclusion screening, overpayments, privacy, and record retention.

• Policies that are accessible, understandable, and reviewed at least annually.

• A process for updating policies when laws or operations change.

Element 2: Compliance Leadership and Oversight

The GCPG emphasizes the importance of a compliance officer, a compliance committee, and governing body oversight.

• Compliance officer. The organization should designate a compliance officer with sufficient authority, resources, and independence. The GCPG discusses the value of the compliance officer reporting directly to the chief executive and having direct access to the governing body, and it cautions against structures that create conflicts, such as having the compliance function led by or subordinate to legal counsel or the financial function.

• Compliance committee. A committee of leaders from key departments supports the compliance officer in implementing the program.

• Governing body. The board or owners should be knowledgeable about the compliance program, receive regular reports, and exercise reasonable oversight.

Element 3: Training and Education

Effective training helps staff understand compliance expectations and their own responsibilities.

• Provide general compliance training to all staff at hire and at least annually.

• Provide role-specific training for clinicians, coders, billing staff, intake staff, and leadership.

• Train the governing body on its oversight responsibilities.

• Track attendance and evaluate training effectiveness.

Element 4: Effective Lines of Communication and Disclosure Programs

Employees and others need safe ways to raise concerns.

• Maintain an anonymous or confidential reporting mechanism, such as a hotline.

• Communicate a clear non-retaliation policy.

• Make the compliance officer accessible.

• Track reports and their resolution.

Element 5: Enforcing Standards Through Consequences and Incentives

Standards must be applied consistently.

• Establish clear disciplinary guidelines for compliance violations.

• Apply discipline consistently, regardless of position.

• Consider incentives that recognize compliance-supporting behavior.

• Conduct background checks and exclusion screening for employees, contractors, and vendors.

Element 6: Risk Assessment, Auditing, and Monitoring

This element is central to audit readiness.

• Conduct a formal compliance risk assessment at least annually.

• Develop an annual audit plan based on the risk assessment.

• Conduct both auditing, which is a formal review by independent reviewers, and monitoring, which is ongoing review by operational staff.

• Use data, such as CMS's Program for Evaluating Payment Patterns Electronic Report (PEPPER) and internal analytics, to identify trends and outliers.

• Report results to the compliance committee and governing body.

Element 7: Responding to Detected Offenses and Developing Corrective Action Initiatives

When problems are found, the response matters.

• Investigate promptly and thoroughly.

• Determine root causes.

• Implement corrective actions and monitor their effectiveness.

• Report and return overpayments as required under 42 CFR 401.305.

• Consider self-disclosure when appropriate, such as through the HHS-OIG Health Care Fraud Self-Disclosure Protocol, the CMS Voluntary Self-Referral Disclosure Protocol, or, for potentially criminal conduct, disclosure to the Department of Justice under the joint policy announced in October 2026.

Adapting the GCPG for Small and Large Organizations

The GCPG recognizes that compliance programs should fit the size and complexity of the organization.

Small Organizations

For small practices and agencies with limited resources, OIG has recognized that the compliance officer may have other responsibilities, that compliance functions may be shared, and that outside resources can help. Practical approaches include:

• Designating a compliance contact with clear responsibilities and time to perform them.

• Using outside consultants or auditors for periodic reviews.

• Focusing on the highest-risk areas.

• Using OIG and CMS educational resources.

Large Organizations

Large organizations generally need:

• A dedicated compliance department with adequate staffing.

• Formal compliance committees, possibly at multiple levels.

• Sophisticated data analytics and auditing capabilities.

• Integration of compliance across affiliated entities.

Other Compliance Considerations in the GCPG

The GCPG also addresses topics such as quality and patient safety, new entrants to the healthcare industry, financial incentives and ownership structures, and compliance considerations related to emerging business models. Organizations should consider how these topics apply to their operations, especially when ownership, investment, or business models change.

Using the Industry Segment-Specific Guidance

Organizations should use the GCPG together with any applicable ICPG and with older segment-specific guidance that has not yet been updated. For example:

• The Nursing Facility ICPG addresses risk areas specific to nursing facilities, including quality of care and reimbursement.

• The Medicare Advantage ICPG addresses risk areas such as access to care and prior authorization, marketing and enrollment, risk adjustment, quality of care, oversight of third parties, compliance in vertically integrated organizations, and submission of accurate claims.

Providers in segments without a new ICPG can continue to consult OIG's earlier segment-specific guidance, along with OIG reports, audits, and enforcement actions relevant to their services.

What Makes a Compliance Program "Audit-Ready"?

An audit-ready compliance program is one that can demonstrate, with documentation, that it is designed effectively, implemented in practice, and working. When auditors, investigators, or prosecutors evaluate a compliance program, they often ask whether the program exists on paper only or whether it actually prevents, detects, and corrects problems.

Characteristics of an audit-ready program include:

• Documented risk assessments that reflect current enforcement priorities.

• An audit plan tied to identified risks, with completed audits and results.

• Evidence that findings led to corrective actions and follow-up.

• Records showing that overpayments were identified, quantified, reported, and returned on time.

• Training records showing who was trained, when, and on what.

• Hotline logs showing reports were received, investigated, and resolved.

• Exclusion screening records.

• Governing body minutes showing regular compliance reports and oversight.

• Policies that are current and reflect actual practices.

Questions Auditors and Investigators May Ask About Your Compliance Program

When an organization faces an audit, investigation, or settlement negotiation, government reviewers may ask questions designed to test whether the compliance program is real and effective. Preparing answers in advance is a good way to identify gaps. Typical questions include:

• Who is the compliance officer, to whom does that person report, and how much time and staff support does the role have?

• How often does the governing body receive compliance reports, and what do those reports contain?

• When was the last compliance risk assessment completed, and what risks did it identify?

• What audits were performed in the last year, what did they find, and what corrective actions followed?

• How are overpayments identified, quantified, and returned, and how many were returned in the last year?

• How many hotline reports were received, how were they investigated, and how were they resolved?

• How are employees, contractors, and vendors screened for exclusion?

• What training do employees receive, and how is completion tracked?

• How are referral and financial relationships reviewed and approved?

• What happened the last time a significant compliance problem was discovered?

An organization that can answer these questions with documents, not just descriptions, is in a stronger position.

Measuring Compliance Program Effectiveness

Effectiveness is about results, not only structure. Organizations can track measures such as:

• Percentage of staff who completed required training on time.

• Number and types of hotline reports and average time to resolution.

• Number of audits completed compared with the audit plan.

• Error rates in audited areas and changes over time.

• Number and amount of overpayments identified and returned.

• Time from identification to corrective action.

• Results of follow-up audits after corrective actions.

• Exclusion screening completion rates.

• Employee survey results about comfort raising concerns.

Reviewing these measures regularly helps the compliance committee and governing body understand whether the program is working and where to invest resources.

Documentation to Maintain

To demonstrate an effective program, organizations commonly keep:

• The code of conduct and all compliance policies, with revision histories.

• Compliance officer job description and reporting structure.

• Compliance committee charters, agendas, and minutes.

• Governing body minutes reflecting compliance reports and decisions.

• Annual risk assessments and audit plans.

• Audit reports, corrective action plans, and follow-up results.

• Training materials and attendance records.

• Hotline logs and investigation files.

• Exclusion screening records.

• Overpayment logs and refund documentation.

• Records of disciplinary actions related to compliance.

Aligning Your Risk Assessment With 2026 Enforcement Priorities

A risk assessment is most useful when it reflects the risks that regulators and enforcers are actually focused on. Based on recent federal actions, risk areas for many providers in 2026 include:

• Medicaid billing, especially home and community-based services, behavioral health, and personal care.

• Durable medical equipment, laboratory testing, and skin substitutes.

• Hospice eligibility and home health documentation.

• Telehealth-enabled ordering.

• Medicare Advantage risk adjustment and coding.

• Provider enrollment accuracy, including ownership and managing employee reporting.

• Referral relationships and marketing arrangements.

• Retention of identified overpayments.

• Identity misuse involving beneficiary and provider identifiers.

Organizations should also consider their own data, prior audit findings, contractor reviews, hotline reports, and operational changes.

The Role of the Governing Body

The GCPG emphasizes that the governing body, whether a board of directors, owners, or another body, has an important oversight role. Board members do not manage day-to-day compliance, but they should understand the compliance program and ensure it is effective. Practical steps include:

• Receiving compliance reports at regular intervals, such as quarterly, and documenting discussion in minutes.

• Meeting with the compliance officer without management present, at least periodically.

• Reviewing the annual risk assessment and audit plan.

• Asking questions about significant findings, overpayments, hotline trends, and corrective actions.

• Ensuring that the compliance function has adequate resources and authority.

• Participating in compliance training focused on board responsibilities.

In 2026, with heightened federal attention on ownership, management, and accountability across the healthcare system, documented board oversight is an important part of demonstrating that compliance is taken seriously at the highest level.

Compliance During Growth and Ownership Changes

The GCPG discusses compliance considerations for new entrants to the healthcare industry and for organizations with financial incentives or ownership structures that may create compliance risk. Organizations that are growing, being acquired, acquiring others, or receiving outside investment should:

• Conduct compliance due diligence before transactions, including billing, enrollment, referral relationships, and prior audits.

• Integrate acquired entities into the compliance program quickly.

• Review whether financial incentives, such as productivity bonuses or growth targets, could encourage improper billing.

• Confirm that Medicare and Medicaid enrollment changes are reported accurately and on time.

• Evaluate enrollment rules that affect transactions, such as the change in majority ownership rules for hospices and home health agencies and any active enrollment moratoria.

A Practical 90-Day Plan to Strengthen Your Compliance Program

Days 1 to 30: Assess

• Compare your current program to the seven elements in the GCPG and any applicable ICPG.

• Review policies, training records, hotline logs, audit reports, and governing body minutes.

• Identify gaps and prioritize them by risk.

Days 31 to 60: Build

• Update or create priority policies, such as overpayments, exclusion screening, and audit response.

• Conduct or update the annual risk assessment.

• Develop a risk-based audit plan.

• Refresh training for leadership and high-risk departments.

Days 61 to 90: Implement and Report

• Begin audits under the new plan.

• Establish a regular reporting schedule to the compliance committee and governing body.

• Track corrective actions to completion.

• Document everything.

Common Compliance Program Weaknesses

• Policies that are outdated or do not match actual practices.

• A compliance officer without sufficient authority, time, or resources.

• A governing body that receives little or no compliance information.

• Training that is generic and not tailored to roles.

• Hotlines that are rarely used or not trusted.

• Audits that identify problems without corrective action.

• Overpayments that are identified but not returned.

• Risk assessments that are not updated.

• Lack of documentation showing that the program works.

Using OIG Resources Beyond the GCPG

OIG offers additional resources that can support an audit-ready compliance program. These include advisory opinions on specific arrangements under the Anti-Kickback Statute, special fraud alerts and bulletins that describe suspect practices, audit and evaluation reports that highlight risk areas in particular service lines, the List of Excluded Individuals and Entities for screening, and the Health Care Fraud Self-Disclosure Protocol. Reviewing OIG reports relevant to your services each year is a practical way to keep your risk assessment current.

Frequently Asked Questions

Is the GCPG mandatory?

No. OIG's compliance program guidance is voluntary. However, it reflects OIG's views on effective compliance and is widely used as a benchmark.

What are the seven elements of a compliance program?

According to the GCPG, they are written policies and procedures; compliance leadership and oversight; training and education; effective lines of communication with the compliance officer and disclosure programs; enforcing standards through consequences and incentives; risk assessment, auditing, and monitoring; and responding to detected offenses and developing corrective action initiatives.

Do small practices need a compliance program?

Compliance programs should be scaled to the organization's size and resources. The GCPG discusses adaptations for small entities, and even small organizations benefit from basic policies, training, screening, auditing, and a way to raise concerns.

Is there specific guidance for my type of organization?

OIG has published industry segment-specific guidance for nursing facilities and Medicare Advantage, and it maintains earlier segment-specific guidance for other provider types. Check OIG's compliance webpage for the latest documents.

How often should we conduct a risk assessment?

At least annually, and whenever there are significant changes in laws, enforcement priorities, operations, or ownership.

Conclusion

The OIG General Compliance Program Guidance offers a practical, widely recognized framework for building an effective compliance program. In 2026, with record enforcement activity, real-time data analytics, and a coordinated federal anti-fraud effort, organizations that implement the seven elements thoughtfully and document their work are better positioned to prevent problems, detect them early, and respond credibly when auditors or investigators ask questions.

An audit-ready program is not just a binder of policies. It is a living system of leadership oversight, risk assessment, auditing, training, communication, enforcement, and corrective action that can be demonstrated with evidence.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in compliance program development, risk assessment, auditing, and audit readiness. We help organizations evaluate their programs against OIG's General Compliance Program Guidance and industry-specific guidance, conduct risk assessments, build audit plans, update policies, train leadership and staff, and document program effectiveness. If you would like help building an audit-ready compliance program, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. HHS-OIG General Compliance Program Guidance (November 2023), PDF. https://oig.hhs.gov/documents/compliance-guidance/1135/HHS-OIG-GCPG-2023.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Modernization of Compliance Program Guidance Documents. https://oig.hhs.gov/documents/compliance-guidance/1114/GCPG-ICPG-Federal-Register-Notice.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Compliance. https://oig.hhs.gov/compliance/

• U.S. Department of Health and Human Services, Office of Inspector General. Nursing Facility Industry Segment-Specific Compliance Program Guidance. https://oig.hhs.gov/compliance/nursing-facility-icpg/

• U.S. Department of Health and Human Services, Office of Inspector General. Medicare Advantage Industry Segment-Specific Compliance Program Guidance. https://oig.hhs.gov/compliance/ma-icpg/

• U.S. Department of Health and Human Services, Office of Inspector General. Spring 2026 Semiannual Report to Congress. https://oig.hhs.gov/documents/sar/11794/Spring_2026_SAR.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. The 7 Fundamental Elements of a Compliance Program. https://oig.hhs.gov/documents/featured-topics/11789/Guide_to_the_Seven_Fundamentalsx.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure. https://oig.hhs.gov/compliance/self-disclosure-info/

• U.S. Department of Justice, Office of Public Affairs. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025. https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-68b-fiscal-year-2025

• U.S. Department of Justice, Office of Public Affairs. National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection with Over $6.5 Billion in Alleged Fraud (June 23, 2026). https://www.justice.gov/opa/pr/national-health-care-fraud-takedown-results-455-defendants-charged-connection-over-65

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud. https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self

• The White House. Establishing the Task Force to Eliminate Fraud, Executive Order 14395 (March 16, 2026). https://www.whitehouse.gov/presidential-actions/2026/03/establishing-the-task-force-to-eliminate-fraud/

• Centers for Medicare & Medicaid Services, Center for Program Integrity. Crushing Fraud: Annual Report 2025. https://www.cms.gov/files/document/crushing-fraud-annual-report.pdf

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs