Regulatory and compliance programmes: the project manager's approach
Regulatory and compliance programmes are the projects a health system cannot choose to skip. A federal rule, an audit finding or a payer requirement sets the scope and, often, a deadline that cannot move. Missing it means penalties, lost reimbursement or a corrective action plan.
For a project manager, these programmes are different in three ways: the regulation is the requirements document, evidence matters as much as delivery, and the work never really ends, because compliance has to be sustained and re-proven every year.
The programmes you are likely to run
HIPAA Privacy & Security
HHS Office for Civil Rights (OCR)
Security risk analysis, access controls, encryption, audit logging, workforce training, business associate agreements.
Deadline: Continuous; annual risk analysis expected. Audit or breach findings bring hard dates.
Interoperability & information blocking
21st Century Cures Act, ONC/ASTP, CMS
Patient access APIs (FHIR), release of results to patients, information-blocking exception policies, TEFCA participation.
Deadline: Rule-driven effective dates; enforcement with disincentives for providers.
Price transparency
CMS Hospital Price Transparency rule
Machine-readable file of standard charges and a consumer-friendly shoppable-services display.
Deadline: Ongoing; CMS warning letters give roughly 90 days to correct.
CMS quality & payment programmes
CMS (MIPS, Promoting Interoperability, Hospital IQR)
Measure capture in the EHR, data validation, attestation and submission.
Deadline: Fixed annual reporting periods and submission windows.
Joint Commission accreditation
The Joint Commission
Survey readiness across National Patient Safety Goals, environment of care, medication management and documentation.
Deadline: Unannounced surveys roughly every 36 months; findings need evidence of standards compliance within 60 days.
Billing compliance & corrective action
OIG, DOJ, payer audits
Coding accuracy, documentation improvement, Corporate Integrity Agreement obligations, repayment processes.
Deadline: Set by the agreement or audit; often multi-year with independent review.
A six-step approach, from rule to evidence
- 1
Interpret the rule
- Work with compliance, legal and the business owner to turn the regulation into plain-language requirements.
- Record each requirement with its citation, so every task traces back to the rule.
- Confirm the effective date, any enforcement grace period and the penalties for missing it.
Evidence produced: Requirements register with citations
- 2
Assess the gap
- Compare current state against each requirement: compliant, partly compliant or not compliant.
- Rate each gap by risk (likelihood of a finding × penalty or patient impact).
- Identify owners in every affected department, not only IT.
Evidence produced: Gap assessment and risk ratings
- 3
Plan backwards from the deadline
- Schedule from the compliance date backwards, leaving time for testing, training and an internal audit before it.
- Put high-risk gaps and long-lead items (vendor upgrades, contracts) on the critical path first.
- Agree an interim control or workaround for anything that will not be ready in time.
Evidence produced: Integrated schedule and interim-controls log
- 4
Remediate
- Deliver changes to systems, policies, procedures and workflows together; a policy without a workflow change is not compliance.
- Run workforce training and track completion by role.
- Keep a change log showing what changed, when and who approved it.
Evidence produced: Updated policies, system changes, training records
- 5
Validate and collect evidence
- Test every control and store the proof: screenshots, reports, sign-offs, sample audits.
- Ask internal audit or an independent reviewer to test before the regulator does.
- Build an evidence binder organised by requirement, so an auditor can follow it in minutes.
Evidence produced: Evidence binder mapped to requirements
- 6
Sustain and monitor
- Hand controls to named operational owners with a monitoring schedule.
- Set up recurring checks (access reviews, file refreshes, audits) and dashboards.
- Track regulatory change so next year's rule updates start as a planned change, not a fire drill.
Evidence produced: Control ownership matrix and monitoring calendar
How compliance projects differ from normal projects
| Dimension | Compliance programme | Typical project |
|---|---|---|
| Scope | Set by the regulation; you cannot trade it away. | Negotiated against time and cost. |
| Deadline | External and usually fixed. | Set by the sponsor; can move with approval. |
| Definition of done | Proven with evidence that an auditor accepts. | Accepted by the sponsor. |
| Key stakeholders | Compliance officer, legal, privacy/security officers, regulators. | Sponsor, users, delivery team. |
| End state | Ongoing: monitoring and annual re-proof. | Project closes and hands over. |
Common pitfalls and how to prevent them
Starting too late
Track proposed rules, not only final ones. Start the gap assessment as soon as a final rule is published.
Treating it as an IT project
Most findings come from workflows and people. Give clinical and operational owners named tasks.
No evidence trail
Decide at kickoff what proof each control needs, and collect it as you go rather than at the end.
Over-scoping
Separate 'required by the rule' from 'nice to have'. Deliver the required items first.
Nobody owns it afterwards
Don't close the project until each control has an operational owner and a monitoring schedule.
Frequently asked questions
- What is a healthcare compliance programme?
- A structured set of projects and ongoing controls that bring an organisation in line with a regulation or accreditation standard, such as HIPAA, CMS rules or Joint Commission standards, and keep it there.
- What does a project manager do on a compliance programme?
- The PM turns the regulation into a traceable requirements list, runs the gap assessment, plans backwards from the deadline, coordinates remediation across departments, and makes sure evidence is collected and handed to operational owners.
- How is compliance work different from other healthcare projects?
- Scope and deadline are set externally, success is judged by an auditor's acceptance of evidence, and the work continues as monitoring after the project closes.
- Do I need a legal background?
- No. You need to work closely with compliance and legal, who interpret the rule. Your job is to make the work traceable, scheduled and provable.