Top Risks 2024

2. Revenue cycle 

Since the COVID-19 pandemic, healthcare organizations have faced lost revenues due to changes in the service delivery models and higher employment and supply costs. The ability to bill and collect for all services provided has become even more important. Inefficiencies in revenue cycle operations and performance could result in delayed or reduced cash flow, unnecessary overhead, negative patient experience, and reduction in community benefit. Noncompliance with government billing regulations and payer contract requirements could result in lost reimbursement, fines, and exclusion from participation in governmental programs. These challenges might be magnified for organizations that rely on third-party vendors to provide some or all their revenue cycle functions on an outsourced basis and, therefore, have less day-to-day oversight and control.  

Similarly, risks increase for healthcare organizations relying on automated claims billing systems for which they have limited visibility to or control over functionality. Newer electronic medical record systems are incorporating “clinically driven revenue cycle” processes whereby the billing functions are triggered by clinician’s actions/documents. In addition, commercial payers might aggressively negotiate reimbursement terms or deny reimbursements in markets with little payer competition or where healthcare organizations wield minimal buying power.

Audits for consideration:  

• Revenue cycle process effectiveness assessment 
• Clinical documentation, coding, and billing compliance 
• Payer contracts / expected reimbursement 
• Chargemaster maintenance 
• Denials management 
• Patient access / registration 
  
  
  

3. Accounts payable 

Key business processes such as accounts payable are critical to every healthcare organization. While these processes are highly visible and typically well-managed, when significant changes occur within the AP process, e.g., leadership or employee turnover or staff reductions, or within the overall organization, e.g., changes in operating procedures due to a pandemic, implementation of a new enterprise resource planning system, or organizational consolidation or centralization post-merger), fraud risks might increase due to changes in people, processes, or technology, or suspension/elimination of key internal controls.  

Specific risks include fraudulent or unauthorized payments to existing vendors or employees, creation of and payment to fictitious vendors, and inappropriate or unauthorized updates to vendor master data causing payments to be diverted from the correct vendor. 

Audits for consideration: 

• Analysis of AP transaction data to identify potential unauthorized, fraudulent or duplicate payments 
• Analysis of corporate purchase card transaction data for nonbusiness uses 
• AP and vendor master file system access and general IT controls audit 
• Vendor master file change management process 
• Procure-to-pay end-to-end process audit 
  
  
  

4. Human resources and workforce challenges 

The workforce challenges that healthcare organizations face include recruiting, hiring, and retaining qualified employees as demand for healthcare services increases due to the aging U.S. population and the competition for healthcare workers intensifies. Workers leaving the healthcare sector due to pandemic-related burnout and accelerated retirements have only worsened the challenge over the past three years.  

One way healthcare organizations have responded is through increased reliance on travel nurses. Some formed their own travel nurse programs to limit related costs. Others offered increased benefits or incentives to retain workers. Some of those that could not respond with creative solutions reduced or eliminated services or service lines at select sites of care.  

The situation has created several specific risks that hospitals and health systems historically have not had to deal with before on such a scale. These risks include:  

• Decreased quality and safety of patient care and clinical outcomes, leading to higher readmission rates, higher hospital-acquired infection rates, and higher mortality rates  
• Lower quality scores leading to lower reimbursement rates  
• Higher labor costs attributable to higher salary and benefit expenses and travel nurse program expenses resulting in impaired financial performance  
• Increased difficulty in filling openings in the executive ranks, especially in organizations where the approach to succession planning (that is, identifying and mentoring successors) has not been formalized or well-established 
• Inefficient benefit plan structure and design, creating excessive costs for both the employer and employee, leading to dissatisfaction with potential turnover and decrease ability to attract scarce resources  
  
  

Audits for consideration:  

• Travel nurse management and contract compliance  
• Critical department staffing levels assessment 
• Recruiting and retention processes 
• Succession planning program 
• Premium employees pay levels 
• Employee benefit plan review, including enrollment criteria and processes 

5. Physician compensation 

Physician contracts continue to be a significant risk area for healthcare organizations due to the high operational, reputational and financial exposures. Risks include violating federal fraud and abuse statutes, e.g., Stark, false claims, and anti-kickback statutes, through payments to physicians without a contract, in excess of contractual amounts, and/or above fair market value; physicians using hospital space without proper lease or compensation to the health system; recruitment arrangements that do not meet regulatory requirements; and failure to monitor compliance with contract and recruitment arrangement terms. 

Audits for consideration:  

• Physician payment processes  
• Physician contracting process, including recruitment and Leases  
• Physician compensation models, e.g., RVU, incentive payments, administrative services 

Audits for consideration:  

• No Surprises Act compliance  

3. Price transparency 

Stricter technical price transparency requirements took effect in 2024, including:  

• New terms defined 
• Good faith effort and machine-readable file attestations 
• Standardizing the MRF format and data elements 
• Improving access to hospital MRFs 
• Enhanced enforcement 
  
  

There are additional federal requirements that will go in effect Jan. 1, 2025, as Estimated Allowed Amount, Modifier, Drug Unit of Measurement, and Drug Type of Measurement become required data elements in MRF.  

Because price transparency files are required to be publicly posted, CMS is able to remotely validate compliance and has begun publicly citing hospitals for noncompliance. Monetary fines can be imposed and impact a hospital’s reputational risk stemming from public criticism if a hospital knowingly does not comply with requirements or revenue cycle bills do not match charges posted on a hospital’s website.  

Audits for consideration:  

• Compliance with CMS and any applicable state regulations  

4. Advance beneficiary notice 

Medicare provides coverage for a wide variety of medical services, but that coverage is not absolute. There are circumstances where services generally covered by Medicare are denied as either not reasonable or necessary, or as constituting custodial care. Healthcare organizations must notify a beneficiary in advance by providing an Advance Beneficiary Notice when the provider believes that items or services will likely be denied because of the above criteria. If the provider does not deliver a valid ABN to the beneficiary, the beneficiary cannot be billed, resulting in lost revenue to the healthcare organization. 

If an ABN is used inappropriately to collect from a Medicare beneficiary, a refund to the beneficiary may be required. Refunds must be made within specified time limits; healthcare organizations who knowingly fail to make a required refund within these time limits may be subject to civil money penalties and/or exclusion from the Medicare program.  

Audits for consideration:  

• ABN compliance  

 

5. Credentialing 

A healthcare organization’s medical staff bylaws should require that medical staff are credentialed and privileged upon new hire and at least every two years. Procedures to flag all Licensed Independent Practitioners, i.e., any individual permitted by law and by the organization to provide care, treatment and services, without direction or supervision, requiring credentialing and re-credentialing and the tracking of credentialing and re-credentialing activities are critical to make certain it is done and completed timely. Both CMS and Joint Commission have developed detailed guidance. Successful credentialing thus requires sound initial assessment procedures, as well as access to comprehensive, reliable and practitioner-specific performance data.  

Organizations can be at risk of lawsuits alleging negligent credentialing practices if privileges are approved without fully verifying an applicant’s qualifications and proficiency or professional liability insurance coverage or licensing lapses in off years of the biennial credentialing process.  

Audits for consideration:  

• Practitioner credentialing 

Key considerations for business continuity in healthcare organizations include the importance of Enterprise Resilience, which is a collaborative effort across departments to recover and continue operations from the onset of a disruption through to the restoration of normal operations. Enterprise Resilience planning ensures the organization can recover and maintain essential business functions, provide safe and quality patient care, and safeguard sensitive data in the event of system downtime.  

Additionally, the organization must prioritize the restoration of applications that are vital to patient care and safety. Not all systems are equally essential, so a clear framework for application recovery prioritization is necessary. Applications such as electronic health records, patient monitoring systems, and other key healthcare tools must be restored first, while less critical systems can be brought online later. Enterprise Resilience also includes risk mitigation strategies such as business impact analyses, downtime procedures, and regular testing and training to ensure staff are prepared to respond effectively to any disruptions. Failure to address these risks could undermine patient safety and hinder the ability to comply with legal, regulatory, and financial obligations.  

Audits for consideration: 

• Business continuity plan for disruptions and resilience. 
• Third-party risk management audit for vendor resilience 
• Application recovery priority  

 

3. Biomed device security 

Biomedical devices are increasingly connected to the internet, which exposes them to cyberattacks that can compromise patient safety and disrupt care. Attacks can lead to device malfunctions that harm patients, theft of sensitive data for identity theft or blackmail, and disruptions in treatment. Older medical devices are especially vulnerable due to outdated software, lack of support, and regulatory challenges. Outdated software often contains known vulnerabilities that attackers can exploit, while lack of manufacturer support means these vulnerabilities remain unpatched. The complexity of medical devices and the time-consuming FDA approval process for software updates further complicate security. 

Many healthcare organizations still lack mature governance over medical device procurement, vendor oversight, and risk management. Insufficient security controls like poor access management, weak passwords, and inadequate network segmentation increase risks to patient safety and organizational security. 

Audits for consideration: 

• Biomedical device governance and procurement  
• Biomedical device security  
• Biomedical device maintenance and third-party service-level agreement compliance 

4. Cybersecurity  

Cybersecurity threats continue to evolve rapidly, with third-party incidents increasingly causing significant impacts on healthcare organizations. The lack of mature controls governing cybersecurity remains a top risk, particularly as the likelihood of an attack causing extended downtime has grown significantly in recent years. While layered technology solutions and the information security department form the first line of defense against these threats, the consequences of a cyberattack can span across the entire organization, affecting both IT infrastructure and business operations. Risks include system downtime, which hampers the ability to provide patient care, the exposure of sensitive data, employees falling victim to social engineering tactics, and attacks originating from trusted third parties, such as vendors or software providers. Additionally, healthcare organizations face challenges in quickly recovering from a substantial IT threat, and the risks associated with unauthorized access to systems and data continue to rise. In addition to the direct impact on patient care and operations, cyber threats can lead to significant financial losses, legal liabilities, and reputational damage. 

Audits for consideration:  

• Cybersecurity risk assessment  
• Third party security risk management  
• Cybersecurity controls and technology 
• Ransomware preparedness and response  
• Incident response and recovery  
• Vulnerability management  

5. Data governance 

Data governance refers to the comprehensive management of an organization’s data through well-defined procedures and plans. It ensures that both structured and unstructured data are accessible, accurate, secure, and usable. Effective data governance is considered both high risk and high reward, especially when data can be fully leveraged to enhance decision-making and analytics capabilities. Weak internal controls in data governance can compromise the reliability of data used in decision-making and heighten the risk of unauthorized or inappropriate data disclosure. 

A strong data governance program provides essential safeguards to ensure data security, privacy, accuracy, accessibility, and usability. Common risk areas include the potential for extensive patient data to reside on personal devices, unmanaged network shares, clinical devices, and various third-party platforms. 

Audits for consideration:  

• Data governance program maturing  
• Data location and inventory classification   
• Third-party data handling and security  
• Data loss prevention  
• Data retention and disposal