The CMS memo, read and assigned before lunch.
A memo arrives. Mandate reads it, separates the obligations from the background, quotes the memo text behind each action item, names the department, and sets a working due date ahead of CMS's. Each owner gets a morning brief. The officer sees what is late, what is with compliance, and what closed, with the evidence attached.
- Acknowledgements by name on the memo, with a timeline entry per acknowledgement
- Correct a department once and the next memo of that kind goes to the right owner
- Every reassignment, evidence upload, and return is a timeline entry nobody can edit later
Eighteen tables. The current standards. Nothing kept.
ODAG Tables 1 to 5, CDAG Tables 1 to 7, FA Tables 1 to 4, SNPCC, and CPE. Field rules come from the CMS record layouts. Timeliness comes from the current regulation, which is why the Scrubber tests standard organization determinations at 7 days when the protocol PDF still says 14.
- Complete universe export with the issue written into the row, plus tabs for timeliness, missing data, and formatting
- Large files run in a worker so a 70,000 row universe does not lock the screen
- Validated in memory. Enrollee rows are removed before anything is stored. A de-identified timeliness summary is all that persists
Engagement notice to final report, in the CMS format.
Internal program audits on ODAG, CDAG, SNPCC, and provider directory accuracy, and delegated entity audits, on one engine. The notice goes out on your letterhead. The universe request runs on the CMS clock. The data check is the Scrubber. Sampling follows the protocol. Findings become conditions, and the draft and final reports come out in the CMS program audit format with the results workbook beside them.
- Auditee access with its own sign-in and multi-factor, so a department or a vendor works its own evidence request
- Protected health information is working material only: samples drawn from validated universes and destroyed at close, with the destruction record on the audit
- Every finding routes to the Issues Log and, where warranted, opens a CAP
A policy checked against the rule that governs it, with the citation next to every flag.
Open a policy for review and the guide has already checked it against the final rule, the CMS memos your plan received, and the duties in your state Medicaid contract. It flags only what it can cite, offers the wording, and stays silent where it is not certain. RuleIQ does the same from the rule's side: it reads a proposed or final rule as duties, matches each duty to the policy that should carry it, and lists the duties no policy cites yet, by department.
- Certain or silent. A flag without a source is not shown
- Department owners review and attest in the same screen; the officer signs off
- Every review is recorded with what changed and why, in one plain sentence
The risk register scored the way the compliance committee reads it.
Every risk sits in one of the eight compliance domains or Reputational, with inherent and residual scores, the owner, the controls, and the year over year change. The heat map and the register go to the committee and the board as they are, and the work plan draws its monitoring from what scored highest.
- Eight domains plus Reputational, nothing invented
- Inherent and residual scoring with the controls that close the gap
- Feeds the COA Work Plan, so monitoring follows the risk
A privacy incident carried from the first report to the last letter.
Intake, the risk assessment, the sixty day clock from discovery, state rules, the notifications, and the letters to members, HHS, and the covered recipients who reported it. The program itself lives beside the incidents: policies, training, the vendor reviews, and the officer’s record.
- The clock starts at intake and is visible on every case
- Assessment written to the HIPAA factors, with the outcome recorded either way
- Letters generated from the case and kept as sent
- Discovery. The clock starts the day the incident is known, or should have been known. Every case is dated from that day, not from the day it reached the privacy officer.45 CFR 164.404(b)
- Assessment. The four factor risk assessment: what was involved, who used or received it, whether it was actually acquired or viewed, and how far the harm was mitigated. The outcome is recorded either way.45 CFR 164.402
- Notification. Individuals without unreasonable delay and within sixty days. HHS within sixty days when five hundred or more are affected, otherwise in the annual log. Media when five hundred or more in a state.45 CFR 164.404, 164.406, 164.408
- Business associates. Notice from the associate to the plan, the agreement terms that bind it, and the record of both.45 CFR 164.410, 164.504(e)
- Mitigation and sanctions. Harmful effects mitigated, workforce sanctions applied and recorded, substance use disorder records handled under their own consent rules.45 CFR 164.530(e), (f) · 42 CFR Part 2
- Documentation. The case, the letters, and the decisions kept for six years, ready for an OCR request.45 CFR 164.530(j)
The roster in, adequacy measured, the HPMS tables out.
The roster is scored against every CMS standard by county and specialty every time it changes. Gaps become findings the network team works. Office attestations run on a cycle so the roster stays true. Drive times are mapped. When a gap cannot be closed, the exception request drafts itself with the rationale and the supporting data.
- Standards met by county, thin margins flagged before they become gaps
- Trend across runs for the board
- Correspondence and attestations on the record
