Office of Risk Management

UToledo Health (“UToledo”), encompassing University of Toledo Physicians, LLC (“UTP”), University of Toledo Medical Center (“UTMC”), and all affiliated entities, is committed to conducting all clinical, academic, and business activities with integrity and in compliance with applicable federal, state, and private payer laws and ethical standards, including guidance issued by the Office of Inspector General (“OIG”).

Healthcare Compliance is a shared, enterprise‑wide responsibility integrated into daily operations and decision‑making. All individuals and entities acting on behalf of UToledo, including employees, faculty, providers, trainees, contractors, vendors, and agents, are expected to uphold these standards and to seek guidance or report concerns without fear of retaliation.

Adherence to the UToledo Healthcare Compliance Program is a necessary condition of employment, appointment, engagement, or contractual relationship and is essential to sustain trust, accountability, and organizational excellence.

UToledo has established this Ethics and Healthcare Compliance Program (“Program”) to affirm its enduring commitment to delivering high-quality, patient-centered care in compliance with all applicable federal, state, and local laws and regulations. This Program supports UToledo’s mission to improve the human condition through excellence in healthcare, education, and research.

UToledo’s Healthcare Compliance Program is designed to promote ethical conduct and a culture of integrity across all operations. It serves as a practical guide for all personnel, helping them perform their job functions in a manner that aligns with applicable laws, regulations, and internal policies. The Program is structured to ensure compliance with federal, state, and local requirements; prevent, detect, and respond to instances of noncompliance; evaluate the effectiveness of policies and procedures to mitigate risk; and provide a framework for reporting and addressing potential violations. Ultimately, it supports UToledo’s commitment to legal and ethical excellence while fostering a safe and accountable healthcare environment.

To align with federal guidelines for an effective compliance program, UToledo’s incorporates the following core elements, including an annual risk assessment:

• Written Standards and Policies
  Clearly articulate UToledo’s commitment to ethical behavior and legal compliance.
• Designated Compliance Leadership
  Includes a Chief Compliance Officer who reports directly to senior leadership and the Board of Trustees, and an Executive Compliance Committee responsible for oversight.
• Training and Education
  All workforce members are required to complete mandatory compliance training, including modules on fraud, waste, and abuse (FWA) and Health Insurance Portability and Accountability Act (HIPAA). Training is tailored to specific roles and responsibilities, and supplemental training is assigned as needed to address compliance gaps.
• Reporting and Investigation
  All personnel have a duty to report suspected non-compliance. Confidential reporting mechanisms are in place, including the anonymous mycompliancereport.com line, along with established procedures for investigation and resolution.
• Monitoring and Auditing
  Ongoing internal reviews are conducted to assess compliance risks and ensure adherence to policies and regulatory requirements.
• Organizational Accountability and Corrective Action
  UToledo applies consistent disciplinary guidelines and implements corrective action plans to address compliance concerns, promote accountability, and prevent recurrence.
• External Offense Response and Corrective Steps
  UToledo is committed to self-disclosure of certain identified errors, issuing refunds for overpayments, and taking appropriate corrective actions to mitigate future risk and maintain regulatory compliance.
• Risk Assessment (Informal Element)

UToledo conducts an annual enterprise-wide risk assessment to proactively identify, prioritize, and mitigate compliance risks. Results are used to inform the compliance work plan, training focus areas, auditing activities, and resource allocation to strengthen the overall effectiveness of the compliance program.

In addition to the scheduled annual review, the Healthcare Compliance Program is regularly evaluated and updated to reflect changes in laws, regulations, and industry’s best practices. This ongoing process ensures the program remains effective, relevant, and aligned with UToledo’s commitment to ethical and compliant operations.

UToledo is dedicated to fostering a culture where ethical decision-making, transparency, and accountability are central to every role. All workforce members are expected to uphold the highest standards of professional conduct, avoid conflicts of interest, and speak up about concerns- confident that they can do so without fear of retaliation.

UToledo upholds a comprehensive set of Standards of Ethical Conduct and institutional policies that guide the behavior of its workforce, contractors, and affiliated entities. These standards reflect UToledo’s commitment to ethical, legal, and professional conduct in all aspects of patient care, education, research, and operations.

UToldeo’s Standards of Ethical Conduct articulate the values that guide our workforce beyond minimum compliance requirements.

These principles complement the University’s Standards of Conduct (Policy 3364-25-01) and apply to all members of the UToledo community:

• Comply with applicable laws, regulations, and University policies
• Act with honesty, fairness, and integrity in all professional activities
• Foster a safe, inclusive, and respectful environment
• Avoid conflicts of interest and disclose potential concerns promptly
• Promote a culture of ethical behavior and accountability

These commitments are reinforced through regular training, policy updates, and leadership engagement. Violations of University policies remain subject to disciplinary action.

UToledo has implemented a comprehensive framework of policies and procedures that ensure alignment with federal and state regulations, university policies, and healthcare program standards. These policies are foundational to UToledo’s healthcare compliance infrastructure and are regularly reviewed to reflect evolving legal requirements and best practices.

These policies are designed to:

• Provide clear guidance for ethical and compliant service delivery
• Support daily operational adherence to legal and regulatory standards
• Foster a culture of compliance and transparency
• Build trust with patients, partners, and the broader community

When UToledo delegates responsibilities to third-party vendors or service providers, those entities are contractually required to comply with UToledo’s policies, procedures, standards and applicable federal and state laws. This includes adherence to fraud, waste, and abuse (FWA) prevention protocols and participation in UToledo’s compliance training and reporting systems.

Accessibility and Review

All UToledo policies are available to the public through the UToledo Policy Portal. Depending on the type of policy, reviews occur either annually or every three years, with updates made as necessary to reflect changes in laws, regulations, or operational needs. Draft policies are shared for campus-wide feedback, promoting transparency and encouraging stakeholder participation in the policy development process. Policy owners are responsible for ensuring timely review, revision, and implementation in accordance with established governance processes.

UToledo is committed to ensuring that its policies are accessible to individuals with disabilities, consistent with applicable federal and state accessibility requirements. Reasonable accommodation and alternative formats are available upon request.

Approved policy changes are communicated to affected stakeholders through established institutional communication channels.

The organization maintains a robust and independent HIPAA Privacy Program, overseen by the designated Privacy Officer. This program includes comprehensive HIPAA policies, privacy practices, workforce training, breach notification procedures, and regulatory compliance activities.

The HIPAA Privacy Program operates separately from the Healthcare Compliance Department. While the Healthcare Compliance Plan acknowledges the existence of this program as part of the organization’s overall compliance framework, operational oversight of HIPAA Privacy remains solely with the Privacy Officer.

A conflict of interest arises when an individual’s personal, financial, or outside interests could interfere with, or reasonably appear to interfere with, the individual’s responsibilities to UToledo. Workforce members are expected to act in UToledo’s best interests and to avoid situations that compromise, or appear to compromise, independent judgment.

UToledo requires the disclosure of actual, potential, or perceived conflicts of interest in accordance with established processes and timelines. Disclosures may include financial interests, outside activities or relationships, ownership interests, consulting arrangements, or other affiliations relevant to an individual’s role or responsibilities. Identified conflicts are subject to review and, when appropriate, management or mitigation measures consistent with UToledo compliance standards.

As UToledo continues to advance an integrated, enterprise‑wide approach to conflict of interest management, workforce members are expected to comply with current disclosure requirements and any future enhancements to policies, processes, or oversight mechanisms designed to promote consistency, transparency, and accountability.

Failure to disclose, cooperate in the review process, or comply with conflict of interest or gifts requirements may result in corrective or disciplinary action, up to and including termination of employment, appointment, or contractual relationship.

UToledo is committed to ensuring all financial relationships and referral arrangements comply with applicable federal and state laws, including, but not limited to the Stark Law and the Anti-Kickback Statute (AKS). These laws prohibit improper financial relationships between healthcare providers and referral sources. This policy applies to contracts with physicians and other referral sources, compensation agreements with individuals or entities who refer patients, and joint ventures and shared service arrangements. Financial arrangements are subject to review and oversight by the Healthcare Compliance Department, in coordination with other appropriate institutional stakeholders, to assess compliance with applicable legal and regulatory requirements.

Ongoing Monitoring and Compliance

The Healthcare Compliance Department will coordinate periodic reviews of but not limited to:

• Physician compensation arrangements
• Lease agreements
• Clinical co-management and incentive-based contracts

Identified compliance risks or deficiencies are addressed through appropriate corrective action, which may include contract modification, termination, or other remedial measures, as appropriate. Any suspected noncompliance with the Stark Law or Anti‑Kickback Statute (AKS) is promptly escalated for internal review and investigation and, where required, reported to appropriate regulatory authorities.

UToledo prohibits the offering, giving, soliciting, or acceptance of gifts, payments, favors, or other items of value (whether provided directly or indirectly) that are intended to, or could reasonably be perceived as, exerting a substantial and improper influence on professional judgment, business decisions, referrals, or transactions. Improper inducements, including bribery and kickbacks, are not permitted. Gifts or items of value that violate applicable federal or state law are strictly prohibited, regardless of amount or intent.

Any gifts or items of value must be lawful, nominal in nature, consistent with UToledo policies, and must not influence, or appear to influence, decision‑making or create a conflict of interest.

For purposes of this Healthcare Compliance Program, an item of nominal value refers to a gift or item of value that is low in monetary worth, infrequent, non‑cash in nature, and not intended to influence, or reasonably appear to influence, professional judgment, business decisions, referrals, or other actions on behalf of UToledo. Items of nominal value may become impermissible if offered or accepted repeatedly or under circumstances that create a cumulative substantial value.

Items of nominal value must be lawful, consistent with UToledo policies and compliance guidance, and appropriate under the circumstances. Cash, cash equivalents, or items tied to business decisions, referrals, or procurement are not considered nominal.

If a workforce member receives or is offered a gift or item of value, including one believed to be of nominal value, the individual is expected to seek guidance from Healthcare Compliance.

UToledo will not employ, contract with, or maintain any affiliation with individuals or organizations that are excluded or debarred from participation in:

• Federal health care programs (e.g., Medicare, Medicaid, or other government-funded programs)
• Federal procurement or non-procurement programs, as defined by applicable law

This prohibition applies to any person or entity providing services, goods, or functions that are significant to UToledo’s operations, including but not limited to:

• Employees, contractors, affiliates, consultants, and credentialed providers
• Vendors and subcontractors
• Individuals in positions of ownership or control

UToledo conducts screening and credentialing to ensure compliance with these requirements and reports as required by law. Any affiliation with an excluded individual or entity will result in immediate corrective action.

Workforce members and covered individuals are expected to promptly report any actual or potential exclusion, debarment, or loss of eligibility to Healthcare Compliance.

If an individual or entity is identified as excluded:

• The department responsible for conducting the exclusion screening will promptly report findings to the Director of Healthcare Compliance. Following a thorough investigation, if the exclusion status is confirmed, UToledo will notify the appropriate regulatory authorities, including the U.S. Department of Health and Human Services Office of Inspector General (OIG), as applicable.
• Required notifications will also be made to the Ohio Department of Medicaid or other relevant state agencies.
• UToledo will ensure that no payments are made for services provided, ordered, or prescribed by individuals or entities that are confirmed to be excluded.
• If payments are inadvertently made to excluded individuals or entities, UToledo will take appropriate steps to identify and return any potential overpayments in accordance with applicable regulatory requirements

Ongoing Monitoring and Compliance

UToledo’s Healthcare Compliance Department, in coordination with the Medical Staff Office and Human Resources, is responsible for:

• Conducting monthly exclusion checks for all employees, contractors, and providers.
• Maintaining documentation of all screening activities in accordance with UToledo's records retention policies and applicable federal and state requirements.

Ensuring that any changes in a provider’s status that may affect eligibility to participate in federal or state health care programs are reported within 30 days of discovery.

Vendors and contractors engaged in business with UToledo are expected to uphold fundamental regulatory, legal, and ethical standards. These include, but are not limited to, adherence to Standards of Conduct, confidentiality, intermediate sanctions, avoidance of improper influence, prevention of false claims and fraud, and respect for whistleblower protections, including use of the compliance hotline.

All current and prospective vendors and contractors must comply with this Standard of Conduct as a condition of doing business with UToledo. Any UToledo personnel who become aware of violations of these standards by vendors or contractors are required to report the matter to their supervisor or manager.

All current and prospective vendors and contractors must also comply with processes and information in the Supplier Visitation and Compliance procedure PUR-001.  Failure to do so may result in loss of visitation privileges or business opportunities.  

UToledo operates under the ultimate authority of the University of Toledo Health Board (“UTH Board”) and its designated Medical Executive Committee. The UTH Board is the governing body responsible to the UToledo Board of Trustees for ensuring that UToledo’s Healthcare Compliance Program is effectively implemented and continuously improved.

Board and executive leadership Responsibilities

• Be knowledgeable about the Compliance Program’s structure, policies, and operations.
• Act in good faith to ensure that UToledo maintains a robust internal reporting system that enables timely identification and resolution of compliance issues.
• Promote a culture of integrity, accountability, and ethical conduct across all levels of the organization.

UToledo employs a structured compliance oversight framework that integrates executive leadership, risk management, and the Healthcare Compliance Department. This framework ensures alignment with federal and state regulations, university policies, and program integrity standards for Medicaid and Medicare. The framework incorporates ongoing risk assessment to inform compliance priorities, oversight activities, and resource allocation.

The UToledo Healthcare Compliance Director provides enterprise‑wide oversight and guidance in support of ethical conduct and regulatory compliance across UToledo Health, including UTMC and UTP. While compliance activities have historically been supported through entity‑specific structures, UToledo is advancing a coordinated and integrated approach to compliance oversight in order to promote consistency, alignment, and shared accountability across all UToledo Health entities.

Compliance responsibilities are shared across leadership, management, and operational areas, with defined roles and expectations consistent with applicable laws and institutional policies.

The Chief Compliance Officer provides strategic leadership and operational oversight of UToledo’s Healthcare Compliance Program. This role is responsible for directing compliance education and training initiatives, overseeing audits and investigations, monitoring adherence to regulatory and policy requirements, and ensuring timely reporting of compliance matters. The CCO serves as the primary liaison to executive leadership and the Board of Trustees on healthcare compliance‑related issues and has the authority to escalate significant or unresolved compliance concerns to executive leadership or the Board, as appropriate.

Compliance Officer Responsibilities

The CCO also serves in the capacity of Associate Vice President, Risk Mangement and Chief Risk Officer. In this role, the CCO reports directly to the Executive Vice President for Finance/Administrative and Chief Financial Officer and maintains a dotted-line reporting relationship to the Board of Trustees to support independence, transparency, and appropriate oversight..

The CCO is granted the authority and resources necessary to:

• Develop and implement compliance-related policies and procedures
• Lead investigations and corrective actions related to fraud, waste, and abuse (FWA)
• Chair or co-chair regular compliance workgroups that include representatives from operations, care management, and clinical services
• Facilitate cross-functional collaboration through compliance workgroups and initiatives

While the CCO may delegate day-to-day compliance operations and initiatives to the Director of Healthcare Compliance, the CCO retains ultimate responsibility for the effectiveness and integrity of the compliance program.

UToledo maintains a Compliance Committee to provide enterprise‑level oversight and strategic guidance for compliance with applicable federal, state, and other legal and ethical requirements. The Committee is composed of senior leadership and compliance‑related subject matter expertise across clinical, operational, academic, research, and administrative functions, supporting a multidisciplinary and organization‑wide perspective.

The Compliance Committee promotes the effectiveness of the Compliance Program by fostering consistent standards, facilitating collaboration across UToledo entities, and reinforcing shared accountability for ethical conduct and compliance. The Committee serves as a forum for identifying, assessing, and addressing compliance risks; monitoring compliance‑related trends and issues; reviewing compliance initiatives and performance indicators; and supporting the development and oversight of corrective actions, as appropriate.

Through its oversight role, the Compliance Committee reinforces a culture of compliance by encouraging open communication, proactive risk management, and integration of compliance considerations into organizational decision‑making. The Committee works collaboratively with Healthcare Compliance and executive leadership to support continuous improvement and alignment across UToledo.

Compliance Committee Responsibilities

• Providing oversight of the UToledo’s Healthcare Compliance Program to support ethical conduct and compliance with applicable laws and requirements
• Supporting the development, implementation, and monitoring of enterprise compliance initiatives, including fraud, waste, and abuse prevention efforts
• Promoting awareness of, and responsiveness to, applicable federal and state compliance requirements, including laws related to false or improper claims
• Advising governing leadership on significant or emerging compliance risks and recommending appropriate mitigation or corrective actions
• Reviewing and providing input on the annual healthcare compliance risk assessment and related healthcare compliance workplan to support alignment with organizational priorities

To support the practical implementation of the UToledo’s Healthcare Compliance Program, a Compliance Champion Workgroup functions as a coordinating forum for day‑to‑day compliance activities across the organization. The Workgroup focuses on translating compliance expectations into operational practice and supporting timely communication and issue resolution.

The Compliance Champion Workgroup facilitates collaboration around compliance initiatives, assists with dissemination of compliance guidance and regulatory updates, supports identification and escalation of compliance concerns, and contributes operational insight to compliance risk mitigation efforts.

By promoting consistency, information sharing, and frontline engagement, the Workgroup helps embed compliance into routine operations and reinforces a culture of shared accountability and continuous improvement across UToledo.

UToledo provides comprehensive compliance training to ensure understanding of federal and state requirements, particularly those related to Medicaid and Medicare fraud, waste, and abuse (FWA). Training is tailored to the roles and responsibilities of each individual and includes:

• New employee orientation upon hire
• Annual compliance training for all workforce members

Comprehensive training equips every member of the UToledo workforce with a clear understanding of their role in upholding a culture of integrity and accountability. A variety of methods will be used to deliver all essential content effectively.

Training content includes but not limited to:

• Introduction to Fraud, Waste, and Abuse
• UToledo’s internal FWA policies and procedures
• Medicaid-specific reporting protocols and timelines, including state contract requirements
• Conflict of Interest
• Prohibitions against employing or affiliating with excluded or sanctioned individuals
• Whistleblower protections for reporting suspected FWA
• HIPAA
• Credentialing and enrollment standards for providers and subcontractors

Training is delivered through a variety of formats, including:

• In-person sessions
• Online learning modules
• Email reminders
• Video conferencing
• Other digital platforms as appropriate

All new workforce members at UToledo are introduced to the Healthcare Compliance Team during new hire orientation. During onboarding, they are required to complete mandatory compliance, HIPAA, and other related training, which includes but is not limited to:

• Ethical decision-making in healthcare settings
• Legal responsibilities under Medicaid and Medicare programs
• Obligations to prevent and report fraud, waste, and abuse (FWA)
• Use of internal and anonymous reporting systems to raise concerns safely and confidentially

With strong support from the Board of Trustees, UToledo has implemented comprehensive systems to ensure clear and consistent communication between the Healthcare Compliance Department and UToledo workforce members. These systems facilitate the timely dissemination and understanding of the UToledo Code of Conduct, along with applicable compliance policies and procedures. Key stakeholders, including the Board of Trustees, executive leadership, and individuals with significant decision-making authority- receive essential compliance information that promotes accountability and fosters a culture of ethical behavior throughout the organization.

UToledo’s communication expectations emphasize:

• A strong institutional commitment to ethical conduct.
• The importance of compliance with federal and state laws and regulations.
• Awareness of applicable laws and policies relevant to each individual’s role.
• The responsibility of each workforce member to act in accordance with these laws and the UToledo Standards of Conduct.

UToledo is committed to fostering a culture of integrity, accountability, and transparency. All workforce members, contractors, and affiliated individuals are encouraged and empowered to seek guidance or report concerns related to potential non-compliance with federal or state laws, UToledo policies, or the UToledo’s Standards of Conduct, without fear of retaliation.

Reporter Follow-Up

When feasible, UToledo will provide follow-up communication to the individual who reported the concern, while maintaining confidentiality and complying with applicable legal obligations.

UToledo is committed to maintaining a safe and supportive environment where individuals can report concerns without fear of retaliation. Every reasonable effort will be made to preserve the confidentiality and anonymity of those who report suspected non-compliance, except where disclosure is required by law, such as in legal investigations, subpoenas, or regulatory reporting obligations.

UToledo strictly prohibits any form of retaliation against individuals who, in good faith, report a concern, seek guidance, or participate in a compliance investigation. This protection applies regardless of the outcome of the investigation.

All reports are documented, reviewed, and investigated promptly and objectively. When appropriate, corrective actions are implemented, and feedback is provided to the reporting party when feasible. This approach reinforces UToledo’s commitment to ethical conduct, transparency, and continuous improvement.

UToledo provides multiple avenues for reporting suspected misconduct, fraud, waste, abuse (FWA), and other potential compliance violations. These channels are accessible to all UToledo workforce members, subcontractors, and patients, and include:

• Direct Reporting to supervisors, department managers, and/or Healthcare Compliance.
• Confidential and Anonymous Options, such as:
• A toll-free compliance hotline.
• A secure online reporting portal.
• Email or written reports submitted to the Healthcare Compliance department.
• External Sources, including:
• Service verification letters.
• Random sampling audits.
• Patient feedback.
• Other internal monitoring mechanisms.

UToledo takes a proactive and structured approach to addressing potential instances of fraud, waste, abuse (FWA), or other compliance concerns. When such issues are identified, whether through internal audits, service verification methods (e.g., member letters, data sampling, hotline reports), self-assessments, or other monitoring activities, a prompt and thorough investigation is initiated in collaboration with appropriate stakeholders. All workforce members are expected to cooperate with compliance investigations, provide complete and accurate information, and participate in investigative activities as requested. Participation in and cooperation with compliance investigations is a responsibility of every workforce member.

EMTALA Compliance Reviews and Investigations

Potential violations of the Emergency Medical Treatment and Labor Act (EMTALA) will be reviewed and investigated in accordance with applicable federal and state laws, regulations, and organizational policies and procedures. Reported concerns, identified deficiencies, or suspected violations involving patient screening, stabilization, transfer, or access to emergency medical care will be promptly evaluated and thoroughly investigated in collaboration with appropriate clinical, operational, legal, and compliance stakeholders. Where warranted, corrective actions will be implemented to address identified issues, mitigate risks, and support ongoing compliance with EMTALA requirements.

Investigation and Response Framework: The Wound Metaphor

UToledo applies a practical metaphor to guide its response process—Stop the Bleed, Fix the Wound, Clean Up the Floor—to ensure swift action, root cause resolution, and long-term prevention:

• Stop the Bleed
  Immediate corrective actions are taken to contain the issue, prevent further harm, and mitigate ongoing risk.
• Fix the Wound
  A detailed investigation is conducted to identify the root cause of the violation. UToledo addresses any systemic weaknesses, process gaps, or control failures that contributed to the issue or hindered early detection.
• Clean Up the Floor
  Broader remediation efforts are implemented, including updates to policies, training, and compliance safeguards. UToledo may revise its compliance program to reduce the likelihood of recurrence and reinforce a culture of accountability.

Legal and Regulatory Coordination

When criminal activity is suspected or legal exposure is identified, UToledo will coordinate with law enforcement or regulatory agencies as appropriate. The Office of Legal Affairs may be consulted to determine whether communications or investigative activities should be conducted under attorney-client privilege.

Anonymous Reporting – for compliance and ethics concerns

• Call toll-free: 888.416.1308
• Healthcare Compliance Voicemail: 419.383.3555
• Online reporting – Access ID: UOFT

Privacy Office – for privacy and HIPAA privacy violations

• Phone: 419.383.4270
• Email: PrivacyOffice@utoledo.edu

Government Agencies – after reporting concerns internally that you feel still have not been addressed

• Department of Justice
• Office of Inspector General
• Ohio Department of Health
• Joint Commission
  • Email: complaint@jointcommission.org

UToledo through its Healthcare Compliance and Internal Audit departments, maintains a structured monitoring and auditing program to uphold regulatory compliance, detect fraud, waste, and abuse (FWA), and safeguard the integrity of clinical and administrative operations.

Monitoring activities may be conducted by Healthcare Compliance and operational departments as part of routine oversight and internal controls, while auditing activities are performed by Healthcare Compliance and Internal Audit to provide structured, objective evaluation of compliance risks and controls.

UToledo will implement a unified compliance framework that aligns its Annual Audit Plan and Annual FWA Prevention Plan to ensure comprehensive oversight, reduce duplication of efforts, and maintain compliance with Ohio Administrative Code Rule 5160-1-29 and applicable OIG guidance.

This integrated approach leverages a shared risk assessment process to inform both plans, while maintaining distinct focus areas and reporting structures.

UToledo leverages data analytics, benchmarking, and internal reporting to conduct enterprise-wide risk assessments. These assessments guide the prioritization of audit activities and help identify emerging compliance risks, including those related to billing, documentation, and clinical operations.

A single, enterprise-wide risk assessment will be conducted annually to:

• Identify and evaluate risks related to fraud, waste, abuse (FWA), regulatory noncompliance, and operational vulnerabilities.
• Prioritize risks based on likelihood, impact, regulatory scrutiny, and historical audit findings.
• Inform both the Annual Audit Workplan and the FWA Prevention Plan, ensuring alignment and efficiency.

Examples of high-risk areas include:

• Claims processing
• Prior authorization
• Service verification
• Utilization management
• Patient safety/Quality reviews

Guided by the risk assessment, UToledo will develop a targeted audit workplan that includes:

• Audit Scope & Priorities
• Focus on high-risk areas across clinical and administrative functions.
• Include billing, documentation, and regulatory adherence.
• Audit Activities
• Review provider and subcontractor activities to validate encounter data.
• Evaluate billing practices and service documentation.
• Assess internal controls and compliance with UToledo policies.
• Reporting & Follow-Up
• Findings reported to the Chief Compliance Officer, Executive Compliance Committee, and Board of Trustees.
• Corrective actions and follow-up audits are initiated to address deficiencies.

Annual Healthcare Compliance FWA Prevention Plan

Within the Annual Compliance Audit Plan, the FWA Prevention Plan focuses on Medicaid-related FWA risks and includes:

• Program Integrity (PI) Audit Work Plan
• Lists all scheduled audits with responsible parties, data sources, and timelines.
• Includes encounter data validation aligned with the audit plan.
• Compliance Risk Monitoring
• Uses standardized checklists to evaluate subcontractors and providers.
• Maintains a separate Compliance Review Work Plan.
• FWA Allegation Response
• Procedures for triaging, investigating, and resolving FWA allegations.
• Coordination with ODM’s Medicaid Fraud Control Unit (MFCU) as needed.
• Corrective Actions
• Prompt resolution of confirmed FWA incidents.
• Coordination with law enforcement for suspected criminal acts.
• Ongoing Compliance Activities
• Continuous monitoring and adherence to contractual and regulatory requirements.

UToledo incorporates service verification as a key component of its Healthcare Compliance Program to ensure the accuracy, integrity, and legitimacy of billed healthcare services. This process is designed to confirm that services documented in the medical record were actually rendered to patients and appropriately billed in accordance with federal and state regulations.

Objectives of Service Verification:

• Validate that billed services match those provided and documented.
• Detect and prevent instances of fraud, waste, and abuse (FWA), including phantom billing, upcoding, and unbundling.
• Ensure compliance with Medicare, Medicaid, and other payer requirements.
• Support accurate reporting and reimbursement processes.
• Promote transparency and accountability in clinical and administrative operations.

Verification Methods May Include:

• Retrospective chart reviews comparing clinical documentation to billing records.
• Random sampling of high-risk services or departments.
• Patient or provider confirmations, when appropriate.
• Use of electronic health record (EHR) analytics to identify discrepancies.
• Integration with internal audit and monitoring activities.
• Comprehensive review of nurse visit documentation.
• Full review of high-level evaluation and management (E/M) codes .
• Verification of provider orders for accuracy and completeness.
• Coder validation is supported by system edits.

Service verification activities are typically coordinated by the Healthcare Compliance Department in collaboration with the Internal Audit Department. These efforts are informed by internal reports, industry risk areas, and findings from prior audits or investigations. The goal is to proactively identify discrepancies, ensure services billed were rendered and documented appropriately, and uphold regulatory standards.

Findings from service verification reviews are evaluated, and when necessary, corrective actions are developed and implemented. Results are reported to the Chief Compliance Officer, the Executive Compliance Committee, and other relevant stakeholders to support continuous improvement and maintain transparency.

In addition, the Revenue Cycle department is responsible for upholding the same standards. Revenue Cycle conducts internal monitoring and service verification activities using the same structured approach, ensuring consistency and alignment across the organization.

All UToledo workforce members share responsibility for maintaining a culture of ethical behavior, regulatory compliance, and transparency. This includes actively supporting the reporting of conduct that may violate UToledo’s Standards of Ethical Conduct, compliance policies, or applicable healthcare laws and regulations.

To promote transparency and accountability in UToledo’s efforts to identify and address fraud, waste, and abuse (FWA), the Healthcare Compliance Department provides summary dashboard reports to executive leadership and the Board of Trustees, including the Finance and Audit Committee, on a regular basis, including quarterly and annual reporting, using designated templates and in alignment with applicable regulatory expectations. Compliance updates may be provided in writing or through presentation, based on meeting agendas, risk prioritization, and reporting needs.

Report Contents

Each report will include:

• Referrals and investigations of suspected FWA.
• Status updates on open, in-process, and closed Program Integrity (PI) audits.
• Summary of corrective actions and outcomes, where applicable.

These reports are coordinated by the Healthcare Compliance Department. The reporting process supports UToledo’s commitment to regulatory compliance, continuous improvement, and proactive risk management.

UToledo is committed to maintaining the highest standards of integrity, compliance, and ethical conduct. Failure to follow compliance standards may result in disciplinary action, up to and including termination of employment or contract. Other potential consequences may include corrective action, retraining, suspension, or referral to law enforcement or regulatory agencies, depending on the circumstances and severity of the violation.

Disciplinary action may be taken against:

• Individuals who fail to follow UToledo’s Standards of Conduct, compliance policies, or federal/state healthcare program requirements.
• Those who unreasonably fail to detect or report known or suspected violations.
• Individuals who engage in conduct that could compromise UToledo’s integrity or reputation as a trusted healthcare provider.

Disciplinary actions may include:

• Counseling
• Coaching
• Verbal or written warnings
• Mandatory retraining
• Suspension or termination
• Referral to licensing boards or law enforcement, as applicable

UToledo’s disciplinary process is designed to:

• Prevent surprises by ensuring expectations are clearly communicated.
• Emphasize the seriousness of compliance violations.
• Clarify the nature of the issue and the corrective actions required.
• Assess the individual’s willingness and ability to correct the issue.

Positive Incentives

To reinforce a culture of compliance, UToledo may incorporate compliance‑related considerations into recognition and performance‑related acknowledgments for departments or individuals who demonstrate a strong commitment to compliance. These incentives are applied in alignment with organizational practices and leadership approval.

Coordination with Human Resources ensures that compliance performance can be appropriately reflected within personnel management processes. All incentive‑related actions are applied consistently and documented by Human Resources and the Healthcare Compliance Department.

UToledo is committed to the timely, accurate, and transparent reporting of suspected fraud, waste, and abuse (FWA) to appropriate external agencies, as well as the prompt return of any identified overpayments. These actions are carried out in full compliance with all applicable federal and state laws, regulations, and contractual obligations. Through proactive oversight, coordinated reporting, and adherence to regulatory timelines, UToledo promotes accountability, supports a culture of integrity, and ensures the responsible stewardship of healthcare resources.

When credible evidence of FWA is identified – through internal audits, service verification, hotline reports, or other monitoring mechanisms – UToledo will assess the severity of the issue and determine whether external reporting is required. All external reporting is coordinated by the UToledo Healthcare Compliance Department, in consultation with, but not limited to, Legal and other relevant departments such as Internal Audit, Revenue Cycle, Information Security, or clinical leadership.

Required Reporting and Agencies

Confirmed or suspected FWA involving employees, providers, subcontractors, patients, or other third parties will be reported to one or more of the following, as appropriate:

• Centers for Medicare & Medicaid Services (CMS)
• Ohio Department of Medicaid- including Surveillance Utilization Review Section (SURS) or Office Program Integrity (OPI)
• Ohio Attorney General’s Medicaid Fraud Control Unit (MFCU)
• Office of Inspector General (OIG)
• Law enforcement, when criminal activity is suspected
• Any other designated oversight body as required by contract, regulation, or payer agreement

This list is illustrative and not exhaustive. Additional reporting to other federal, state, or professional oversight agencies, including licensing, credentialing, or enforcement authorities, may be required based on the facts and applicable legal or regulatory requirements. 

Reporting Timeline and Method

Suspected incidents of fraud, waste, or abuse must be promptly escalated and reported in accordance with applicable federal and state requirements. Reporting decisions may be coordinated with Legal Affairs, as appropriate, to ensure compliance with legal, regulatory, and contractual obligations.

Reports may be submitted by mail, phone, fax, or secure electronic communication using current contact information provided by the appropriate regulatory or enforcement agency. 

Documentation and Accountability

All reporting activities are documented and tracked by the Healthcare Compliance Department to ensure adherence to regulatory requirements and to promote transparency and accountability. Reporting activities are coordinated with investigation, corrective action, and remediation efforts, as appropriate, and are conducted in a manner consistent with UToledo’s confidentiality and non‑retaliation standards.

UToledo is committed to cooperating fully with authorized investigations conducted by federal, state, or other governmental or regulatory oversight and enforcement authorities, as required by applicable law.

In support of such investigations, UToledo will, as appropriate and consistent with applicable law:

• Provide timely access to relevant books, records, documents, and facilities;
• Submit requested documentation in the manner directed by the investigating agency; and
• Coordinate communications in accordance with guidance from regulatory or law enforcement authorities to avoid compromising the integrity of an investigation.

If UToledo is notified of a credible allegation of fraud involving an individual or entity, UToledo will cooperate with applicable governmental, regulatory, or enforcement authorities and comply with any legally required directives, as required by law.

Standards of Conduct and Compliance

• Standards of Conduct (3364-25-01)
• Organizational Business Ethics Policy (3364‑100‑50‑05)
• Financial Conflict of Interest (3364-70-01)
• Interactions with Vendors at UToledo (3364-81-04-027-00)

Organizational Structure

• Quality and Patient Safety Council (3364‑87‑20)
• Institutional Ethics Committee (3364‑87‑14)

Training and Education

• Mandatory Training (3364-25-127)

Communication

• Compliance Incident Reporting (3364-15-03)
• Protected disclosures through the anonymous reporting line (3364-15-05)
• Non-Retaliation (3364-15-04)
• Detecting and preventing fraud, waste and abuse (3364-15-02)
• Financial Fraud Prevention (3364-15-18)
• Protecting Patient Privacy During Medical Encounters (3364‑100‑01‑22)
• Confidential Patients (3364‑100‑01‑13)
• Patient Safety Events (3364-100-50-38)

Accountability, Monitoring, Auditing, Notification, and Remediation

• Policy on records management and retention (3364-5-05)
• Medical record retention and destruction; disposal of PHI (3364-90-16)

Compliance Committee
A multidisciplinary committee responsible for supporting the effectiveness of the compliance program through oversight of compliance activities, risk areas, monitoring results, compliance investigations, corrective actions, and regulatory requirements. The Compliance Committee promotes organizational accountability and assists in maintaining compliance with applicable laws, regulations, and UToledo policies and procedures.

Workforce Members
Individuals who perform work on behalf of UToledo, regardless of payment status, including employees, volunteers, trainees, and any other individuals under UToledo’s direct supervision or control.

Excluded or Sanctioned Individuals
Persons or entities prohibited from participating in federal healthcare programs due to fraud, abuse, or other violations.

Executive Compliance Committee
A governing body that reviews compliance issues, audit outcomes, and proposed corrective actions.

Revenue Cycle Department
Responsible for billing, reimbursement, and ensuring that all services are documented and billed appropriately.

Centers for Medicare & Medicaid Services (CMS)
Federal agency overseeing Medicare, Medicaid, and other health programs. UToledo reports suspected fraud or overpayments to CMS as required.

Office of Inspector General (OIG)
Federal office tasked with identifying and investigating healthcare fraud, waste, and abuse.

Fraud, Waste, and Abuse (FWA)
Activities involving intentional deception or misrepresentation (fraud), excessive or unnecessary use of services or resources (waste), and practices inconsistent with sound fiscal or clinical standards (abuse), which may result in improper payments or harm to program integrity.

Enterprise-Wide Risk Assessment
An annual process that identifies and evaluates areas of operational, regulatory, or financial risk across the organization.

FWA Prevention Plan
A structured plan targeting high-risk areas specific to Medicaid and Medicare to proactively detect and prevent fraud, waste, and abuse.

Program Integrity (PI) Audit Work Plan
A list of FWA-related audits including responsible teams, timelines, and data sources.

Corrective Action Plan (CAP)
A formal plan implemented to address identified compliance issues, including specific actions, timelines, and accountability measures designed to remediate problems and prevent recurrence.

Overpayment
Funds received in excess of what is owed under federal or state healthcare programs due to billing or documentation errors. An overpayment is considered "identified" when the provider has actual knowledge, reckless disregard, or deliberate ignorance of the overpayment.

UToledo's Compliance Program is designed to support compliance with applicable federal and state laws, regulations, and guidance, including, but not limited to, the following:

False Claims Act (FCA): 31 U.S.C. §§ 3729-3733

Prohibits knowingly submitting, or causing the submission of, false or fraudulent claims for payment to the federal government. Violations may include billing for services not rendered, upcoding, or falsifying documentation and may result in substantial civil penalties, treble damages, and exclusion from participation in federal healthcare programs.

Anti-Kickback Statute (AKS): 42 U.S.C. § 1320a-7b(b)

Prohibits the knowing and willful offering, payment, solicitation, or receipt of remuneration to induce or reward referrals or generate business reimbursable by a federal healthcare program, including Medicare and Medicaid.

Stark Law (Physician Self-Referral Law): 42 U.S.C. § 1395nn

Prohibits physicians from referring Medicare patients for certain designated health services to entities with which the physician or an immediate family member has a financial relationship, unless a statutory or regulatory exception applies. The law also prohibits billing Medicare for services resulting from a prohibited referral.

Medicaid Program Integrity Requirements: 42 C.F.R. Part 455

Establishes provider screening, enrollment, disclosure, and program integrity requirements designed to prevent, detect, and address fraud, waste, and abuse in the Medicaid program. 

Civil Monetary Penalties Law (CMPL): 42 U.S.C. § 1320a-7a

Authorizes the imposition of civil monetary penalties and assessments for certain fraudulent, abusive, or otherwise improper conduct involving federal healthcare programs, including violations related to false claims, beneficiary inducements, and excluded individuals.

Exclusion Authorities: 42 U.S.C. § 1320a-7

Authorizes the exclusion of individuals and entities from participation in federal healthcare programs and prohibits payment for items or services furnished, ordered, or prescribed by excluded parties.

Emergency Medical Treatment and Labor Act (EMTALA): 42 U.S.C. § 1395dd

Requires Medicare-participating hospitals to provide an appropriate medical screening examination and necessary stabilizing treatment to individuals with emergency medical conditions, regardless of their ability to pay.

CMS Conditions of Participation (CoPs): 42 C.F.R. Parts 482, 485, and other applicable regulations 

Establish minimum health and safety standards that healthcare organizations must meet to participate in Medicare and Medicaid programs, including requirements related to patient rights, quality assessment and performance improvement, medical records, infection prevention, and governance.

Health Insurance Portability and Accountability Act (HIPAA): 45 C.F.R. Parts 160 and 164

Establishes standards for the privacy, security, and breach notification of protected health information (PHI) and requires covered entities to implement administrative, physical, and technical safeguards.

Office of Inspector General (OIG) Compliance Program Guidance and General Compliance Program Guidance (GCPG)

Provides guidance for developing, implementing, and maintaining effective compliance programs. Key elements include written policies and procedures, compliance oversight, education and training, effective communication, monitoring and auditing, enforcement of standards, and corrective action.

U.S. Sentencing Guidelines for Organizations: U.S.S.G. Chapter 8

Provides criteria for evaluating the effectiveness of an organization's compliance and ethics program and may be considered in determining organizational penalties for misconduct.

Ohio Revised Code Chapter 3364

Establishes the governance, powers, duties, and authorities of The University of Toledo and its Board of Trustees, including the operation and oversight of the University of Toledo Medical Center.

Federal Overpayment Reporting and Return Requirements (60-Day Rule): 42 C.F.R. § 401.305

Requires Medicare and Medicaid overpayments to be reported and returned within 60 days of identification or the due date of any corresponding cost report, whichever is later.

Ohio Medicaid Fraud, Waste, and Abuse Requirements: Ohio Administrative Code 5160-1-29

Requires the Ohio Department of Medicaid to maintain a program to prevent and detect fraud, waste, and abuse and establishes standards related to Medicaid program integrity and enforcement.

Ohio Ethics Laws: Ohio Revised Code Chapters 102, 2921, and related provisions

Establish standards of ethical conduct for public officials and employees, including requirements related to conflicts of interest, improper compensation, misuse of official position, and other prohibited activities applicable to employees of public institutions.