Healthcare compliance: a strategic function for billing

The term compliance comes from the verb “to comply,” which means to obey, to be in conformity. In the corporate world, it is the set of practices, policies and procedures a company adopts to ensure alignment with laws, regulations, ethical standards and internal rules. In short, compliance means doing the right things the right way.

Compliance in healthcare comes with additional challenges. Hospitals operate in one of the most demanding regulatory environments in the country. There are rules from the ANS (Brazil’s National Supplementary Health Agency), Anvisa (National Health Surveillance Agency) and the CFM (Federal Council of Medicine), labor and tax obligations and, since 2020, the rules of the LGPD (Brazil’s General Data Protection Law) applied to patients’ clinical data.

At the same time, fraud and waste consume more than R$ 30 billion a year in private healthcare, according to the Institute for Supplementary Health Studies (IESS). Navigating this landscape without a structured compliance program exposes the institution to avoidable fines, denials and reputational risks.

What is healthcare compliance?

Healthcare compliance is the guardian of all conformity in safety, quality of care and sound management of every resource. This work goes far beyond avoiding fines: it creates a culture of integrity and ethics that affects the entire sector.

A solid compliance program in hospitals, clinics, laboratories and health plans rests on specific focus areas.

The three pillars of healthcare compliance

1. Regulatory compliance

Regulatory compliance is the foundation of the program, focused on strict adherence to sector legislation. In Brazil, the main areas are:

• Anvisa: rules on medications, health products, operating licenses and good manufacturing, distribution and use practices.

• ANS: regulation of health plans, mandatory coverage, premium adjustments and relationships with plan members and providers. Normative Resolution (RN) No. 623/2024, in force since July 2025, introduces a responsive enforcement model with fines of up to R$ 1 million per breached order and a gradual increase of up to 170% in penalty amounts.

• Professional councils (CFM, COREN, CFO and others):codes of ethics and guidelines for the practice of the health professions.

• Labor and tax laws:applicable to any company, with particularities in the sector, such as on-call shift schedules and specific taxation of medical services.

2. Preventing fraud and abuse

The healthcare sector is recognized worldwide as a target for fraud that raises costs and undermines the system’s sustainability. According to IESS, in 2022 alone, health plans lost more than R$ 30 billion to fraud and waste, equivalent to 12.7% of revenue for the period. The most common practices include:

• Billing fraud: charging for procedures that were not performed (ghost services), upcoding (charging for a more expensive procedure than the one performed) or splitting services to inflate the total amount (unbundling). To understand the direct impact on the hospital, see: Claim denials: what they are and how to avoid them.

• Diversion of materials and medications:affects inventory and treatment safety.

• Kickbacks and bribes:illicit agreements between hospitals, suppliers or physicians to steer purchases, medication use or patient referrals in exchange for improper commissions.

Compliance builds robust internal controls, such as detailed hospital claims audits and transaction monitoring, to mitigate these risks at the source.

3. Privacy and data protection (LGPD)

Managing sensitive data is central in the healthcare environment. The electronic health record (EHR) brings together highly confidential clinical, genetic and health information.

The General Data Protection Law (LGPD) (Law No. 13,709/2018) set strict rules for collecting, processing and storing this data. Healthcare institutions must ensure:

• explicit patient consent;

• technological security against leaks and unauthorized access;

• anonymization or pseudonymization of data whenever possible in research and statistics.

Violating these rules can result in fines of up to 2% of the institution’s annual revenue, capped at R$ 50 million per violation.

The strategic importance of healthcare compliance

Integrity is a healthcare institution’s main asset. A compliance program is a strategic investment that protects the organization’s reputation and financial sustainability.

The consequences of noncompliance are measurable and serious:

• Fines and sanctions:the ANS and Anvisa impose heavy penalties for serious irregularities. With RN No. 623/2024 and RN No. 656/2025, the amounts were adjusted and raised, restoring the deterrent effect that had been lost with the outdated 2006 amounts.

• Loss of network participation and reputation:fraud and misconduct can lead to removal from payer networks or from the SUS (Brazil’s public health system), paralyzing the operation. Reputational damage drives away patients and qualified professionals.

• Impact on the revenue cycle:noncompliant processes generate avoidable denials, increase rework in hospital billing and undermine cash flow.

The table below summarizes the practical impact of having or lacking compliance on the main risk fronts:

Structure of a compliance program: the 9 elements

A robust compliance program rests on elements that structure an ethical culture, mitigate risks and strengthen the institution’s legal certainty. The essential pillars are:

1. Senior management commitment

The program only works when leadership takes the lead. The example comes from the top: directors, coordinators and managers need to embody and reinforce values, mission and ethical principles in daily life. Without this alignment, there is no culture of integrity.

2. Risk assessment

Mapping operational, financial, labor and reputational risks is a mandatory step. The analysis guides decisions, reduces liabilities and protects the institution’s image.

3. Code of conduct

A document that defines expected behaviors, prohibited practices and ethical standards. It guides employees, suppliers, partners and investors, and makes the institution’s commitment to integrity and transparency public.

4. Clear internal policies

These are protocols and procedures that translate the Code of Conduct into daily practice. They include anti-corruption policies, PPE use rules and hiring and termination guidelines, always aligned with the sector’s regulatory requirements.

5. A trusted whistleblowing channel

A strategic tool for identifying deviations, irregularities and unethical conduct. The channel strengthens the program’s credibility and allows problems to be addressed early, avoiding inspections, sanctions and reputational damage.

6. Structured internal investigation

Every report needs to be investigated with independence, method and fairness. Internal investigation ensures consistent answers about possible misconduct and points to the necessary corrections.

7. Ongoing training

Training spreads expected conduct and reinforces organizational values. It strengthens the institutional climate, reduces risks and helps address sensitive topics such as harassment, discrimination and quality of care.

8. Third‑party due diligence

Integrity is not just internal. The institution must assess suppliers, business partners and service providers. Due diligence protects against relationships that could compromise the institution’s reputation and legal certainty.

9. Ongoing audit and monitoring

This is the program’s maintenance: it reviews routines, checks adherence to rules, identifies failures and ensures continuous evolution. Without monitoring, compliance loses strength and stops producing results.

Technology as an ally in compliance management

The regulatory complexity of healthcare and the volume of data involved make technology indispensable for effective compliance. Manually auditing 100% of claims, cross-checking clinical data against each payer’s rules and monitoring contractual deadlines is operationally unfeasible without automation.

By automating critical stages of the revenue cycle, such as medical audit, form validation, claims analysis and denial management, Rivio strengthens operational compliance, reduces risks and protects institutions’ financial sustainability. The platform identifies discrepancies before claims are sent, prevents invisible losses and ensures the hospital receives 100% of what it is entitled to.

In a sector where noncompliance costs billions a year and fines have risen significantly under the new ANS regulation, technology and compliance are no longer optional and become part of the revenue strategy.

FAQ: frequently asked questions about healthcare compliance

What is healthcare compliance?

It is the set of practices, policies and internal controls that ensure the hospital operates in compliance with the law, ANS and Anvisa rules and the sector’s ethical standards. It covers everything from billing and data protection to fraud prevention and the management of contracts with payers.

What is the difference between compliance and hospital audit?

Compliance is preventive: it structures processes, policies and culture so that noncompliance does not occur. Hospital audit is a compliance tool, with a technical focus on verifying claims, documentation and procedures already performed. The two work together to reduce denials and ensure operational compliance.

Does compliance reduce denials?

Yes. Many hospital denials originate in compliance failures: an incorrect procedure code, incomplete documentation, a discrepancy with each payer’s contractual rules. A compliance program structures billing processes to eliminate these inconsistencies before claims are sent.

What are the main penalties for hospitals without compliance?

Fines from the ANS and Anvisa, which can reach R$ 1 million per violation under RN No. 623/2024; removal from payer networks; LGPD penalties of up to 2% of annual revenue; and the risk of administrative and legal proceedings.

How do you start implementing a hospital compliance program?

The starting point is risk assessment: mapping where the institution is most exposed, whether in billing, data management, contracts with payers or internal processes. Based on this diagnosis, the Code of Conduct, internal policies and monitoring mechanisms are defined. Relying on automated audit technology speeds up implementation and reduces exposure from the very first months.