Compliance committees meet on a cadence — monthly at some health systems, quarterly at most. The agendas are full. Physician arrangement compliance often appears as "status: ongoing" or doesn't appear at all until something forces it onto the docket. By then it's too late to be proactive.
This post is built for hospital compliance officers running those meetings. Six questions that surface whether your physician arrangement compliance audit program is actually working — and what to do if the answer to any of them is "I'm not sure."
Forward to anyone whose committee agenda could use sharper questions.
Question 1: Of all our active physician arrangements, how many have an FMV opinion older than 18 months?
This is the maintenance question, and it's the most common failure mode in settled Stark cases. The 2024 OIG General Compliance Program Guidance and the 2005 Hospital Supplemental Compliance Program Guidance both treat FMV documentation as a foundational element. Recent enforcement matters — across multiple federal districts — increasingly cite FMV opinion staleness as a factor.
There's no statutory expiration date for FMV opinions. But practitioners and defense counsel converge on 12-24 months as a defensible refresh cadence for active arrangements, with shorter cycles for arrangements with material compensation movement.
If your answer is "I'm not sure," that's the actionable finding. The first quarter of any improved compliance program is just establishing the answer.
Question 2: For each arrangement, can we produce — in under five minutes — the chronological evidence that the underlying safe harbor or Stark exception elements were satisfied at every renewal?
This is the documentation question. It's not about whether the arrangement was compliant; it's about whether you can prove it was, with timestamps.
The standard practitioners reach for is "tamper-evident" — documentation that demonstrates the evidence existed at the time the arrangement was active, not assembled retroactively for the audit. Append-only audit logs, cryptographically chained records, or independently-witnessed contemporaneous documentation all serve this purpose.
The five-minute threshold is operational, not legal: if assembling the evidence takes longer than five minutes per arrangement, the program will fail under real audit pressure simply because there isn't time.
Question 3: When did our OIG LEIE exclusion screening last run, and is that documentation auditable?
The General Compliance Program Guidance reinforces what most hospitals already do: monthly batch screening against the OIG List of Excluded Individuals and Entities. The 2026 OIG Medicare Advantage ICPG — published February 2026 — adds explicit expectations for ongoing monitoring documentation that some hospitals haven't tightened up to.
The audit question is two-part: when did it run, and can you prove it ran. The second question matters because exclusion-database verification is one of the easier compliance failures to document poorly. "We screen monthly" doesn't satisfy an auditor; the timestamp + the result + the action taken does.
Question 4: Do our quality-incentive arrangements with physicians distinguish between Medicare Advantage outcomes and broader patient outcomes?
This question is newer, and it matters increasingly. The February 2026 MA ICPG raises the bar on compensation arrangements that could compromise clinical independence in MA-enrolled patient care. Most hospital-physician arrangements with quality-incentive components were designed before the 2026 OIG Medicare Advantage ICPG existed, which means most weren't designed with this lens.
The fix isn't usually structural change to the arrangement — it's structural change to how the metrics are calculated. Per-capita measures across all patients address the independence concern; MA-specific carve-outs typically don't.
If your committee hasn't reviewed quality-incentive structures since February 2026, that review is the highest-leverage agenda item for the next meeting.
Question 5: What's our process for adding new arrangements to our compliance tracking system within seven days of execution?
This is the systems question. Most compliance failures don't happen because the controls are wrong — they happen because new arrangements get tracked in spreadsheets that aren't reconciled against the actual contract repository for months. By then the FMV opinion may be missing, the safe harbor election may be unclear, and the arrangement is live with no compliance footprint.
The seven-day threshold is operational. Whatever the threshold is, it has to be one your team can actually meet. If new arrangements are tracked monthly but executed daily, the gap will become a finding.
Question 6: Does our General Counsel's quarterly review of physician arrangements include a periodic exception re-validation cycle?
This is the question that connects compliance to legal exposure. Compliance officers maintain the documentation; General Counsel owns the legal defense. The two functions intersect at exception re-validation: confirming each active arrangement still satisfies the same Stark exception or AKS safe harbor it was structured to satisfy at execution.
Exception fit can drift. A Personal Service Arrangement (42 CFR §411.357(d)) that was clearly compliant at signing can lose fit if compensation structure changes, term renews without documentation update, or the underlying service mix shifts. The re-validation cycle catches these drifts before they become enforcement findings.
A General Counsel who reviews arrangements quarterly with an exception re-validation lens converts compliance documentation into legal defensibility. A GC who reviews arrangements only when something goes wrong is responding to events, not preventing them.
What to do with the six questions
Most hospital compliance programs can answer two or three of these confidently. The remaining questions are the actionable findings — not failures of the program, but the boundary of what the program currently sees.
The pattern compliance officers describe most often: they know what the standards require, but they don't have a system for proving compliance arrangement-by-arrangement, fast enough, with the documentation trail an investigation would demand. Spreadsheets capture the data; they don't produce the evidence under time pressure.
ArrowISE is purpose-built compliance infrastructure for physician arrangements: real-time FMV expiration alerts, structured safe harbor and Stark exception element validation, OIG LEIE screening with auditable documentation, and audit-ready evidence exports designed for both defense counsel preparation and committee reporting.