Fractional Chief Compliance Officer

A Compliance Function That Is Also Your Counsel

Most organizations that need a chief compliance officer cannot justify hiring one. The role sits awkwardly: too senior to hand to an office manager, too intermittent to fill at a six-figure salary, and too consequential to leave open. So it gets absorbed — by a COO who already has a job, by a consultant who visits quarterly, or by nobody in particular until something forces the issue.

Global Link Law provides the function on a fractional basis. A practicing healthcare attorney serves as your chief compliance officer, builds and runs the program, and stays close enough to the business to catch problems while they are still small. You get the seniority without the salary line.

Why an attorney-led compliance function is structurally different

There are good compliance consultancies, and several are better than most law firms at high-volume operational work. Three things change when the person running your compliance function holds a law license and is engaged as counsel.

Privilege. A compliance risk assessment is, by design, a written inventory of everything wrong with your organization. When a consultant produces it, that document is generally discoverable. When counsel produces it in the course of providing legal advice, it may be protected. Structuring the engagement correctly at the outset determines which of those is true, and it cannot be fixed retroactively once a subpoena has issued.

The escalation path is already inside the firm. When a hotline report turns out to be substantive, a consultant hands you a finding and a recommendation to call a lawyer — who then spends the first two weeks learning your business. Our compliance work sits in the same firm as our investigations practice, led by a former federal prosecutor. The person who knows your program is the person who conducts the privileged internal investigation, and there is no handoff.

Legal judgment is the work, not an input to it. Most consequential compliance questions are legal questions wearing operational clothes. Whether a physician compensation arrangement fits a Stark exception. Whether a marketing arrangement implicates the Anti-Kickback Statute. Whether a vendor’s access to PHI requires a business associate agreement or something more. A consultant identifies the issue and routes it. Counsel resolves it.

What the engagement covers

Engagements vary, but the work falls into three areas.

Building the program. Compliance program design against the seven elements OIG has long treated as the framework for an effective program, adapted to your size and risk profile. Written policies, code of conduct, and the standards that make them enforceable rather than decorative. Risk assessment and gap analysis, structured for privilege. Reporting mechanisms including hotline design and non-retaliation protections. Auditing and monitoring plans that produce evidence rather than activity. Board and committee reporting, and the materials that go with it.

Running it. Serving as designated compliance officer of record where the structure permits. Chairing or supporting the compliance committee. Workforce training delivered by an attorney and documented for audit — our Lawriocity® training programs extend this to HR and procurement teams. Exclusion screening, credentialing oversight, and vendor compliance monitoring. Investigating and resolving reports as they arise, under privilege where appropriate. Regulatory tracking, with the changes that actually affect you flagged rather than forwarded.

Specific risk areas. HIPAA privacy and security, including business associate agreements and breach response. Fraud and abuse: Anti-Kickback Statute, Stark Law, and the False Claims Act exposure that follows from both. Billing and coding compliance, overpayment identification, and the 60-day repayment rule. Medicare Advantage and managed care program requirements. Telehealth, remote monitoring, and digital health specific obligations. Clinical AI governance, including the state requirements now emerging around automated decision-making in coverage and care.

Your first ninety days

Days 1–15 — Orientation and document review. We inventory what exists: policies, training records, prior audits, payer agreements, vendor contracts, any prior government contact. Most organizations have more than they remember and less than they need.

Days 16–45 — Risk assessment. Structured interviews with the people who actually run billing, clinical operations, HR and IT. This is where the real exposure surfaces, and it is rarely where leadership expects. The output is a written assessment prepared as privileged legal advice.

Days 46–70 — Prioritized remediation plan. Not a list of everything wrong. A sequence, ordered by exposure and effort, with owners and dates. The top three items should be in progress before day 90.

Days 71–90 — Build the operating rhythm. Policies drafted or revised, training scheduled, committee cadence established, monitoring plan running. From here the engagement becomes ongoing.

When this is the wrong answer

If you are large enough to justify a full-time compliance officer, hire one. If your need is high-volume chart auditing and coding review, a specialist consultancy will do it better and cheaper. If you are operating under a Corporate Integrity Agreement that requires a dedicated internal officer, the structure may not be available to you at all. We would rather tell you that in the first conversation than three months into an engagement. Our fractional CCO practice works alongside our Regulatory & Compliance and FCPA & anti-corruption teams, so if what you need sits elsewhere we can point you to it.