The Investment Deep Dive, Part 1: How Much Should You Spend on Healthcare Compliance?
Watch Now
Listen Now
-
How much should a healthcare organization spend on compliance? In this episode of The Compliance Advantage, host Ross Ronan digs into the real benchmarking numbers behind healthcare compliance budgets, drawing on survey data from the Health Care Compliance Association (HCCA) and the Society of Corporate Compliance and Ethics (SCCE).
Ross breaks compliance spend into three buckets and walks through what peer organizations invest by revenue tier, by employee headcount, and by payer mix. He explains why a mid-size healthcare organization can run a strong, fully functional compliance program for roughly $150,000 to $300,000 a year, and why a company that draws most of its revenue from Medicare, Medicaid, TRICARE, or CHAMPUS carries more risk and should invest more.
The throughline is simple: compliance spend is an investment, not a cost. Ross makes the case for setting a compliance budget and keeping it funded, so the program scales with growth instead of getting rebuilt after a problem surfaces. He also shows how peer benchmarking changes the conversation, giving a CEO or board real evidence of a commitment to compliance rather than a binder on a shelf.
For CEOs, CFOs, and private equity deal partners, this is a practical guide to knowing your number, seeing where you fall against your peers, and funding a compliance program that protects revenue and supports growth.
-
How much should a healthcare organization spend on compliance?
A mid-size healthcare organization can run a strong, fully functional compliance program for about $150,000 to $300,000 a year. The right number depends on your revenue, your employee count, and how much of your revenue comes from government payers.
What do healthcare companies spend on compliance, by revenue size?
Spending rises with revenue. In the 50 to 100 million dollar range, about two-thirds of companies spend more than $100,000 a year, and close to half spend more than $250,000, based on Health Care Compliance Association survey data.
Does employee headcount change how much you should spend?
Yes. More employees means more chances for something to go wrong, so larger headcounts tend to spend more. But headcount alone does not set the number. The volume of compliance issues and your payer mix matter more.
How does payer mix affect a compliance budget?
The more revenue that comes from Medicare, Medicaid, TRICARE, or CHAMPUS, the more risk you carry and the more you should invest. A $50 million organization with 80 to 90 percent government payers has far more exposure than one with 5 to 10 percent.
Is compliance a cost or an investment?
It is an investment. Ross compares it to a budget you set and keep funded, so the program scales with the business instead of getting rebuilt after a problem appears.
Why compare your compliance budget to your peers?
Peer benchmarking shows whether you are keeping pace or falling behind. When a CEO can show a board or a buyer that the company invests more than most peers, that is real evidence of a commitment to compliance, not a program sitting on a shelf.
What is the first step if you do not know your number?
Know your numbers. Pull the Health Care Compliance Association and Society of Corporate Compliance and Ethics benchmark surveys, or ask a partner to run your revenue, headcount, and payer mix, so you can see where you fall against your peers.
-
Why benchmarking data matters now
Interviewer (00:00)
We're doing something a little different with this series. We've got some data on what healthcare organizations are actually investing in compliance, and we wanted to bring it straight to our audience. So Ross, set the stage for us. What are we looking at?
Ross Ronan (00:19)
HCCA and SCCE have done compliance program surveys for a number of years. When I started looking at this, probably five, six, seven, ten years ago, there weren't a lot of participants in these survey results. So a lot of people didn't have the results carrying a lot of weight. They always said, well, there's not a lot of people participating, so I don't know that it really means anything. It's kind of skewed. And I worked for a very large healthcare organization at that time, and I know I didn't participate in some of these numbers.
So what I've seen over the years, as the certifications have grown, is that compliance programs and compliance officers are more involved with their associations. They're participating in these surveys a little bit more. And what that really does is put benchmarking tools down for organizations to ask, how much should you be spending? How much are people spending within a healthcare organization for compliance? And what are your peers doing compared to where you're at?
I think that's really important, because a lot of CEOs and board members come to me and say, what should be my budget for a healthcare compliance program for our size of organization? Well, first and foremost, every organization is a little bit different. If they have more compliance issues, they're going to need more compliance spending and resources, or outsourcing to legal counsel review. If they have more issues, it doesn't really matter how much money you make or how many employees you have. If you have a lot of compliance issues, you've got to put more resources into it.
But when I look at these survey results, in my mind it's really the starting point of where you should be when you're starting your compliance program and when you're investing in it. That's a really important piece. We talk to a lot of companies that are getting larger and growing every year, and they get to this capacity where they say, hey, I really feel like I need to invest in compliance. They come to us from a consulting standpoint, an outsourced compliance program, and they ask, what should it be?
When they start thinking about using outside organizations to help build a compliance program, one thing they should stop thinking about is, I'm investing in a consultant to help me build this, or I'm investing in a compliance officer to help me build this internally. What they really need to start thinking about is, where do I budget my compliance program, and I set it and I forget it. Whether it's an outsourced compliance program or an internal compliance officer, you've got to peg the number where it needs to be, put the money in there, and budget for it. It's not a one and done thing. It is a long-term investment in the organization that, if you do it right, can scale and grow with the organization.
The three spending buckets
Interviewer (03:29)
Let's look at some actual numbers. What do the numbers show?
Ross Ronan (03:36)
When we look at the numbers, they go for a big range, but we like to categorize them into three buckets because I think it's really important for what we do in our business. Once you get to the $500 million or more and the billion-dollar range, there's a lot of spending that goes into a compliance program. And it's not hard for those organizations to say, yeah, if you're making 750, a billion, two, three, five billion dollars a year in healthcare, you need to put a lot of money into your compliance program. That's a no-brainer.
But it really gets harder for the organizations that fall within that 50 to $500 million range, or less than $50 million in revenue. That's where people start asking those questions. So we bifurcate the spending into about three categories: less than $100,000 a year on compliance, $100,000 to $250,000, and over $250,000 annually.
I think on average a mid-size healthcare company can get away with $150,000 to $250,000. 150 to 300,000 is probably a very nice range to be in. You can do a lot of different things, whether you're outsourcing that or doing it internally.
When we look at these ranges of what people are spending, it makes a difference when you're comparing yourself, in revenue and employee size, to what your peers are actually spending. We talk about the compliance advantage a lot here on this podcast, because that's the name of it, and we are looking for ways for companies to use compliance as their advantage. When you're looking at your peers and someone else is spending this amount of money and you're not, does it really mean you've invested in your program? Are you the same as somebody else? I think it's real evidence that you're being very intentional about what you're doing from a compliance program standpoint.
Spending by revenue tier
Interviewer (05:42)
How about walking us through the actual revenue tiers? What should a leader know about where their peer group falls?
Ross Ronan (05:52)
If we look at real numbers, and I'm going to look down at my notes here because I'm not a guy who memorizes statistics: say you're under $25 million in revenue. Those are pretty small organizations in healthcare, and we see about 43% of them invest $100,000 or more in compliance. That's probably closer to the $25 million end. Less than half are spending that amount, and the rest are spending a little bit more.
When we get into that 25 to $50 million range, which is a lot of startup healthcare companies, the ones on the verge of really expanding and starting to see where their risks are, about 53%, so over half, spend $100,000 or more, and about 47% spend $250,000 or more. So there's a nice range there. If we're 25 to $50 million in revenue, almost half of our peers in that range are actually spending $100,000 up to $250,000 across the board.
We get into that 50 to $100 million range and people start going, okay, I get it, I understand what I need to spend. In the 25 to $50 million range it hurts a little bit when you have to spend $100,000 or $200,000. But when you get into the 50 to $100 million, you have a lot more risk, a lot more to lose. We see about 66% of those companies spend greater than $100,000, and about 47% are above the $250,000 mark. That's compliance resources like a compliance officer, coding and billing, monitoring and auditing from third parties, the hotline. All of those go into investing in a compliance program. Two-thirds of those companies between 50 and $100 million are investing a pretty substantial amount into that program. And you could do a lot with 200, $250,000 in a compliance program and run it very nicely.
When you look at the 100 to $300 million range, almost 80% are investing greater than $100,000, which is no surprise. And when you look at the 300 to $500 million range, 90% are spending greater than $100,000, which is a no-brainer, but more importantly about 75 to 76% are spending over $250,000. So over three-quarters of those that make 300 to $500 million in revenue are spending a lot of money investing in their compliance program, in the quarter-million-dollar range or higher.
As companies are scaling and growing their revenue, they're clearly scaling their compliance program and making that investment, because it matters, and because they have more to risk.
How payer mix changes the risk
Ross Ronan (09:30)
When we talk about investing in compliance programs, we do try to do it by revenue and by employee size, because that's what the survey results come out at, but it really makes a difference what your payer mix is.
If you're 25 to $50 million in revenue and 90% of your patients and revenue come from a federal healthcare program, whether it's Medicare, Medicaid, TRICARE, or CHAMPUS, your risk is really 25 to $50 million of revenue, and that's huge. But if you're 25 to $50 million in revenue and you have 5% or 10% government payers, your risk is a lot lower. You might be able to spend $100,000 or less. But if 80 to 90% of your revenue is coming from the federal healthcare program, even at $50 million, that is a lot of risk to take on without having a small investment of between 150 and $250,000.
Spending by employee headcount
Interviewer (10:32)
What about the employee side? Does headcount tell the same story?
Ross Ronan (10:40)
It does, in a little bit of a different way. When you have more employees, you have more potential and opportunity for things to go wrong. You have people who may or may not do the right thing. You have a lot of potential issues that could happen. So employee count is really important to know.
People used to come to me all the time and ask, how many compliance people do I need per employee in my organization, on a percentage basis? It doesn't really work that way. These survey results do try to correlate that to some extent, but just because you have more employees doesn't necessarily mean you have more compliance issues. It means you have more potential for people doing the wrong thing.
So what we see is, under 250 employees, about 38, 39% of those companies are spending probably less than or right at $100,000 a year. And that's a lot of employees. I've seen some physician practices with 15, 20, 30 employees who still invest $100,000-plus in their compliance program, because they make 25 to $50 million in revenue. When you get up to the 250 to 500 range is really when you start topping over half. So over half are spending $100,000 or more, and about 45% are spending $250,000 or more.
As you're scaling with the growth of the organization, the more employees you have, the more people are spending higher amounts on those compliance programs. But we're not talking millions, we're talking 150, $250,000. For example, in the 1,000 to 3,000 employee range, about 78% are spending more than $100,000, and about 59% are spending greater than $250,000. Once you get into the 3,000 to 5,000, and over 10,000 employees, you're really spending 80, 90% up in the $500,000 range. But those are very large organizations that really know what their exposures are.
So as your employee base grows, you obviously have a little bit more compliance risk, because people can do wrong things and do them unknowingly, and you need to invest more in those compliance programs.
Why this data wasn't used before
Interviewer (13:24)
Why do you think this kind of data hasn't been used or utilized in the past by leaders before now?
Ross Ronan (13:36)
Like I said before, when compliance first came out in the late nineties and early two thousands with the OIG guidance in healthcare, I think people were just trying to figure it out. There was a lot of transition from finance or revenue cycle into compliance. Then as compliance developed and grew over time, you saw a lot more clinical and legal people getting into the compliance realm, which started to professionalize it more. Early on, we didn't even have certifications for compliance.
Nowadays you can see people getting their degrees in compliance, graduating, holding their certifications, being a certified compliance officer, which is really important. As we've grown as a profession, it becomes less shoot-from-the-hip and more of a science. HCCA and SCCE putting the survey reports together, and people participating, has made it more relevant to what's really going on.
I also think CEOs are putting more accountability into it. Back in the day, we threw a lot of people at problems in compliance. Someone referred to me as a Gen One compliance officer, which made me feel old, but it was important to say, because we really didn't know. We just put people at problems. We didn't have a lot of processes. I don't even think we had hotlines, we were literally using 1-800 numbers. As we started developing a lot of processes for compliance programs, the cost started coming down.
Human resource cost is expensive. If you can start building compliance programs using these survey results, and understand where the dollars should sit, you can say, maybe I need one or two compliance people, and then they can use outsourced billing and coding, outsourced hotline services, and consultants to help. By the way, those are far cheaper on average than hiring another body, where you have to pay payroll, benefits, bonuses, and corporate taxes on top of an employee.
So when we look at these numbers, they just mean a lot more today. A lot of people would be surprised that they could have a really nice, fully functional compliance program for two to $300,000 a year, and it's not necessarily breaking the bank. When you really look at it, that's one investigation, one audit, one set of dollars you have to give back that are going to affect your bottom line. You have to look at it as an investment in my future, and I'm going to set it and forget it based on this information. We use them all the time when providing guidance to potential clients who want to know what they should do. We say, this is where you fall, and this is where you fall within your peers, to be competitive.
What changes when a leader sees the peer comparison
Interviewer (16:54)
What do you think changes for a leader when they see this kind of peer comparison for the first time?
Ross Ronan (17:02)
I actually think they're a little shocked, and their mindset changes to say, maybe I'm not a trendsetter here, maybe I'm a little behind the curve compared to my peers. Especially in this competitive environment, where we have a lot of investment in different healthcare organizations, whether they're venture capitalists or private equity, or even consolidation. These people looking at it want there to be a compliance program. You want to be better than your peers as a CEO, as a board member. You want to be above what everybody else is doing.
Everybody wants to be a trendsetter. They don't want to be lagging behind. So leaders are going, wow, this is my competitive advantage. They want to say, I'm in the 50, 60% range while my peers are in the forties, and I went ahead and did this, I spent $200,000 because this is what I need in my compliance program. They turn around and say, okay, I'm above average, I'm above what they're doing.
And if someone's coming to look at consolidating, or even if the government's coming to look at your commitment to compliance, you can show them, yes, we're committed, we are doing all these things, and by the way, 30% of our peers are not, and we are. We're in this upper echelon. People do believe that investing in a compliance program shows a commitment to compliance, and that it's not just a bookshelf program where you've bought something and stuck it on a shelf.
The tier that surprised Ross the most
Interviewer (18:59)
Is there a tier or a size where the data surprised you the most?
Ross Ronan (19:08)
It really does surprise me when I look at around $50 million or less. That seems to be a pain point for a lot of people when they look at that expense.
Take an example of a healthcare company that makes around $50 million in revenue. From my experience, not necessarily from any facts, so someone could fact-check me on it, most healthcare businesses generally run about 15% net margins. So net earnings on $50 million comes out to about seven and a half million dollars a year. If you spend $200,000 on a compliance program and your net earnings are 7.5 million, you're spending about 2.73% of your net earnings on a compliance program. That's a big number for a lot of people to swallow. But it also shows you're committed to compliance and you're spending a real portion of your earnings on it.
Now, as your earnings go up, from 50 to $100 million, that percentage is going to go down, because if you build the right program, it's scalable. You can spend 200, $250,000 and scale that up to $100 million without actually spending more money. So it really surprised me to see these 50, 50 to $75 million companies looking at that and wanting to be better than their peers, investing in a compliance program that's going to make them better.
The first step if you don't know your number
Interviewer (20:52)
If someone is listening and they don't know their number, what's the first thing they should do?
Ross Ronan (20:59)
Hopefully you have a compliance program, because you can ask your compliance officer, who should be involved in HCCA, to pull down the benchmark surveys. Also, call someone like us and say, can you run my numbers and tell me where we're at. I'd love to see what we need to do from a compliance program standpoint and how to build one.
There are a lot of resources out there. I use HCCA and SCCE. I'm sure there are a number of other benchmark surveys that look at compliance programs. It's garbage in, garbage out. It depends on who's reporting that survey information for you to be able to depend on those numbers. But as we put it into practice, with our experience implementing compliance programs across the country, across specialties, across multiple industries, the numbers we see on HCCA do play out pretty well. When we talk about 150 to $250,000 in that range between 50 million and 150, $250 million in revenue, that plays out pretty close.
It's really important that people put a budget in place for their compliance program. Whether they insource it or outsource it doesn't really matter. Putting a budget in place to show CEOs and boards what you're committed to really does show you've made a commitment to compliance, and that it's okay to spend a certain amount of money to make sure you're competitive with your environment and protecting your investment.
Part 1 close
Interviewer (22:46)
That is part one of our three-part series on compliance investment. Next time, we're going to make this real: scenarios, real boardroom conversations, and how this data plays out in practice.
Ross Ronan (23:01)
Thanks. I appreciate it. I think the investment is one of the key portions to establishing a compliance program.
Interviewer (23:10)
Absolutely. Thank you for listening to The Compliance Advantage, and we'll see you in part two.
Also Available On:
“A lot of people would be surprised that they could have a really nice, fully functional compliance program for two to $300,000 a year, and it’s not necessarily breaking the bank.”
