> ## Documentation Index
> Fetch the complete documentation index at: https://docs.officeridge.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> HIPAA security, quality assurance, and regulatory compliance.

Compliance covers HIPAA security, quality assurance, and regulatory compliance.

## Who can use it

Organization Admins, Location Admins, and Compliance Officers.

## The compliance dashboard

Unlike most modules, Compliance leads with a summary rather than a table. It shows open findings by
severity, findings by status, and how many have been open more than 30 days.

<Warning>
  Aging findings are the number to watch. A finding open beyond 30 days is usually one nobody owns.
  Work the aging count down before adding new audits.
</Warning>

## What lives here

<CardGroup cols={2}>
  <Card title="HIPAA" icon="shield" href="/compliance/hipaa">
    Audit trail, security incidents, business associates, and compliance documents.
  </Card>

  <Card title="Quality" icon="clipboard-check" href="/compliance/quality">
    Audit findings, disallowances, audits, and the compliance calendar.
  </Card>

  <Card title="QAPI" icon="trending-up" href="/compliance/qapi">
    Quality assurance and performance improvement initiatives.
  </Card>

  <Card title="Member safeguards" icon="heart-handshake" href="/compliance/member-safeguards">
    Complaints, incident reports, and member rights.
  </Card>
</CardGroup>

## How findings arrive

Findings reach Compliance from two directions:

| Source             | Example                                                 |
| ------------------ | ------------------------------------------------------- |
| Automated checks   | Wage violations, EVV mismatches, credential expirations |
| Audits and surveys | Internal audits, regulatory surveys, payer reviews      |

Automated findings are the useful ones to act on daily, because they catch problems while they are
still cheap to fix. See [Quality](/compliance/quality).

## Working the compliance cycle

<Steps>
  <Step title="Review open findings by severity">
    Start with the most severe. Severity levels are `STANDARD`, `CONDITION`, and
    `IMMEDIATE_JEOPARDY`.
  </Step>

  <Step title="Assign ownership">
    A finding without an owner does not get fixed.
  </Step>

  <Step title="Fix the underlying cause">
    Most findings point at another module — a lapsed credential, an unresolved EVV exception, an
    expired authorization.
  </Step>

  <Step title="Close the finding">
    Record the correction so the audit trail shows what was done.
  </Step>

  <Step title="Check the calendar">
    Upcoming regulatory deadlines are on the compliance calendar.
  </Step>
</Steps>

<Warning>
  `IMMEDIATE_JEOPARDY` is the most serious classification available. Findings at this level carry
  regulatory deadlines and must be escalated immediately, not queued.
</Warning>

## Troubleshooting

| Problem                                     | What to check                                                                         |
| ------------------------------------------- | ------------------------------------------------------------------------------------- |
| Compliance is missing from my sidebar       | It is limited to Organization Admins, Location Admins, and Compliance Officers.       |
| Findings keep reappearing                   | Automated checks re-run. Closing a finding without fixing the cause means it returns. |
| A finding references a module I cannot open | Ask a colleague with that role to fix it, or have your role reviewed.                 |
| The aging count will not go down            | Findings older than 30 days need assigning, not re-reviewing.                         |

## Related

<CardGroup cols={2}>
  <Card title="Survey preparation" icon="clipboard-check" href="/guides/survey-preparation">
    Getting ready for a regulatory survey.
  </Card>

  <Card title="Licensing" icon="file-check" href="/licensing">
    Licences, surveys, and deficiencies.
  </Card>
</CardGroup>