Why Wipfli?
Wipfli’s healthcare consulting services take a comprehensive approach to your organizational needs, looking not just at processes and procedures but also at how you can develop and support your people. With our tailored solutions, you can help ensure accurate reporting, maintain compliance and thrive financially while meeting the healthcare needs of your community.
Reimbursement is the lifeline of your financial health. Wipfli can help you navigate Medicare and Medicaid reporting rules so that you can file for the appropriate rate and stay in compliance. Our experienced team supports a variety of healthcare entities with services, including:
- Annual Medicare/Medicaid cost report preparation
- Coding and compliance
- Disproportionate share reimbursement
- Licensing and Medicare/Medicaid certification/enrollment
- Medicare/Medicaid appeals
- Medicare/Medi-Cal preparation, review, appeals and rate-setting
- On-site reimbursement staffing
- Payment projections for regulatory changes
- Payor contract audits and compliance
- Provider-based applications
- Rural health clinic/FQHC rate-setting and change-in-scope rate change reports
Wipfli’s revenue cycle management services can help you understand your cash flow and improve your processes so that you achieve greater financial stability. Our team has experience serving a wide range of healthcare organizations, including rural healthcare providers, FQHCs, hospitals, health systems, home health and hospice providers and senior living providers. We can support your organization with:
- Revenue cycle process assessment
- Coding audits
- Outpatient coding
- Compliance
- Strategic pricing reviews
- Third-party payor contracting
- Denials management
Wipfli can help you be strategic in the way you analyze, optimize and implement capital and facility planning. We support your organization with:
- Feasibility studies
- Functional and space program design
- Market assessment and demand forecasting
- Physician demand planning
- Valuations and transactions
Wipfli brings a wide range of experience in helping FQHCs and other healthcare organizations meet regulatory requirements for strategic planning and stay future-ready.
Our strategy services are data-based, performing gap analysis to help you understand how you can get from your current state to your desired future state. They’re also actionable, providing you with clear next steps and support to help you navigate the risks and challenges you may face with implementation.
Insights and resources
ARTICLE
Digital behavioral health therapy and Medicare opportunity
Behavioral health leaders are facing a familiar, but increasingly difficult equation: Demand is growing faster than the workforce, waitlists are lengthening and adding more appointments is not always financially or operationally realistic. The question is no longer whether organizations need more capacity. It is how to create that capacity without simply asking an already-constrained clinical team to do more. Digital mental health treatment may offer one part of the answer. Used appropriately, these tools can reinforce a clinician-led treatment plan between appointments, give patients another way to engage with care and support a more scalable operating model. Medicare reimbursement makes the opportunity more tangible, but reimbursement alone does not make the model sustainable. Why the traditional outpatient model is under pressure Outpatient behavioral health is labor-intensive. Revenue is closely tied to clinician time, yet organizations are competing for a limited supply of licensed professionals while managing payer rates that may not fully support the cost of recruiting and retaining them. More demand, by itself, does not solve that problem. That is why the strategic question should be broader than “How do we add appointments?” Leaders should ask: Which parts of care require a clinician in real time, which activities can be reinforced digitally and where could technology improve access without weakening clinical accountability? Where digital therapy can fit Digital therapy is most useful when it supports a defined clinical purpose. A clinician still evaluates the patient, establishes the treatment plan and determines whether a particular tool is appropriate. The technology can then support structured exercises, education, symptom tracking or skill reinforcement between visits. This is not about replacing therapists. It is about reserving clinician time for the work that requires judgment, relationship and intervention, while allowing patients to engage with structured elements of care on their own schedule. For the right patient population, this can improve continuity and help a clinician support more patients without simply adding hours to the calendar. Potential applications include structured support for conditions such as depression, anxiety, insomnia, post-traumatic stress and substance use disorders. The specific use must follow the product’s authorized indication and the organization’s clinical protocols. Not every app is a medical device, not every device is appropriate for every patient and not every digital interaction is reimbursable. Medicare creates an opening, not a guarantee Medicare now recognizes services associated with qualifying digital mental health treatment devices, including the supply of the device and related treatment-management work. That is an important change because it gives providers a defined pathway to evaluate. It should not be interpreted to mean that any behavioral health app can be prescribed and billed. Coverage and payment depend on the device, the patient, the professional furnishing the service, documentation, time requirements and other billing conditions. Organizations also need to confirm how their Medicare Administrative Contractor prices the service and whether Medicaid and commercial payers follow the same pathway. Medicare can be a starting point, but it is not a universal reimbursement strategy. Five questions leaders should answer before investing 1. What capacity problem are we trying to solve? Start with a defined patient population, service line or access constraint. A focused use case is easier to evaluate than a broad “digital transformation” initiative. 2. Which patients and treatments fit the model? Establish eligibility criteria, exclusions, escalation protocols and expectations for clinician involvement. Safety and clinical appropriateness have to lead the design. 3. Do the unit economics hold? Model device cost, expected payment by payer, staff time, patient activation, documentation, denials, integration and cybersecurity. The objective is not to claim volume. It is a sustainable care model that improves access and uses clinician capacity wisely. 4. Can the workflow support defensible billing? Ordering, onboarding, time capture, patient communication, device use and continued eligibility must be documented consistently. If those steps sit outside normal clinical and revenue-cycle workflows, the program may add work without producing corresponding value. 5. How will we govern and measure the program? Define accountability for clinical escalation, informed consent, privacy, cybersecurity, vendor oversight, outcomes and adverse-event response. Decide in advance what success means and when the organization will expand, redesign or stop the program. A practical path forward For most providers, the right next step is not an enterprise-wide rollout. It is a disciplined pilot. Select one clinically appropriate population, confirm the device and payer requirements, map the workflow, train the team and monitor access, patient engagement, clinician time, denials and net financial contribution. Digital therapy has real potential to extend care and improve the economics of outpatient behavioral health. But the opportunity will not come from the app alone. It will come from combining the right clinical use case with a defensible reimbursement strategy and an operating model that clinicians and patients can actually use. Read more Revenue leakage in healthcare: How to find and prevent it AI in healthcare finance: Practicality over hype, strategy over speculation 5 reimbursement strategies for rural health clinics
ARTICLE
How tech companies can adapt to growing cybersecurity risks
For tech companies of any size, cybersecurity threats are part of doing business. The typical company’s network will often experience thousands of attempted cyberattacks per day, and as vendor relationships proliferate, the average attack surface only continues to grow. But are your defenses prepared to handle this onslaught and prevent a data breach? Keep reading to find out. How are data breach risks evolving for tech companies? Tech companies have always been heavily targeted by cyber attackers. But AI has made it easier than ever for even inexperienced cybercriminals to attempt an attack, while flawed AI-written code has also created new holes to be exploited. Tech companies are also sharing more data than ever with their vendors, which means you can suffer the consequences of a data breach even if your own systems remain secure. Key evolving data breach and cybersecurity risks include: AI-powered attacks: Data privacy breaches and identity threat-based attacks are way up because of AI. For example, AI tools make it easier to pull off a phishing scam with polymorphic emails so attackers can steal credentials needed to access your systems, at which point they can steal valuable data or attempt a ransomware attack. AI makes it simple enough that even children are trying their hand at hacking. Poorly written AI code: Tech companies are increasingly turning to AI coding tools like Claude Code to quickly write new code. However, this code is often implemented without human due diligence or testing, raising the risk that security holes will go undetected until exploited during an attack. Vendor proliferation: Companies that use multiple SaaS products or AI tools face additional exposure. If one of your vendors gets successfully breached, all the data you shared with that vendor is at risk of compromise, so each additional vendor you use raises your risk level. To make this even more complicated, consider that your vendors could have shared your data with third-party vendors of their own. Practice attacks on smaller companies: If your business is under a certain size, you might think you’re not worth attacking. But cybercriminals increasingly see small and mid-sized businesses as practice: A way to try out new attack methods and hone their skills before moving on to target a big fish. Complex cybercriminal relationships: Just as you have vendor relationships, many bad actors do as well. For example, a hacker may attack your business simply as a demonstration to impress a potential client or carry out a successful breach of your systems not to steal any of your data themselves, but so they can sell that access to another party. What kind of damage could a major data breach do to your business? A major data breach can cause financial, reputational and operational harm to your business. Expect both direct damages like operational downtime or the cost to resecure your systems, as well as second-order effects such as lost opportunities or regulatory action. The most damaging cyberattacks involve gaining insider access to your core systems. Attackers sometimes collaborate with a willing insider, like an employee looking to make some extra cash, but will more often get in by tricking a team member into sharing their access credentials through phishing or other social engineering scams. Once inside, attackers often take their time to look around. By some estimates, the typical cybercriminal may remain in your systems for an average of 220 days after first breaking in. That’s a lot of time to find valuables to steal. Insider attacks often cost the company 10-15% more (on the low end) than an external bad actor. Plus, the length of time that an investigation takes usually increases because insiders can cover their tracks more effectively. Expect significant financial losses after a data breach A successful data breach or other cybersecurity incident can quickly become a major drag on your balance sheet. Expect damages like: Sensitive internal and customer data stolen and sold on the black market Ransom payments starting at $60,000 Operational downtime Higher cybersecurity insurance premiums, think 2-3 times what you’re paying now Regulatory blowback, which can include fines, starting at $500,000 Reputational damage, with customers moving to your competition The cost of re-securing your systems after an attack, which could undo five years or more of network investment Ransomware attacks carry especially high financial and operational costs Hackers may simply attempt to steal your data and then vanish. However, once inside your systems, some may launch a ransomware attack instead. During a ransomware attack, an attacker will lock down your core systems or critical data, paralyzing your operations while pressuring you to make a ransom payment. In addition to the financial damages described in the previous section, a ransomware attack can trigger ransom costs that average: $60,000 for small businesses $500,000 for midsize companies $1.5 million for larger firms If these amounts sound lower than you might expect, consider that if the ransoms were too big, nobody would pay. But if they’re tolerable from a cash flow perspective, firms are likely to pay and try to recover later from insurance. A risk-based cybersecurity strategy helps businesses adapt to today’s threats Many tech companies think about cybersecurity strictly in terms of compliance. If you’re a fintech company, for example, you might be tempted to assess your specific regulatory requirements, implement frameworks like PCI and HITRUST to satisfy regulators and then move on. That would be a mistake. Treating cybersecurity as just a compliance exercise still leaves you exposed to potential harm, especially because compliance standards typically don’t account for newer or evolving threats. However, adopting a risk-based cybersecurity strategy can help significantly reduce your potential pain. Under a risk-based approach, you’d go beyond simple compliance to map out the specific threats you face and prioritize them based on likelihood and degree of harm. This can allow you to implement additional defenses to reduce your potential repercussions should you suffer an attack. How tech company CIOs should implement a cybersecurity risk management strategy Tech CIOs or CISOs often benefit from guiding their businesses to adopt a cybersecurity posture built on defense-in-depth. This is a risk-based strategy that deploys multiple layers of protective measures so your systems won’t be compromised by a single point of failure. Using a defense-in-depth approach, an attacker can often be stopped even if they’ve already broken through one or more of your defensive layers. Defense-in-depth also factors in the likelihood of a particular attack, prioritizing defenses based on risk rather than attempting the impossible task of being strong everywhere at all times. Here are key action steps to implement a risk-based cybersecurity approach that incorporates defense-in-depth: 1. Work with a cybersecurity advisor Unless you have a large internal cybersecurity team (10+ people), you’ll typically benefit from working with a third-party cybersecurity advisor who does this every day. An advisor can help you implement a risk-based approach and apply concepts like defense-in-depth to your specific business. 2. Understand your points of failure Map out your points of failure, like breached firewalls, team members clicking on a phishing link or third-party vendors. This will help you figure out where to add additional controls, policies and team training exercises. Your people are probably your weakest link, so you’ll need to account for that as you move forward. 3. Don’t add unnecessary tech Don’t add new tech to your business just because it’s new. Every additional vendor you work with expands your attack surface, so as you integrate more AI and other advances into your existing systems and processes, do so deliberately and with a careful eye on cybersecurity. 4. Limit network access for everyone Higher-than-necessary credentials represent a distinct security threat. Make sure that your team only has the minimum level of network access they need to do their jobs, including your C-suite, who are the most vulnerable to phishing or spear-phishing attacks. 5. Use AI network monitoring to speed up breach detection AI tools can help you implement more effective network monitoring, so you can detect an unusual login or other signs of a breach more quickly. This can help you avoid long-term exposure even if your systems are successfully compromised. 6. Do careful vendor due diligence Talk to your third-party vendors about their own cybersecurity efforts, including whether they take a risk-based or compliance-based approach. To fully understand your vendor risks, you’ll also want to ask about whether any of their own third-party vendors could have access to your data. 7. Implement governance policies and trainings Your whole team needs to be responsible for cybersecurity. Establish clear governance policies, including for how you use AI , to prevent team members from exposing your data to unauthorized tools. Offer regular training on threats like phishing scams and hold tabletop exercises to practice how your business would respond to an active cyberattack. 8. Set up MFA All of your core systems should use multifactor authentication (MFA) to add an additional layer of protection against unauthorized access. Ideally, this should be done with an authenticator app rather than through a code sent via email or text message, as the latter is easier to compromise. 9. Back up your data To mitigate a worst-case scenario like a ransomware attack (or a strike by a nation-state actor hell-bent on causing chaos ), regularly back up your data. This will prevent a total loss in the event that an attacker decides to wipe your systems and allow you to resume normal operations more quickly in the aftermath of an attack. Think of cybersecurity as a journey, not a single event Finally, you’ll do a better job protecting your data and your business if you think of cybersecurity as an ongoing process. You don’t have to implement a bunch of new defensive layers all at once. In fact, small but consistent monthly actions to improve your security will often deliver more impact than one big splashy annual upgrade. Bear that in mind as you move forward. Read more The right cybersecurity framework boosts a business’s value Nation-state actors represent a growing cybersecurity threat AI governance framework: Start with intent
ARTICLE
Rural hospital strategy: Maximizing value for your entire network
Rural hospitals are often essential access points, major employers and important parts of a regional delivery network. Yet within a large health system, their financial contribution can be easy to overlook because their total revenue may be smaller than that of a single service line at a tertiary hospital. That is the wrong comparison. The better question is whether the rural hospital is being used strategically. Is the system preserving local access, directing the right care to the right setting and taking advantage of the reimbursement structures available to qualifying rural providers? The answer is not to move services to a rural location simply because reimbursement may be different. It is to evaluate patient need, clinical appropriateness, capacity, compliance and system economics together. Why rural hospitals require a different strategy Rural healthcare operates with lower volume, a higher proportion of patients covered by government programs in many markets, longer travel distances and persistent workforce constraints. Rural communities also vary widely. A frontier hospital, a regional rural referral center and a hospital located near a metropolitan area do not face the same market conditions. Specialist access is one of the clearest differences. When patients must travel long distances for routine specialty care, they may delay treatment or rely on the emergency department. A coordinated outreach, rotating-specialist, or telehealth model can keep appropriate care local while connecting the rural hospital to the broader health system. For the health system, that rural location is more than a small hospital. It is existing infrastructure, a trusted community presence and a platform for primary care, diagnostics, outpatient services, emergency care and referrals. The strategic value comes from using that platform well. Three reimbursement structures that matter for rural hospitals Rural status by itself does not create a single reimbursement model. The relevant payment methodology depends on the provider type, program eligibility, ownership structure, services furnished, payer and state rules. Three programs deserve particular attention. 1. Critical Access Hospital reimbursement A CAH is a specific Medicare provider type, not a general term for every rural hospital. Qualifying hospitals must meet federal requirements that include rural location, distance or necessary-provider criteria, a limit of 25 inpatient beds, 24/7 emergency services and an annual average length-of-stay requirement for acute inpatient care. Medicare generally reimburses CAHs for allowable costs under a cost-based methodology. That can be advantageous in a low-volume environment, but it does not automatically make every service profitable. Leaders still need disciplined cost reporting, service-line analysis, charge capture and an understanding of how shared costs are allocated across the system. 2. Rural Health Clinic payment An RHC is a federally certified outpatient clinic located in a rural, underserved area. RHCs may be independent or provider-based, and Medicare generally pays qualifying visits under an all-inclusive-rate methodology, subject to applicable rules and limits. The key point is not that an RHC receives the full amount charged. Payment depends on the clinic’s status, the service, the payer and current payment rules. Health systems should evaluate where RHC certification is available, whether the provider-based structure is appropriate and whether operations, staffing, billing and documentation support compliance. 3. The 340B Drug Pricing Program The 340B program allows eligible covered entities to purchase outpatient drugs at discounted prices. For qualifying rural hospitals, it can support access and financial sustainability, but participation brings significant eligibility, registration, recordkeeping and program-integrity responsibilities. Health systems should treat 340B as a compliance-intensive program, not simply a margin opportunity. The right approach is to confirm eligibility, maintain strong oversight and monitor federal and manufacturer developments that may affect the program. Where the opportunity is for rural hospitals The most durable opportunity is to match local demand with services that can be delivered safely and efficiently in the rural community. That may include primary care, infusion, imaging, rehabilitation, selected outpatient procedures, behavioral health, specialty clinics or other services supported by the market. This requires a system-level view. Moving every patient to the tertiary center can create travel burdens, increase leakage and underuse rural capacity. Moving a service to a rural site solely for reimbursement can create compliance and operational risk. The goal is a clinically sound network in which each location has a clear role. Bring specialty care closer to the patient A rotating-specialist model can expand access without requiring a full-time specialist at every rural location. It also strengthens the connection between local primary care providers and the health system’s specialty network. In many cases, consultation, diagnostics and follow-up can occur locally, while more complex interventions remain at the tertiary center. Done well, this model can reduce avoidable travel, improve continuity and create a more predictable outpatient pathway. It also helps the system reserve higher-acuity capacity for patients who truly need it. Use telehealth as care infrastructure, not a future windfall Telehealth can extend specialty, behavioral health and follow-up care into rural communities, but reimbursement rules remain service- and site-specific and continue to change. Current Medicare rules for RHC and FQHC distant-site medical telehealth do not simply mirror the RHC all-inclusive rate, while mental health telehealth follows different requirements. For that reason, telehealth should be evaluated first as an access and workforce strategy. The business case should reflect the current billing rules, technology costs, clinical workflow, patient connectivity and the value of keeping care within the system. Any future payment improvement should be treated as upside, not the foundation of the investment. What health systems should do now? Start with a practical, location-by-location review: Define the role of each rural hospital and clinic within the regional continuum of care. Analyze service-line demand, contribution margin, capacity, referral patterns and patient out-migration. Validate CAH, RHC, provider-based and 340B eligibility, operations and compliance. Review cost-reporting practices, cost allocation, charge capture, coding, denials and payer performance. Identify services that can be delivered locally based on community need, clinical appropriateness, staffing and infrastructure. Build specialist outreach and telehealth models around access and continuity, using current reimbursement rules in the financial model. Evaluate rural facilities with measures that reflect their mission and strategic role, including access, network retention, quality, workforce and financial sustainability. A rural hospital should not be dismissed because it will never produce the same total revenue as a large urban medical center. Its value is different. It can preserve access, anchor the local care network, support primary and outpatient care and connect patients to the broader health system. The opportunity is not to chase reimbursement. It is to build a disciplined rural strategy that aligns community need, clinical delivery, reimbursement, infrastructure and long-term sustainability. Health systems that do that well can strengthen both their rural facilities and the system as a whole. Read more Rural healthcare RCM: Let data analytics improve your financial performance 5 reimbursement strategies for rural health clinics The tech infrastructure that can drive your rural health transformation
Reach out to our team
Connect with our healthcare advisors to discuss strategies for improving reimbursement and achieving stronger financial results.
LET'S CONNECT
Discover how our experienced healthcare advisors can help you strengthen financial performance and prepare for the future of care delivery.
