How we help you
Effective cybersecurity starts with readiness. Wipfli can help your organization reduce the costs of a data breach and improve your HIPAA compliance by focusing on proactive risk management.
From cybersecurity testing to HIPPA security risk assessments, our emergency preparedness services give you a fuller picture of your organization’s security position. We also help you comply with the CMS Emergency Preparedness Rule, as well as provide training and exercises tailored to your organization.
Wipfli is ready to help your organization with any level of cybersecurity need, from developing policies and procedures to fully managed services.
After assessing your cybersecurity needs, we can help your organization implement a comprehensive solution, including firewalls, internal controls, vendor management and training. We also stay connected throughout the process, helping your healthcare organization manage the change and providing any troubleshooting support you need.
In the event of a cybersecurity incident, Wipfli provides response and handling support to help ensure continuity and access to your data and technology.
You’ll receive a dedicated phone number and email so that you can reach your incident response team 24/7. They’ll help you isolate, contain and eradicate incidents and minimize the impact on your organization.
Reach out to our team
Meet the advisors who help healthcare leaders build resilient security programs that support operational continuity and patient trust.
Insights and resources
ARTICLE
AI in senior living: How organizations can use AI to scale smarter
AI is changing how businesses and organizations operate across sectors — and healthcare is no different. But while senior living leaders are curious about AI’s potential, many are unsure of how to use its capabilities to drive growth and help their organization scale. However, the biggest roadblock to AI-driven growth isn’t the technology itself, but mindset. Keep reading to learn more about how to solve that, plus how you can get more effective AI adoption within your senior living organization. What are the challenges keeping senior living organizations from embracing AI? Faced with challenges like rising costs and Medicaid cuts that are already taking effect, many senior living organizations could benefit from finding efficiencies through AI. But this has proven easier said than done, in part because embracing AI demands a mindset shift. AI is a change management problem While integrating AI into your senior living organization does require implementing new tools and upskilling your team, it’s also largely an exercise in change management. Your team is used to operating one way, which can make building and sustaining the momentum you need to rebuild your systems or processes to take advantage of AI or automation tools feel a little bit like pushing a boulder up a hill. According to a survey of Wipfli clients, 91% of businesses or organizations report that non-technical obstacles are the biggest blockers to better leveraging new technologies like AI. Meanwhile, only 19% of executives actually feel comfortable leading an AI-transformation effort. In other words, because AI is still such a new and rapidly developing technology, organizations and leaders don’t feel comfortable with it. And that discomfort can make it harder to create results. Haphazard AI use can actually slow adoption and create chaos Is your senior living organization currently using AI? If your first instinct is to answer no, there’s a very good chance you’re wrong, because some of your individual team members are almost certainly using AI tools, regardless of whether they have buy-in from leadership. However, this risks creating a wild west scenario, where AI gets implemented piecemeal or haphazardly and without any overarching AI strategy. In this situation, you won’t have any governance standards, policies or processes to help ensure consistency and can even risk HIPAA violations by exposing PHI to AI tools that don’t meet compliance requirements. Plus, such haphazard efforts will often flounder, blunting momentum for a more organized AI implementation plan. How can AI help senior living organizations scale and grow? AI can accelerate workflows and enable better decision-making through improved data analytics . Examples of how it can help your senior living organization scale and grow include: Reduced administrative burden and improved staff efficiency Many organizations have worker shortages, creating large workloads for the staff they do have. AI solutions for senior living centers can automate repetitive administrative activities such as scheduling, documentation, billing support and referral management, allowing employees to spend more time focused on residents and higher-value work. Generate better insights from organizational data Senior living organizations have large amounts of operational, financial and clinical data. AI can help analyze that information to identify trends, reveal inefficiencies and provide leaders with insights to make more informed decisions about future investments that can spur growth. Enhanced resident experiences AI can help organizations better analyze resident preferences, behaviors and care needs. These insights can result in more personalized services and higher-quality resident experiences. The happier your residents and their families are, the more your reputation will benefit and the easier it will be to differentiate yourself in a competitive market. What are the risks of using AI in senior living? While AI can deliver meaningful benefits, it does come with the following risks: Data privacy and compliance risks Senior living organizations manage sensitive resident information, making data protection a critical concern. If employees use AI tools without proper safeguards, protected health information (PHI) could be compromised, jeopardizing your organization’s HIPAA compliance. Inaccurate or misleading outputs AI systems can produce inaccurate or incomplete information. While AI can be a valuable support tool, organizations should establish processes for human review and oversight, particularly when outputs could influence resident care, operational decisions or regulatory compliance. Inconsistent usage across the organization Without a coordinated strategy, employees will likely use different AI tools for different reasons. This can create inconsistencies in workflows, increase security risks and make it difficult to measure the effectiveness of AI initiatives across the organization. Lack of governance Even promising AI initiatives can struggle if organizations fail to establish clear policies, training programs and accountability measures. Effective governance helps ensure AI is used responsibly, consistently and in ways that support organizational goals. How can senior living organizations implement AI responsibly? For senior living leaders looking to develop an effective, organization-wide approach to AI, the process matters. Specifically, you want to determine where you want to go, how you’re going to get there and what tools you’ll need to succeed. 1. Establish direction by identifying specific problems you want to solve A good AI strategy doesn’t mean buying your team a ChatGPT Pro subscription. Instead, identify specific problems within your organization where AI could make a difference. For example, if your organization is struggling to find skilled healthcare workers to fill key roles, consider whether AI could allow you to deploy your existing team more effectively by automating certain lower-level tasks so your staff can focus on more patient-centric work. Or can AI analyze data from your EHR to identify patient health trends you can use to improve care? Here, it can be good to lean on an advisory firm to help assess your current systems and processes and find gaps that AI could fill. You can also do this entirely in-house, so long as you keep the focus on looking for problems to solve. 2. Design your AI implementation strategy Once you’ve identified how you want to use AI to help grow your organization, you need to build a framework for implementation. This means designing an organization-wide AI strategy to help put new solutions into place. This includes laying out specific steps in the implementation process, identifying leaders or change champions to actually spearhead the rollout and establishing KPIs. It’s also essential to evaluate your existing data sources and prepare them for use by AI tools, a process that can include establishing a centralized data repository or warehouse. During this effort, you’ll need to consistently communicate with your whole team about why change is happening here and how they can help, as well as consider what training or upskilling opportunities you’ll need to provide. 3. Deliver by implementing specific tools that fit your strategy At this point, you can start implementing AI tools to address growth objectives you’ve chosen to target. However, this isn’t just a one-and-done event but an ongoing process that involves both choosing the right tools and embracing the human, change-management side of the equation. Your advisor can help you decide which AI solutions make sense for your needs, as the market has brought forth a dizzying array of options. Within your organization, communication remains essential, as you need to not just establish momentum, but maintain it. How can leaders prepare for AI? An effective AI strategy typically starts at the top, with commitment from leadership. So how should leaders prepare to oversee this effort with an eye towards more effective change management? Here are key leadership pillars to consider: Self-awareness: Before you ask your team to change by implementing AI, are you prepared to do the same? AI literacy: Your leadership team and organization need a shared understanding of what AI actually is and how you’ll be using it. Change leadership: Don’t just throw change at your team, but implement thoughtfully through planning, clear communication and celebrating wins or milestones. Effective use of resources: Throughout your AI implementation process, consider what work is being done, who will perform it, when it should happen and why it matters. Coaching and upskilling: Create training or coaching opportunities for your whole team to adapt to the changes within your organization. How Wipfli can help We advise senior living organizations on how to strengthen performance, deliver a high-quality experience, navigate change and grow. Let’s talk about your goals and explore how innovative solutions like AI can help you reach them. Start a conversation or listen to a podcast interview with the authors of this article to learn more about AI for senior living. Let’s strengthen your organization Read more How independent life plan communities can thrive while maintaining their independence Senior living providers are missing out on valuable revenue opportunities. Here’s how to change that. How financial and demographic shifts are impacting the senior living industry
ARTICLE
Simplify FFHS grant compliance with a compliance calendar
For federally funded human services (FFHS) organizations, federal funding helps sustain programs and services that communities rely on. But that money does not come without strings attached. It introduces a significant set of 2 CFR Part 200 compliance and audit responsibilities. Compliance with federal grant requirements is a year-round responsibility. For many FFHS organizations operating with lean administrative teams, balancing program delivery with documentation, monitoring and reporting obligations can be challenging. Without a structured approach, compliance activities often compete with mission-focused work for limited staff time. To manage these obligations more effectively, many organizations are adopting compliance calendars that help transform regulatory requirements into a structured workflow. Keep reading to learn how your organization can use a compliance calendar to organize grant compliance requirements and reduce audit surprises. What are the 2 CFR Part 200 compliance and audit requirements? Federal grant recipients and subrecipients must comply with 2 CFR Part 200, commonly known as the Uniform Guidance. These regulations establish rules for managing federal funds, maintaining accountability, demonstrating compliance throughout the grant life cycle, and meeting federal audit requirements. Core 2 CFR Part 200 compliance obligations Federal grant recipients and subrecipients must establish processes to demonstrate that funds are being spent in accordance with award requirements. Key obligations include: Written policies: Maintain documented policies governing procurement, financial management, travel, cost allowability and other grant-related activities. Internal controls: Establish controls that help safeguard federal funds, detect issues early and support ongoing monitoring. Cost principles: Ensure all expenses charged to a grant are allowable, allocable and reasonable under federal requirements and award terms. Subrecipient monitoring: If applicable, assess subrecipient risk, monitor performance and verify that downstream subrecipients comply with applicable requirements. Record retention: Retain financial records, supporting documentation and other records required by federal award terms for at least three years from the date of submission of the final financial report, unless a longer retention period applies. Uniform Guidance audit obligations Uniform Guidance also establishes the following audit requirements: Single audit threshold: Organizations that expend $1,000,000 or more in federal awards during their fiscal year must undergo a single audit or a qualifying program-specific audit. Program-specific audit: Under certain conditions, organizations may be eligible for a program-specific audit. Auditor independence: Organizations must hire an independent auditor to conduct a single audit. The auditor must be independent and comply with the ethical and independence requirements of the Generally Accepted Government Auditing Standards (GAGAS). Data collection and submission: The reporting package and data collection form must be submitted to the Federal Audit Clearinghouse within 30 calendar days of receiving the auditor’s report, or within nine months after the end of the audit period, whichever is earlier. Resolution and corrective action: Organizations must address audit findings and implement corrective actions when deficiencies are identified. Compliance needs to be continuous, not an annual event Many organizations still think about compliance as an annual event. They will wait to gather documentation and records until an audit is about to begin. Under 2 CFR Part 200, compliance activities occur throughout the grant life cycle, requiring ongoing monitoring, documentation and oversight. Internal controls, spending reviews and program performance requirements need to be ongoing between audits. If your organization focuses only on compliance in preparation for an annual audit, you are more likely to have issues with missing documentation, delayed reports or unresolved control issues. The challenge for many FFHS organizations is not understanding the requirements. It is keeping track of hundreds of tasks, deadlines and reviews across multiple programs. That is where a compliance calendar can help. What is a compliance calendar? A compliance calendar is a centralized tool that tracks grant deadlines, reporting requirements, monitoring activities, documentation reviews and other compliance tasks. In practice, a compliance calendar functions as a project management tool specifically designed for grant compliance. Rather than simply listing reporting due dates, an effective compliance calendar breaks each obligation into its required actions. It identifies who is responsible, establishes milestone deadlines and provides reminders before key deliverables are due. This approach helps transform compliance from a series of deadlines into a repeatable process. A compliance calendar will: Notify staff of upcoming due dates Compliance calendars can assign tasks to specific roles and generate reminders before deadlines arrive. Program staff, finance teams, grant managers and leadership can all receive notifications when action is required. Increased visibility into grant responsibilities helps ensure they do not slip through the cracks and reduces the risk of missed deliverables. Create a single source of truth A significant advantage of a compliance calendar is centralization. Instead of scattered spreadsheets, emails and personal reminders, organizations can maintain a single source of truth for grant requirements and upcoming tasks. This improves visibility across departments and makes it easier to coordinate activities. What should be included in a compliance calendar? An effective compliance calendar translates regulatory requirements into specific scheduled activities. Rather than tracking only final due dates, it breaks compliance obligations into the tasks that need to occur beforehand. For each grant, consider including: Financial and programmatic reporting activities: Key reports and the steps required to prepare them, such as budget-to-actual reviews, reconciliation of grant expenditures, collection of program performance data, management review and final report approval. Monitoring and internal control activities: Periodic reviews designed to identify issues early, including transaction testing, review of supporting documentation, segregation of duties assessments, cash management reviews and follow-up on previously identified concerns. Subrecipient oversight activities (if applicable): Risk assessments, monitoring visits, review of required reports, documentation of follow-up actions and verification that corrective actions have been implemented. Grant administration requirements: Budget modification deadlines, equipment inventories, policy and procedure reviews, staff training requirements and grant closeout activities. Each activity should identify a responsible person, target completion date, required documentation and any review or approval steps needed before the task is considered complete. For example, if a quarterly federal financial report is due October 30, the compliance calendar might schedule expenditure reconciliations by October 10, supporting documentation reviews by October 15, management review by October 20 and final approval before submission. By assigning responsibilities and deadlines to each step, organizations can reduce the risk of incomplete reports, missing documentation or last-minute corrections. How does a compliance calendar reduce audit findings? A compliance calendar helps organizations identify and correct issues before they become audit or monitoring findings. The calendar helps staff establish a regular cadence for performing monitoring activities and documentation reviews throughout the year. If a compliance issue emerges, it can be investigated and corrected before an audit or monitoring visit. For example, your compliance calendar can notify a staff member that it is time to review grant-related transactions. During that review, it is discovered that an invoice, approval form or other required record is missing. Thanks to the early discovery, they can locate the documentation and resolve the problem before an audit or monitoring event occurs. If the same issue is discovered by auditors or monitors and supporting evidence cannot be produced, the expense may be questioned or disallowed, even if the expenditure was legitimate. Every grant needs its own calendar Each federal award has its own timeline for compliance obligations. Track every grant individually while maintaining a centralized view of all grant activity. A compliance calendar should follow each grant from award through closeout, accounting for reporting and budget deadlines, monitoring activities and renewal requirements. How can compliance calendars reduce staff burnout? Compliance calendars help organizations plan compliance activities in advance rather than relying on reactive efforts near reporting deadlines or audit fieldwork. When staff can see upcoming deadlines weeks or months in advance, they can schedule tasks as needed, coordinate across departments and avoid emergency requests. Rather than relying on personal reminders and spreadsheets to remember due dates and monitoring requirements, employees can rely on a structured system to keep tasks organized. This structured approach is especially valuable for FFHS organizations that operate with minimal staff. People choose to work at an FFHS because they want to serve community needs, not perform administrative tasks. A compliance calendar can help organizations manage compliance demands more predictably, reducing disruptions to program operations. Compliance calendars can be used for more than grants While grant compliance may be a top priority, the same approach can support other organizational requirements. Examples include: Cybersecurity regulations and frameworks: Track risk assessments, training activities, policy reviews and security testing schedules. Procurement compliance: Monitor purchasing requirements, bid deadlines, contract renewals and procurement reviews. Internal compliance programs: Manage policy updates, board reporting requirements and other governance activities. How to get started with compliance calendars The first step in implementing a compliance calendar is to assess whether the software you already have meets your needs. Do your current tools allow you to: Clearly assign compliance responsibilities Send automated reminders to staff Consistently track reporting deadlines Provide program and finance teams access to the same information View all active grants For smaller organizations that only need to manage a handful of grants, the calendar tools in Microsoft Outlook may be sufficient. Larger organizations managing more grants will likely need a more robust tool like Microsoft D365 or Sage Intacct , which has grant management capabilities, including task tracking and checklist functionality. Read more As nonprofit funding tightens again, can clearer insights help you make more of what you do have? What potential Form 990 changes could mean to tax-exempt organizations Compensation strategies for nonprofits competing in tight labor markets
ARTICLE
Rural healthcare RCM: Let data analytics improve your financial performance
The healthcare industry’s digital revolution has unlocked the vast potential of data analytics, which can play an indispensable role in helping craft a revenue cycle management (RCM) strategy that will keep rural healthcare providers ahead of the curve. As powerful as data analytics can be in navigating complex financial and operational challenges, it can also be confusing to know how to interpret and model the data to reveal the right patterns and insights. Here’s how providers can leverage their data in improving rural healthcare RCM, so that they can reach new heights in patient care and financial performance. What is rural healthcare revenue cycle management? Revenue cycle management (RCM) in rural healthcare is the comprehensive financial process that healthcare providers use to manage all aspects of patient care revenue. The key components of RCM include: Patient registration Insurance verification Charge capture and coding Claims submission Payment posting Denial management Reporting and analysis With RCM, organizations aim to streamline rural health billing and claims processes, enhancing operational efficiency and patient satisfaction while ensuring practices are compensated appropriately. Because of its complexity, it can be difficult to determine if your RCM strategy is doing its best to support your financial stability and enable the delivery of quality patient care while optimizing operational efficiency. How data analytics improves rural healthcare RCM Data analytics can be leveraged at every stage of RCM to optimize financial performance , streamline operations and enhance the patient experience. Here are three important benefits of data analytics in an RCM strategy: Improved financial performance With a data-driven approach, rural health providers can develop more accurate revenue forecasts, enabling them to better allocate limited resources and anticipate fluctuations in cash flow. Moreover, data analytics can help identify patterns in claim denials, which can be used to develop strategies that reduce future denials and increase claim approval rates. Improved operational efficiency Beyond financial performance, data analytics can also drive operational efficiency. By identifying inefficiencies in the revenue cycle, providers can take targeted action to streamline processes, saving both time and money. Additionally, a data-driven approach to RCM can help optimize resource allocation, helping organizations manage staffing challenges by ensuring that staff are deployed effectively and that administrative burdens are minimized. Improved patient experience By reducing wait times and improving communication between providers and patients, a data-driven RCM strategy can foster greater patient satisfaction and loyalty. This, in turn, can contribute to long-term financial stability. What are the challenges of implementing data analytics in RCM in rural healthcare? Despite the myriad benefits of data analytics, the adoption of such technology is not without its challenges. Here are four things to consider when launching a data analytics-based RCM approach: Data privacy Data privacy concerns are of paramount importance, as healthcare providers must ensure that they remain compliant with HIPAA. This includes safeguarding data during both storage and transmission, as well as implementing robust privacy policies to protect patient information. Fostering a data-driven culture Rural health providers must invest in staff training and development to foster a data-driven culture. This means not only equipping staff with the necessary skills but also nurturing a mindset of continuous improvement. By cultivating a culture that values data-driven decision-making, providers can help ensure that their RCM strategy remains agile and responsive to change. Data quality To effectively use data analytics in RCM, providers must have access to accurate and reliable data. This necessitates implementing data validation processes and establishing data governance protocols to ensure that data quality remains a top priority. Choosing the right tools To harness the full potential of data analytics in RCM, healthcare providers must carefully select the appropriate tools. When choosing data analytics tools, key features to consider include ease of use, scalability and integration capabilities. It is also important to tailor these tools to the unique needs of your organization, ensuring that the technology aligns with specific goals and requirements. How to start implementing data analytics into your RCM Implementing data analytics into your revenue cycle management strategy doesn’t require an overnight transformation. Instead, rural healthcare providers can take a phased approach that aligns analytics initiatives with their most pressing financial and operational needs. By focusing on high-impact use cases, building a strong data foundation and equipping staff with the right tools and insights, organizations can experience measurable improvements quickly while setting the stage for long-term success. Identify high-impact use cases first Start by targeting areas where analytics can deliver immediate value, such as denial management, claims turnaround time or cash collections. Focusing on specific pain points helps demonstrate ROI early and builds momentum for broader adoption. Assess and strengthen your data foundation Evaluate the quality, completeness and accessibility of your RCM data across systems. Implement data validation processes and standardize data inputs to help ensure your analytics produce reliable, actionable insights. Select tools that integrate with existing systems Choose analytics platforms that can seamlessly connect with your EHR, billing and practice management systems. This can simplify staff adoption and minimize workflow disruptions. Build internal capabilities and accountability Train key staff to interpret dashboards and reports and assign ownership of monitoring performance metrics. Establish regular review processes so insights translate into consistent operational improvements. Read more The tech infrastructure that can drive your rural health transformation State of rural healthcare 2025 executive summary Transforming healthcare access: CMS finalizes groundbreaking changes for rural health clinics and FQHCs
LET'S CONNECT
Discover how our experienced healthcare advisors can help you strengthen financial performance and prepare for the future of care delivery.
