Instructions for Use

These templates support POL-003 (Compliance Reporting, Investigation, and Resolution) and the Compliance Ticket Management SOP (POL-003-SOP). Each form corresponds to an artifact produced at a step of the ticket lifecycle, and the SOP's Forms Reference maps Form 1 through Form 12 to the forms below.

Access and handling. Form 1, the unredacted intake record, is restricted to the Compliance Officer. The remaining forms are part of the working case file and are handled under the access controls in POL-003 and the SOP. Completed forms are stored in HIPAA-compliant cloud storage with role-based access.

Realization. These forms may be completed on paper, as fillable documents, or directly in the ticketing system (OSticket) or another electronic system, and may later be mapped into a compliance management system. Any realization must capture the same fields defined here and reference each form by its number.

Compliance Ticket Forms

Form 1: Compliance Intake Form (Unredacted, Restricted)

Access level: Compliance Officer only

Ticket ID:

Date / time received:

Intake source:

• ☐ Employee (named)
• ☐ Anonymous internal report
• ☐ Client or family
• ☐ Audit finding
• ☐ External inquiry
• ☐ System-detected issue
• ☐ Other: _______________

Reporter name (if known):

Reporter contact information (if provided):

Original narrative (verbatim; do not edit):

Initial category (select all that apply):

• ☐ HR / Employment
• ☐ Billing / Reimbursement
• ☐ Privacy / Security (HIPAA)
• ☐ Ethics / Professional Conduct
• ☐ Licensing / Scope of Practice
• ☐ Other: _______________

Immediate risk identified? ☐ Yes ☐ No

Notes (intake only):

Form 2: Redaction Log

Ticket ID:

Redaction date:

Redacted by:

Elements removed or masked:

• ☐ Reporter identity
• ☐ PHI not required for investigation
• ☐ Employee identifiers not required
• ☐ Other: _______________

Rationale for redaction decisions:

Location of original unredacted record:

Form 3: Triage and Risk Classification Form

Ticket ID:

Date of triage:

Triage performed by:

Credibility assessment: ☐ Credible ☐ Requires clarification ☐ Insufficient information

Risk level: ☐ Low ☐ Medium ☐ High ☐ Critical

Applicable oversight bodies (select all that apply):

• ☐ MassHealth
• ☐ Commercial payer(s)
• ☐ HIPAA / OCR
• ☐ MA Board of Allied Mental Health (licensure)
• ☐ Other: _______________

Interim controls required? ☐ Yes ☐ No

Case owner assigned:

Triage notes:

Form 4: Aggregation and Pattern Review Form

Ticket ID:

Related prior tickets identified? ☐ Yes ☐ No

If yes, list Ticket IDs:

Pattern determination: ☐ Isolated issue ☐ Potential recurring issue ☐ Systemic issue

Escalated to Compliance Committee? ☐ Yes ☐ No

Notes:

Form 5: Investigation Plan Template

Ticket ID:

Case owner / investigator:

Investigation start date:

Scope of investigation (explicit inclusions and exclusions):

Evidence sources to review:

• ☐ Documents / records
• ☐ Billing or system logs
• ☐ Policies / procedures
• ☐ Interviews
• ☐ Other: _______________

Interview plan (if applicable):

Conflict of interest assessed and documented? ☐ Yes ☐ No

HR / legal consultation required? ☐ Yes ☐ No

Outside counsel referral recommended? ☐ Yes ☐ No

Form 6: Evidence Log

Ticket ID:

Form 7: Interview Summary Template (if applicable)

Ticket ID:

Interviewee name / role:

Interview date:

Interview conducted by:

Summary of information provided (facts only):

Follow-up required? ☐ Yes ☐ No

Form 8: Findings Summary

Ticket ID:

For each finding, record:

• Allegation:
• Determination: ☐ Substantiated ☐ Unsubstantiated ☐ Inconclusive
• Supporting evidence:
• Applicable policy / regulation:
• Rationale:

Repeat for each finding.

Form 9: Corrective Action Plan (CAP)

Ticket ID:

Root cause summary:

Form 10: Notification Log

Ticket ID:

Form 11: External Reporting Record (if applicable)

Ticket ID:

Reporting required? ☐ Yes ☐ No

Authority / entity notified:

Date reported:

Method of reporting:

Reference / confirmation number:

If not reported, rationale:

Form 12: Case Closure Summary

Ticket ID:

Investigation completed date:

Corrective actions completed or scheduled? ☐ Yes ☐ No

Final disposition: ☐ Substantiated ☐ Unsubstantiated ☐ Inconclusive

Follow-up monitoring required? ☐ Yes ☐ No

Closure approved by (Compliance Officer):

Closure date:

Retention

Completed compliance ticket forms are part of the compliance program files. Per POL-003 and its SOP, compliance tickets and associated documentation are retained for a minimum of six to ten years, depending on issue type and applicable regulatory requirements, and are stored securely with role-based access controls.

The Compliance Officer is custodian of the unredacted intake records (Form 1). The working case file and the remaining forms are retained under the access controls defined in POL-003 and the SOP.