Callen-Lorde Community Health Center

Christopher Frumusa

Healthcare Compliance Authority

Christopher Frumusa brings an organization-wide perspective to healthcare compliance, risk management and privacy, shaped by experience working across clinical and operational teams. His approach emphasizes early collaboration, data-driven risk identification and systems that support both accountability and continuous improvement.

Seeing Healthcare Governance From The Ground Up

My progression from special projects coordinator and manager into compliance and risk leadership gave me an organization-wide view of healthcare operations. Working across nearly every team at a busy New York City-based Federally Qualified Health Center provided a boots-on-the-ground perspective of what happens inside the clinic.

As leaders move further into the organizational hierarchy, it can become easier to lose sight of direct patient care. My earlier roles kept me connected to stakeholders across different levels of the organization and exposed me to the realities shaping their daily work.

That experience continues to influence how I approach governance. Compliance and risk decisions are stronger when leaders understand how policies, systems and requirements affect the people responsible for delivering care.

Moving Compliance Into The Workflow

Balancing regulatory compliance, privacy, and operational efficiency requires moving beyond compliance as a static checking function. Compliance works better when it operates as part of the systems and workflows supporting patient care.

Silos between compliance, IT and privacy, and clinical operations can create friction. Clinicians may develop workarounds to deliver care, privacy teams may impose restrictive controls, and compliance teams may identify risks only after problems occur.

System access provides one example. Access should align closely with specific clinical and operational roles while supporting the requirements of the HIPAA Security Rule. Staff should not need to submit manual permission requests every time a rotation or assignment changes.

Using Trends To Anticipate Risk

The most effective way I have found to identify, manage and mitigate risk is by tracking trends. I spend the first thirty minutes of each day reviewing our incident reporting system, catching up on reportable incidents from the previous day and looking for changes in reporting patterns.

Those reports influence the topics my team selects for quarterly risk assessments. Incident reporting consequently becomes more than a record of events. It becomes a source of information for risk mitigation, continuous quality improvement and continuous compliance.

Organizations can only act on what they track and monitor. Keeping a close eye on incident data makes it possible to recognize emerging patterns and investigate potential risks before they affect patients, employees or operations.

Reframing Compliance as a Partner

Compliance is most effective when it is involved in clinical and operational conversations early rather than brought in after decisions have already been made. Early involvement allows compliance teams to understand the goals of an initiative while identifying privacy and regulatory considerations from the outset.

I am fortunate to work in an organization where colleagues bring me into meetings for new ideas and pilot programs from the beginning. That involvement creates an opportunity to clarify patient consent forms, privacy notices and data-sharing boundaries before implementation.

Preventing a privacy breach or regulatory violation during a pilot protects patient trust while reducing the possibility of regulatory penalties.

Creating Space for Learning and Accountability

A strong compliance culture also requires reporting systems where employees can raise near-misses and compliance oversights without fear of punishment. Transparent, nonpunitive reporting can surface systemic risks and workflow problems before they affect patient care or grant funding.

Recognition can reinforce that behavior. Publicly acknowledging staff members who identify potential risks or workflow flaws demonstrates that speaking up contributes to organizational improvement rather than creating individual blame.

Root-cause analysis should follow the same principle. Examining system vulnerabilities instead of focusing exclusively on individual errors creates opportunities to understand why a lapse occurred and what needs to change.

In my experience, compliance lapses are often connected to broader workflow and organizational issues rather than human error alone. Addressing those underlying conditions creates a stronger foundation for accountability, continuous learning and sustainable improvement.