Stop using “annually” as your entire governance strategy.
Why "we review everything annually" sounds responsible, but doesn't necessarily mean an organization is doing anything particularly useful.
Somewhere along the way, behavioral health organizations seem to have collectively decided that reviewing every policy once a year is the gold standard of compliance.
It sounds responsible, doesn't it?
We have a policy manual. We have a review schedule. Someone is responsible for making sure everything gets updated, approved, and filed away before the next survey. There's probably even a beautifully organized spreadsheet tracking which documents are current, which ones are overdue, and who still needs to sign off on something.
And when leadership asks whether the organization's policies are up to date, someone can confidently report that everything has been reviewed.
Wonderful.
But I've spent enough time working in behavioral health operations to develop a certain skepticism about what that statement actually means.
Because there's a pretty significant difference between having a policy that's been reviewed and having a policy that accurately reflects how an organization operates.
I've encountered plenty of situations where policies look perfectly acceptable on paper, but the actual workflow has evolved into something entirely different. Sometimes the document references a position that no longer exists, a form nobody uses, or an electronic medical record the organization replaced two systems ago.
And occasionally, the people responsible for following the policy have never actually seen it.
Yet somehow, the document has a current review date.
Which is impressive, I suppose, if our primary objective is making sure the footer reflects the correct year.
The bigger question, at least to me, is whether we're spending so much time proving that policies have been reviewed that we've lost sight of what they're supposed to accomplish.
Because policies aren't supposed to exist simply to satisfy an auditor or give the compliance department something to track.
They're supposed to establish expectations, guide decisions, support employees, protect patients, and create consistency in how an organization delivers care.
And if they aren't doing those things, I'm not particularly impressed by how recently someone approved them.
First, Where Did This Annual Review Rule Actually Come From?
One of the things I've noticed in healthcare is how easily certain practices become accepted as requirements, even when nobody can explain where the requirement originated.
Someone says that all policies have to be reviewed annually. Someone else repeats it during a leadership meeting. Eventually, it becomes part of the organization's compliance calendar, and before long, everyone treats it as though it's a universal regulatory standard.
But is it?
The answer is a little more complicated.
There isn't one universal rule requiring every behavioral health policy, in every type of organization, to be reviewed annually.
The actual requirements depend on the services being provided, the organization's licensing structure, applicable state and federal regulations, accreditation standards, payer contracts, and sometimes even the specific population being served.
A residential substance use treatment program doesn't necessarily operate under the same requirements as an outpatient mental health practice. A hospital-based psychiatric program may have obligations that differ from those of a community mental health center. And an organization providing services across multiple states can find itself navigating several different regulatory frameworks at once.
Even within a single organization, different policies may be governed by entirely different requirements.
For example, OSHA's Bloodborne Pathogens standard requires an Exposure Control Plan to be reviewed and updated at least annually, as well as when certain changes in tasks, procedures, or technology affect occupational exposure.
The requirements for emergency action plans are different. OSHA specifies circumstances when the plan must be reviewed with employees, including when it is developed, when employee responsibilities change, and when the plan itself changes.
The HIPAA Security Rule takes another approach, requiring periodic evaluation and evaluation in response to relevant environmental or operational changes affecting electronic protected health information.
And certain CMS emergency preparedness requirements for hospitals and community mental health centers establish two-year review-and-update cycles for specified plans and procedures, along with additional requirements that don't necessarily follow the same schedule.
Then there are changes to requirements involving substance use disorder records under 42 CFR Part 2, payer documentation expectations, accreditation standards, state licensing rules, and professional practice requirements.
The point isn't that one review schedule is better than another.
It's that the governing requirements aren't identical.
And that means an organization needs to understand what actually applies to it before deciding how frequently something should be reviewed.
I think this is where we sometimes make compliance unnecessarily complicated while simultaneously oversimplifying the most important part.
Rather than identifying the specific requirement, someone establishes a blanket annual review schedule because it feels safe.
And to be fair, reviewing policies annually can be a perfectly reasonable internal standard. Some organizations may decide that a yearly review makes sense for certain policies, even when an external authority doesn't specifically require that frequency.
There's nothing inherently wrong with that.
But the decision should be informed by the applicable requirements, the level of risk involved, and the organization's actual operations.
Otherwise, we're not necessarily following a regulatory standard.
We're following organizational folklore with a recurring Outlook invitation.
The Problem With Treating Every Policy Exactly the Same
I understand the appeal of a standardized review calendar.
From an administrative perspective, it's relatively easy to manage. You assign dates, identify responsible individuals, track approvals, and create a process for confirming that everything has been reviewed.
The problem is that not every policy carries the same level of risk, and not every operational process changes at the same pace.
A policy governing medication administration, emergency response, patient rights, or incident reporting can have immediate implications for patient safety.
A policy describing a relatively stable administrative process may not carry the same consequences if it becomes slightly outdated.
Both deserve appropriate oversight, but the level of attention they require isn't necessarily identical.
And when organizations treat every document as equally urgent, they can end up spending enormous amounts of time reviewing things that are functioning perfectly well while overlooking policies connected to significant operational problems.
I've seen how easily this can happen.
Leadership assigns a particular month for policy review, department heads receive their documents, and everyone is expected to complete the process while continuing to manage their normal responsibilities.
For larger organizations, that can mean reviewing hundreds of policies within a relatively short period.
And what happens when the clinical director is already covering vacancies, the operations team is dealing with staffing problems, and compliance is preparing for another survey?
Well, the review still has to get done.
So someone opens the document, makes a few minor changes, updates the date, and sends it along for approval.
Technically, the policy has been reviewed.
Whether anyone has examined the actual workflow is another question entirely.
There's also the issue of what happens between scheduled reviews.
Imagine an organization reviews its policies in January. Everything is current, leadership is satisfied, and the compliance tracker is displaying an encouraging amount of green.
Then, in March, the organization implements a new electronic medical record.
In May, a payer changes its authorization or documentation requirements.
By July, a clinical incident reveals that employees aren't clear about escalation procedures.
And in September, the organization expands its services or changes its staffing structure.
Should the affected policies really wait until the following January simply because that's when the next review is scheduled?
Of course not.
But I've encountered enough rigid administrative systems to know that sometimes organizations become more concerned with following the review calendar than responding to the changes happening around them.
And that seems a little backward.
A policy should be reviewed when the governing requirement calls for it, but also when something happens that calls its accuracy or effectiveness into question.
Sometimes that will be annually. Sometimes it will be more frequently, and sometimes a different scheduled interval may be appropriate.
The important thing is understanding why.
What Happens When the Policy and the Actual Workflow Stop Speaking to Each Other?
This is the part of policy management that I find particularly interesting, mostly because it reveals so much about how an organization actually functions.
I've worked on developing and revising policies, operational procedures, clinical workflows, and employee expectations, and one thing I've learned is that the written document doesn't always tell you what people are really doing.
Sometimes it tells you what leadership thinks they're doing.
Those can be two very different things.
Consider a policy describing how an incident should be reported.
On paper, the process might be beautifully organized. The employee completes a specific form, notifies the appropriate supervisor, documents the event in the designated system, and follows a clearly defined escalation procedure.
But what happens when you actually speak with the employees responsible for reporting those incidents?
Maybe they're using a different form because the original one isn't available in the EHR. Maybe the supervisor listed in the policy no longer holds that position. Perhaps employees have been instructed to notify someone else because the formal process takes too long.
Or maybe different departments have developed entirely different procedures because nobody ever clarified how the policy should apply to their programs.
At that point, the question isn't simply whether the policy is current.
It's whether the organization has any idea how the process is actually being carried out.
And I think that's something leadership should be considerably more interested in.
Because informal workarounds don't always develop because employees are careless or resistant to following instructions.
Sometimes they develop because the approved process doesn't work.
An employee encounters a barrier, finds a way around it, and continues doing their job. Other employees adopt the same approach because it seems practical, and eventually the workaround becomes the normal procedure.
Meanwhile, the official policy remains exactly as written.
That doesn't mean every workaround is appropriate, and some can create significant safety or compliance concerns.
But I do think they provide valuable information.
If employees consistently avoid a particular procedure, leadership should be curious about why. Is the process unnecessarily complicated? Does it require resources employees don't have? Is there confusion about who owns a particular responsibility? Does the technology support what the policy requires?
And perhaps most importantly, is the approved procedure actually possible to follow?
Because a policy that can't be implemented consistently isn't providing the protection leadership may believe it is.
There's also an important distinction between employees being unfamiliar with a policy and employees knowingly choosing not to follow it. Those situations require different responses, and a meaningful review process should help identify which problem actually exists.
Sometimes the solution is training. Sometimes the policy needs clarification. Other times, the underlying workflow needs to be redesigned.
But simply updating the document without addressing the operational problem doesn't accomplish much.
The PDF may be beautiful.
The process is still broken.
Maybe We Should Be Listening to Employees Before Waiting for an Audit
One thing that continues to surprise me is how much useful operational information organizations overlook simply because it doesn't arrive in the form of a formal report.
Employees will often tell you when something isn't working.
They may not use the language of policy governance, risk management, or regulatory compliance, but they're usually pretty capable of recognizing when a process makes their jobs unnecessarily difficult.
They'll tell you that nobody knows who is supposed to approve something, that two supervisors provide conflicting instructions, or that a form hasn't worked correctly since the last software update.
They'll explain that a procedure takes too long, that documentation requirements don't match the actual workflow, or that a particular expectation is impossible to meet within the time available.
And sometimes, they'll simply say, "That's not how we do it."
I think that sentence deserves a lot more curiosity than it typically receives.
Because it's telling you there's a disconnect between what the organization has established as its expectation and what employees experience in practice.
That disconnect might be minor.
Or it might reveal a significant problem involving patient safety, regulatory compliance, clinical documentation, or accountability.
Either way, it's information worth examining.
And yet, I've seen organizations become so focused on formal compliance processes that they overlook the people who are actually performing the work.
We conduct audits, review policies, update documents, and establish corrective action plans, but sometimes fail to ask employees whether the procedures they're expected to follow make any sense.
Which is unfortunate, considering those employees probably have some fairly useful opinions about the subject.
I don't think frontline feedback should replace regulatory interpretation, clinical oversight, or formal policy review.
But it should absolutely inform the process.
A policy may be legally appropriate and still be poorly implemented. It may describe a sound procedure while failing to account for the realities of a particular department. Or it may have been developed with the best intentions but never adequately translated into training, technology, and daily practice.
Understanding those gaps requires more than reviewing the document.
It requires talking to the people responsible for following it.
And ideally, listening to what they say before an incident, audit finding, or patient complaint forces the organization to pay attention.
Compliance Can't Be the Only Department That Understands the Policies
Another issue I think deserves attention is how organizations assign responsibility for policy management.
In some settings, nearly everything gets handed to compliance or quality assurance.
Those departments are expected to maintain the policy library, monitor regulatory requirements, coordinate reviews, track approvals, and make sure the organization is prepared for surveys.
All reasonable responsibilities.
But somewhere along the way, policy management can become so centralized that the people responsible for the actual operations have very little involvement in developing or maintaining the procedures governing their work.
And I don't think that's a particularly effective approach.
Compliance professionals play an essential role in understanding regulatory expectations, establishing oversight, and identifying areas of risk.
But they aren't necessarily the subject-matter experts for every clinical, operational, financial, human resources, privacy, and technology process within an organization.
Nor should they be expected to be.
A clinical director should be involved in evaluating policies that affect clinical care and supervision. Operations should understand the procedures governing scheduling, admissions, staffing, and daily workflows. Revenue-cycle leadership should be responsible for ensuring billing and authorization procedures reflect payer requirements and actual processes.
Privacy, security, HR, and other specialists need to contribute where their expertise is relevant, and legal counsel may be necessary when requirements are complex or disputed.
The point isn't to create a committee large enough to make every decision unnecessarily painful.
It's to make sure the people who understand the work are involved in defining how that work should be performed.
Because if compliance writes a procedure that operations can't implement, or leadership approves a policy without understanding the resources it requires, the organization hasn't necessarily solved anything.
It's created another document employees are expected to follow without adequate support.
And when something goes wrong, those same employees may be held accountable for failing to comply with a process that was never particularly realistic in the first place.
That doesn't seem like a terribly effective system of accountability.
I think strong policy governance requires a balance between centralized oversight and clearly defined responsibility across departments.
Someone needs to maintain the overall process and ensure applicable requirements are addressed. But the individuals responsible for delivering services should also understand, validate, and take ownership of the procedures governing their work.
And executive leadership needs to ensure that the necessary time, resources, and authority exist to make those procedures operational.
Otherwise, we end up expecting one compliance employee and a spreadsheet to carry an unreasonable amount of organizational responsibility.
A Real Policy Review Should Actually Tell Us Something
If I were evaluating an organization's policy-management process, I wouldn't begin by asking how many policies were reviewed during the previous quarter.
I'd be more interested in understanding what the organization learned from those reviews.
Did anyone discover that a policy was outdated or inconsistent with current requirements? Were there procedures employees couldn't reasonably follow? Did the review identify a training gap, a documentation problem, or unclear responsibility between departments?
And if something needed to change, what happened next?
Because I think this is where policy reviews should become a meaningful part of operational improvement rather than a separate administrative exercise.
A thoughtful review begins with understanding why the policy exists and what requirements govern it. That might involve confirming applicable laws, licensing provisions, accreditation standards, professional expectations, or contractual obligations.
From there, the organization should consider whether the policy still reflects its services, staffing, patient population, and actual workflows.
But I wouldn't stop there.
I'd want to understand whether employees know the expectations, whether they have the tools to follow them, and whether the organization can demonstrate that the process is being implemented.
For example, if a policy requires a specific form of clinical documentation, does the EHR support that requirement? Are employees trained to complete it correctly? Is anyone reviewing whether documentation is consistent and timely?
If a policy establishes a procedure for addressing patient grievances, can the organization demonstrate that complaints are received, investigated, documented, and resolved according to the established process?
And if an incident reveals a weakness in the procedure, is someone responsible for determining whether the corrective action actually improved anything?
Those are the kinds of questions that make policy reviews useful.
They also create opportunities to connect compliance with the information organizations are already collecting through audits, incident reports, grievances, employee feedback, documentation reviews, and operational performance measures.
Which means we don't necessarily need another enormous administrative initiative.
We need a better way of using the information that's already available.
I think this is particularly important in organizations where leadership is stretched thin and employees are managing multiple competing responsibilities.
Time is limited. Resources are limited. And behavioral health organizations rarely have the luxury of putting everything else on hold for a comprehensive policy overhaul.
That's why prioritization matters.
Start by understanding what's in the policy library and whether the organization can identify who owns each document and what requirements apply.
Then examine which policies carry the greatest operational or clinical risk, where requirements or workflows have changed, and where employees are already reporting problems.
From there, develop a realistic process for addressing those gaps, assigning responsibility, updating the connected systems, and confirming that changes are actually implemented.
Some organizations may need a significant initial cleanup. Others may already have reasonably strong documentation but need better processes for responding to regulatory changes, incidents, or operational problems.
Either way, the objective should be creating something that can be maintained.
Not a massive project that consumes three months of leadership attention, produces an impressive collection of updated documents, and then disappears until the following year.
Because if everything has to be rebuilt every time the review calendar comes around, the organization probably hasn't established a sustainable system.
It's established an annual administrative crisis.
And we already have enough of those.
The Problem Isn't That We Don't Have Enough Policies
I sometimes wonder whether behavioral health organizations have become a little too comfortable equating more documentation with better oversight.
A problem occurs, so we create a policy.
An audit identifies an issue, so we update a procedure.
An employee makes a mistake, so everyone receives another acknowledgment form confirming that they've reviewed the expectations.
And to be fair, sometimes those are appropriate responses.
But I think there's also a tendency to assume that once something has been documented, the problem has been addressed.
It hasn't necessarily.
A policy can establish expectations, but it can't guarantee understanding. It can describe a workflow, but it can't make that workflow functional. And it can assign responsibility, but it can't ensure that the person responsible has the resources or authority to follow through.
Those things require operational leadership.
They require training, communication, supervision, monitoring, and a willingness to examine whether the organization is actually functioning the way leadership believes it is.
I've become increasingly interested in the relationship between what organizations say they expect and what their systems make possible.
Because when those two things don't align, employees are often left trying to navigate the difference.
They may be expected to follow procedures that don't match current workflows, meet documentation requirements without adequate technology, or take responsibility for decisions they don't have the authority to make.
And when problems arise, the organization can point to the policy and explain that expectations were clearly established.
But were they?
Was the employee adequately trained? Was the procedure realistic? Did the appropriate tools exist? Was the policy consistent with how the organization actually operated?
And did leadership know there was a disconnect?
I think those questions deserve serious consideration before deciding that a policy violation is simply an individual performance problem.
That doesn't mean employees aren't accountable for following established procedures.
They absolutely are.
But organizations also have a responsibility to ensure those procedures are appropriate, understandable, accessible, and possible to implement.
Otherwise, we're treating the existence of a policy as evidence that we've fulfilled our responsibility, even when the policy itself may not be accomplishing anything particularly useful.
The Actual Point
I've spent a considerable amount of time throughout my career developing policies, revising procedures, evaluating operational systems, and trying to make sense of why organizations continue experiencing problems that their own documentation supposedly addresses.
And one thing I've learned is that the most important questions usually aren't about whether a document exists or when it was last reviewed.
They're about what happens when someone actually tries to use it.
Does the policy make expectations clearer? Does it support safe and consistent care? Does it help employees understand their responsibilities and make appropriate decisions? Does it reflect the organization's actual operations?
And when something changes, does the organization recognize that change and respond appropriately?
Those are the questions I wish we spent more time asking.
I don't think annual policy reviews are inherently bad, and I'm certainly not suggesting organizations should abandon the review schedules required by their regulators, licensing authorities, payers, or accreditors.
Those obligations matter, and organizations need to understand and meet them.
But I do think we need to stop assuming that reviewing every policy once a year automatically creates a strong compliance program.
Because a policy that's technically current but operationally irrelevant doesn't offer nearly the protection we might believe it does.
And a policy that accurately reflected the organization six months ago may need immediate attention if something significant has changed since then.
The goal shouldn't be to maintain a perfectly organized collection of documents.
It should be to maintain a system of expectations and procedures that actually supports the people delivering and receiving care.
That's one of the reasons I find the operational side of behavioral health so interesting, and why I end up writing about subjects like this on Tina Out of Network.
On the surface, policy review isn't particularly exciting. I realize there probably aren't many people waking up on a Saturday morning hoping to spend several hours contemplating document-control procedures.
But underneath the administrative language are some much more interesting questions about leadership, organizational behavior, accountability, and the difference between what an organization believes is happening and what its employees experience every day.
And those questions matter.
Because strong policies aren't simply a compliance requirement. They're one of the ways organizations establish consistency, communicate expectations, and create systems that support safe, effective care.
But only when those policies reflect reality.
So the next time someone confidently announces that every policy has been reviewed and the compliance calendar is completely up to date, I think it's worth asking one more question.
That's great. But do we actually know whether any of those policies are working?
Because updating the footer from 2025 to 2026 might make the document current.
It doesn't necessarily make the organization any better.
And I think we should probably be a little more interested in the second part.
