Instructions for Use

These templates support POL-003 (Compliance Reporting, Investigation, and Resolution) and the Compliance Ticket Management SOP (POL-003-SOP). Each form corresponds to an artifact produced at a step of the ticket lifecycle, and the SOP's Forms Reference maps Form 1 through Form 12 to the forms below.

Access and handling. Form 1, the unredacted intake record, is restricted to the Compliance Officer. The remaining forms are part of the working case file and are handled under the access controls in POL-003 and the SOP. Completed forms are stored in HIPAA-compliant cloud storage with role-based access.

Realization. These forms may be completed on paper, as fillable documents, or directly in the support ticket system or another electronic system, and may later be mapped into a compliance management system. Any realization must capture the same fields defined here and reference each form by its number.

Compliance Ticket Forms

Form 1: Compliance Intake Form (Unredacted, Restricted)

Access level: Compliance Officer only

Ticket ID:

Date / time received:

Intake source:

• ☐ Employee (named)
• ☐ Anonymous internal report
• ☐ Client or family
• ☐ Audit finding
• ☐ External inquiry
• ☐ System-detected issue
• ☐ Other: _______________

Reporter name (if known):

Reporter contact information (if provided):

Original narrative (verbatim; do not edit):

Initial category (select all that apply):

• ☐ HR / Employment
• ☐ Billing / Reimbursement
• ☐ Privacy / Security (HIPAA)
• ☐ Ethics / Professional Conduct
• ☐ Licensing / Scope of Practice
• ☐ Other: _______________

Immediate risk identified? ☐ Yes ☐ No

Notes (intake only):

Form 2: Redaction Log

Ticket ID:

Redaction date:

Redacted by:

Elements removed or masked:

• ☐ Reporter identity
• ☐ PHI not required for investigation
• ☐ Employee identifiers not required
• ☐ Other: _______________

Rationale for redaction decisions:

Location of original unredacted record:

Form 3: Triage and Risk Classification Form

Ticket ID:

Date of triage:

Triage performed by:

Credibility assessment: ☐ Credible ☐ Requires clarification ☐ Insufficient information

Risk level: ☐ Low ☐ Medium ☐ High ☐ Critical

Applicable oversight bodies (select all that apply):

• ☐ MassHealth
• ☐ Commercial payer(s)
• ☐ HIPAA / OCR
• ☐ MA Board of Allied Mental Health (licensure)
• ☐ Other: _______________

Interim controls required? ☐ Yes ☐ No

Case owner assigned:

Triage notes:

Form 4: Aggregation and Pattern Review Form

Ticket ID:

Related prior tickets identified? ☐ Yes ☐ No

If yes, list Ticket IDs:

Pattern determination: ☐ Isolated issue ☐ Potential recurring issue ☐ Systemic issue

Escalated to Compliance Committee? ☐ Yes ☐ No

Notes:

Form 5: Investigation Plan Template

Ticket ID:

Case owner / investigator:

Investigation start date:

Scope of investigation (explicit inclusions and exclusions):

Evidence sources to review:

• ☐ Documents / records
• ☐ Billing or system logs
• ☐ Policies / procedures
• ☐ Interviews
• ☐ Other: _______________

Interview plan (if applicable):

Conflict of interest assessed and documented? ☐ Yes ☐ No

HR / legal consultation required? ☐ Yes ☐ No

Outside counsel referral recommended? ☐ Yes ☐ No

Form 6: Evidence Log

Ticket ID:

Form 7: Interview Summary Template (if applicable)

Ticket ID:

Interviewee name / role:

Interview date:

Interview conducted by:

Summary of information provided (facts only):

Follow-up required? ☐ Yes ☐ No

Form 8: Findings Summary

Ticket ID:

For each finding, record:

• Allegation:
• Determination: ☐ Substantiated ☐ Unsubstantiated ☐ Inconclusive
• Supporting evidence:
• Applicable policy / regulation:
• Rationale:

Repeat for each finding.

Form 9: Corrective Action Plan (CAP)

Ticket ID:

Root cause summary:

Form 10: Notification Log

Ticket ID:

Form 11: External Reporting Record (if applicable)

Ticket ID:

Reporting required? ☐ Yes ☐ No

Authority / entity notified:

Date reported:

Method of reporting:

Reference / confirmation number:

If not reported, rationale:

Form 12: Case Closure Summary

Ticket ID:

Investigation completed date:

Corrective actions completed or scheduled? ☐ Yes ☐ No

Final disposition: ☐ Substantiated ☐ Unsubstantiated ☐ Inconclusive

Follow-up monitoring required? ☐ Yes ☐ No

Closure approved by (Compliance Officer):

Closure date:

Form 13: Grievance Receipt Confirmation (Template)

Use: Sent to the filer within 2 working days of receiving a grievance, by mail or email matching the filer's channel. Complete every bracketed field. Do not add investigation detail, opinions about the concern, or commitments beyond the SOP.

Ticket ID (internal; does not print in the letter):

> Dear [filer name], > > We received your grievance on [date received]. Thank you for bringing this to us. > > [Name and role] is looking into your concern and will send you a full written response by [date, within 10 working days of receipt]. If we need more information, we will contact you. > > Raising a concern never affects the learner's services. You may also contact the learner's health plan at any time, using the member services number on the insurance card, or an advocacy organization. > > If you have questions in the meantime, call 413-461-7120. > > [Name, role]

Form 14: Grievance Written Response, Tier 1 (Template)

Use: The Supervising BCBA's full written response, sent within 10 working days of receipt. A copy is filed with the ticket.

Sharing rules: State findings at conclusion level. The response does not include: interview contents or the investigation working file; names of other clients, families, or reporters; specifics of any personnel action (state that appropriate action was taken); health information beyond the learner's own; speculation, blame, or admissions of legal responsibility.

Tone: Plain, factual, and respectful. Acknowledge the concern, state what was done and what is true, and avoid defensiveness.

Ticket ID (internal; does not print in the letter):

> Dear [filer name], > > Thank you for your patience while we looked into the concern you raised on [date received]. > > What we reviewed: [the records, conversations, and steps taken, stated at category level] > > What we found: [the conclusion, in plain language] > > What changes: [any changes to services, scheduling, communication, or process; if nothing changes, say so and state why] > > If this response does not resolve your concern, you can ask the Executive Director for a second review: call 413-461-7120, email ethics@abaswma.org, or write to Applied Behavioral Analysis Services, 432 State Street, Belchertown, MA 01007. The Executive Director responds in writing within ten working days. > > Raising a concern never affects the learner's services. > > [Name], Supervising BCBA

Form 15: Grievance Written Response, Tier 2 (Template)

Use: The Executive Director's written response to a second-review request, sent within 10 working days of the escalation. A copy is filed with the ticket. The sharing and tone rules on Form 14 apply.

Ticket ID (internal; does not print in the letter):

> Dear [filer name], > > I have completed a second review of the concern you raised on [date received] and the response you received on [Tier 1 response date]. > > What I reviewed: [the prior response, the ticket record, and any additional steps, stated at category level] > > What I found: [the conclusion, in plain language] > > What changes: [any changes; if the prior response stands, say so and state why] > > This completes our internal review process. You may contact the learner's health plan at any time, using the member services number on the insurance card, or an advocacy organization. > > Raising a concern never affects the learner's services. > > [Name], Executive Director

Form 16: Internal Report Acknowledgment (Template)

Use: Sent to a named internal reporter when the Compliance Officer acknowledges receipt of a report. Anonymous reports without a reply channel receive no acknowledgment. This template does not create a response clock. It confirms receipt and the protections that apply.

Sharing rules: The acknowledgment does not include triage conclusions, investigation detail, or the identity of any other party. Do not promise outcome detail or ongoing updates.

Ticket ID (internal; does not print in the letter):

> Dear [reporter name], > > Your report of [date received] has been received and logged. It will be reviewed under our compliance reporting policy (POL-003). > > Information about a report is shared only on a need-to-know basis, and your identity is protected to the extent the law permits. ABAS prohibits retaliation against anyone who reports a concern in good faith. If you believe you have experienced retaliation, notify the Compliance Officer, or the Executive Director if your concern involves the Compliance Officer. > > If you have information to add, contact [name and role]. > > [Name], Compliance Officer

Form 17: Internal Report Closure Communication (Template)

Use: Sent to a named internal reporter at case closure, where the Compliance Officer determines notification is appropriate. A copy is filed with the ticket. The sharing rules on Form 16 apply, and findings print only at the level below.

Tone: Professional, factual, and appreciative of good-faith reporting. No assurances beyond POL-003's printed protections.

Ticket ID (internal; does not print in the letter):

> Dear [reporter name], > > The review of the concern you reported on [date received] is complete. Where findings warranted action, appropriate action has been taken. > > Details of the review, including any findings or actions involving other individuals, remain confidential and are shared only on a need-to-know basis. Thank you for raising the concern. > > ABAS prohibits retaliation for good-faith reporting. If you believe you have experienced retaliation, notify the Compliance Officer, or the Executive Director if your concern involves the Compliance Officer. > > [Name], Compliance Officer

Retention

Completed compliance ticket forms are part of the compliance program files. Per POL-003 and its SOP, compliance tickets and associated documentation are retained for a minimum of six to ten years, depending on issue type and applicable regulatory requirements, and are stored securely with role-based access controls.

The Compliance Officer is custodian of the unredacted intake records (Form 1). The working case file and the remaining forms are retained under the access controls defined in POL-003 and the SOP.