Healthcare quality, compliance and privacy.
An independent consultant helping Alaska’s Tribal and non-profit health organizations reduce risk, loss and liability exposure.
Rooted in Alaska.
Michael Cruz, CHC, CHPC, is the independent consultant behind Waqaa. Based in Alaska, he has more than 18 years of healthcare experience in the state.
He works with Tribal and non-profit organizations to develop and maintain compliance with the internal and external regulatory oversight they answer to.
Waqaa takes a comprehensive, systematic and effective approach to risk prevention and management, to reduce your organization’s risk, loss and liability exposure.
- Based in
- Alaska
- Experience
- 18+ years in Alaska healthcare
- Works with
- Tribal and non-profit organizations
- Certifications
- CHC, CHPC
- Focus
- Quality, compliance, privacy, accreditation readiness
Know where you stand before a reviewer tells you.
Health organizations answer to many overseers at once: federal and state regulators, funders, accrediting bodies, and their own boards and policies. Gaps tend to surface during an audit, a survey or an incident, when they are most expensive to fix.
Waqaa builds compliance into daily operations. That means clear policies people can follow, evidence that is easy to find, and a team that knows what is expected of it.
- Privacy and security of health informationHIPAA and related patient confidentiality requirements.
- Regulatory and funder oversightFederal, state, Tribal and grant requirements your programs must meet.
- Policies and documentationWritten procedures that match what your staff actually does.
- Accreditation standardsSurvey preparation, mock reviews and corrective action plans.
Assess
Review policies, practice and records against the standards that apply to you.
Prioritize
Rank findings by risk so the most serious gaps are closed first.
Correct
Write the plans, policies and training that close each gap.
Maintain
Set up routine monitoring so compliance holds between reviews.
Risk prevention that is systematic and effective.
Compliance Assessments
Review your programs against internal policy and external regulatory oversight.
Privacy Assessments
Find where patient information is exposed and close the gaps before they cost you.
Quality Assurance
Build the measures and routines that keep care consistent and improving.
Accreditation Readiness
Prepare your team and documentation well ahead of survey day.
Compliance news for 2026.
What changed this year, in plain terms. Updated November 8, 2026.
Security Rule overhaul delayed
Final action is not expected before mid-2027. The current rule still applies today.
Medicare telehealth extended
Congress extended the flexibilities through December 31, 2027, after a short lapse in early 2026.
Ransomware keeps rising
Reported attacks on healthcare rose about 14% in early 2026. Attacks on healthcare businesses grew faster than on providers.
Medicaid work requirements
Alaska must start by the end of 2026, with a possible phase-in or delay. Alaska Native and American Indian people are exempt.
Joint Commission requirements cut
Hospital requirements dropped from 1,551 to 774 in January 2026, mostly by consolidating them. Check your own manual.
Alaska rural health funding
CMS announced funding for 254 Alaska projects, including telehealth, community health aide tools and workforce.
Part 2 deadline has passed
Substance use records now follow HIPAA-style rules and penalties. Review notices and consent forms.
IHS oversight and realignment
IHS met Tribal leaders in Anchorage. Its oversight plan stresses a culture of compliance.
OCR risk analysis cases
Completed investigations as of April 2026. The common finding is no organization-wide risk analysis.
Missing foster children report
OIG found Alaska often did not notify parties who could help locate American Indian and Alaska Native children.
Relief fund spending
Selected IHS and rural providers did not comply, or may not have complied, with Provider Relief Fund terms.
Whistleblower retaliation finding
A contractor’s employee reported patient safety concerns. OIG found the firing was retaliatory.
More from the Office of Inspector General
What to do this quarter
- Update your security risk analysis
- Review privacy notices and consent forms
- Confirm your accreditation manual
- Keep dated records of every review
Draft for Michael’s review. Figures come from public news and agency pages found on November 8, 2026, mostly through secondary sources, so check them against the linked sources before publishing. General information, not legal advice.
Request a call back.
Pick a day and time and leave your phone number. Michael will call you then to talk through your quality, compliance or privacy needs.
- Choose a weekday that suits you.
- All times are Alaska Time.
- Michael calls the number you give.
Say waqaa.
Tell Michael about your organization and what oversight you need to meet.