Kusserow on Compliance: Tips on what to expect from hotline vendors

The U.S. Sentencing Commission and HHS Office of Inspector General (OIG) make it clear that for any compliance program to be effective, it must have active compliance communication channels that meet defined capabilities. Translated, this means organizations must have an employee hotline that permits reporting sensitive matters outside the normal supervisory channels. The failure to establish a credible internal compliance reporting channels often drives individuals to report externally to the OIG and DOJ as “Whistlblowers.”  Internally operated and managed hotlines are generally a bad idea because they are extremely inefficient, costly, and seldom meet any minimum standards. Internal hotlines raise the question of whether anonymity is truly offered and whether employees will ever sufficiently trust calling an employee. It is therefore not surprising that 80 percent of organizations participating in the 2018 Compliance Benchmark Survey Study reported using a hotline vendor. Hotline vendors have the training and experience to handle complainants. However, determining who can provide the best service at the right price is a challenge.


What to Expect from Hotline Vendors

    1. Two levels of service are needed: (a) live operator answered calls and (b) a web-based reporting system which prompts individual complainants. Over the last decade there has been a marked trend towards reporting via the web—today web-based reporting almost equals operator answered calls. Organizations should pass on any vendor that does not provide both services.


    1. Avoid start up hotline services and ask for a statement of their experience. The more a service knows about hotline operations, the less likely they are to encounter problems or mishandle information.


    1. Use only vendors knowledgeable with issues, concerns, and regulatory issues unique to the health care sector. Also, ensure they recognize and ask the right questions about high risk areas identified by the HHS OIG, including those related to the Stark Law and the Anti-Kickback Statute.


    1. Avoid any vendor contract that won’t permit cancellations without cause with a simple 30-day written notice. Hotline vendors should hold clients by good service not by contracts. In any contract with a vendor, look to see if cancellation of service is restricted. If so, consider finding a way out of the arrangement and in obtaining service elsewhere.


    1. Vendor contracts should include a provision requiring a full written report within the same day of receipt of a call. Urgent matters should be reported immediately via phone.


    1. The hotline must provide an option for The U.S. Sentencing Commission, DOJ, and OIG call for anonymity in their guidelines. In the health care sector, nearly two-thirds of all hotline reporters request anonymity. Anonymity is generally in the best interest of the organization as there is no burden of protecting identity if it is unknown. The hotline vendor should have as part of their service a means of communication between the compliance officer and an anonymous reporter. Insist on having that included in the service.


    1. Avoid any vendor that provides reports by facsimile or email, as they are not secure and where PHI may be involved could be a complicating HIPAA privacy factor. Web-based reporting is the most secure with notification of a report being provided via email.


    1. Compare costs of service, keeping in mind that a vendor should be able to provide their services at a set fee that can be used for comparison purposes. A good rule of thumb is that the cost of a hotline service should not be more than $1 per employee per year. Periodically, compare costs of the vendor being used against other vendors. It may prove to be an opportunity to save money.


    1. Look for any inclusive vendor services, such as providing operating protocols for following up on allegations and complaints received through the hotline, as well as other related policies. More reputable firms also provide newsletters or report updates to keep clients up to date on issues relating to their hotline function. Find out what they offer.


    1. Look for a vendor that will provide personalized service and is easily accessible and responsible for any and all issues that arise under the contract. Avoid the frustration of interactive voice response (IVR) phone systems, which move callers from one office to another before reaching a stranger who may or may not be able to answer questions.


    1. Like any other vendor, the company should have at least one- to three-million dollars liability coverage.


    Richard Kusserow will be available to answer any questions related to hotlines at booth 412 at the Las Vegas HCCA Conference.



Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.