Kusserow on Compliance: A Dozen tips for evaluating hotline vendors

Review current vendor contracts; it may be time to switch

A hotline is a critical part of any effective compliance program. It provides an avenue of communication that permits employees to report sensitive matters outside the normal supervisory channels. The compliance officer bears the responsibility of constantly reviewing and improving the effectiveness of the hotline operation. The U.S. Sentencing Commission, HHS OIG, and DOJ call hotlines critical to an effective compliance program. Most hotlines are operated through vendors. Only a very few organizations have the size, capacity, and resources to manage a 24/7 hotline, as is needed for an effective operation. The following are some best practice tips in selecting or retaining a hotline vendor:

 

  1. Compare costs of a vendor with the cost to maintain and operate a hotline in-house. A vendor should provide their services at a set (fixed) fee that can be used for comparison purposes. A good rule of thumb is that the cost of a hotline service should be around $1 per employee per year.

 

  1. Industry Focus. Determine the level of expertise in the health care industry. It is advisable to have a company familiar with and sympathetic to health care issues, rather than focus on employee theft or other generic matters common to all industries. Ask for a breakdown of the types of clients they serve. Do they have a primary focus (transportation, finance, energy, health care)?

 

  1. Hotline Service Types. In today’s environment, it is advisable to have two levels of service. The first is a Web-based reporting system that prompts individual complainants, as well as the option to call and speak with a live operator. Either approach has its pluses and minuses. Your vendor should provide both approaches in a single service fee.

 

  1. Vendor Contract Traps. A vendor should keep business with good service, not tricky contract terms. The contract should permit cancelation at any time with a simple 30-day notice.  If you have a current contract, check the termination clauses to see if cancelling a contract is cumbersome. If it is, ask to renegotiate the termination clause and if they decline, then take steps to follow termination procedures in the contract. Usually such procedures are a short window to cancel, before the contract renews.

 

  1. Hotline Number. Always use and own your own hotline number. To use a vendor number is another common vendor trap. If you advertise their number, to then change would necessitate changing all the places you have advertise the number. If, in such a contract, it is advisable to either renegotiate the agreement to use you own number or change to another vendor, it is worth the pain of making the change.

 

  1. Background and References. It is advisable to know as much about the vendor as you can. Determine who the key players are in the ownership, management and operation of the service and check out their credentials. Do they have personal history and expertise in hotline operations? Also, ask for client references from any vendor you are considering.

 

  1. Policies, Procedures, and Protocols. The company should be able to provide expert advice on developing operating protocols for following up an allegations and complaints received through the hotline. This includes providing/signing a Business Associate Agreement to meet HIPAA Protected Health Information requirements (and if they don’t know what that means, forget them).

 

  1. It is important to insist and have as part of any contract, provision of a full written report within one business day of receipt of the call. For urgent matters, it should be immediate.

 

  1. Reports Provided. Reports on individual calls should be well written, clear, concise and of high quality. The manner the report is delivered is important. There are security problems with reports provided either by facsimile or email. This could be problematic. Web-based reporting is the most secure, with notification of a report being provided via email.

 

  1. Like any other vendor, the company should have at least one to three million dollars liability coverage. If your vendor does not have this insurance, consider changing over to one that provides this assurance.

 

  1. Caller Contact Information. Although anonymity is a must for any hotline, sometimes gaining additional information from callers is important. Vendors should have procedures for providing callers with a means to call back without disclosing their identity. Check that out to see if it meets your needs.

 

  1. Accessibility to Responsible Parties. Responsiveness of vendors to your hotline needs is very important. If something comes up, will there be a responsible live human being available with who you can communicate issues and concerns? You never want to be lost in a bureaucratic shuffle or IVR system.

 

For more information on this topic, contact Marvin Mills (mmills@complianceresource.com).

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2020 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Effective compliance document management system

All effective health care compliance programs should implement some type of compliance Document Management System (DMS), which involves the process of organizing, filing, controlling, and storing documents. The primary purpose is to ensure that all documents, including the Code of Conduct, charters of compliance functions, compliance-related policies and procedures, records of hotline and investigation activity, etc. are current with applicable laws, regulations, and requirements and are properly maintained. A well-managed compliance DMS evidences the effectiveness of the compliance program. Compliance officers need to ensure that their records management policy is being followed and is in line with any retention schedules required by law. When audited by a government entity, it would be necessary to produce evidence about the operation and management of the compliance program. A well-structured DMS will ensure the organization meets regulatory compliance mandates, provide the availability of documents evidencing compliance program effectiveness, and, in turn, mitigate exposure to liabilities.

The 2020 Eleventh Annual Healthcare Compliance Benchmark Survey conducted by SAI Global and Strategic Management Services included questions that focused on management of policy and compliance documents. Results from the latest survey found that compliance offices were split nearly in half between those that manually manage compliance-related documents and those who used automated assistance. One-third reported using some sort of document management software to assist. Only one-fifth reported using a comprehensive document management system. The trend from review of past surveys clearly indicate a movement away from manual processes to DMS. The following are tips to consider when managing compliance-related documents:

  1. Document Management System (DMS). Develop a compliance Document Management System to track, administer, and store compliance related documents and health care compliance policies and procedures.

 

  1. Set-up a Records Retention Schedule. As part of the DMS, schedule how long records should be kept from an operational and legal standpoint, and that outdated records are disposed of in a timely, systematic manner. When determining the retention period for records, it’s important to: (a) perform a record inventory of all physical and electronic records; (b) establish a standardized record classification system; and (c) conduct research on all federal, state, and local records retention requirements.

 

  1. Policies and Procedures. Develop and implement policies and procedures for the creation, distribution, retention, storage, retrieval, and destruction of compliance related documents and health care compliance policies and procedures. Ensure that the compliance records management policy addresses protection of patients’ protected health information. Keep all revised or rescinded policy documents. Should an issue arise concerning a policy, it will be the document in effect at that time and not a current version.

 

  1. Accessibility and Location. The DMS must include being able to find and access information, when needed. It is advisable to index records by date, subject matter, creator, and location of the record.

 

  1. Ongoing Monitoring and Auditing. It is important to have ongoing monitoring of the records management system to ensure compliance with the policy and procedures. Periodic independent audits of compliance should also take place to ensure retention schedules are being followed, timely reviews are made to keep documents current, destruction of documents are in accordance with policies, etc.

 

  1. Records Disposal/Destruction. There are times when documents are no longer needed and should be destroyed. Maintaining unnecessary records longer than necessary increases exposure to possible breaches. Disposing or destroying records must follow closely the written policy guidance, including the means for doing it. It is also important to keep a record of the record disposal.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2020 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: New COVID-19 scam warning from the FBI

Some providing false test results to get off work

Causing business to shut down and unnecessary quarantining

Further crippling some businesses

The FBI has issued a series of warnings about a rise in coronavirus-inspired scams that have emerged in recent weeks. The latest warning cautioned employers to be on the lookout for employees using falsified doctors notes and other medical documents claiming they tested positive for coronavirus. The FBI cited once case where a worker at a critical manufacturing company submitted a letter that appeared to come from a medical facility and showed a positive COVID-19 test result. In response, the company shutdown a manufacturing site to disinfect the facility and halted production and delivery of necessary materials. The company also notified all workers at the facility, including four people who had to be quarantined because they had close contact with the infected employee. The FBI’s advice to employers is to be on the lookout for inconsistencies in medical documentation from employees and to contact medical providers listed on medical documents to verify the information. The importance of verifying employees who test positive will become more important as more business activity will be reactivated by government authorities.

Kusserow on Compliance: FBI reports rise in schemes involving the COVID-19 pandemic

The FBI reported that fraudsters are taking advantage of COVID-19 pandemic to steal your money, personal information, or both. Fraudsters see a vulnerable population scared and looking for help to protect themselves and their families. They are increasingly resourceful and view the current crisis as an opportunity to advance their schemes. Today, many are looking for medical attention, equipment, and supplies. As a result, a new fraud threat involves fake cures or treatments for the virus, many of which can be extremely dangerous or even fatal.

People who are at home and out of work are vulnerable to work-from-home scams where up-front money is requested—such requests are not something a legitimate employer does. One of the most prevalent schemes is where criminals make contacts pretending to be from the government to require mandatory COVID 19 testing in order to gain personal information, money, or to hack into a computer. Other scams involve acquiring personal information under the pretense of determining eligibility to receive government benefits. In some cases, fraudsters are even going door-to-door to try to convince individuals that they need to provide money for COVID-19 testing, financial relief, or medical equipment. The FBI has teams of agents working on these cases and have arrested and filed charges against many engaging in these crimes. They FBI advises everyone to be on the lookout for the following “red flags” involved in email contacts:

  • Unexplained urgency
  • Last minute changes in wire instructions or recipient account information
  • Last minute changes in established communication platforms or email account addresses
  • Communications only in email and refusal to communicate via phone or video
  • Requests for advanced payment of services when not previously required
  • Requests from employees to change direct deposit information

The following tips have been offered to help protect against these schemes:

  1. Be very wary of any attachments or links.
  2. Be suspicious of anyone offering you something that’s “too good to be true”
  3. Beware of contacts purporting to be a government agency requiring taking a COVID-19 test
  4. Beware of individuals offering to sell you a COVID-19 test kit or supplies
  5. Beware of medical professionals requesting payment for treating a friend or relative
  6. Be skeptical of last-minute changes in wiring instructions or recipient account information
  7. Verify addresses of emails from those you know; it may be just one letter difference
  8. Never contact a vendor solicitation via the number provided in the email
  9. Ensure URL in emails is exactly as seen in the past for the business it claims to be from
  10. Be alert to hyperlinks that may contain misspellings of the actual domain name
  11. Accept a medical treatment or virus test only from known doctor or pharmacist
  12. Use extreme caution in online communication
  13. Seek out legitimate sources of information and not accept what is sent without request

For more information, the HHS OIG issued a COVID-19 Fraud Alert Video to warn about several health care fraud scams.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2020 Strategic Management Services, LLC. Published with permission.