Kusserow on Compliance: Using experts to staff gaps in the compliance office

It is becoming increasingly common for changes in compliance programs to lead to “gaps” that can leave an organization without day to day management or support. This can result in serious problems and potential liability, especially at a time when mandatory compliance requirements are under development and there are increasing expectations for compliance by the Department of Justice (DOJ), HHS Office of Inspector General (OIG), and CMS. With the heightened enforcement environment, leaving such a gap can be risky. All this makes the problem of finding a suitable replacement of someone properly qualified in a timely manner a relatively high priority, but not an easy task. In many cases, the gap is not with the chief compliance officer, but compliance managers or other professionals in the office. In any case, the effort that goes into finding and hiring a properly experience and qualified person may be difficult and time consuming. The quick fix of designating someone internally to do the work, until a permanent replacement can be recruited, is unwise and may be downright dangerous. For smaller organizations, it is not likely there is anyone who is sufficiently qualified to carry out all the duties. It is also not good for someone to take on those duties temporarily and make decisions that may haunt them when they return to their old job. Also, making some decisions, when not properly trained or qualified, may create a potential problem for the organization. What is worse is selecting someone to take on the role of compliance officer as a temporary set of secondary duties to their current job. This will always lead the individual to continue giving priority to their regular job and do as little as possible in compliance. As such, it is not surprising that many turn to engaging temporary experts to fill the gap until suitable replacement can be found.

A properly qualified outside expert acting in a temporary capacity has a lot of advantages. They bring the experience of having served in other organizations and dealing with many of the same issues already addressed by prior jobs. Important also is that they have not be invested in any prior decisions, nor have they been aligned with any parties in the organization. Most importantly, they bring “fresh eyes” to the program. They can provide a lot of added benefits, such as:

  • Offering suggestions and giving guidance for improvements
  • Providing an independent assessment of the status of the compliance program
  • Making an assessment of high-risk areas that warrant attention
  • Giving ideas on building a firmer foundation for the compliance program
  • Reviewing adequacy of the existing code, compliance policies, and other guidance
  • Evaluating the quality and effectiveness of compliance training
  • Developing a “road map” for the incoming compliance officer to follow
  • Assisting in identifying and evaluating candidates for the permanent position
  • Assessing resources needed to effectively operate the compliance program
  • Identifying or building metrics that evidence compliance program effectiveness
  • Developing comprehensive briefings for management and board on the state of the program

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Use of temporary compliance and privacy officers

By now every health care provider is aware of the need for an effective compliance program under direction and management by a compliance officer, as well as a privacy officer to ensure HIPAA compliance. It is common these days for organizations to have compliance and privacy officer vacancies as result of a retirement, termination, someone changing jobs, or any other of a dozen reasons. Sometimes it may have been triggered by an audit or investigation by the HHS Office of Inspector General (OIG), Department of Justice (DOJ), HHS Office for Civil Rights (OCR), or a CMS contractor. In other cases, a board or new executive leadership may wish to use proven experts to promote and/or elevate the programs to a higher level. Regardless of the reason, the departure of a long time incumbent creates a vacuum that needs to be filled quickly for day to day management and responding to emerging issues to avoid serious problems and potential liability. The worst time to have a vacancy is when entering the holiday season and the end of the calendar year. For a variety of reasons, it is a time when many problems and issues arise needing prompt attention.

Steve Forman, CPA, is an expert on the subject with over 25 years as a healthcare compliance officer and consultant, including serving on multiple occasions as an interim compliance officer.  He notes that the sudden departure of a compliance or privacy officer makes the problem of finding someone properly qualified in a timely manner a serious issue. Confronted with a rapidly evolving regulatory and enforcement environment, health care organizations cannot afford to take the chance on having a gap in these positions. When such a gap occurs, engaging an expert on a short term engagement can hold the reigns of the program together, while a permanent replacement is found. Using a properly qualified outside expert presents a lot of advantages.  They can bring the experience of having served in other organizations and dealing with many of the same issues already addressed by prior jobs. It is also important that they have not been invested in any prior decisions, nor have they been aligned with any parties in the organization.  Most importantly, they bring “fresh eyes” to the program. They can provide objective assessment on the state of the compliance program, offer suggestions, and give guidance for improvements.

Suzanne Castaldo, JD, who specializes in providing interim compliance and privacy officers for healthcare clients, noted that clients to whom she has provided interim officers, usually take three to five months to find that hire a permanent replacement with necessary experience and qualifications. When they seek temporary officers, she provides experienced professionals with previous experience as a compliance or HIPAA privacy officer. Over the last 25 years, her firm has worked with over 3,000 health care organizations in building, evaluating, managing, and building compliance program that provide a unique level of knowledge and expertise. Using the right professional with a lot experience and technical skills can make significant improvements for any compliance program in a relatively short order.

Camella Boateng is another highly experience compliance professional who has served as an interim compliance and privacy officer for several organizations. She has found that organizations have a tendency to understate the needs in the vacant position.  In every case where she has been called upon to fill a vacancy, she has encountered serious problems that were hidden or not recognized by the organization. In fact, these unattended problems often were the reason for the departure of the incumbent. As such, those seeking temporary compliance or privacy officers require more than someone just to monitor and manage day to day work. They should look to added benefits and services an outside expert can bring, including providing an independent assessment of the status of the compliance program and high-risk areas warranting attention. Before leaving the engagement they can develop a “road map” for the incoming compliance officer to follow. All this can result in developing comprehensive briefings for management and board on the state of the program

Lisa Shuman is a consultant that has served as an interim privacy officer for organizations. She observed that the work flow is different from that of a compliance officer. She has found from her experience that most engagements can be part time with much of the work done remotely.  The first month usually involves focusing on reviewing adequacy of existing policies, procedures, controls, and training content. After that, the work focuses primarily on privacy violation investigations that arise, however, it is important that the interim privacy officer be available at any time to deal with issues

 

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Extending and economizing compliance programs—tools, services and tips

Compliance officers are confronted with a host of ever increasing external regulatory and internal demands with most having inadequate resources to meet all the challenges.  Furthermore, it is becoming increasingly common to add responsibility for HIPAA Privacy to the portfolio of compliance officers’ duties. All of this results in ongoing efforts to find ways to extend capabilities, while being sensitive to limited available resources. There are finite options available. Of course, the preference is to handle all this with internal staff. However, unfortunately for most compliance officers, limitations on increased office staffing limits this option. In some cases, organizations turn to Out-Sourcing their compliance program. This is most often done as a measure to temporarily fill gaps with an Interim Compliance Officer (ICO) when an incumbent leaves, or smaller organizations contracting the function out to an individual or firm to assume responsibility by providing a Designated Compliance Officer (DCO). Co-Sourcing is a third option and “middle ground” between hiring new staff (In-Sourcing) and Out-Sourcing and may prove to be the best strategy available for compliance officers to take huge pressures away, if implemented correctly. It involves using limited vendor services and tools to address key elements in the compliance program.

Co-Sourcing Compliance Services/Tools

The key factor that separates Out-Sourcing from Co-Sourcing is the maintaining control and direction under the compliance officer. It involves using a third-party on an ongoing basis to supplement limited staff resources by carrying part of the workload. It can help bridge the gap without compromising the ability to easily return to a structure where the compliance officer reassumes full operation when staffing issues are resolved. This approach is also recognized by the OIG as a useful solution to where an organization is limited in-house compliance expertise and resources. Compliance Officers are increasingly employing this as a means as a practical solution when confronted with a staffing shortage and offers the advantage of using limited, rather than full time services. It also may permit gaining access to a range of specialist without having them full time on payroll.

Common Types of Co-Sourcing Tools/Services

Co-Sourcing Expert Services

There are a number of advantages of engaging outside experts for limited scope of work, especially to address staff shortage or obtaining technical skills that do not exist in-house. Careful use of vendors to supplement the Compliance Office can not only gain access to experts not available in-house, but can save time, money, and effort; while maintaining flexibility to end an arrangement at anytime, when no longer needed. The following are common examples of Co-Sourced services:

Co-Sourcing Tips

  1. Clearly define duties, tasks, responsibilities, and methodology for vendor to follow.
  2. Ensure the agreement is flexible to expand or contract levels of service as needed.
  3. Look for providers that have industry specific expertise.
  4. Check experience and seek references of the firm.
  5. Ensure individuals provided have the needed skills, experience, and expertise.
  6. Bigger is not always better, as smaller niche firms are more likely to provide better, less expensive services.
  7. If planning to Co-Source for multiple tools and services, consider seeking discounts for a “bundling” arrangement.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Effective hotline programs

All healthcare organizations need confidential compliance communication channels. First and foremost among them is a hotline. By definition, all effective compliance programs should have a hotline. It is an important avenue of communication between employees and management, in that it permits employees to report sensitive matters outside the normal supervisory channels.  The reality is that developing and monitoring a hotline is a critical part of any effective compliance program. It provides an avenue of communication that permits employees to report sensitive matters outside the normal supervisory channels. The compliance officer bears the responsibility of constantly reviewing and improving the effectiveness of the hotline operation.  The US Sentencing Commission, the HHS Office of Inspector General (OIG), and Department of Justice (DOJ) all call for having a hotline, as well as other authorities, including the Sarbanes-Oxley Act for publicly traded companies and the federal courts in connection with unlawful harassment. Failure to establish positive internal compliance reporting channels often results in reporting externally to the OIG and DOJ from “whistleblowers.” The challenge is establishing effective internal compliance communication. Today, it is the exception to find organizations trying to manage a hotline function internally. The fact is that any advantage of internally operated hotlines is more than off-set by the disadvantages.

From a practical standpoint, it simply is not cost effective to operate a hotline 24/7 internally.  Even those that decide to operate and manage the function in house are confronted with a number of challenges—it is extremely inefficient, costly and seldom meets any minimum standards. Hotline numbers will need to be “backstopped” against tracing and all caller identification systems have to be blocked. People answering the calls in house should not be highly visible to the work force. Confidence comes from neither party being known to the other. Hotline vendors have the training and experience to handle complainants. Callers are generally nervous and afraid and knowing they are providing information to an outside party generally is reassuring. They always raise the question of whether anonymity is truly offered and whether employees will ever sufficiently trust calling an employee. It has become the standard practice for organizations to outsource their hotline to a vendor.  However, evaluating those providing the best service at the right price is a challenge. The following are questions that can be used to determine a properly qualified vendor. Those failing key tests should be avoided as they may prove to be a future liability.

 

Questions for hotline vendors

  1. Cost of Service. Does the vendor charge an established fixed rate or sliding rate based upon number of calls? Seek a fixed, not a variable rate, based upon number or time of calls. A good rule of thumb is that the cost of a hotline service should not exceed $1-3 per employee per year.

 

  1. Industry Focus. Can the vendor evidence having understanding and expertise of issues related to the health care industry? Failing to understand healthcare standards and regulatory matters limits the ability to properly debrief callers. Ask for a breakdown of the types of clients they serve by industries.

 

  1. Hours of Service. Does the vendor provide 24/7 service? If not, don’t use them.

 

  1. Call Centers. Does the vendor provide call services? If so, avoid them completely. Call centers provide outbound calls used to promote services and products. Others answer after hour services for businesses (doctors, plumbers, electricians, etc.) and relate messages to their clients. The people doing this are performing a clerical function and answering hotline calls requires more professional expertise. Furthermore, there is the risk of having calls interrupted by a call for some needing emergency service.

 

  1. Hotline Service Types. Does the vendor provide multiple levels of service for (a) receiving live operator calls and (b) a web-based reporting system that prompts individual complainants? One level alone is not enough.

 

  1. Avoiding Vendor Contract Traps. Does the contract permit cancellation at any time with a simple 30 day notice? If not, don’t use them. Staying with a vendor should be because of good service, not because of being locked into them by contract terms. If you have a current contract, check the termination clauses to see if cancelling a contract is cumbersome. If it is, ask to renegotiate the termination clause. If they decline, then take steps to follow termination procedures in the contract.

 

  1. Hotline Number. Does the vendor want to use their phone number? This is a common vendor trap to lock in users to their service. You advertise their number everywhere and to change would necessitate changing all the places you have advertise the number. Always use and own your own hotline number that can be pointed to a vendor.

 

  1. Language Translation. Does the vendor provide a language translation service to address non-English speakers?

 

  1. Check Vendor Background. What is the level of hotline experience among the ownership, management, and operation of the service?

 

  1. Length of Hotline Experience. How many years of experience can the vendor evidence in the management of hotline operations?

 

  1. Policies, Procedures, and Protocols. Does the vendor provide advice on developing operating protocols for following up an allegations and complaints received through the hotline?

 

  1. Business Associate Agreement (BAA). Does the vendor offer to sign a BAA to meet HIPAA protected health information (PHI) requirements for any patient related information received through the hotline? If they don’t know what that means, forget them.

 

  1. Timelines. Will the vendor agree to provide a full written report within one business day of receipt of the call and for urgent matters, immediate notification?

 

  1. Report Delivery Security. Does the vendor deliver call reports by the most secure means? It is critical to establish a secure call report submission process to a specific responsible party and to an alternate should the primary contact be unavailable? Any delivery of reports via fax or email lack necessary security. It is critical that reports are secured to protect those filing the report, as well as those who are subject of the report or mentioned in them. HIPAA PHI, proprietary and confidential data, and personnel information must be protected. Web-based reporting is the most secure with notification of a report being provided via email.

 

  1. Routine vs. Urgent Reporting. Does the vendor assist in establishing a process that alerts the primary contact to any urgent report received? A delay in reporting a serious issue could result in potential liabilities.

 

  1. Insurance. Does the vendor provide at least one to three million dollars liability coverage? If your vendor does not have this insurance, consider changing over to one that provides this assurance.

 

  1. Caller Contact Information. Does the vendor have procedures for providing callers with a means to call back without disclosing their identity?

 

  1. Personalized Service. Does the vendor provide the identity or identities of individuals available to respond to any issues or question that may arise, whether it relates to call reports, invoice issues, or providing general advice? Not having easy access to someone or having to go through a phone system moving you from one office to another before you find a stranger who may or may not be able to answer your questions can be frustrating. If possible, seek an identified accounts manager who will be responsible for any and all issues that arise under the contract.

 

  1. Training and Assistance. Does the vendor provide guidance on the best way to promote understanding of the hotline?

 

  1. Other Useful Benefits. Are there any other services or benefit provided under the contract? This would include such things as supporting policy and procedures for hotline management, poster templates, newsletters, etc. For smaller organizations, these benefits may exceed even the service fees paid to the vendor. Find out what they offer.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.