Kusserow on Compliance: Measuring the compliance culture

The OIG, DOJ, and other oversight agencies believe the compliance program should be a change agent in promoting a culture of compliance that creates an environment less likely to have regulatory or enforcement problems. This means establishing a culture where everyone in the work environment embraces and adheres to a set of shared attitudes, values, goals, and practices that characterizes an institution or organization when it comes to compliance with laws, regulations, rules, standards, codes of conduct, and policies. The OIG in its compliance-program guidance for hospitals states that “fundamentally, compliance efforts are designed to establish a culture . . . that promotes prevention, detection and resolution of instances of conduct that do not conform to federal and state law, and federal, state and private payor health care program requirements, as well as the hospital’s ethical and business policies.” Today, however, both the DOJ and OIG continue to encounter organizations that have a compliance program on paper, but lacking in quality, commitment, and ethics—a culture of compliance. It is therefore logical that compliance officers find means to evidence that the culture of the organization matches the compliance goals and be able to evidence this, if and when, they are challenged to do so.

One way to gain understanding of the compliance culture is through a survey which tests understanding and acceptance of the compliance program. This is among the best means for evaluating, evidencing, and benchmarking the overall compliance program effectiveness. Using surveys is also one of the two methods suggested by the OIG in its Compliance Program Guidance for Hospitals and Supplemental Guidance for Hospitals.  The OIG noted that “as part of the review process, the compliance officer or reviewers should consider techniques such as . . . using questionnaires developed to solicit impressions of a broad cross-section of the hospital’s employees and staff.” The OIG further reinforced this by stating it “recommends that organizations should evaluate all elements of a compliance program through “employee surveys.” In the 2018 SAI Global/Strategic Management Compliance Benchmark Survey of compliance programs, respondents indicated that one-third of organizations with compliance programs survey their work force on compliance issues. However, only a minority of them use professionally developed and tested surveys, relying upon internally generated and administered ones that do not carry the same level of credibility.

Steve Forman, CPA has been using compliance culture surveys for the last twenty years as a compliance officer and as a compliance consultant. He believes that one of the best and most inexpensive methods for evaluating, evidencing, and benchmarking compliance program effectiveness is through a compliance culture survey that measures employee perceptions of ethical culture and/or the compliance program. He likes using this type of survey, alternately with a compliance knowledge survey that tests employee knowledge of the program. Results from a professionally administered survey provide a very powerful and credible report to the compliance oversight committees, as well as to any outside authority questioning the program.  Such surveys can also identify relative strengths in the compliance programs, as well as those areas requiring special attention that are invaluable for compliance officers.

Jillian Bower Concepcion has many years experience in administering compliance surveys, as well as serving as interim compliance officer. She explained that culture surveys focus on the beliefs and values which guide the thinking and behavior of employees within an organization. They are usually presented in a Likert Scale format that offer a series of gradation where respondents are asked whether they “Strongly Disagree,” “Disagree,” are “Neutral,” “Agree,” or “Strongly Agree,” with the statement presented in each item. She notes it is highly advisable to use a valid and independently web-based administered survey that has been tested over many organizations and ensures participant confidentiality. Using a professional survey service specializing in health care compliance is surprisingly inexpensive and less costly than developing and delivering a survey in house, that doesn’t carry the same level of credibility. The Compliance Resource Center (CRC) has been using the Compliance Benchmark Survey© since 1993 and has been employed with hundreds of health care organizations and a surveyed population of over a half-million. Clients find that comparing their results with the universe to be the most beneficial information. Survey reports are typically about 50 pages in length and provide advice on each topical area and question as to how improvements may be made.

Carrie Kusserow, Managing Senior Consultant for Strategic Management, has been using compliance surveys to assist with benchmarking the progress of compliance program. Such benchmarking was called for by the OIG when it stated in its compliance guidance that “the existence of benchmarks that demonstrate implementation and achievements are essential to any effective compliance program.” She has found surveys can be used to meet that standard, two ways. First, if the survey being used is anchored in a database of users, the organization can benchmark them against that universe, viewed as very important by most organizations. Second, an initial survey can establish a baseline from which future surveys can be used to benchmark progress of the compliance program and measuring change in the compliance environment over a period of time.

Carrie Kusserow and Jillian Bower Concepcion will be available to discuss this subject in more detail at the HCCA conference in Las Vegas, booth 412

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: OIG opinion on the effect of exclusion

OIG Advisory Opinion 18-01 was issued in response to a request regarding the effect of an exclusion from Medicare, Medicaid, and all other Federal health care programs. As a result of criminal conviction for health care fraud pursuant to a civil False Claims Act (FCA) settlement, the Requestor agreed to be permanently excluded. The Requestor received a good faith employment offer from a newly formed, for-profit corporation that will be offering long-term care pharmacies (the LTC Pharmacies) access to discounted rates for emergency medications that the company negotiates with local retail pharmacies. The prices the company would charge for the medications the LTC Pharmacies obtain from the local retail pharmacies would be the discounted rate the company negotiated with the local retail pharmacies, plus a mark-up. The Requestor inquired whether the engagement proposal to market its services (the Proposed Arrangement) would violate the terms of the exclusion and constitute grounds for the imposition of sanctions.

The OIG concluded that, although the Proposed Arrangement could violate the terms of the exclusion and could constitute grounds for the imposition of sanctions, the OIG would not impose such sanctions in connection with the Proposed Arrangement, based upon the following representations:

  • Neither the Requestor nor the company would directly submit claims for items or services that are paid for by any federal health care program, including any medications the LTC Pharmacies obtain from the local retail pharmacies; and would not directly or indirectly have any role in the LTC Pharmacies’ or their customers’ submission of claims to any federal health care program.
  • Neither the Requestor nor the company would submit claims to Medicare, Medicaid, or any other federal health care program for any items or services provided in connection with the Proposed Arrangement.
  • The Requestor would market the company’s services to the LTC Pharmacies and offer them the opportunity to contract with the company to receive lower prices than they normally would pay when ordering emergency medications from a local retail pharmacy.
  • Neither the Requestor nor the company would exercise any direct or indirect control over determining the volume, type, and frequency of any medications they would need or order.
  • The company would pay the Requestor a fixed salary plus a commission based on the number of LTC Pharmacy accounts the Requestor secured for the company with no compensation determined based on the volume, value, frequency, price, or selection of any medications, including federally reimbursable medications, the LTC Pharmacies or their customers would order.
  • Neither the Requestor, nor any member of the immediate family would have direct or indirect control of the company.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Changes in the Stark Law

Over the years, the Stark law has evolved considerably from regulatory requirements to use by the DOJ in enforcement of the False Claims Act. Unlike the Anti-Kickback Statute, which is enforced by the OIG, the Stark law is considered regulatory and under CMS jurisdiction. The Stark law was designed to prohibit doctors from referring Medicare patients to hospitals, labs, and colleagues with whom they have financial relationships, unless they fall under certain exceptions. Stark prevents hospitals from paying providers more when they meet certain quality measures, such as reducing hospital-acquired infections, while paying less to those who miss the goals. Providers have registered numerous concerns that the Stark Law is inhibiting their ability to participate in Patient Protection and Affordable Care Act (ACA) (P.L. 111-148) reforms. The CMS Administrator, Verma, has acknowledged the difficulty of reconciling the Stark Law’s restrictions with the current shift to value based payment structures, noting that that the Stark Law “was developed a long time ago” with current payment systems and operations being different, requiring some changes in the rules. This is not the first time CMS has tried to move the easing of rules concerning the Stark law. In 2015, CMS published a Proposed rule relaxing aspects of the Stark law, including easing of some of the strict liability features of the law and the CMS burden in dealing with the interpretation of key terms, requirements, and other issues.  After reviewing an enormous amount of self-disclosures, CMS realized that a large part of its docket involved arrangements that may technically violate the statute but do not actually pose significant risks of abuse, thus necessitating some changes and clarifications.

Inter-Agency Group formed to focus on easing Stark Barriers

During a January, 2018 American Hospital Association webinar, the CMS Administrator announced plans to convene an inter-agency group consisting of CMS, the OIG, HHS General Counsel, and the DOJ to focus on how to minimize the regulatory barriers of the Stark law that began in 1989 and underwent expansion in the 1990s. Verma noted that the review is in line with CMS’s “Patients Over Paperwork” initiative, which is in accord with the President’s Executive Order that directs federal agencies to “cut the red tape” to reduce burdensome regulations.

Congress Acts

Regardless of the results of the inter-agency review, the fact remains that only so much can be done by regulatory policy changes. All real changes must be made in the law will necessarily have to come from Congress. The Bipartisan Budget Act of 2018 imposed changes on laws related to health care fraud and abuse. On one side they quadrupled fines and doubled potential prison time from five to ten years for violation of the Anti-Kickback Statute.  The Civil Monetary Penalties (CMP) law penalties were doubled. On the other side, Congress moved to reduce some of the burdens by codifying CMS regulatory guidance. Some specific relief involved expired leases and personal services contracts that, if otherwise compliant, will remain protected as long as the terms and conditions continue unchanged.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Ongoing auditing and monitoring of high risk areas—16 tips for compliance officers

By Steve Forman, CPA

In its various guidance documents, the OIG has repeated stressed the importance of ongoing monitoring and auditing of high-risk areas, yet there remains considerable confusion regarding the differences between the two; and who has responsibility for them. The following addresses this issue and provide tips for consideration by compliance officers in meeting the challenge of this key compliance program element.

Ongoing monitoring

Ongoing monitoring is a program manager’s responsibility, not the compliance officer’s. It entails establishing and maintaining controls and metrics to determine on a continuous basis whether operations comply with established policies, procedures, regulations or laws and whether significant risks are being adequately addressed and mitigated. This includes keeping current with changes in rules, regulations, and applicable laws; developing internal controls, policies, and procedures to comply with them; training staff on these rules; and taking active steps in monitoring or verifying compliance with these new guidelines. Ongoing monitoring should be designed to test for inconsistencies, duplication, errors, policy violations, missing approvals, incomplete data, dollar or volume limit errors, or other possible breakdowns in internal controls. Monitoring techniques may include sampling protocols that permit program managers to identify and review variations from an established baseline.

Ongoing auditing

Ongoing auditing is reviewing the ongoing monitoring process. In essence, it is a spot check. The review must be independent and objective, which means that it should be done by people external to the program area being audited. The compliance office, internal or external audits, other program managers, outside consultants, or any combination thereof can be used to conduct ongoing auditing. The objective of the audit should be to verify that program managers are properly carrying out their monitoring responsibilities and to recommend where internal control mechanisms can be improved. This includes confirming that controls are in place and functioning as they were intended or identifying weaknesses in the program that need to be addressed. In any case, the compliance officer should ensure that both the monitoring and auditing is taking place and doing what it should be doing. The compliance officer should also verify that corrective actions taken as a result of audits are timely, effective, and sustainable.  This should also be an ongoing focus of any management level compliance committee or board level compliance committee.

Tips: 16 Questions for compliance officers

  1. Has a compliance audit plan been developed to verify that ongoing monitoring and auditing are addressing compliance high-risk areas?
  2. Have program managers identified and listed all compliance high-risks areas related to their operational areas? Many such risks are found in the OIG guidance, work-plans, fraud alerts, advisory opinions, audits, and enforcement priorities. In addition it is useful to monitor Medicare contractor activities (e.g. RACs, ZPICs, etc.), industry news, PERM reports, and PEPPER data, etc.
  3. Are program managers engaged in assessing high-risk areas within their operations?
  4. Are high-risk areas ranked in terms of level of risk, probability of risk exposure, and impact or damage from a risk area?
  5. Do you also consider high impact, low probability risks?
  6. Have program managers developed and implemented monitoring plans to address all identified risk areas?
  7. Are all compliance risks areas being tested and reviewed on an ongoing basis?
  8. Is there priority given to address areas of highest risk?
  9. Have program managers calculated the potential damage for a risk failure, including the potential scale of direct and indirect financial consequences (i.e., liability, penalties, etc.), as well as whether they have established the likelihood of a risk event, taking into consideration whether the area is a current enforcement priority (e.g., improper physician arrangements)?
  10. Does ongoing auditing verify monitoring by program managers is taking place to addresses adequacy of the internal controls (e.g. policies/procedures) to reduce likelihood of that an unwanted event will occur in high risk areas?
  11. Has ongoing auditing validated that ongoing monitoring is effective in achieving the desired objectives?
  12. Have corrective action plans have been instituted for all risk area deficiencies identified by ongoing monitoring or auditing?
  13. Is there a process by which corrective action measures taken are working as intended?
  14. Are results of monitoring and auditing included as regular agenda items for management and board level compliance committees?
  15. Have compliance experts been engaged to independently evaluate the effectiveness of a compliance program, inasmuch as the OIG identifies it as a program that should be part of ongoing auditing. Place special emphasis in the scope of work on reviewing whether high-risk areas are being properly addressed.
  16. Do you periodically evaluate that effectiveness of the risk assessment program?

 

Steve Forman, CPA is the Senior Vice President of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening. His comments in this blog reflect experience of over 35 years, having served as Director of Management Operations for the OIG, 10 years as VP for Audit and Compliance for a major health system, and as a compliance consultant for many healthcare organizations. Mr. Forman has published widely on this subject.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of SM.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.