Compliance officers are confronted with a host of ever increasing external regulatory and internal demands with most having inadequate resources to meet all the challenges.  Furthermore, it is becoming increasingly common to add responsibility for HIPAA Privacy to the portfolio of compliance officers’ duties. All of this results in ongoing efforts to find ways to extend capabilities, while being sensitive to limited available resources. There are finite options available. Of course, the preference is to handle all this with internal staff. However, unfortunately for most compliance officers, limitations on increased office staffing limits this option. In some cases, organizations turn to Out-Sourcing their compliance program. This is most often done as a measure to temporarily fill gaps with an Interim Compliance Officer (ICO) when an incumbent leaves, or smaller organizations contracting the function out to an individual or firm to assume responsibility by providing a Designated Compliance Officer (DCO). Co-Sourcing is a third option and “middle ground” between hiring new staff (In-Sourcing) and Out-Sourcing and may prove to be the best strategy available for compliance officers to take huge pressures away, if implemented correctly. It involves using limited vendor services and tools to address key elements in the compliance program.

Co-Sourcing Compliance Services/Tools

The key factor that separates Out-Sourcing from Co-Sourcing is the maintaining control and direction under the compliance officer. It involves using a third-party on an ongoing basis to supplement limited staff resources by carrying part of the workload. It can help bridge the gap without compromising the ability to easily return to a structure where the compliance officer reassumes full operation when staffing issues are resolved. This approach is also recognized by the OIG as a useful solution to where an organization is limited in-house compliance expertise and resources. Compliance Officers are increasingly employing this as a means as a practical solution when confronted with a staffing shortage and offers the advantage of using limited, rather than full time services. It also may permit gaining access to a range of specialist without having them full time on payroll.

Common Types of Co-Sourcing Tools/Services

• Hotline Operation
• Compliance Training Programs
• Code and policy development, updating
• Audit Guides for High Risk Areas
• Sanction Screening (use of tools or outsourcing whole process)
• Compliance Surveys

Co-Sourcing Expert Services

There are a number of advantages of engaging outside experts for limited scope of work, especially to address staff shortage or obtaining technical skills that do not exist in-house. Careful use of vendors to supplement the Compliance Office can not only gain access to experts not available in-house, but can save time, money, and effort; while maintaining flexibility to end an arrangement at anytime, when no longer needed. The following are common examples of Co-Sourced services:

• Enterprise Risk Management Assessments
• Ongoing Monitoring/Auditing
• HIPAA Privacy/Security Rule Evaluations/Risk Analysis
• Reviewing Physician Arrangements
• Conducting Internal Investigations (compliance and/or HIPAA)
• Statistical Data Claims Expert to determine error rates
• On call expert advisors and regulatory analysts
• Conducting “Mock Audits” and Claims Reviews
• Compliance Liaison/Manager (outlying facilities)
• Designated HIPAA Privacy/Security Officers
• Internal Auditor Services

Co-Sourcing Tips

1. Clearly define duties, tasks, responsibilities, and methodology for vendor to follow.
2. Ensure the agreement is flexible to expand or contract levels of service as needed.
3. Look for providers that have industry specific expertise.
4. Check experience and seek references of the firm.
5. Ensure individuals provided have the needed skills, experience, and expertise.
6. Bigger is not always better, as smaller niche firms are more likely to provide better, less expensive services.
7. If planning to Co-Source for multiple tools and services, consider seeking discounts for a “bundling” arrangement.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.