How to Design and Implement A Corporate Compliance

How to Design and Implement A Corporate Compliance Program Auditing and Monitoring Operations and Business Processes 1

Our House Analogy The physical structure (walls, ceiling) Ø Like the mechanical aspects of a compliance program n The “furniture/appliances” Ø The substantive laws/policies n Ø What we must “comply” with versus the “how we get there” 2

Prior Sessions: “Process” Aspects (The House) n Some of the process pieces we’ve explored: Ø Compliance officer/committee Ø Employee education/training Ø Checking exclusion status of employees & contractors Ø Creating/retaining compliance records 3

Today: More Process n Auditing and Monitoring Systems Ø OIG: Integral to an “effective” compliance program Ø Monitoring operations (business processes, quality, resident safety) Ø And your compliance program’s effectiveness 4

Auditing & Monitoring Is Just: n Reliable, periodic systems to audit or check on identified “risk areas” in corporate/facility operations Ø Not overly complex Ø But comprehensive & reliable Ø That specifies how it works and who’s responsible for auditing Ø With reviews of systems for reliability 5

RISK … “exposure to the chance of injury or loss” 1. 2. 3. Business Risk Healthcare Company Risk Quality Risk 6

RISK Lawsuit Whistleblower Theft Survey Falsification Resident Trust Conflict of Interest Five Star Medical Necessity Exclusion Denials Abuse False claims Investigation Background Check Kickback Referral Supplementation Class action Audit PROBE Disclosure Labor Controls Staffing Consolidated Billing Triple Check Reimbursement Coding HIPAA RUGS HR RAC MDS MAC POC EEOC SOD SEC CMP OIG CMS DOJ AR PPD EIEIO 7

LONG TERM CARE RISKS BUSINESS LTC HEALTHCARE COMPANY QUALITY 8

Business Risks Enforcement Financial Viability Sarbanes. Oxley (Public Company) 9

Healthcare Company Risks Whistleblower Regulatory OIG/DOJ 10

Quality Risks Litigation Reimbursement Fraud/Abuse 11

One Risk Management Approach (aka “the Silo approach”) Business Risks Healthcare Company Risks Quality Risks 12

Components of Risk Management “Silos” Business Risks External Internal Audit Dashboard Healthcare Company Risks OIG – Compliance Program Quality Risks CMSQuality Improvement - survey - quality measures - staffing 13

Another Risk Management Approach (aka “an Integrated Approach” Business Risk External Internal Audit Dashboard Quality Risk CMSQuality Improvement - survey - quality measures - staffing Healthcare Company Risk OIG – Compliance Program 14

“DASHBOARD” for Integrating Risk Data n Data Metrics Ø Quality Ø Business Ø Healthcare Company Compliance 15

Dashboard Formats 16

Dashboard Development n n n Get constituent buy-in and allocate funds; Select project team; Ø In-house Ø Consultant /vendor Ø Combination Determine data to be “rolled-up”; Ø Don’t create new data Select dashboard format based on ease of data import (manually or through IT); Wide-distribution to constituents Ø Act on indicators 17

Making Auditing and Monitoring Practical A Step-By-Step Approach to Taking the Pulse of Your Operations and Compliance Program 18

1. Specifically target and identify what you are auditing n Possible audit “targets” come from: Ø OIG “risk areas” (later webinars) Ø Your own operations experience § Internal/external finance or business audits § Survey results, QI scores, QA meetings, complaints, hotline calls, satisfaction surveys 19

Poor “Targeting” = Poor Results With multiple targets, failure to clearly define, and give team clear direction = disorganization, missed issues & ineffective auditing n Am I targeting med error rates, contract compliance with illegal kickbacks, improper MDS coding and resulting improper payment claims? n 20

2. Design the Specific Auditing Steps You’ll Employ What source information/processes am I examining? Ø Unlocked med carts in hall, sample of payment claims, facility contracts, hotline responses? n Where is the information I’m testing located in terms of operations? n 21

2. Design the Specific Auditing Steps You’ll Employ n How will we audit those sources? Ø Pulling/reviewing resident charts? Ø Interviewing nursing staff, families, residents? Ø Observing staff with residents? Ø Observing compliance officer interactions with Board members? 22

2. Design the Specific Auditing Steps You’ll Employ n How will we gather and report our findings? Ø Preparing written reports, charts, or making oral reports? Ø To whom? § Maybe internal reporting and/or external to consultants/counsel 23

2. Design the Specific Auditing Steps You’ll Employ n How frequently are we accessing our information sources? Ø Annual audit of financial records? Ø Quarterly review (med. regimen) ? Ø Time-limited review of med error rates (spike in rates)? § Followed by periodic check on the “fixes” § The findings dictate frequency 24

2. Design the Specific Auditing Steps You’ll Employ n Who’s responsible for the audit to make sure it’s targeted, examines the sources we’ve identified, on the schedule we’ve established? Ø For internal/external audits, put one person in charge § Even with audit “teams” § Including for reporting function 25

3. Decide How We’ll Use the Audit Results Obtained n n Depends on the issue and company Ø External CPA audit goes to CFO Ø Care plan audit to DON, administrator, consultant, Quality Assurance Committee Purpose: spot an issue, analyze it, repair it, communicate repair, consider legal reporting requirements 26

If You Want to Write a Specific Audit Flowchart These questions will direct how to do that Ø Really, for any issue you can think of: quality, finance, business ops n And, if you’re looking for an “audit & monitoring” policy for your compliance program, these questions will take you there n 27

An Example Compliance with Facility Obligations Under Medicare Part D [From OIG 2008 Supplemental Guidance for Nursing Facilities] 28

1. Target / Identify What We’re Monitoring n Audit/monitor following aspects of Medicare Part D compliance: n Explaining Part D Plans to residents accurately/completely? n Are our pharmacy contracts sufficient to ensure resident choice in Part D Plans? 29

1. Target / Identify What We’re Monitoring n n n Have mechanism to contract with additional pharmacies or with one (exclusive) with broader Plans? Avoid coaching, steering, requiring a resident to select a specific Part D Plan or specific pharmacy? Do employees/contractors accept items of value from Part D Plan or pharmacy to refer patients? 30

2. Designate Specific Audit Steps Review any policy/procedure and “scripts” used to explain Part D Plans to residents n Observe 15 instances of staff explaining Plans to residents. n Supplement with 15 interviews of staff, residents and families re how we explained Plans n 31

2. Designate Specific Audit Steps n n n Identify failures to describe Plan fully or accurately or respond to resident requests for Plans we don’t offer Observe 15 instances of pharmacy rep or contractor discussing Plans with residents Any instances of coaching, steering, requiring a specific Plan or pharmacy? Supplement with resident/family/staff interviews re those interactions. Counsel employees / consider discipline for violations & any corrective action required? 32

2. Designate Specific Audit Steps n n n Observe 15 interactions between resident and contract pharmcy(ies) to ensure no steering, coaching, etc. Report violations to compliance officer/committee Ø Corrective action required? Examine how pharmacy contracts are negotiated / executed to ensure no items of value to induce contracts or referrals 33

2. Designate Specific Audit Steps n Identify any items of value provided to facility staff, resident or family by facility staff, Part D Plan rep, or pharmacy rep Ø Via interviews with staff, resident, family, contractors (I. D. #) Ø Determine if permissible under applicable law (counsel / compliance officer) Ø Identify who will perform these steps by title and frequency (if not above) 34

3. Designate How We Will Use the Audit Results n n n Share audit results and any noncompliance instances with compliance officer or designee as soon as practicable after audit And with QA Committee as directed by compliance officer Compliance officer will share results with Board and decide if additional steps required (corrections, external reporting) 35

Summary n n n Our Q and A approach is one format Many ways to design audit system Keys are: Ø Is it manageable? Ø Does it work (finding problems)? Ø Is it thorough? Ø Are we actually using it and the results? Ø Are we auditing the audit system to ensure it’s working also? 36