An effective compliance program involves constant evaluation and improvement. To keep improving your program, risk areas need to be consistently monitored and audited. These processes are a compliance program’s detection mechanisms, and they can assist you in finding new risks or detecting ones that have escalated. Additionally, auditing and monitoring can verify that management has put mechanisms in place to mitigate previously identified risks. A reporting system is also necessary for staff to use if they encounter instances of noncompliance and are not comfortable raising issues with management. The reporting system is the safety mechanism for an employee to feel free to raise issues without fear of retaliation or retribution. Having these tools and processes in place demonstrates an organization’s commitment to continually improving its compliance program.
While an expectation of 100% compliance is an ideal goal, it is also unrealistic since organizational compliance relies on everyone’s compliance and accountability. The key is to strive for and demonstrate a process for continually improving and evolving your compliance program and its activities. To that end, you’ll find a strong emphasis on the importance of evaluation in the most recent regulatory agency settlements.
Regular monitoring is an ongoing need. Management should monitor the risks of the organization and ensure that they are mitigated. Monitoring helps to identify early on if risks are escalating so that they can be addressed quickly and reprioritized when needed. Moreover, all OIG compliance program guidance state that ongoing evaluation is critical to a successful compliance program. Regulators (such as the DOJ and HHS OIG) have also identified key areas they look at when evaluating the effectiveness of compliance programs.
Auditing and Monitoring Plan
Every compliance program should have an auditing and monitoring plan, and this can be created by the compliance program or another department in the organization. Either way, a plan should be developed and documented according to the priority risks identified in the compliance risk assessment. If a compliance professional is not the person who develops the auditing and monitoring compliance plan and another function is responsible, compliance should document in the plan how priority risks are evaluated and how ongoing monitoring occurs. Doing so demonstrates the integration of compliance with other risk partners in the organization. For example, the internal audit function may be auditing the compliance risk priorities, while compliance conducts ongoing monitoring of those risks. Demonstrating how priority risks are being handled should be reflected in compliance documentation.
Auditing and monitoring are important elements of an effective compliance program. The compliance professional needs to be involved with and understand what is being done to address priority compliance risks. Auditing and monitoring efforts help compliance develop and adapt training plans, reporting, communications, and more. These efforts are key to validating compliance to policies, rules, and regulations—and important for identifying further action needed around risk priorities, monitoring for remediation of risks, and controls.
Areas of risk common to most healthcare organizations—regardless of business segment, size, or geography—may include the following:
-
Third-party relationships
-
Billing and coding
-
Conflicts of interest
-
Medical necessity reviews
-
Physician arrangements
-
Teaching physicians (documentation review)
-
Business associate agreements
-
Data privacy and security
-
Documentation of homebound status
-
Aggregate payments to healthcare providers
-
Coverage analysis for research
-
Appropriate credentials for overseeing a specific program (such as rehabilitation)
-
Delegated care management
-
Scope of practice
Other risks to be reviewed depend on the industry and type of organization, i.e., status as private, for-profit, tax exempt, or public. Some risk areas identified previously or in the risk assessment won’t necessarily be the compliance department’s focus, but compliance should ensure that audits occur and that issues are addressed.
Any areas of concern and risk priorities previously identified, either internally or by an outside agency, should be monitored carefully and regularly. The reporting system will also identify new risks in the organization or can show recurring trends and unresolved issues. Risks are always changing, and monitoring helps identify changing risks. A dynamic audit and monitoring plan alerts compliance to the need for reprioritizing risks. For more information on the risk assessment process, see Chapter 6, “Risk Assessment.”