Policies and procedures provide tangible evidence to stakeholders and regulators that an organization is committed to compliance. A comprehensive compliance program is incomplete without a code of conduct and clearly defined compliance policies.

Embedding a compliance culture into everyday activities is crucial and should be guided by the organization’s policies and procedures.

The compliance officer and compliance committee should oversee the code of conduct and compliance documents, ensuring they are accessible and understandable.

Employee and contractor performance evaluations should incorporate adherence to the code of conduct and relevant policies.

The CEO’s confirmation of the organization’s commitment to compliance can be effectively communicated through a signed introduction in the code of conduct. A signed statement or endorsement from the board can reinforce the organization’s overall commitment to compliance.

Outdated policy documents undermine their reliability and credibility to users and regulators. Inaccurate or unreliable policies diminish the authority and effectiveness of the compliance program.

An effective compliance program requires a board and senior leadership that understand its value and are committed to its success, including a designated compliance officer with authority and resources to lead a successful program.

The compliance officer should be given the authority, stature, access, and resources to lead the compliance program effectively.

The compliance officer’s role includes:

• Reporting directly to the CEO or the board, with independent board access

• Having sufficient stature to interact equally with other senior entity leaders

• Exhibiting impeccable integrity, sound judgment, assertiveness, an approachable manner, and the ability to gain employees’ respect and trust

• Accessing adequate funding, resources, and staff to manage a program capable of identifying, preventing, mitigating, and remedying compliance risks

• Advising the CEO, board, and senior leaders on compliance risks, operational strategies, and the program’s functioning

• Chairing the compliance committee

• Reporting to the board on program implementation, operations, needs, and the entity’s compliance risks and risk management strategies

• Working with other departments like internal audit, risk, quality, and IT for compliance risk reviews, monitoring, and auditing

• Independently investigating compliance matters, leading internal investigations, recommending policy/process changes, and corrective actions

• Developing policies and programs encouraging reports of suspected fraud and improprieties without fear of retaliation

The compliance officer should be empowered and independent, capable of identifying and addressing compliance risks and maintaining federal healthcare program compliance

The compliance officer should avoid roles in the entity’s legal or financial functions and report directly to the CEO or the board.

• Thus, the compliance officer should not lead or report to the entity’s legal or financial functions, and should not provide the entity with legal or financial advice or supervise anyone who does. The compliance officer should report directly to the CEO or the board. Usually, leaders of these functions are the general counsel and the chief financial officer, but some entities give them different titles. (Bold in original document)

The compliance officer should maintain separation from healthcare delivery and related operations to prevent conflicts of interest, avoiding responsibilities in healthcare delivery, billing and coding, or claim submission.

Ideally, the compliance officer’s sole responsibility should be compliance, but if they also serve as the privacy officer, they should have adequate staff and resources for both roles.

The compliance officer should have the authority to review all relevant documents, data, and information for the organization’s compliance activities, including patient and billing records, and the authority to conduct or delegate compliance investigations.

The compliance committee’s duties include analyzing legal and regulatory requirements, developing and reviewing policies, monitoring internal controls, assessing training needs, developing disclosure programs, conducting risk assessments, and evaluating the effectiveness of the compliance program and work plan. The compliance officer should chair it.

Organizational leadership, including the board and CEO, should set the tone for the compliance program and compliance committee, emphasizing regular attendance and participation in committee meetings as part of performance evaluations.

The compliance officer should periodically assess the compliance committee’s performance, comparing expected and actual performance and seeking input from committee members, the CEO, and the board.

The board’s fiduciary oversight includes overseeing the compliance officer and compliance committee, understanding compliance risks, and ensuring access to necessary knowledge and resources.

The board’s oversight of the compliance officer includes ensuring their authority, independence, and resources for effectively implementing, maintaining, and monitoring the compliance program.

The board should ensure the compliance officer’s stature matches their responsibilities, and that the organization’s structure allows for uninhibited communication of compliance risks to the board.

To maintain the compliance officer’s independence, the board should ensure they are free from conflicting organizational responsibilities.

The board should regularly review the compliance officer’s and compliance program’s resource adequacy, considering the entity’s size, complexity, and interactions with federal healthcare programs.

Regular (at least quarterly) meetings between the board and the compliance officer should take place to discuss compliance activities risks, and there should be executive sessions without non-board members.

The compliance officer should create an annual training plan, specifying topics and target audiences and integrating feedback from past audits and investigations. The compliance committee should review this plan annually to ensure it aligns with current needs and regulatory changes in federal and state healthcare laws.

“All board members, officers, employees, contractors, and medical staff (if applicable) of the entity should receive training at least annually on the entity’s compliance program and potential compliance risks.” (Bold in original document)

There should be targeted training sessions tailored and assigned according to individual roles, responsibilities, and related compliance risks. These sessions should focus on relevant federal healthcare program rules and address specific compliance risks associated with each role.

There should be targeted training for new and existing board members. New members should receive prompt training on governance and compliance oversight. It should cover specific healthcare board responsibilities, risks, and effective oversight techniques. The compliance officer should also arrange periodic updates for the board on evolving compliance risks and changes in relevant federal and state healthcare regulations.

The compliance committee should ensure training materials are accessible to everyone, considering cultural diversity by providing multiple language options. Training can be conducted live, online, or through prerecorded videos. Regardless of the format, there should be a way for participants to ask questions, such as email queries to the compliance officer.

Mandatory compliance training should be a condition for continued employment or engagement, with noncompliance leading to potential termination. It should also be a key criterion in annual performance evaluations of employees and assessments of contractors. Hospitals and similar entities should collaborate with their chief medical officers and chiefs of staff to ensure all medical staff complete the required training.

Personnel must be aware of how to contact the compliance officer directly (via email, telephone, messaging), with this information prominently displayed in common areas and online platforms.

The compliance officer should periodically survey personnel to ensure communication methods meet the needs of a diverse workforce.

OIG believes that whistleblowers should be protected against retaliation, a concept embodied in the provisions of the False Claims Act. In some cases, employees may sue their employers under the False Claims Act’s qui tam provisions out of frustration because of the company’s failure to act when a questionable, fraudulent, or abusive situation was brought to the attention of senior leaders. (Bold in original document)

The compliance committee should establish multiple direct reporting channels for employees to report violations of federal and state healthcare regulations and entity policies, ensuring these reports bypass potential interference from supervisors or other staff.

Organizations should enforce consequences for noncompliance, such as remediation or sanctions, and offer incentives to promote compliance and innovation. Balancing both is key to ensuring effective compliance programs.

Organizations should set and communicate procedures for identifying, investigating, and rectifying noncompliant actions, including retraining or disciplining involved individuals. These procedures should outline potential consequences and detail the roles (e.g., managers, HR) responsible for deciding these outcomes.

The consequences of noncompliance should be consistently applied and enforced. All levels of employees should be subject to the same consequences for the commission of similar offenses. The commitment to compliance applies to all personnel levels within an entity, including contractors and medical staff.

OIG believes that corporate officers, managers, supervisors, healthcare professionals, and medical staff should be held accountable for failing to comply with, or for the foreseeable failure of their subordinates to adhere to, the applicable standards, laws, policies, and procedures.

Although an entity may not be able to publicly recognize an individual who raises a substantiated concern that results in the mitigation of harm or risk, the entity should find a way to recognize this in the performance reviews of individuals. This, of course, is not possible for people who wish to remain anonymous. Also, this does not apply to individuals who raise compliance or legal violations for which they themselves committed or were responsible. (Bold in original)

The compliance committee and entity leaders should assess if incentive plans, like sales or admission goals, promote ethical and compliant operations. They should consider if these goals might inadvertently encourage noncompliant behaviors, such as improper inducements to healthcare practitioners or referral practices. The review should also consider any unintended consequences of specific performance targets.

Risk assessment, auditing, and monitoring are vital in pinpointing and measuring compliance risks. Traditionally central to compliance programs, the importance of a formal compliance risk assessment process has recently gained increased recognition and emphasis from OIG, compliance professionals, and other stakeholders.

Periodic compliance risk assessments should be a component of an entity’s compliance program and conducted at least annually.

A formal compliance risk assessment should gather and evaluate risks from various sources, both external and internal. It involves prioritizing these risks and deciding on response strategies. The compliance committee—tasked with conducting and implementing this assessment—may benefit from coordinating with compliance, audit, quality, and risk management teams for a joint assessment. This approach optimizes resource use and minimizes redundant evaluations. The findings then guide the compliance committee and the compliance officer in prioritizing resources and formulating the compliance work plan, which includes audits and monitoring based on risk priority.

Entities should use data analytics to identify compliance risks. Regardless of size, all entities should analyze their data directly or via a third party, like a billing contractor. The complexity of data analytics can vary based on the volume of data and the entity‘s analytical capabilities and resources.

Entities should internally compare standard metrics of their healthcare operations to identify outliers in focus areas.

The compliance committee should incorporate a schedule of audits in the compliance work plan, aligned with risks identified in the annual risk assessment. Additionally, they should ensure the compliance officer has the capacity to conduct or oversee extra audits as needed, such as during investigations revealing systemic issues.

Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity. (Bold in original document)

Entities should also periodically assess the compliance program’s effectiveness. The review should determine how effectively each compliance program element functions.

The board should mandate a review of the compliance program’s effectiveness, with findings and recommendations reported directly to them. Considering the entity’s resources and compliance history, such as significant failures or unaddressed risks, the board may hire an external expert for this review.

Regardless of an entity’s dedication to compliance, the effectiveness of its policies, procedures, training, and risk assessment, a compliance officer will inevitably encounter audit or monitoring results that highlight issues or receive reports through the disclosure program necessitating investigation. “If, over time, a compliance officer does not receive this type of information, the compliance officer should consider conducting a compliance program effectiveness review.” (Bold in original document)

Compliance programs must have processes and resources to investigate compliance issues effectively, remediate legal or policy breaches, report to applicable agencies when appropriate, and analyze root causes to avoid repeat offenses.

The effectiveness of a compliance program is evident in how an entity responds to substantial overpayments or severe misconduct, distinguishing robust programs from superficial ones.

As a general matter, if credible evidence of misconduct from any source is discovered and, after a reasonable inquiry, the compliance officer or counsel has reason to believe that the misconduct may violate criminal, civil, or administrative law, then the entity should promptly (not more than 60 days after the determination that credible evidence of a violation exists) notify the appropriate government authority of the misconduct.

Implementing corrective action initiatives once the entity has gathered sufficient credible information to determine the nature of the misconduct, it should take prompt corrective action, including:

• refunding of overpayments;

• enforcing disciplinary policies and procedures; and

• making any policy or procedure changes necessary to prevent a recurrence of the misconduct.