Compliance Today - November 2023

One challenge for any compliance program is developing compliance messaging that will be effective across an employee population that has diverse expertise, technical knowledge, experience, and education levels. Developing a message that will resonate requires creativity; however, sometimes your interactions and ideas for promoting your compliance program can have a larger impact on building a culture of compliance than you might expect. That is what happened recently with an ice cream social our compliance team hosted for our employees.

By way of background, as part of Millennium Health’s compliance program and our goal of building a compliance culture within all departments, I periodically attend department meetings to update employees on our compliance program and initiatives. Some departments are naturally interactive, while others are more difficult to engage. To build our culture of compliance, however, I needed to find a way to engage even the most reserved group of employees in the discussion. During one department meeting with a typically reserved group (we will refer to them as “The Quiet Group”), I asked, “What do we need to do to get you out of your shell to ask questions and engage in the discussion?” One person spoke up—“ICE CREAM!” It was an interesting response that I was not sure would lead to engagement. However, I committed to considering the idea, making it clear that in exchange, I wanted more participation in compliance meetings moving forward, and thus, the challenge had been issued.

Our company promotes a strong culture of celebration and corporate events, so our compliance team decided to host one of our own: A summer ice cream social for all on-site employees (we have remote employees located throughout the country) called “Break Out of Your (Chocolate) Shell with the Compliance Team.” The plan was to serve ice cream with chocolate magic shell so we could have employees symbolically “break the shell” to encourage them to engage with compliance during the department meetings. Coordinating with our facilities team to set up the event and our marketing team to create and distribute event flyers, I announced the event at our next meeting with The Quiet Group, which was a little over a month before the ice cream social.

Apparently, the mere announcement of the ice cream social inspired some people to participate, and we became hopeful that this approach just might work! A couple of weeks before the event, we received inquiries from two employees within The Quiet Group regarding sharing user credentials to access one of our network systems. The questions were promptly addressed with a statement from the department director reminding the team that they are not permitted to share user credentials and instructing them to notify their supervisors if there is a problem with a login. To reinforce the messaging, our chief information security officer attended the next department meeting to review our policies and procedures related to network credentials and passwords.

Although the initial inquiries had been addressed, the ice cream social also offered a great opportunity to reinforce the compliance messaging for our company while also building our culture of compliance.

On the day of the ice cream social, all available executive team members joined in serving the employees. We set up a line of tables that contained, in order, bowls, ice cream, magic shell, napkins, and spoons, but on this day, we did not call them spoons. Each person walking the line would easily recognize that they would take one spoon intended for their use and would not have any reason or inclination to share it with anyone else. Why not apply that same rationale to user credentials? And that is what we did. We reidentified the box of spoons with a sign labeled “passwords.” As people walked through the line, we instructed each person to take a “password” intended for their use only and not to be shared with anyone else. Initially, there was some confusion with the instruction to “take a password;” however, once it was explained, the metaphor was understood and resulted in a lighthearted way for compliance to reinforce the significance of network security responsibilities.

The ice cream social provided an excellent opportunity to engage and build rapport with employees. We did not, however, anticipate an unexpected benefit. Following the event, one of the people who raised the initial question about the sharing of passwords sent the department director a thank you message for how her query was addressed with the entire department. Although we had closed out our compliance inquiry, this thank you message was feedback that our resolution efforts achieved the objective.

What started as an idea to build compliance engagement with a group of employees turned out to be another promotional opportunity for Millennium Health’s compliance program slogan: “Compliance is FUNdamental” and reinforced our messaging that employees can raise compliance questions, have them promptly addressed and supported at the executive level, while having fun along the way.

Investing $350 in an ice cream social for such a positive outcome was money well spent and gave us a tangible and documented example of the effectiveness of our compliance program.