When he contacts employees for interviews during a compliance investigation, Mike Sandulak, executive director of investigations and physical security at Providence, a health system based in Renton, Washington, doesn’t divulge any details. He simply tells employees their name came up in connection with a report to compliance and “all their questions will be answered in the interview.” The reason to be vague is “you don’t know what” people will do when facing a compliance-related interview, especially if they have an inkling what it’s about, Sandulak said. For example, there could be an attempt to ask people to change their stories.

That’s one of the strategies shared by Sandulak, a former FBI special agent, for compliance investigations, which he said are “the main mechanism for safeguarding that your organization has completely and appropriately reviewed/investigated all allegations of noncompliant conduct.”^[1] They “can also identify root causes of an issue.”

There should be established standards for investigations, Sandulak said at the Health Care Compliance Association’s Compliance Institute March 29.^[2] They should be “objective and impartial” and conducted promptly. While there’s no deadline attached, investigations of a misdirected fax won’t take as long as a breach of 500 records. Providence provides updates every 30 days and makes sure everyone relevant is interviewed. “If you missed someone, think about being deposed in two years if the case goes to trial,” he said. “I always assume every report could go to litigation. That’s how you want to conduct an investigation.”