Holly Hester (holly.hester@nethealth.com) is Senior Director, Strategic Client Partnerships, at Net Health in Grand Rapids, MI, and Yolunda Dockett (ydockett@aadermatology.com) is Chief Compliance Officer at Anne Arundel Dermatology in Linthicum Heights, MD.
The compliance risk assessment has been described as the “eighth element” of an effective corporate compliance program, emphasizing its importance above and beyond the established requirements for auditing, monitoring, and overall program assessment. An annual compliance risk assessment is essential to determine the scope of an organization’s compliance plan, to identify areas of increased risk, and to direct the overall compliance efforts of the organization.
In 2015, Deloitte defined compliance risk as “the threat posed to an organization’s financial, organizational, or reputational standing resulting from violations of laws, regulations, codes of conduct, or organizational standards of practice.”[1] Compliance risk management is the process that mitigates or reduces this risk to a level that is acceptable to company leadership or management. Risk can never be erased. It must be decreased to a level that is tolerable, and this tolerance level differs between organizations and even between specific elements of risk. For example, one organization may take a zero-tolerance approach to billing policy violations, while another company may encourage the reeducation of violators.
The compliance risk assessment helps the organization understand the full range of its risk exposure, including the likelihood that a risk event may occur, the reasons it may occur, and the potential severity of its impact. An effectively designed compliance risk assessment also helps organizations prioritize risks, map these risks to the applicable risk owners, and effectively allocate resources to risk mitigation.
Healthcare organizations should ensure each department is included in the risk assessment process. This includes rehabilitation services when it is a part of the organization’s business line. Incorporating the rehabilitation division into the risk assessment further demonstrates the presence of a comprehensive risk assessment process. Furthermore, much of an organization’s risk exposure exists within the rehabilitation services division. There is no one way to conduct a risk assessment unless a regulatory body mandates the approach, and for therapy practices and post-acute care, there is no standard or regulation.
Identifying risks
Start by reviewing previous internally identified problem areas:
-
What do your internal auditing and monitoring findings tell you?
-
Have you been audited or investigated by a payer or other regulatory or enforcement body?
-
What are your medical review and appeal findings?
-
What are your recent survey findings?
-
What issues or concerns have been reported via your internal reporting process or compliance hotline?
Additionally, review data available in operational and clinical reports generated from the electronic health record (EHR) or other health information technology (IT) systems, such as utilization trends and revenue by payer, discipline, and location.
The risk identification process should also include external sources of information gathered outside of the organization:
-
Applicable Office of Inspector General (OIG) Work Plan updates and audit reports;
-
Corporate integrity agreements and settlement trends;
-
Regulatory updates;
-
Audit activity and trends from the Medicare administrative contractors and Medicare Advantage payers; and
-
Current investigations and enforcement actions by the OIG, Department of Justice, and Office for Civil Rights.
Once organizational risks are identified, they should be categorized or classified into general risk areas. Some risk areas that apply to rehab services are:
-
Compliance with the state practice acts for physical, occupational, and speech therapy;
-
Documentation;
-
Billing/coding;
-
Insurance/payer regulations and medical review;
-
Human resources (HR);
-
Telehealth service delivery;
-
Health Insurance Portability and Accountability Act (HIPAA);
-
Contracts;
-
Quality of care;
-
Internal reporting; and
-
Infection control.
