Healthcare Compliance Forms and Tools

Table of Contents

Executive Summary X

Introduction X

SWOT Analysis X

2020 Financial Data X

FY 2020–2021 OIG and State Work Plans X

Corporate Compliance and Internal Audit Risk Assessment Interviews X

Recent Prior Audits X

Voluntary Disclosures X

Government Audit Summary X

Program for Evaluating Payment Patterns Electronic Report X

Recovery Audit Contractor (RAC) Audits X

Medicare Case Mix X

Comprehensive Error Rate Testing (CERT) X

Professional Fee Documentation and Billing X

Corporate Compliance Non-Coding Initiatives X

Office of the Medicaid Inspector General X

The Patient Protection and Affordable Care Act (PPACA) X

Conflicts of Interest X

United States Sentencing Commission Federal Sentencing Guidelines X

Key 2021 Reimbursement Changes X

The CMS Medicaid Integrity Program (MIP) X

Zone Program Integrity Contractor (ZPIC) X

Medicare Administrative Contractors (MACs) X

Data Mining X

2020 Hotline Trend Analysis Summary: HelpLine and Internal Cases X

Annual Mandatory Compliance Training X

Health Insurance Portability and Accountability Act (HIPAA) X

Compliance Policies X

Other Regulatory Topics X

Conclusion X

Exhibit A X

Executive Summary

A key objective of the Office of Corporate Compliance (Corporate Compliance) is to continuously reassess risk areas, reprioritize compliance projects that are most critical to the mission of the organization, and to report compliance developments and compliance audit findings to the Board of Trustee’s Audit and Corporate Compliance Committee, the full Board of Trustees as appropriate, the Executive Audit and Compliance Committee, the Chief Executive Officer and other members of Senior Management.

Compliance risk is mitigated through internal review processes. Monitoring and auditing provide early identification of program or operational weaknesses and substantially reduce exposure to government or whistleblower claims. Although many assessment techniques are available, one effective tool is the performance of regular, periodic compliance audits by internal or external auditors.

The purpose of the 2021 Risk Assessment Guide is to briefly describe the various sources used by Corporate Compliance to identify and assess potential risk areas for the 2021 Corporate Compliance Work Plan. The planning process for this Work Plan is ongoing and dynamic. Corporate Compliance continually evaluates new data throughout the year to identify and reassess the likelihood of any potential risk to the organization.

Brief Summary of the Corporate Compliance Risk Assessment Analysis

Similar to our 2020 risk assessment, the Compliance Risk Assessment indicates that compliance resources should be placed on 42 issues as they remain at high or medium-high risk. Under the Federal-State Health Reform Partnership (F-SHRP), the State is mandated to generate $644 million in fraud and abuse recoveries in 2021, its highest financial target to date. In addition, as part of a recent state regulation, the organization is required to perform risk reviews and audits on facilities that bill over $500,000 in Medicaid billings. We anticipate that the State will audit the effectiveness of our compliance program.

The 2021 risk assessment places 42 issues at a high or medium-high risk.

This year the organization’s vulnerability with respect to ancillary services was moved from medium to medium-high as a result of current audits. In addition, the 2020 federal healthcare legislation places an emphasis on ancillary services and will require mandatory compliance programs for these services.

For 2021, inpatient billing is in the medium-high risk category since the volume within the organization is great and there is an increase in government audits and investigations, including the launch of new recovery audit contractor (RAC) audits. However, prior Corporate Compliance and government audits had not detected any significant audit findings in this area.

New service lines and other new businesses are listed as a separate area of risk because the organization has not had an opportunity to complete enough audits to fully assess its internal controls to mitigate potential billing errors.

Quality of care and medical necessity also remains a risk category because the government is devoting more enforcement resources in this area. Both federal and state regulators are moving toward quality-based audits, some of which already have resulted in multimillion-dollar settlements. These audits are focused on various quality issues, including medical necessity, such as whether a patient should be treated as an inpatient versus an outpatient. The organization is working on ways to further collaborate between quality and compliance to ensure that we are jointly monitoring quality-related issues.

Issues relating to physician financial arrangements remain a high-risk area because the law is a strict liability statute and the government continues to dedicate enforcement resources to reviewing physician arrangements. In 2020, the Department of Justice collected $108 million from an Ohio hospital for unlawful payments to physicians in exchange for cardiac patient referrals. The recently enacted healthcare legislation will make it even easier for the government to pursue Stark Law and Anti-Kickback Statute claims against healthcare providers.

In addition, the Compliance Risk Assessment found that more resources should continue to be placed on creating a greater awareness of the Compliance Program, including its policies related to privacy issues. In 2020, the organization had a number of privacy breaches despite employee education and awareness initiatives.

Please see the graph below to view the general risk areas. See the enclosed 2021 Corporate Compliance Work Plan to view the planned compliance and audit initiatives to address potential risks.

The purpose of this graph is to provide a visual depiction of high-risk issues that may affect the organization based on our analysis. The graph does not include all proposed audits, initiatives, or risks but provides a high-level overview of the compliance risks that may affect the organization.

Introduction

In order to have an effective Corporate Compliance Program, it is necessary to continuously assess risk, reprioritize compliance projects, and report compliance developments and audit findings to the Board’s Audit and Corporate Compliance Committee, the full Board of Trustees as appropriate, the Executive Audit and Compliance Committee, the Chief Executive Officer, and the General Counsel. This 2021 Risk Assessment Guide briefly describes some of the various sources used by Corporate Compliance to identify and assess potential risk areas. See Exhibit A for a listing of the primary resources consulted for this review.

SWOT Analysis

In 2020, Corporate Compliance assessed the resources available to ensure an effective compliance program at the organization. One of the assessment tools used was the Strengths, Weaknesses, Opportunities, and Threats (SWOT) analysis, depicted below. The primary weakness identified is employee awareness of the Compliance Program, including privacy. To address this risk, Corporate Compliance launched an awareness campaign to increase program awareness.

Other weaknesses identified by the Compliance Risk Assessment include ancillary service coding. To address this risk, Corporate Compliance instituted new monitoring activities in order to track and trend potential risk areas. In addition, the organization plans to implement the following measures: additional education to affected employees, additional monitoring activities, and additional audits to further mitigate this risk.

The primary threats identified demonstrate there are a number of external agencies that are likely to focus various audits at the acute care facilities. The amount of government resources dedicated to review organizations’ coding and billing continues to increase at an accelerated rate because of the new federal legislation. In addition, the government may continue to specifically focus on certain facilities because of past audits.

Despite these threats, the organization’s Compliance Program has continued to receive national awards as having the best compliance practices. The Compliance Program also has opportunities in the future to further improve upon its efforts. For example, we may improve throughput times to audit coding records and conduct HIPAA audits. In addition, we can continue to improve our transparency efforts by starting to build a compliance web portal.

2020 Financial Data

Analyzing the organization’s financial data is a key component of Corporate Compliance’s risk assessment process. We review inpatient and outpatient revenue trends, including net patient revenues and payer and case mix. For purposes of this guide, financial data is for year-to-date data from January 1, 2020, through and including October 31, 2020. Data is analyzed at the facility level for net patient revenues (net of provision for bad debt), payer mix, and case mix to determine potential external audit risk and allocation of Corporate Compliance Audit resources.

The organization’s tertiary centers receive the largest amounts of federal healthcare program revenues and therefore have a higher likelihood of being audited by government agencies. The community hospitals also receive a significant portion of their inpatient revenue from federal dollars. Clinics outside the four walls of the hospitals also have a high likelihood of being audited by state agencies. The organization will also focus its Medicaid-specific audits at facilities that bill over $500,000 of Medicaid revenue.

FY 2020–2021 OIG and State Work Plans

Two key resources are the OIG FY 2021 Work Plan and the State FY 2020–2021 Work Plan. Each year, these governmental agencies release audit Work Plans that provide a road map of their planned audit activities. It is an industry standard for healthcare providers to review the OIG and State Work Plans annually and to evaluate their own entities for these potential risk areas. Corporate Compliance reviewed these Work Plans and incorporated any applicable audit categories into its 2021 Work Plan.

Corporate Compliance and Internal Audit Risk Assessment Interviews

Corporate Compliance, along with Internal Audit (IA), performed interviews of key leaders with the goal of including these individuals in the overall risk evaluation and discussion. After completion of the interview phase, both Corporate Compliance and IA create individualized audit work plans that are shared between them before finalization to avoid audit overlap. Audit results are shared throughout the year between the departments.

Recent Prior Audit

Internal Corporate Compliance Audits Summary

The Corporate Compliance Audit Department conducted a total of 34 audits in 2020, not including investigatory audits. This is an increase from the 32 audits Compliance conducted in 2019. Of those audits, 30 were finalized and submitted to the Executive Audit and Compliance Committee and Senior Leadership. Status update reports of these audits are also shared with the Board of Trustee’s Audit and Corporate Compliance Committee on a quarterly basis. Four audits were started in 2020 but are still in the process of being finalized. These audits will be reported to the Executive Audit and Compliance Committee, Senior Leadership, and the applicable Board of Trustees’ committees during 2021. Audit topics were chosen based upon the 2020 Risk Assessment and included audits of faculty practice.

Corporate Compliance Audit also is responsible for various investigative audits that are requested by management or are referred through the Compliance HelpLine or other referrals. These audits are conducted throughout the year on an as-needed basis. All requests are evaluated and referred to the appropriate member of the audit team for review. In 2020, there were 12 investigative audits, a decrease from the 21 investigative audits in 2019. Ten of the 12 investigations are closed and resulted in no material findings.

During 2020, Corporate Compliance Audit’s findings were generally nonmaterial in nature and were communicated to key stakeholders. Corrective actions were recommended to the appropriate management, and any identified overpayments were refunded. In 2021, Corporate Compliance Audit plans on auditing more relevant potential risk areas through the use of data mining.

The graph above depicts the trend of audits from 2016 through 2020 for Part A, Part B, and Investigative audits.

Voluntary Disclosures

The OIG, State, and Medicare’s Fiscal Intermediaries have processes for healthcare providers to voluntarily disclose and rectify overpayments received. The benefits of self-disclosure include forgiveness or reduction of interest payments, extended repayment terms, waiver of penalties and/or sanctions, and possible preclusion of a subsequently filed State False Claims Act qui tam action based on the disclosed matter. As a result of the internal review processes and our proactive Corporate Compliance Program, the organization discovered a number of overpayments during 2020 that arose as a result of inadvertent incorrect billing, documentation problems, and other issues. The organization made voluntary disclosures to Medicare or Medicaid of X matters and repaid (or has proposed to repay) an approximate total of $2 million. This figure does not include items that are not routinely disclosed during our normal audit process.

Government Audit Summary

The organization continues to be audited by government agencies on a regular basis. In 2020, the number of government audits increased significantly, which is not a surprise given the vast amount of new resources the government has dedicated toward ensuring healthcare providers submit accurate claims to Medicare and Medicaid. The number of audits increased by over 20% when compared to 2019. The following grid depicts the status of all government audits at all facilities as of December 2020. Please note this grid does not include the recent RAC requests.

Program for Evaluating Payment Patterns Electronic Report (PEPPER)

PEPPER is an electronic report available from the federal government containing hospital- specific data for target areas that have been identified as high risk for payment areas (i.e., specific diagnosis-related groups [DRGs] and discharges). It is suggested that anything above the 80^th percentile or below the 20^th percentile, as compared to National, State, and Jurisdiction (i.e., Regional) benchmarks, should be reviewed. The grid below identifies those areas for the organization. The outliers listed below are facility specific, and no trends were identified as organization-wide issues.

Even though a facility may be at or above the 80^th percentile for a certain DRG, it does not mean the facility’s coding is inappropriate. A facility could have a higher ranking because of demographic or other environmental reasons. In 2019-2020, Compliance and Quality conducted audits in several of these areas.

FY 2020 PEPPER Report Summary

The grid above demonstrates that there are several areas that are above the 80^th percentile and within or below the 20^th percentile in comparison to the National, State, and Jurisdiction. Corporate Compliance will conduct data-mining activities in this area to ensure the potential risk areas are appropriately addressed.

Recovery Audit Contractor (RAC) Audits

RAC audits recently began after a long delay. Based on the RAC demonstration project (2005-2008), the Centers for Medicare & Medicaid Services (CMS) has identified Medicare payments that were not medically necessary and coded incorrectly for numerous hospitals.

The newly appointed RAC contractor began requesting charts from the organization for review this summer. To date, over 75 records have been requested. CMS-approved audit issues for our region include transfer of care, MS-DRG validation, durable medical equipment, and other services such as pharmacy supply and dispensing fees, clinical social worker services, urological bundling, and ambulance services. Currently, there are 71 approved issues listed by the RAC for review. The RAC also intends to audit physician documentation and billing in the future. In addition, the RAC plans to use its discretion to extrapolate its findings in certain cases. Extrapolation is the process that Medicare contractors use to estimate a total overpayment based on an audit of a relatively small subset of claims. As a result, even a relatively small finding could result in a potentially large overpayment in the future.

Moreover, the Patient Protection and Affordable Care Act (PPACA) also included the expansion of the RAC program to Medicaid claims. States must implement RACs for Medicaid and must use a contingency fee payment system. The original implementation deadline was December 31, 2020. A RAC vendor has not yet been selected to audit Medicaid claims but is expected to do so in 2021. This will be in addition to the Medicaid Integrity Contractors (MICs) that CMS already contracts with to audit Medicaid claims to ensure claims were appropriately coded and paid and the voluminous audits that the state conducts at our facilities.

Medicare Case Mix

The case mix index represents the complexity of a hospital’s patients’ cases and indirectly demonstrates the average level of care provided to its patients in a given time period. Case mix is an effective tool to help identify compliance trends, because when monitored over time, trends may indicate changes in coding practices, patient population, and services offered. The frequency of shifts should be minimal, and when a shift occurs, management response is required.

Corporate Compliance reviewed the Medicare case mix index. The case mix for a few of the organization’s facilities increased slightly in 2020.

Comprehensive Error Rate Testing (CERT)

The Comprehensive Error Rate Testing (CERT) program was initiated by CMS to achieve the agency’s mission to emphasize accountability, pay claims appropriately, and to provide a renewed focus on the customer. The program produces national, contractor-specific, and service-specific paid claim error rates, as well as a provider compliance error rate. The paid claim error rate is a measure of the extent to which the Medicare program is paying claims correctly. The provider compliance error rate is a measure of the extent to which providers are submitting claims correctly.

The program has independent medical reviewers periodically reviewing representative random samples of Medicare claims that are identified as soon as they are accepted into the claims processing system. The independent reviewers medically review claims that are paid. Claims that are denied are validated to ensure that the decision was appropriate.

Professional Fee Documentation and Billing

In 2019, Corporate Compliance identified professional fee documentation and billing as a high-risk area and hired an additional resource to help assist in monitoring faculty practice’s coding and billing. Also, a large number of new physicians will be joining the organization in 2021. As a result, additional physician documentation and billing audits will continue to be a high priority and a focus of the Corporate Compliance Work Plan based upon this and other factors. In addition, the organization has budgeted two additional full-time employees to be dedicated to conduct additional coding and billing audits to mitigate risk.

Physician Practice Acquisitions

In 2020, the organization acquired several physician office practices as part of its expansion of its service lines. When acquiring physician office practices, it is important to conduct appropriate due diligence to ensure that effective compliance controls exist. While the organization performs due diligence reviews during the acquisition process, it can be difficult to identify every compliance risk, especially with respect to billing and coding. Accordingly, the organization’s acquisition of physician office practices is a potential risk area.

Corporate Compliance Non-Coding Initiatives

Corporate Compliance spearheaded several noncoding initiatives in 2020 as part of its Work Plan. Among other items, these initiatives included reviewing X, creating additional controls to X, revamping X, launching additional compliance X, and implementing X. These initiatives helped to further enhance the organization’s Compliance Program.

Office of the Medicaid Inspector General

The core function of State is to conduct and supervise activities to prevent, detect, and investigate Medicaid fraud and abuse with the goal of assuring integrity in the Medicaid program. Fraud and abuse control activities are shared with a variety of state agencies, including, but not limited to, the Department of Health, the Office of Alcoholism and Substance Abuse, the Office of Mental Health, and the State Education Department. These agencies coordinate their work with the State Attorney General’s Medicaid Fraud Control Unit and the State Comptroller.

2019 State Annual Report

State leads the nation in Medicaid fraud, waste, and abuse prevention and detection, and serves as a role model for other states to emulate. For fiscal year 2019-20, the Legislature has established a goal of $870 million in state-share recoveries and cost avoidances for State nearly three times the amount assigned in 2016-17.

To achieve this goal, State worked throughout the last year to develop accurate, reliable measures of cost avoidance and developed new techniques to identify potential for cost avoidance in every part of the agency and the Medicaid program.

State saved $1.61 billion “through cost-savings activities” last year, according to the agency's 2019 annual report, which also shows State exceeding a federal target to recover hundreds of millions of dollars in Medicaid funds as required under the F-SHRP agreement.

Under F-SHRP, State and other agencies are responsible for recouping “fraud and abuse” payments totaling $429 million in 2020 and $644 million in 2021. These recovery goals are in addition to targets set in the State budget for collection of back payments from responsible third-payers—targets that were recently increased by more than $150 million as part of the Deficit Reduction Plan.

The graph above depicts the percentage of statewide recoveries for fraud financial investigations, civil recoveries, provider audit recoveries, and system match recoveries.

The graph above depicts the top five categories for the 2019 provider audits.

The graph above depicts the top three categories for the State rate audits for 2019.

The graph above depicts the top five categories of the State’s activities related to system match and recovery.

The Patient Protection And Affordable Care Act (PPACA)

On March 23, 2010, President Obama signed into law the PPACA. This law increases the risk levels of all healthcare providers, including our X, given the vast amount of resources and enforcement weapons created by this bill. PPACA included approximately $300 million of new funding over six years to further supplement the government’s already large arsenal of enforcement resources.

One example of the new PPACA enforcement tools is the requirement that healthcare providers maintain mandatory compliance programs. The Secretary of HHS will be rolling out specific standards for various industries. Durable medical equipment and home health providers will likely be subject to this requirement because they were highlighted in PPACA as being high-risk areas.

Other new enforcement laws include enhanced screening requirements of applicants for enrollment, a requirement that physicians be enrolled in Medicare to order durable medical equipment or certify home health services, more expansive revisions to the Anti-Kickback Statute and False Claims Act, and new civil monetary penalties laws for new healthcare areas that are subject to fraud and abuse. There is also a plan to introduce a new bill to double the penalties for Medicare fraud, which are already significant in nature. This proposed legislation also include changes how long a healthcare provider has to submit a claim for reimbursement. Facility claims must now be submitted within one year from the date of service, which may affect our ability to recoup funds for services we have provided. In addition, CMS has now been given the authority to suspend payments during a pending fraud investigation. PPACA also includes changes to how healthcare providers should address overpayments.

The PPACA imposes an express duty to refund and report overpayments 60 days after overpayment is identified or when the cost report is due. The failure to report and return may lead to False Claims Act liability. Taken together, these provisions clearly signal the government’s intention to aggressively pursue and prevent fraudulent and abusive activities and to maximize recovery when overpayments are identified. While these changes will not materially change the approach the X uses to identify and address potential compliance risks, the new legislation will further increase the risk level of any noncompliance with the applicable regulations.

Conflicts of Interest

PPACA also includes the Physician Payment Sunshine provisions, which requires drug, medical device, biological, and medical supply manufacturers to disclose direct payments or transfers to physicians and teaching hospitals that are $10 or more (or total over $100 in a calendar year). It also requires those manufacturers to disclose any nonpublic ownership or investment interests of physicians and their immediate family members in the manufacturers. Those reporting requirements took effect March 31, 2013, and the information will be available online to the public. Also, many states already have proposed or passed similar laws regarding physician financial relationships, including New York and New Jersey.

In order to address this issue, the organization recently revised its Gifts policy to make it more stringent. In essence, the new policy is a “no gifts” policy and allows physicians to serve as consultants to healthcare manufacturers only under appropriate circumstances. In addition, the organization has recently implemented a more robust electronic conflict of interest reporting form that our physicians and key employees will be required to fill out on an annual basis and update as appropriate throughout the year.

United States Sentencing Commission Federal Sentencing Guidelines

Federal law enforcement authorities will often refer to the Federal Sentencing Guidelines (Guidelines) when determining whether to criminally prosecute an organization at the conclusion of a criminal investigation or to pursue the organization on civil grounds. Certain provisions of the Guidelines contain specific compliance plan guidelines that are generally regarded as the template from which effective corporate compliance programs are based. In fact, the OIG based its Compliance Guidance for healthcare providers on these Guidelines.

The Guidelines are also likely to be considered by corporate governance regulators and private plaintiffs in determining whether to pursue the members of a governing board for breaches of their fiduciary duties to oversee the compliance plan. For these reasons and others, these Guidelines are generally recognized as the benchmark of an “effective” organizational corporate compliance plan. In 2010, the United States Sentencing Commission enacted amendments to the Guidelines to further strengthen the role of the compliance officer. In short, the new amendments make clear that in order for a corporation to be eligible to receive a reduced sentence, it also must have in place the following at the time of a potential criminal act:

• The compliance officer should have a “direct reporting obligation” to the board or subgroup thereof (e.g., the compliance or audit committee);

• The compliance program detected the criminal conduct before it was discovered or was reasonably likely to be discovered outside of the organization (i.e., by regulators);

• The organization promptly reported the offense to the federal government;

• No corporate compliance officers were involved with, condoned, or were willfully ignorant of the criminal offense; and

• The organization conducted an assessment of its existing compliance program, including modifications to the program as may be appropriate to prevent the occurrence of similar conduct.

The amendment specifically refers to the use of outside professional advisers to ensure the adequacy of the assessment efforts. Also, the Commentary to this amendment defines “direct reporting obligation” as one which provides the compliance officer with express authority to communicate personally with the governing authority (1) promptly on any matter involving criminal or potential criminal conduct and (2) no less than annually on the implementation and effectiveness of the organization's compliance plan.

The X already has in place reporting measures that meet the intent of these Guidelines. However, X from the State also recommended that the compliance officer provide an in-person presentation to the full board at least on an annual basis. We will implement this reporting in 2021. These changes are a reminder of the federal government’s focus on enhancing governance controls in organizations.

Key 2021 Reimbursement Changes

There have been a number of key reimbursement changes that can affect compliance initiatives. Below is a summary of some of them that Corporate Compliance will be evaluating as part of its 2021 risk assessment.

The CMS Medicaid Integrity Program (MIP)

The MIP was established via the Deficit Reduction Act and substantially increased funding dedicated to Medicaid program integrity efforts. This program is the first national strategy to detect and prevent fraud and abuse in the history of the Medicaid program, and efforts will yield significant savings to help sustain the program. Funding of $255 million will be allocated over five years (2016–2020) and $75 million annually beginning in 2021. CMS will implement this program through MICs. Audit targets include physicians, home health/skilled nursing, hospice, nursing facility/nursing home, renal dialysis, durable medical equipment, transportation/ambulance, labs/X-ray and pharmacy.

MIP is the first federal program created to conduct Medicaid provider audits. Its purpose is to support program integrity to the states, and conduct post-payment audits of providers and identify overpayments. MIP is working with the State on joint Medicaid audit projects and is expected to target our state this year. To date, MIP has conducted 15 audits.

Zone Program Integrity Contractors (ZPICs)

CMS has consolidated the work of Medicare's Program Safeguard Contractors and Medicare Drug Integrity Contractors with new ZPICs. Nationally, there are a total of seven zones with three contractors awarded to each zone. The new contractors will be responsible for ensuring the integrity of all Medicare claims under Parts A and B (hospital, skilled nursing, home health, provider, and durable medical equipment), Part C (Medicare Advantage health plans), Part D (prescription drug plans), and Medi-Medi (Medicare-Medicaid data matches). The advantages of consolidating these efforts include improved data and document information sharing; enhanced project and case tracking in the Federal Investigation Database; and enhanced fraud, waste, and abuse leads. To help address this risk, the organization has invested in an internal data-mining tool to help detect irregular coding and billing patterns.

Medicare Administrative Contractors (MACs)

As required by section 911 of the Medicare Prescription Drug, Improvement and Modernization Act of 2003, CMS is replacing its current claims payment contractors (fiscal intermediaries and carriers) with new contract entities called Medicare administrative contractors (MACs). State home health and hospice claims will be processed through X. All Part A and Part B claims will be processed through X.

Data Mining

The government uses sophisticated data mining tools to target healthcare providers whose claims are not in full compliance with all applicable regulations. Both the federal government and State plan to specifically invest millions of dollars to further ramp up their ability to effectively data mine aberrant claim patterns.

Corporate Compliance is currently working with a data-mining software vendor that will provide the ability to effectively analyze large quantities of data. The goal of this analysis is to allow a heightened focus on identified risk areas that will be audited by optimizing existing resources. This product was implemented on X.

Corporate Compliance plans to mine data related to OIG and State topics and conduct probe audits pertinent to data-mining results. Corporate Compliance also identified potential risk areas in the grid through data-mining activities that will be audited in 2021. Prior and current audits have already addressed the majority of the items detected through internal data mining.

2020 Hotline Trend Analysis Summary: HelpLine And Internal Cases

The Corporate Compliance HelpLine is an avenue by which individuals or interested parties may report any issue or question associated with any of the X’s policies, conduct, practices, or procedures believed by the employee to be a potential violation of criminal, civil, or administrative law, or any unethical conduct. Inquiries can be made via the HelpLine 24 hours a day, seven days a week. Individuals are encouraged to report any problem or concern either anonymously or in confidence via the HelpLine as they deem appropriate.

To date, the number of internal and HelpLine cases received in 2020 was slightly higher than last year. Over X reports were received through the HelpLine and by other means, including walk-ins, mail, and telephone. This translates to a rate of approximately 10 calls per thousand System employees, which is above the national average. However, only X% of the employees surveyed knew how to contact the compliance office to report an issue. The grid describes the general categories of reports received in 2020. The largest number of issues arose in the category of X followed by X, X, and X.

Annual Mandatory Compliance Training

In 2020, over X% of the organization’s employees (including per diem employees) completed the annual mandatory compliance training program. Please note that a few facilities operate on a different training schedule due to internal reasons and their completion rates are estimated based upon past performance and data received to date this year. The program was created in-house and features the organization’s Code of Ethical Conduct and policies and procedures. This year the training highlighted X policy, which won a national media award for its content. Among other topics, the X and X rules were also highlighted. In a survey that over X employees completed, approximately X% of the employees agreed or strongly agreed that the compliance training gave them a better understanding of the organization’s Compliance Program and found the training program effective.

The program includes broadcast news reports on compliance-related healthcare issues and an original video segment regarding X. New employees of the organization are required to complete the Compliance online orientation program before or shortly after they commence work. A list of the organization’s employees who have not completed the annual compliance training has been provided to Human Resources to assess appropriate disciplinary action in addition to their managers reflecting this on their annual performance evaluations.

Health Insurance Portability and Accountability Act (HIPAA)

The enactment of the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act has dramatically changed the landscape for compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security rules. HITECH included significant expansion of HIPAA Privacy and Security requirements to address concerns related to confidentiality in electronic health information storage and exchange. These provisions place new compliance obligations not only on covered entities, but also on their related business associates. HITECH includes provisions to dramatically increase penalties for violations to a maximum of $1,500,000 per violation per calendar year. In addition, the State has been given concurrent jurisdiction with the federal government to enforce HIPAA. This means that the number of enforcement actions under HITECH will likely increase.

The HITECH Act includes a requirement that covered entities must notify individual patients, and the Secretary of HHS in some cases, if unsecured protected health information is inappropriately disclosed and harm to the patient may result. The federal government is in the process of issuing new guidance to comply with the recent changes in the HITECH law. In response to these new legal requirements, Corporate Compliance has implemented a new policy regarding breach notification. As a result of the heightened enforcement environment and new law, the X has reviewed, streamlined, and consolidated over X HIPAA policies and forms.

In 2020, the X will report a total of X HIPAA breaches to the HHS Secretary to comply with its annual reporting requirement pursuant to the regulatory provisions of the breach notification law. In addition, the X will report a total of X breaches to the state in instances where the breach involved the potential compromise of a patient’s Social Security data. Examples of the breaches that occurred in the X include X, X, X, X, and X.

All of these breaches have been thoroughly investigated and managed in Corporate Compliance with the X Human Resources disciplinary procedures and supporting policies. Further education on the importance of the privacy and security of patient information and new X policies and forms to improve compliance with HIPAA regulatory requirements is ongoing. In addition, the X conducted several HIPAA audits in 2020 and will continue to do so in 2021 to further monitor this area.

Compliance Policies

Based on the gap analysis of compliance policies conducted last year, Corporate Compliance drafted and the organization adopted a number of new and revised policies. Of greatest significance is the new “Gifts and Interactions with Industry Policy,” which represents a major change from the organization’s previous policy. The policy bans all gifts, including food, from industry to the organization’s employees and places new restrictions on consulting arrangements between employees and industry. This policy became effective in May 2020. The organization also reviewed, streamlined, and consolidated over 30 HIPAA policies and forms. In 2021, Corporate Compliance will be reviewing all of its core compliance policies and Code of Ethical Conduct to ensure they are up to date.

Other Regulatory Topics

Conclusion

In conclusion, the compliance risk assessment indicates that the majority of compliance resources should be placed on medical necessity documentation. The organization should continue to conduct audits at facilities in the areas of physician financial relationships. The compliance risk assessment also demonstrates the need to continue to audit coding and documentation due to the potential financial impact on the organization and the increased government scrutiny despite a favorable historical auditing record.

In addition, the compliance risk assessment found that more resources should continue to be placed on creating a greater awareness of the Compliance Program, including privacy reporting. Also, additional controls should be placed on coding and documentation. To address these issues, the Work Plan has audits or compliance initiatives focused on these risks.

Exhibit A