Compliance Today - February 2020

The government’s view—Don’t mix hats

The federal government, through the Centers for Medicare & Medicaid Services (CMS), operates the Medicare Advantage (MA) program as an alternative means for Medicare beneficiaries to obtain their Medicare health benefits. To make MA plans available, CMS contracts with private health insurance companies. These insurance companies, called MA organizations, are required by applicable CMS regulations to adopt and implement an effective compliance program. This Medicare regulatory mandate includes designation of “a compliance officer...who report[s] directly and [is] accountable to the organization’s chief executive officer or other senior management.”^[1]

CMS guidance for MA organizations expresses strong preference that the CCEO and compliance function be separate and independent from the CLO and the legal function. CMS’s Medicare Managed Care Manual specifies that “[t]he compliance officer should be independent [and] not serve in both compliance and operational areas (e.g., where the compliance officer is also the CFO, COO or GC)”; the reason is to avoid “self-policing in the operational area(s),” which can create “conflict of interest.”^[2]

To be clear, neither CMS regulations nor guidance directs that the mandated CCEO cannot be, or be subordinate to, an MA organization’s CLO. CMS guidance acknowledges that, although an MA organization “must ensure that reports from the compliance officer reach the [organization’s] senior-most leaders (typically the CEO or president),” that “direct reporting relationship between the compliance officer and the senior-most leadership refers to the direct reporting of information, not necessarily to a supervisory reporting relationship”; consequently, the required direct reporting “can be accomplished through a dotted line or matrix reporting.”^[3]

These comments reflect government recognition that “one size won’t fit all” and, hence, there is no one “correct” compliance structure. What matters is that the compliance structure adopted and implemented be “effective” and have “measures that prevent, detect, and correct non-compliance with CMS’s program requirements, as well as measures that prevent, detect, and correct fraud, waste, and abuse.”^[4]

Perhaps for smaller or more resource-constrained organizations, combining compliance with legal may be the only practicable solution. But if the organization has the resources, there appears to be a better choice. As CMS sees it, the compliance officer “must have express authority to provide unfiltered, in-person reports to the sponsor’s senior-most leader [without first being] routed...through operational management such as the COO, CFO, GC...or other executives responsible for operational areas.” To protect that authority, CMS argues that “best practice [will] allow the compliance officer to meet in Executive Session with the [organization’s] governing body [i.e., the board].”^[5]

CMS’s preference for compliance independent from legal has been implemented by the Office of Inspector General (OIG) of the U.S. Department of Health and Human Services. In corporate integrity agreements (CIAs) that resolve federal fraud and abuse and False Claims Act cases, OIG has shown willingness to impose the separation of compliance from legal. In the 2009 CIA with drug-maker Pfizer, which settled (for $2.3 billion) fraud and abuse and False Claims Act charges of illegal off-label prescription drug promotion, OIG required that Pfizer have an executive-level “Chief Compliance Officer [who] shall not be, or be subordinate to, the General Counsel or Chief Financial Officer.” The requirement that the “Chief Compliance Officer shall not be, or be subordinate to, the General Counsel or Chief Financial Officer” has generally become the standard for OIG’s CIAs.^[6]

OIG’s chief counsel at the time of the Pfizer CIA explained that this CIA requirement, which removed Pfizer’s compliance function from under its general counsel, was “intended to eliminate conflicts of interest, and prevent Pfizer’s in-house lawyers from reviewing or editing reports required by” the CIA. The reason for this separation is that “lawyers tell you whether you can do something, and compliance tells you whether you should.”^[7]

OIG’s CIAs also generally mandate that the “Chief Compliance Officer shall be a member of senior management..., shall report directly to the Chief Executive Officer..., shall make periodic (at least quarterly) reports regarding compliance matters directly to the Audit Committee of the Board of Directors..., and shall be authorized to report on such matters to the Audit Committee at any time.”^[8] The OIG CIAs mandate that the CCEO be “a member of senior management” reporting directly to the CEO and the board, which mirrors CMS guidance for MA organizations that “[i]t is best practice for the compliance officer to be a member of senior management” so that the chief compliance officer can “raise compliance issues without fear of retaliation.”^[9] No Balla Bind here (for definition, see Part 1 of this article).

Compliance best practice—Collaborating hats

The CCEO and the compliance function should—indeed, must—work in close, constructive collaboration with the CLO and the legal function. That collaboration can enable the CCEO to enlist the investigative aid and tools of the organization’s legal function to gather evidence to determine whether there has been a compliance deficiency. The CCEO will then have the facts to decide whether and how to report and remedy the issue.

Separately, the investigative capabilities of the legal function can enable the CLO to advise the organization’s senior management and board of directors within the scope of the attorney-client privilege of potential legal liability exposure and the means to manage and mitigate that exposure. Among the benefit of separating the compliance and legal functions is that, when advising management and the board, there should be no ambiguity that the CLO is acting as the organization’s attorney providing privileged advice, and not as the organization’s CCEO reporting compliance deficiencies and their remediation outside the attorney-client privilege. Put differently, it avoids the Balla Bind and the Sulzbach Parable (see Part 1 of this article) and frees the compliance officer to do the compliance job, secure in legal protection from retaliatory firing.

Murphy’s List—Fit the hat to the job

Long-time compliance consultant and attorney Joe Murphy^[10] provides a “top ten” list of reasons the CLO ought not also to serve as the CCEO. Joe Murphy presented this list at a meeting of the Chicago Regional Business Ethics Network on February 10, 2009. His list of reasons appears below as numbered subheads. (My explanations for these reasons are provided in plain text; I alone am responsible and accountable for the explanations.)

Conclusion

Their distinctive roles and responsibilities, regulatory mandates, government guidance, and best practice borne of experience—all argue for the CCEO and compliance function to be independent of the CLO and legal function. The need for compliance independence is rooted in avoiding the potential conflict between the CLO’s duties of providing privileged legal advice on the organization’s legal obligations and potential legal exposures, and the CCEO’s duties of implementing and monitoring compliance with the organization’s code of ethical business conduct and preventing, detecting, and correcting compliance deficiencies.

Murphy’s List, the Sulzbach Parable, the Balla Bind, and the Challenger disaster—each argues for compliance separate from legal and a CCEO separate from the CLO. Assuredly, an organization’s legal and compliance functions must be closely coordinated and work interactively. But their roles and responsibilities differ markedly. Legal is tasked with advising on what the law requires; compliance is tasked with pressing for “what is right.” Keeping these very different roles and responsibilities separate enables compliance and legal to perform their distinct functions with integrity and effectiveness—to the best benefit of the organizations they serve.

Takeaways

• Compliance “best practice” separates an organization’s compliance function from its legal function.

• Real world cautionary tales tell why—to avoid the inherent conflict between the roles, responsibilities, and expectations of compliance versus legal.

• Compliance serves a public function, favoring transparency in enforcing an organization’s pledge of ethical business conduct.

• Legal serves a private function, operating under the obligation to maintain client confidences in protecting the organization’s interests within the bounds of the law.

• Compliance and legal must cooperate, coordinate, and complement each other to work in tandem for the best benefit of the organization they serve.