Page 10
following: • Security management processes to prevent, detect, contain, and correct security violations to include risk analysis, risk management, sanction policies and information systems activity reviews. Compliance Plan 2 - 2 Revised December 12, 2018 • Workforce security oversight to ensure workforce members have appropriate access to electronic protected health information such as authorization and/or supervision of workforce through clearance and termination procedures. • Information access management for authorizing access to electronic protected health information to include isolating health care clearinghouse functions if part of a larger organization, access authorization, and access establishment and modification. • Security awareness and training for all workforce members such as security reminders, protection from malicious software, log-in monitoring, and password management. • Security incident procedures to address security incidents to include response and reporting of suspected or known security incidents and to mitigate the harmful effects of security incidents known to the covered entity. • Contingency planning for responding to an emergency or other occurrence (fire, vandalism, system failure, natural disasters) that damages systems that contain electronic protected health information to include a data backup plan, disaster recovery plan, emergency mode operation plan, testing and revision procedures and applications and data criticality analyses. • Performing periodic technical and nontechnical evaluations in response to environmental or operational changes affecting the security of electronic protected health information. III. Designation of the Compliance Committee The Compliance Committee shall meet at least quarterly and is charged with overseeing the administration of the Compliance Plan. This oversight shall encompass employee training, investigating suspected non-compliant activities, responding to activities that are not consistent with FHCP’s Compliance Plan, coordinating internal compliance audits, overseeing compliance audits performed by outside professional firms, and overseeing any other functions necessary to ensure that the Compliance Plan meets its objectives. All conversations between Compliance Committee members and employees will be kept confidential to the maximum extent permitted by law. In addition to the Compliance Officer, the Compliance Committee shall be comprised of: • President/Chief Executive Officer • Chief Financial Officer/Associate CEO • Chief Information Officer • Legal/General Counsel Compliance Plan 2 - 3 Revised December 12, 2018 IV. Duties of Compliance Officer and Compliance Committee The Compliance Officer and Compliance Committee shall participate in ongoing compliance activities such as: • Facilitate FHCP-wide compliance oversight; • Facilitate the exchange of compliance-related information and resources across FHCP facilities; • Provide a mechanism by which the Board of Directors are apprised of compliance program activities; • Facilitate the review, analysis and development of written policies and standards applicable to the Compliance Plan. The Committee’s primary focus will be on implementing and maintaining an effective compliance program modeled after the definitions contained in the U.S. Sentencing Guidelines and guidance published by the OIG and CMS. Activities will include: • Discussion and analysis of compliance risks • Policies and standards development • Compliance oversight • Delegation of authority • Training, education and communications • Monitoring and investigating • Enforcement and discipline • Responses to problems and corrective action Specific duties of the Compliance Officer and Compliance Committee shall include the following: A. Monitoring and Investigating The Compliance Officer shall be responsible for monitoring and, as needed, investigating the organization’s processes to ensure adherence to regulatory standards and FHCP’s administrative policies and procedures. Monitoring shall be ongoing and include both reviews conducted by Compliance as well as reports produced by operational areas of the organization or outside entities. In the event that an at-risk area is identified, either through monitoring or a report to the Compliance Officer/Committee, an investigation of the suspected practice shall promptly be initiated. B. Audits by Outside Professional Firms The Compliance Committee shall have the authority to retain outside professional firms as needed for guidance on issues arising under the Corporate Compliance Plan. The Compliance Officer shall oversee, organize, and implement all audits conducted by outside professional firms. Compliance Plan 2 - 4 Revised December 12, 2018 C. Report to the Board The Compliance Committee shall provide periodic reports to the Board of Directors. Such reports shall include information such as status of the Compliance Plan and implementation of work plan(s), audit findings, investigation results, and corrective action plans. D. Employee Training The Compliance Officer shall be responsible for overseeing the development and implementation of employee education and training activities related to FHCP’s Compliance Plan. All new employees shall attend the training during their 90-day introductory period. Additional training shall be provided as needed and as appropriate for the employee’s job description. V. Role of Directors, Managers, and Supervisors While the Compliance Officer and Compliance Committee shall assume primary responsibility for the development and implementation of this Plan, all Directors, Managers, and Supervisors shall: • Foster an ethical working environment that adheres to this Plan; • Administer the elements of the compliance program within their department; and • Act as liaison with the Compliance Officer and Compliance Committee. Specific involvement in the Compliance Plan shall include: A. Policy and Procedure Development • Initiate, authorize and support process of policy review & revision; • Maintain open lines of communication with Compliance Officer and Compliance Committee; • Allocate reasonable and necessary resources to ensure Plan adherence; • Give authority to the Compliance Officer to assist with Plan Implementation; and • Take appropriate follow-up action regarding compliance activities. B. Compliance Oversight • Establish the proper "tone" at the top and support the Compliance Committee; • Designate staff to help coordinate compliance program activity within FHCP; • Be visible and accessible; • Help remove barriers when issues are raised; • Give the Compliance Officer "clout" and access to necessary resources; and • Require compliance-related objectives in performance appraisals of all employees. Compliance Plan 2 - 5 Revised December 12, 2018 C. Education and Training • Foster an environment of open and continuous education, training and communication; • Request appropriate resources to support training needs; • Participate in training, education and communications programs; • Support efforts to train at department level D. Reporting, Investigating, Monitoring, Auditing • Communicate to subordinates the availability and importance of reporting systems (Help Line, e-mail, compliance alerts, compliance advisories and other compliance related information); • Encourage management to support reporting systems; and • Support the Compliance Officer and Compliance Committee during all