Page 4
organization's administrators to develop and implement the organization's compliance program, as well as, authorizing funds to accomplish the task. The governing body must rely upon the individuals in the healthcare organization to accomplish the organization's goals including its compliance goals. The governing body will be required to rely upon the compliance officer and the compliance committee to develop and implement the compliance program. While the governing body, the compliance officer, and the compliance committees have primary responsibility for the organization's compliance program, every employee of a the organization is responsible in their own way for healthcare compliance, and the success of the compliance program. The individual members of the organization can and should report any healthcare compliance concerns they have up the chain of command. Those individual members of the organization should not only communicate concerns within their individual areas of responsibility, but they should also report anything that appears out of the ordinary, unusual or questionable. Every individual in the healthcare organization is responsible for the success of the compliance program because failures in the compliance program can impact every member of the organization. The imposition of sanctions in the millions of dollars is common, and even large organizations are affected by those sanctions. What Is Healthcare Compliance? Healthcare compliance is the ongoing process of meeting, or exceeding the legal, ethical, and professional standards applicable to a particular healthcare organization or provider. Healthcare compliance requires healthcare organizations and providers to develop effective processes, policies, and procedures to define appropriate conduct, train the organization's staff, and then monitor the adherence to the processes, policies, and procedures. Healthcare compliance covers numerous areas including, but not limited to, patient care, billing, reimbursement, managed care contracting, OSHA, Joint Commission on Accreditation of Healthcare Organizations, and HIPAA privacy and security to name a few. Healthcare compliance is not a new concept. One of the earliest forms of healthcare compliance was the establishment of minimum standards for surgery facilities by the American College of Surgeons in 1918. Today, the volume of regulations applicable to healthcare organizations and providers requires they have dedicated team members specifically focused on healthcare compliance. Each of the government agencies that regulate healthcare approaches its regulatory framework based upon its own area of control. For example, the Drug Enforcement Administration (DEA) is charged with enforcing the laws regarding controlled substances. The DEA's healthcare compliance is understandably directed toward ensuring that controlled substances are only used appropriately. The Department of Health and Human Services (HHS) Office of Inspector General (OIG) is focused on protecting the federal healthcare programs from fraud, abuse and waste. The OIG has published some of the most comprehensive guidance for healthcare organizations on the elements of an effective healthcare compliance program. According to the OIG, an effective healthcare compliance program must, at the very least, address the following seven areas: 1. The development, distribution and implementation of written standards of conduct and written policies and procedures that describe and further the organization's commitment to meeting and exceeding the legal and ethical standards applicable to the organization; 2. The designation of a chief compliance officer and other appropriate committees and individuals that are responsible for operating and monitoring the compliance program and who report directly to the organization's chief executive officer and the governing body; 3. The development and delivery of effective employee education and training programs; 4. The development and maintenance of effective lines of communication that allow individuals to report compliance concerns without retaliation, including the ability to anonymously report concerns and complaints; 5. The development and implementation of a process to respond to complaints that includes the imposition of appropriate corrective action including discipline of employees when required; 6. The use of internal monitoring and audits to measure compliance and address known deficiencies; and 7. Responding appropriately and quickly to detected offenses and implementing corrective action.The OIG's compliance guidance is focused on eliminating fraud, abuse and waste. The OIG's guidance is useful, but an effective healthcare compliance program must also address the other regulatory compliance areas applicable to the healthcare organization or provider. Every healthcare organization and provider deals with confidential health information. Consequently, every healthcare organization and provider will also need to include compliance with the Health Insurance Portability and Accountability Act (HIPAA) as part of its compliance program. The HHS Office of Civil Rights (OCR) is charged with implementing and enforcing the HIPAA privacy and security rules, and it has provided volumes of guidance on compliance with those rules. So healthcare compliance is the ongoing process of meeting, or exceeding all the legal, ethical, and professional standards applicable to an organization or provider. As the regulations applicable to the healthcare organization change so must its compliance program. When Is Healthcare Compliance Required? Every healthcare organization and provider needs a compliance program immediately. In fact, every healthcare organization and provider should have already established a healthcare compliance program. A large healthcare organization must have a comprehensive compliance program involving numerous individuals from multiple disciplines. Some large hospital systems have compliance departments that include hundreds of individuals. A solo practice physician may not need an extensive compliance department, but that physician will need a compliance program just the same. Healthcare compliance is also an ongoing process. A healthcare organization must constantly review and examine its processes and performance for adherence to minimal requirements as established by laws, regulations and professional standards. A healthcare organization must routinely audit its performance to ensure that it is meeting its requirements. Federal and state healthcare laws and regulations change constantly and the interpretation of those laws and regulations changes just as frequently. Effective healthcare compliance must be an ongoing process of continually reviewing and updating the processes, policies and procedures of the organization. The organization also must continually update the training provided to its employees based upon changes in the regulations. Where Are The Healthcare Compliance Requirements? Every healthcare organization and provider needs to identify all the laws and regulations that apply to their specific organization. The federal laws applicable to healthcare are extensive and are implemented by multiple federal agencies. As discussed above, HHS is responsible for the Medicare, Medicaid, and the other federal healthcare