Corporate compliance programs: risk management for the future.

HEALTH LAW

The Department of Justice has estimated that the government loses $100 billion annually in health care fraud. Consequently, the government's health care fraud enforcement activities with respect to all health care providers and suppliers continue to grow. Last year alone, the government collected more than $8 billion in settlements, fines, and penalties involving health care fraud. Recent settlements with the government have begun to include corporate compliance programs that require continued government oversight of the health care organization as an essential part of the settlement. The first section of this article describes the legal significance of health care companies' having corporate compliance programs. The second section provides a sample list of topics that should be included in any corporate compliance program. Finally, we describe various issues related to the creation and implementation of corporate compliance programs.

Corporate compliance programs are not just for providers who are subject to a government settlement. Rather, all health care organizations should implement compliance programs long before they anticipate a government investigation. A well-established corporate compliance program can aid in the prevention of a legal crisis, and, should a legal crisis arise, the program protects the provider by shielding it from harsher penalties or stricter sentences. Specifically, a corporate compliance program will enable a health care provider or supplier to identify potential areas of liability and to correct the problems.

Legal Significance of Having a Corporate Compliance

Program

A well-established corporate compliance program can protect a provider or supplier in the midst of a legal crisis by shielding it from harsher penalties or stricter sentences. For example, under the federal sentencing guidelines, the fine imposed could be reduced by as much as 50 percent if a provider or supplier is convicted of violating the federal antikickback statute - 42 U.S.C. [sections] 1320a-7b(b) - and the entity has a corporate compliance program in place. Equally important, a corporate compliance program will reduce the likelihood of potential violations by clarifying for employees what behavior is acceptable and what is intolerable. Moreover, a corporate compliance program is an aid to management in detecting violations early enough to enable the health care organization to act proactively in correcting a potential problem.

Topics For Corporate Compliance Programs

There are basically two categories of topics that should be included in a health care entity's corporate compliance program. First, there are generic topics, such as business ethics, that should be included regardless of the type of health care organization involved. Then there are issues unique to the government obligations imposed on the health care organization that could give rise to significant liability for the entity. An example of the first type of topic is a code of business ethics on records management policy. Examples of the second topic type are Medicaid Drug Rebate reporting policy for a pharmaceutical firm and Medicare HMO marketing practices policy (the government has strict rules about prohibited HMO marketing practices).

Every corporate compliance program should have a corporate compliance policy statement. The topics in this policy could include a code of ethics policy; a confidentiality policy; a drug-free workplace policy; a records management policy; labor policies, including personnel policies and procedures; ADA and Family Medical Leave Act policies; a hazardous and medical waste disposal policy; a procurement integrity policy; government billing practices policy; a physician financial relationship policy; and a policy for charitable contributions involving entities or persons in a position to refer patients or to order the company's goods and services. This is only a "bare bones" outline. Each of the topics listed must be fully developed and then included as an attachment to the overall policy statement.

For health care providers that bill federal health programs directly, there is always a particular concern about improper billings. A government billing practices policy would address these issues. A billing policy should include development of internal billing controls and audit procedures, of an internal reporting mechanism, and of an orientation program for those involved in claims processing and submission. The orientation program would include continued compliance training for employees involved in claims processing and submission. Even if the health care organization sells products or services only to providers that bill federal health programs directly, there is a need for such a policy in light of the broad reaches of the "cause to be submitted" language in the false claims statutes.

Other corporate compliance topics that appropriately fall within a corporate compliance program could include federal and state government agency audits; interviews, searches, and other contacts; compliance with federal and state self-referral laws; physician recruitment and retention activities; joint venture activities; purchasing guidelines, including permissible discounts and associated reporting obligations; other billing practices, including specific procedures for dealing with coding uncertainties, Medicare secondary payer issues, credit balances, coinsurance collections, and the like; advance directives; and anti-patient dumping compliance policies and procedures.

Issues Regarding Implementation

One of the most difficult aspects of a corporate compliance program is how to get started in establishing one and how to make sure that its creation and implementation are given high priority within the health care organization. Based on our experience, we have divided implementation into different phases. Phase One is to identify the health care organization's needs, to prioritize those needs, and to establish a starting point. Prioritization is a function of several factors: areas of significant legal exposure based on the activities/business lines, potential government enforcement areas, and areas that directly affect customer exposure.

Every health care organization also has its own starting point. Therefore, the health care organization needs to establish in Phase One what already exists in the priority areas that have been identified. For example, does the provider or supplier already have a policy that requires only certain designated senior executives to write checks made payable to a physician organization in order to ensure compliance with self-referral and antikickback laws prior to payment? Phase One ends with a task list and deadlines.

Phase Two is the actual drafting of policies identified in Phase One. Sometimes, the health care organization prepares the first draft and counsel reviews it; other times, counsel provides the first draft. However, counsel's main responsibility in Phase Two is to be sure that certain timetables are met so that the risk management initiative does not get lost in day-to-day operational priorities.

Phase Three is to obtain review and approval of the corporate compliance program by senior management and the board of directors of the health care organization. Thereafter, the corporate compliance officer would be responsible for quarterly and annual reports to senior management and the board of directors to demonstrate that the policies that were adopted are being implemented properly.

A provider or supplier that follows these guidelines and establishes a corporate compliance program that includes the elements discussed in this article may not be able to prevent a government investigation, but it will have gone a long way in ensuring that such an investigation will not turn into a legal crisis, because it has a risk management mechanism in place that is both proactive and corrective.

Lynn Shapiro Snyder and Elizabeth A. Lewis are health care lawyers in the Washington, D.C., office of Epstein Becker & Green, P.C.