The Essentials of Corporate Compliance.

A midst increasing federal government pressure regarding Medicare/Medicaid fraud and abuse, more and more skilled nursing facilities are considering implementing a corporate compliance plan. Many view this, and with some justification, as a key to legal survival. Unfortunately, the prospect of creating a corporate compliance plan is daunting, raising a myriad of questions, such as: Who has the time to draft the plan? Who has the experience? How much more documentation will staff, already buried in paperwork, need to complete?

Because these issues are so perplexing, many providers have turned to "compliance plans in a can" (of the off-the-shelf, cookie-cutter variety) or have simply turned the whole thing over to a consultant for an exorbitant fee. While both of these strategies might relieve some of the pressure and anxiety, they often result in a plan that fails to provide even limited protection for the facility, let alone identify key liability issues that need to be addressed.

The value and effectiveness of your compliance plan is not, however, going to be judged on how much money you spend or on how many pages you put in a binder that no one reads. It will be determined, rather, by how well the plan is tailored to the facility's operations and how effectively the compliance plan is being carried out on a day-to-day basis. In fact, an effective compliance plan is nothing more than an expansion of your existing quality assurance activities, aimed at addressing all facility operations, including billing and resident care documentation. The good news, in other words, is that because every facility already has a quality assurance mechanism in place, the infrastructure and process for a compliance plan already exists.

If the compliance plan is just an extension of the existing quality assurance process, can providers simply pen in the names of a "compliance committee" in their quality assurance committee meeting notes? Unfortunately, no.

What goes into a compliance plan that will pass today's legal muster? The Office of Inspector General (OIG) has offered guidance on this. OIG lists, for starters, seven key elements in the planning process:

1. implementing a written plan;

2. designating a compliance officer and compliance committee;

3. conducting effective training and education;

4. maintaining effective communication;

5. performing internal monitoring and auditing;

6. enforcing standards through well-publicized disciplinary guidelines; and

7. responding promptly to detected offenses and developing corrective actions.

While this might appear to be a lot to ask, many of these items overlap and complement one another. Let's take a closer look.

Implementing a Written Plan

There are two main written policies a compliance plan should include. First, a Code of Conduct--essentially the facility or provider's "Ten Commandments." The Code of Conduct clearly outlines those activities in which a facility or its staff should never engage (e.g., accepting bribes or kickbacks in return for referrals, upcoding charges, falsifying documentation or filing false claims), and it explains the standards to which all staff are expected to adhere. Though a Code of Conduct can be limited to fraud and abuse issues, they are generally more effective when they include all areas of facility conduct (or misconduct), including discrimination, sexual harassment and dishonest dealings with residents and their families.

The second key written document for a compliance plan is the Compliance Plan Policy. This outlines the day-to-day implementation of the compliance plan. Questions this document addresses include: Who is responsible for training staff? Who is responsible for receiving and following up on complaints, and how are complaints investigated? How is discipline administered when it is determined that an individual has violated the Code of Conduct or the Compliance Plan Policy? The Compliance Plan Policy should also specify corrective actions to be taken when issues are identified.

Often I am asked whether these two documents need to be drafted by an attorney. Generally, I recommend that the facility staff, and not attorneys, consultants or accountants, draft both of these documents themselves, as facility staff have a more intimate working knowledge of the facility than any outside third party. Third parties can be used for backup and review.

For example, when working with our clients, we generally provide them with some basic information concerning the general issues they need to address, as well as some model language. Our clients can then take this language and tailor it specifically to their own practices. Once the facility has drafted these documents, I recommend that they be reviewed by an attorney to ensure that the important issues have been addressed properly and that the Code of Conduct and Compliance Plan Policy are consistent with state and federal law.

So now you're staring at a blank piece of paper and wondering where to start.... The best advice is to just start--and worry about the format and editing later. To prepare, look at the many examples of compliance plans that are available on the Internet. (In fact, many of these examples are posted by healthcare providers as part of their Compliance Plan Policy, which includes making the policy accessible to all employees and the public.) Remember, the compliance plan needs to reflect your facility's operations and should be written in a way that your entire staff understands.

Designating a Compliance Officer and Compliance Committee

Since the OIG issued its first draft compliance policy guide, a new breed of healthcare employee has emerged: the corporate compliance officer. Recent salary surveys of corporate compliance officers indicate that for a health system, they can command a salary in the six-figure range. Fortunately, there is no requirement that a facility hire an individual solely designated as the compliance officer, who has no other job responsibilities. In fact, the OIG was clear in its draft compliance guide for skilled nursing facilities that the compliance officer may be an individual within the facility who already has other responsibilities.

So who should the compliance officer be? The compliance officer should be familiar with the day-to-day operations of the facility. He/she should have some knowledge of, or will need to be educated about, the Medicare/Medicaid, as well as private insurance, billing process. Last but not least, the compliance officer should be trustworthy and discreet, because much of his/her work will be related to very sensitive issues.

Because of the broad scope of the compliance officer's duties, he/she must have authority to conduct full investigations and take disciplinary action if a violation of the Code of Conduct or the Compliance Plan Policy is found. The compliance officer should report directly to the owner or the board of directors. Whoever is selected to serve as the compliance officer should also have sufficient time to devote to his/her duties.

For those organizations having more than one facility, the OIG has indicated that it is acceptable to have one overall compliance officer, with "compliance liaisons" at each of the member facilities reporting to the compliance officer on a regular basis.

Creating a compliance committee is simpler than designating a compliance officer. The compliance committee should be made up of individuals from administration, billing and the clinical areas. Its role? In the initial stages of the compliance plan, the compliance committee reviews the Code of Conduct and the Compliance Plan Policy to identify risk areas and to reach consensus on how the plan is to be carried out. The compliance committee should meet regularly to discuss the facility's progress in complying with its Code of Conduct. The compliance committee should also review the compliance plan in light of newly released government initiatives or announcements regarding healthcare fraud and abuse. The compliance committee should be especially vigilant in reviewing the facility's efforts in addressing the high-risk areas identified by the OIG, including false billing, poor skin care, dehydration, malnutrition and resident abuse. Based on these meetings and discussions, the compliance committee recommends corr ective action to be taken by the facility. Samples might include reviewing and revising, or even creating, a billing manual for the facility; directing additional training of billing staff; arranging for the in-servicing of clinical staff on key clinical issues; having an outside independent audit of clinical charts or of billing practices; evaluating internal investigations; and reviewing the facility policies and practices on the screening of staff.

Conducting Effective Training and Education

A compliance plan must become part of the facility's culture; all staff must become familiar with the Code of Conduct and the Compliance Plan Policy. Creating or conducting effective training and education is therefore critical to ensuring that your compliance plan will be viewed as effective in the eyes of the OIG, the Health Care Financing Administration (HCFA) and the Fiscal Intermediary.

The first piece of an effective training and education program starts when an employee is hired. While many states require that providers conduct a criminal background check on newly hired staff, as well as checking a registry, the OIG has recommended that providers also check the OIG Web site to determine whether the individual under consideration has been excluded from participation in Medicare or Medicaid, which will not pay for any services provided by or prescribed by an excluded individual. Currently, there are 2,192 individuals excluded from participation in Medicaid and Medicare under the category of "skilled nursing facilities." You can check whether an individual has been excluded at http://exclusions.oig.hhs.gov/cgi-bin/oig_counter.pl, and this check should be documented in the employee's file.

Once the screening has been completed, the employee needs to become familiar with the Code of Conduct and the Compliance Plan Policy. These should be reviewed with any new employees at the time of their hire. Again, the employee's file should contain evidence that the employee has reviewed the Code of Conduct and the Compliance Plan Policy and understands them. Of course, communication is critical for the training and education to be effective. The Code of Conduct and the Compliance Plan Policy should be made available to employees in an easy-to-understand form. Providers should simplify their Code of Conduct and Compliance Plan Policy so that they are succinct and clear. (While the phrase "remuneration in cash and kind" might cause some confusion for employees, the phrase "bribe, gift or free service in return for a referral" is much clearer.)

Employees must be regularly in-serviced regarding the compliance plan. These in-services can become an excellent way to address a myriad of issues including fraud and abuse, key employment issues such as harassment and discrimination, and abuse reporting and investigations. These in-services should stress the importance of having staff report any suspect activity without fear of reprisal. Not only does this create more openness, but staff who feel that their complaints will not be adequately addressed are much more likely to bring their concerns to outside parties, such as the federal government or legal "whistle-blowers."

Performing Internal Monitoring and Auditing

A baseline audit, which should be performed at the outset, is an audit of the provider's billing and clinical practices to determine the facility's current compliance with federal requirements. The baseline audit should also include a review of clinical charting and care issues. Baseline audits often reveal significant misunderstandings regarding proper billing practices, as well as questionable transactions. The results of the baseline audit are extremely useful in formulating and revising the Code of Conduct and the Compliance Plan Policy.

Because the baseline audit and subsequent audit can unearth potentially damaging information, providers should have their attorneys retain the accountants or consultants who conduct the audit; this will provide the greatest degree of confidentiality for the results. Work done by an attorney or at the direction of an attorney for the client is afforded some degree of privilege and confidentiality. Failing to have the attorney direct the process can result in the audit results being disclosed to the government or a plaintiffs attorney.

Providers need to continually monitor the effectiveness of the compliance plan. This can be done internally by conducting sample chart reviews regarding clinical issues and conducting billing reviews to ensure that billing is being conducted properly. This can also be done by independent third parties. Consultants can play an important role in ensuring that key clinical and billing issues are being handled appropriately.

The frequency with which a provider conducts the internal monitoring, like all other aspects of the compliance plan, should be individualized to the facility. Obviously, if the initial baseline audit indicates many problems within the facility, internal monitoring should be more frequent in the initial stages of the compliance plan, and could taper off if subsequent audits find improved compliance. Regardless of the facility's compliance level, auditing and monitoring should be done yearly, at a minimum. More informal monitoring should be conducted by the compliance committee at least quarterly, if not monthly. As with the baseline audit, subsequent audits should be done at the direction of the facility's attorney to ensure the confidentiality of the results.

Another key element that must be included in the compliance plan is a formal complaint process that seeks to preserve anonymity. While the OIG urged hospitals to create anonymous toll-free hot lines, the OIG has recognized that such a complaint process might not be practical for most long-term care providers. For these providers, a cottage industry has developed that provides an 800 call-in confidential tip-line for a monthly fee.

Enforcing Standards Through Well-Publicized Disciplinary Guidelines

As previously discussed, the compliance policy should provide clear guidance as to disciplinary action that will be taken in the event that a violation is discovered. Additionally, staff need to be made aware when disciplinary action has been taken against a staff member. As with all policies, it is critical that the provider administer the policy uniformly with regard to all staff members. One of the leading causes of liability that we see among providers is their failure to implement a policy consistently among staff. All too often, a break is given to one staff member over another because he/she "tries harder" or is a really good person." Inconsistent application of a policy without clearly documented good cause can result in a potential lawsuit for unfair treatment, as well as an allegation that the compliance plan is ineffective because it is not properly applied.

Responding Promptly to Detected Offenses and Developing Corrective Actions

It is critical that the facility have an effective complaint process. Once a complaint is received, the facility must document it and take the appropriate follow-up actions to investigate it and determination whether the complaint is valid. Once the investigation has been completed, the appropriate disciplinary action must be taken and documented thoroughly. The compliance committee should regularly review complainte as well as investigation reports, to identify additional areas that must be addressed through its compliante plan. The compliance committee's minutes should reflect that the issues were identified and that the appropriate corrective action was taken. Issues of format and confidentiality should be taken up with the facility's attorney.

In conclusion, formulating compliance plan is a lot of work. But this is not all bad. Many of our clients who have embarked on this journey have found it to be rewarding, simply because the provider was able to identify areas that were being improperly billed and costing the facility money. Staffs of these organizations feel that they have more ownership in the process because they are better informed. Administrators report that they have a better handle on a variety of issues because of the global view that their compliance committees are taking.

It is also difficult to argue one further point: It's better to identify potential criminal issues internally than have the federal government do it for you.

Matthew J. Murer is an attorney with the firm of Duane, Morris & Heckscher, Chicago.

Editor's note: This article is intended for informational purposes only, and is not legal advice. In the event of a problem relating to your facility, you should seek legal counsel.