Is having a compliance program really a "voluntary" matter for providers?

There has been much written regarding the "voluntary" nature of instituting and maintaining an "effective compliance program" for healthcare providers. Much of this literature supports the concept of compliance being interwoven into the culture of an organization. Whether Compliance Programs are truly voluntary is debatable.

While the Federal OIG has not formally stated that maintaining an effective compliance program is mandatory, Arkansas Medicaid has. Ark. Code Ann. § 20-77-2511 states that any provider who receives $750,000.00 annually from the Arkansas Medicaid program, is required to implement a compliance program. Moreover, CMS provider enrollment forms for certain provider types requires a "yes" or "no" answer as to whether the provider has a compliance program meeting certain requirements.

While there are multiple benefits from implementing and maintaining an effective compliance program, it is very important to recognize that there is no "one size fits all" compliance program for all providers. The specifics of a particular Compliance Program will vary based on provider type and provider size, just to name two factors. Each provider, whether a hospital, physician group, ambulatory surgery center or other provider type, should tailor its compliance program to reasonably reflect the compliance activities that the provider is able to perform.

Compliance Program Basics

Very generally speaking, an effective Compliance Program facilitates a healthcare provider's compliance with federal and state laws, rules and regulations that are applicable to the provider, including (but not limited to) Medicare and Medicaid reimbursement policies and procedures. It is well documented that non-compliance with Medicare or Medicaid reimbursement policies and procedures can have devastating effects on providers, particularly smaller providers with less margin to absorb unexpected losses and refunds.

An effective Compliance Program will not only provide guidelines for a provider to follow in the event of a compliance violation or breach (i.e., voluntary identification and refunding of overpayments), but will also help providers avoid compliance issues by implementing front-end auditing and monitoring processes to detect any would-be issues before they become negative compliance outcomes.

OIG Compliance Program Specifics

The Federal Office of the Inspector General has identified seven (7) essential elements of an "effective compliance program," all of which are essential to demonstrating the "commitment to compliance" that the OIG expects of all healthcare providers. These seven elements include:

1. Developing written policies and procedures.
2. Designating a compliance officer and compliance committee.
3. Providing effective compliance training and education.
4. Establishing effective lines of communication.
5. Performing internal monitoring and auditing.
6. Enforcement of standards through well-publicized disciplinary guidelines.
7. Exhibiting a prompt response to detected problems through corrective actions.

In our practice, we advise clients that the Compliance Committee should be comprised of individuals with diverse responsibilities that include the revenue cycle, human resources, and information technology, just to mention a few. We have found that the most effective compliance committees meet on a quarterly basis and include on their agenda certain standing items, such as a human resources report to identify any disciplinary actions taken as a result of compliance violations. We often hear our various clients remark that their compliance committee meetings are among the most informative meetings that they attend. In the early stages of organizing and implementing your compliance program, it is crucial to involve legal counsel in order to assure the entire compliance landscape is addressed by the Compliance Committee in its quarterly meetings.

Arkansas Medicaid Compliance Program Specifics

The Arkansas Legislature, in creating the Office of the Medicaid Inspector General, identified the following elements of an "effective compliance program" for Arkansas Medicaid providers:

• Development of written policies and procedures that:

1. Describe compliance expectations;
2. Describe the implementation of the operation of the compliance program;
3. Provide guidance to employees and others with regard to dealing with potential compliance issues;
4. Identify a method for communicating compliance issues to appropriate compliance personnel; and
5. Describe the method by which potential compliance problems are investigated and resolved.

• Designation of an employee charged with responsibility for operation of the compliance program (i.e., a "compliance officer"):

1. The employee so designated may have other responsibilities in addition to operation of the compliance program; and
2. The employee so designated must report directly to the provider's chief executive or other senior officer and must periodically report directly to the provider's governing board on the activities of the compliance program.

• Providing periodic training to employees of the provider, including executives and governing board members, with regard to the compliance program operation, compliance issues and compliance expectations. The compliance training should also be a part of the orientation process for these individuals.

• Providing lines of communication, including a method to anonymously report potential compliance issues as they are identified by employees, executives and governing board members.

• Establishing disciplinary policies to encourage participation in the compliance program by affected individuals, including a policy that sets forth expectations for reporting compliance issues, assisting in the resolution of such issues and outlines sanctions for:

1. Failing to report suspected problems;
2. Participating in noncompliant behavior; and
3. Encouraging, directing, facilitating, or permitting noncompliant behavior.

• Establishing a system for routine identification of compliance risk areas specific to the provider for:

1. Self-evaluation of the risk areas, including internal and external audits; and
2. Evaluation of potential or actual noncompliance as a result of these audits.

• Establishing a system for:

1. Responding to compliance issues as they are raised;
2. Investigating potential compliance issues;
3. Responding to compliance issues as identified through audits;
4. Correcting problems promptly and thoroughly and implementing processes to reduce the potential for recurrence;
5. Identifying and reporting compliance issues to the Arkansas Department of Human Services or the Office of the Medicaid Inspector General; and
6. Refunding overpayments.

• Establishing a policy of non-intimidation and non-retaliation for good-faith participation in the compliance program, including, without limitation:

1. Reporting potential issues;
2. Investigating issues;
3. Performing self-evaluations;
4. Conducting audits and remedial actions; and
5. Reporting to appropriate officials.

Conclusion

Twenty (20) plus years ago, the concept of Compliance Programs was introduced as "voluntary." Arguably, in some cases implementation of a Compliance Program may still be voluntary. However, as noted in this article, an effective Compliance Program is legally mandated for some providers advisable for all.

Lynda Johnson, and Timothy Ezell are both Partners at Friday, Eldredge & Clark, LLP. Visit www.FridayFirm.com