Sharon Parsley, JD, MBA, CHC, CHRC » YouCompli

Four Critical Listening Skills for Compliance Officers

Sharon Parsley, JD, MBA, CHC, CHRC — Sat, 18 Nov 2023 20:59:51 +0000

Wikipedia describes listening as “giving attention to sound or action.” This overly simplistic definition fails to address the inherent challenges that keep many people from being a good listener in life and, more particularly, in the workplace. The obstacles to good listening skills are many. Those include interruptions, inattention, biased or selective hearing, and focusing on your response rather than the speaker.

Most of us have had the experience of preparing for an important conversation or interaction, only to leave it feeling defeated, misunderstood, and not even really heard. Can you think of a person in your life who, regardless of the topic, always manages to steer the dialogue so that it is all about him or her? Now think about the detrimental effect that feeling can have on the trust you need to build in your healthcare relationships.

Fortunately, being a better listener is possible. In this article, we will examine four essential listening skills that help compliance officers be more effective within their organizations.

Discriminative Listening

According to betterup.com, discriminative listening is a skill all humans are born with. This type of listening relies more on tone, changes in sound and other non-verbal cues. Since we all know that a substantial portion of our communication is non-verbal, successful use of discriminative listening is vital.

Say you are conducting a one-hour live training for a large group of physicians. Ten minutes in, you see that most of them are glued to their cell phones or whispering to each other, and only a few appear to be giving you their full attention. This is a tough situation to find yourself in, but what would you do? Soldier on with your scripted remarks? Embarrass a member of the audience by calling him or her out?

Or can you find a way to adapt the presentation in real-time to make it more interactive? Can you possibly take a pause or a short break and then redirect the discussion to why the topic is important to the audience and go straight to the key takeaways? There may not be a best answer here, but through discriminative listening we should at least be able to ascertain that the presentation is not hitting the mark for this audience. Pay attention to how your audience reacts to what you say and adapt accordingly.

2. Sympathetic Listening

Betterup.com describes sympathetic listening as hearing behind the spoken words to understand the emotions of the speaker. This listening style can deepen your human connection with the speaker as he or she is more likely to feel heard, valued, and validated.

During the early days of the pandemic, I had numerous interactions with patients and their family members. Some of those conversations were initiated due to patient safety or quality of care concerns. Others were about privacy or another compliance matter. What was universally true in every one of those conversations is that the person I was speaking with was scared. Scared that we were fighting an unseen, unknown virus with rapidly changing public health and agency guidance. Scared that they might not be able to say goodbye to their spouse of 50 years because their spouse was in the COVID ICU and had been intubated during the night. Or maybe they were scared because the discharge instructions that an exhausted emergency room (ER) nurse handed to the wrong patient contained sensitive information about their terminally ill child.

Yes, I spent a lot of time listening. In many of those conversations, I was not in a position to “fix” the root issue or concern. I would like to believe, however, that in most of those cases the speaker left our interactions at least feeling heard and that their fears and concerns were also valid emotions.

3. Empathetic Listening

While it sounds similar to sympathetic listening, empathetic listening requires us as a listener to understand what it feels like to be in the position of the speaker. Imagine that you have a downline report who has missed an important deadline. The missed deadline reflects poorly on your entire team and your CEO has called you into a meeting to discuss the issue. Obviously, you need to have a crucial conversation with that team member.

During the course of the conversation, you learn that her spouse lost his job a few weeks ago, and that they are caring for a parent who has Alzheimer’s disease in their home. Should she have alerted you to the possibility of missing a key deadline? Of course. However, you can also tell that she is frightened about now being a single income household and exhausted as she is a full-time mom, now part-time caregiver, as well as one of your trusted team members. It is possible to turn that conversation into a more open dialogue and put yourself in her shoes. Missing the deadline still needs to be addressed, but it can be done in an empathetic and compassionate way.

4. Critical Listening

Finally, betterup.com talks about critical listening skills, which are imperative to help us analyze complex information and evaluate what is being said. Critical listening is key for problem-solving and handling complex projects.

Imagine getting a hotline phone call at 5 p.m. on Friday from an oncology research assistant. That reporter makes allegations about unsafe lab practices, discrimination, and sexual harassment, and says that insurers and patients are erroneously being billed for research-related services. Whew. That is a lot to unpack.

Maybe only the billing allegation falls into your purview. If so, help the caller understand the appropriate reporting channels for the other concerns.

Then, focus attention on the billing issue. You know that research billing is notoriously difficult to get right. You know that your oncology department does a lot of industry sponsored phase 3 research and perhaps some phase 1 and 2 government-funded research.

Maybe you also heard that the individual who was doing Medicare coverage analyses for the oncology research area was recently promoted. You may have no probability of resolving the concern about research billing without gathering information from a variety of organizational stakeholders. Your application of critical listening skills here, however, might help you to readily understand some possible root causes of the issue and aid you in developing an action plan to investigate the concern.

Better Listening Hygiene

We have plentiful opportunities to be good listeners every day. Most of us also have room to improve on our listening “hygiene.” We can commit to making appropriate eye contact with the speaker. We can endeavor to not judge what is being said. We can refrain from unnecessary interruption or jumping in with our story rather than letting the speaker’s words resound. We can minimize distractions by turning off email, instant messaging, and text notifications. We can attempt to create a comfortable and safe environment to have important conversations. Lastly, we can learn to be ok with silence.

Give yourself time back to focus on relationships and listening. Build a scalable, repeatable change management process to enable your team and colleagues to focus on their expertise rather than the minutia of monitoring and reading regs.

Sharon Parsley, JD, MBA, CHC, CHRC, is a health law attorney, compliance officer, author, speaker, investigator, and problem solver. She currently serves as the president and managing director of Quest Advisory Group, LLC. She has nearly 20 years of healthcare compliance and legal leadership experience, and she believes that mentorship and on-the-job training are critical to compliance professional success.  

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Our in-house team works tirelessly to monitor US regulators, carefully read the regulations in their entirety, and translate the information into simple regulatory intelligence you can use. We deliver model procedures and expert tools that can be used to fulfill your business requirements. Everything is validated by a third-party law firm. Follow the button below to get a tour of our healthcare compliance software. 

Get the latest from healthcare compliance experts 

Never miss an article by Sharon Parsley. Sign up for YouCompli’s weekly email if you haven’t already. 

The post Four Critical Listening Skills for Compliance Officers first appeared on YouCompli.

Embrace Your Role as a Healthcare Compliance Project Manager

Sharon Parsley, JD, MBA, CHC, CHRC — Wed, 06 Sep 2023 18:08:18 +0000

Was “project manager” in your current or previous job descriptions? It definitely wasn’t in any of mine! But very quickly, as a healthcare compliance officer, I realized that I was managing multiple projects every day. I was responsible for allocating financial, human, and physical resources to accomplish certain tasks.  

Once I embraced the fact that I was indeed a project manager, I needed to find ways to be as effective as possible.  Rather than fighting it, I looked for ways to get better at it. I treated every scheduled and issue-specific audit and monitoring activity on my annual work plan as a project to manage well. Every hotline concern that warrants investigation became a project. Performing my annual risk assessment was a project. Conducting annual compliance training is a project.  

Even when I had no supervisory responsibility, I was still responsible for personally completing certain tasks, meeting deadlines, and creating deliverables. And so are you.  

The good news: there are methodologies that help. The essential project lifecycle stages include initiation, planning, execution, monitoring, and closure. For smaller projects, these steps can be organized, managed, and executed informally. As a rule of thumb: the larger the project, the more structured its plan and oversight should be. For instance, if you’re implementing significant regulatory changes, you’ll want a robust project plan. If you’re simply responding to a change to an LCD or NCD, you may be able to take a less formal approach. 

In this article I recommend steps to take at each phase of a compliance project and give examples of how these phases might look in a compliance setting. 

Initiation 

Every project needs a beginning. I consider this the “who, what, when, where, why, and how” phase. During this phase, you will:

Identify and involve needed stakeholders.  
Clearly define the “why” behind the project and “what” the project to designed to achieve. 
Determine a target completion date. 
Identify the basic resources needed to accomplish the project.

While you hold the leader’s chair, you won’t be on the hook for delivering all the work. With careful thought up front, you’ll get the right people on the project to enable teamwork. For instance, with a significant coding change, you’ll want the right people at the table to work with you. That may include patient access, along with your mid-cycle and back-end revenue cycle folks. Some of them will have big responsibilities, while others will advise. Your planning creates the space and framework for them to do their jobs. 

Planning 

Larger projects will require a multi-disciplinary approach. It may be appropriate to have formal project planning meetings. The most important steps in planning are: 

Establish and ensure acceptance and ownership of every known task.  
Identify the inter-relationships between tasks.
Ensure that expectations for each deliverable are understood.  
Agree to due dates.

If you are the project owner, your colleagues will appreciate a scalable and measured approach to planning. Allow each project team member to leverage his or her subject matter expertise within the framework you provide. By doing so, you and your project team will be excellent stewards of the human and physical resources needed to complete the project. This adds value for your organization as you will be regularly completing projects on time and on budget.  

Execution 

Now, your project “train” is ready to leave the station. In the execution phase, we obviously will complete the tasks that we identified during the planning phase. Sounds simple, right? 

Let’s now pretend our “project” is to review billing for human subject research. Anyone who has participated in a project of that magnitude can confirm that it truly takes a village to get it right. We need: 

Detailed and timely front-end coverage analysis to identify which services are standard of care (SOC) and which are research-related (RR).  
Excellent controls in place for patient registration processes.  
People who are knowledgeable of the study segregate the charges appropriately, particularly if a patient/subject will receive a combination of SOC and RR services during a visit. 
Separate billing processes to bill and collect from research sponsors.  
Clarity on who is responsible for emergency room charges arising from side effects from the study drug or device and build appropriate processes to handle those charges.

Most of the processes and procedures in this workflow are interrelated and dependent on one another. Our project might include a comprehensive review of all the written organizational policies and procedures in place. We may also validate that the workflow conforms to those policies and procedures. This would likely entail performing tracers on a sample of enrolled subjects and/or services. We would choose a sample (based on our well-defined project plan) and use appropriate subject matter experts, determine whether the bills for services rendered were appropriately categorized and billed. Based on our outcomes, we would consider what, if any, corrective action is necessary.   

During the execution phase, you’re making sure all these plans are working together as you envisioned and supporting and adapting as needed. 

Monitoring 

Project monitoring needs to occur during all phases of the project lifecycle. Proactive and ongoing monitoring and periodic checkpoints allow you to identify issues, resource constraints, and risks arising which have the potential to derail your project timeline, budget, and deliverables. Continuously keeping tabs on the project may enable you to identify tasks that need to be revisited or reallocated. It can provide visibility into whether added resources would keep the project timeline intact or whether adjustment is needed to the budget and/or schedule. Ongoing communication between and among members of a project team is imperative and can prevent unpleasant surprises down the road.     

Let’s say you are helping your facility-based radiology departments comply with applicable Appropriate Use Criteria (AUC) requirements for advanced imaging services provided to Medicare beneficiaries. You should receive information from each ordering practitioner about which Clinical Decision Support Mechanism (CDSM) they consulted and whether the order adheres to the AUC. Each claim for these services must include data about the CDSM consult and have a modifier appended. This seems like a pretty simple project, but there are quite a few other things to consider, such as: 

Do you have or need a policy or procedures for AUC?
What happens when you receive an order for an MRI for a Medicare beneficiary, but the CDSM info is missing or incomplete? 
What are you doing when the CDSM consult shows that the ordered service does not meet AUC? 
What if the patient has Medicare as a secondary payor source?
Where is the CDSM consult documentation being stored? 
Is the consultation information integrated into the patient medical record? 
Do you have a process to identify any outliers within your ordering community?  
If so, what are you doing about it? 
What plan is in place to ensure readiness for the AUC penalty phase?

Address these questions through ongoing monitoring and communication with the project team. That way you can spot issues and adjust as you go. You can also deliver a more robust report at the end of the project because you’ve been in the details with the team. 

Closure  

For every sizable project, consider holding a closure meeting with all involved and affected stakeholder groups. This gives the team a chance to process their experience and build on learnings for next time. You also can recognize and celebrate the end of a job well done. Present findings, opportunities, and corrective action recommendations. Speak candidly about what went well with the project and what didn’t. Keep the minutes of that meeting if it is appropriate to do so. Use what comes out of this closure conversation to improve outcomes and deliverables for your next project.   

Having appropriate controls in your project closure process in place is imperative. Ensure all parties understand who is responsible for creating and retaining project files and any supporting documentation. Know what your enterprise policy is relative to the retention of the project evidence. Have a control process in place to validate that all evidence is appropriately stored or archived. Last, ensure that the project artifacts and materials are adequately safeguarded so people can find them when they need them.   

Your success as a manager of projects directly affects your overall effectiveness as a compliance officer or professional. As a compliance officer, you undoubtedly manage a multitude of simultaneous projects of different scope, size, and duration. It isn’t always easy, but it is worthwhile to continuously evaluate your project management methodologies and look for ways to enhance your skill set.    

Effective project management is rarely done without supportive tools and resources. YouCompli can help you manage your regulatory change management projects, engaging your stakeholders, providing sample materials, and showing you the status of every regulatory change. Learn more. 

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Sign up for our newsletter and explore other trending posts

The Why, What, Who, and When of Healthcare Risk Assessments

Sharon Parsley, JD, MBA, CHC, CHRC — Tue, 06 Jun 2023 16:30:15 +0000

An effective compliance program requires risk mitigation.

Sharon Parsley, JD, MBA, CHC, CHRC contributes a regular post on compliance officer effectiveness for the YouCompli blog. In this article she discusses risk assessment strategies for success.

Risk assessment has not traditionally been considered a core element of a compliance program. However, regulators have made it increasingly clear that they do consider your ability to address and mitigate business risk to be part of an effective compliance program. This change in perspective is evident in the March 2023 updates to the Department of Justice (DOJ)’s Evaluation of Corporate Compliance Programs guidance. As the DOJ unpacks its expectations about each programmatic element, it keeps coming back to risk and risk assessment. So it’s important for us as compliance officers to take note.

In today’s article, I will discuss risk assessment from a “why, what who, and when” perspective. I will also look at ways that you, as an effective compliance officer, can lead this process with your colleagues.

First, a definition: a “risk assessment” can take a lot of forms. The most common definition is that it is the “systematic process of evaluating the potential risks that may exist in an organization.” Your organizational risk profile will be as unique as your business, but should, in any event, catalog your specific regulatory and legal, privacy, cybersecurity, physician relations, and other compliance risks.

Why conduct a risk assessment?

There are a wide variety of reasons why a comprehensive and well-designed risk assessment should be periodically performed. In terms of benefits, risk assessments:

Increase the likelihood that misconduct or noncompliance in higher-risk areas will be identified in a timely manner.
Help you meet the requirement to comply with the Federal Sentencing Guidelines and OIG Compliance Program guidance.
Increase the likelihood that the DOJ would deem your compliance program effective. That, in turn, decreases the possibility of enforcement actions and the imposition of external monitoring requirements, and reduces exposure to imposed fines and sanctions.
Position your program more proactively. This is preferable to you having to be reactive or appearing disconnected from the business.
Enables Compliance to thoughtfully consider how to allocate resources for best outcomes and aids in development of work plan activities.

I have also found that a solid risk assessment program helps a dynamic compliance program get better over time. That’s because risk assessments enable you to incorporate “lessons learned” into your risk mitigation strategies in a timely manner.

The DOJ’s 2023 memo tells us that a compliance program cannot be considered effective unless the company has “identified, assessed, and defined its risk profile.” That guidance goes on to discuss at length various expectations in this arena including that:

The compliance program is specifically tailored, based on identified risks.
The company allocates resources to higher risk areas.
The risk assessment incorporates ongoing review of new risks.
The risk assessment is dynamic and incorporates lessons learned.

The Office of the Inspector General (OIG) is putting out similar signals.

What is the process for risk assessment in healthcare?

Many organizations take a holistic approach, bringing relevant stakeholders together to identify all the risks that could affect their operations. This includes legal, regulatory, compliance, cyber, reputational, strategic, business, financial, and market risks. Other areas you may need to consider include privacy and handling of protected health information, environmental, disaster recovery and business sustainability issues, corruption, process risks, employee behavior, and patient and workforce safety risks. Risk assessment is often viewed as a process involving the following five stages:

Identification
Ranking
Prioritization
Development of work plans and mitigation strategies
Results, action plans, and monitoring of those risk mitigation activities.

Methods of risk identification might include conducting interviews and surveys, mining data, and reviewing salient documents. Ranking and prioritization are, at least in my mind, inter-related concepts. You might create a heatmap wherein you gather input about the likelihood of a risk occurring and the possible impacts to the organization should the risk arise. From there, you will plan to allocate needed resources to specifically tailored activities designed to measure and mitigate the risks deemed most significant to your business.

Regardless of your chosen methodology, make sure that it is well documented. There may be instances where one or more high priority risks are identified but insufficient resources exist to examine every one. In such a case I have found it useful to track each individual risk, even if no action can or will be taken to mitigate it in the current risk assessment cycle. The identified items without current action might warrant being at or near the top of the list for the following year.

Who needs healthcare risk assessments and who conducts them?

Every healthcare provider participating in a federal healthcare program should conduct an enterprise-specific, periodic risk assessment. Obviously, that will look considerably different for a large academic medical center or a health system offering a full spectrum of inpatient and outpatient care than it will look for a small physician practice. The key here is to engage the appropriate stakeholders and to calibrate your risk assessment processes to the risks that are central to your lines of business and geographic footprint.

From an internal perspective, the “who” should also be considered. Is it most logical and effective for Compliance to conduct a stand-alone assessment of compliance risks only? Or would it be more effective to examine risks applicable to your operations from a more holistic enterprise-wide perspective? Presuming your organization requires a holistic approach, which stakeholders should you include in your process? In addition to Compliance, consider including internal audit, legal, operations, risk management, human resources, and sales and marketing.

If it is practical for your organization, using a team-based approach to risk assessment can be very beneficial. Doing so makes it easy to create an inventory of identified risks and the rationale for how and why those risks are ranked and prioritized. More importantly, you can readily articulate the agreed-upon methods to measure and mitigate high ranked risks and to document the lower priority risks that may not receive current year attention.

Worth note is that publicly traded companies will need to comply with Sarbanes-Oxley requirements, so an enterprise risk assessment following COSO (the Committee of Sponsoring Organizations of the Treadway Commission) framework or similar is mandated. For privately held organizations there is no “one size fits all” solution or method for risk assessment. I have seen various approaches over the course of my career, some of which were extremely structured and well-designed. Other risk assessments were conducted in a fairly informal manner but were, nonetheless, largely effective in at least identifying key areas of risk.

When should you conduct a risk assessment?

It is widely considered the best practice to conduct your formal risk assessment annually. With that said, the ideal risk assessment is really an open-ended cycle. By regularly looking at your risks, you are better able to identify all newly arising or emerging risks.

I have frequently seen risk assessments initiated simultaneously with an annual budget cycle. So, for anyone operating on a calendar year basis, your risk assessment would likely commence during the third quarter of the year. Timing would, of course, be adjusted for anyone operating on a fiscal year basis.

Ideally, you will complete your risk assessment prior to the end of your budget cycle in case departments need to request additional resources. Additionally, your annual compliance work plan will at least in part be derived from your risk assessment. As you would traditionally have both your Compliance Committee and your Board approve the annual work plan, you may need to work backward from committee and board meeting dates to develop a calendar for all of the activities that will need to be completed within your risk assessment cycle.

Get Started with a Risk Assessment Process

If you’re trying to decide how to start with risk assessments, remember that, like with exercise, something is better than nothing. Start small to build allies and champions if that’s what it takes. If your colleagues wonder why Compliance is leading the process, you can educate them about the role of compliance. That is, one of your roles is to find and identify areas of misconduct. Without a firm understanding of where misconduct is most likely to occur within your enterprise, you can’t be completely effective in your role. The risk assessment process is the path to understanding your specific areas of risk, the likelihood of each risk arising, and the impacts in and when it does. Remember that you’re helping the organization overall, and you absolutely belong in that process.

Download our White Paper on Risk Assessments Below

YouCompli can help manage risk

YouCompli is the only healthcare compliance management software that includes baked-in legal analysis and expert tools. This combination of regulatory intelligence and simple software helps healthcare organizations manage risk and reduce the impact of regulatory changes.

Get the latest from healthcare compliance experts

We typically send one email a week. We focus on issues that help healthcare compliance professionals today. We do not rent or sell your information.

The post The Why, What, Who, and When of Healthcare Risk Assessments first appeared on YouCompli.

Healthcare Compliance is Everyone’s Business: Legal, Internal Audit, Human Resources and Quality

Sharon Parsley, JD, MBA, CHC, CHRC — Wed, 17 May 2023 16:44:03 +0000

Build relationships across risk assurance functions.

Sharon Parsley, JD, MBA, CHC, CHRC contributes a regular post on compliance officer effectiveness for the YouCompli blog. In this article she discusses relationships and collaboration with other key risk assurance functions.

What does it really take to ensure that an organization has a mature, well-integrated, and high-performing Compliance function? In my experience, the effectiveness and perception of your compliance program directly correlates to how you build and sustain relationships with others. In a previous article, I discussed relationships with operational areas such as Nursing Revenue Cycle, and IT. In this piece, I will focus on relationships and collaboration with other risk assurance areas.

Here are suggestions on how to effectively build relationships and collaborate with Legal, Internal Audit, Human Resources, and Quality. Every organization approaches these functions a bit differently, so you’ll want to apply your own situation to my suggestions.

Legal

Your Legal team advises the enterprise on matters of legal and regulatory risk and, when necessary, defends the organization. The essential objective of a Compliance program is to prevent, detect, and resolve misconduct. On the surface, those have always struck me as very bright line distinctions. In reality, the lines often blur. Collaboration between your two groups is critical, but collaboration is very different than blurred lines. When the two teams don’t know what they own versus where they need to collaborate, interdepartmental cooperation and your outcomes will suffer.

So, what do we do about that? The first step may be having a clear, concise, enterprise-specific charter for Legal and Compliance. That charter will be unique to your organization, but it should set forth very clear expectations for cooperation between these two essential risk assurance functions. Here are some questions to consider in the charter: Do you need Legal buy-in to engage an independent subject matter expert? Can you engage outside counsel without input from your internal Legal team?

Let me give you an example. Physician contracting is an area of considerable risk for most hospitals and health systems. As a result, role clarity is imperative. Hopefully, both Compliance and Legal are involved in your contract approval processes. Within that collaboration, who examines financial relationships to ensure conformity with self-referral and anti-kickback regulations? Who has the duty to look at aggregate compensation to ensure it is within fair market value when a provider or group has multiple contracts?

Use topics like physician contracting to facilitate discussion about your charter. You and your colleagues in Legal should evaluate the charter periodically. When you update it, present it to your board or board committee for approval.

I have typically found it effective to schedule a recurring meeting between Compliance and Legal leadership. Using that time to brief Legal about key Compliance issues and proposed corrective action plans has always been beneficial. It’s incredibly helpful to establish a constructive working relationship with Legal during calm times, so we can work together better when the sky is falling.

Internal Audit

The Department of Justice (DOJ) emphasizes the importance of the relationship between Compliance and Internal Audit (IA) throughout its guidance on corporate compliance program effectiveness. Specifically, when the DOJ makes charging decisions and determines the need for monitoring, the examiners consider whether adequate control testing was done to identify areas of misconduct.

Key areas to consider here are whether Compliance is routinely informed about material findings from IA control testing. IA often assesses what is happening in practice against what a policy or procedure says should be happening. That intersection of policy non-adherence and internal control deficiency should be of interest to Compliance. There may be instances when it makes sense for Compliance to partner with IA to develop corrective action plans to address such findings.

IA may perform operational, financial, and information technology audits enterprise wide. This team is typically charged with ensuring that financial records are fair and accurate. They also examine key processes and systems to improve productivity and efficiency. Lastly, IA may audit operating systems, databases, and IT infrastructure.

I once worked with an IA team that completed an operational audit of research billing processes. That audit identified several material process issues. I collaborated with IA and various operational teams to develop a suitable corrective action plan (CAP). We ended up having to hold all billing for encounters involving research-related services while the CAP was implemented. We further identified overpayments and developed a plan to refund. Then we crafted a multi-phase monitoring and testing plan to ensure the CAP had addressed all the findings. The process and outcomes of this audit and CAP illustrate the close, collaborative work the DOJ wants to see when evaluating compliance program effectiveness.

Human Resources

Human Resources (HR) is a natural partner for Compliance. Both departments care deeply about sustaining organizational culture and shaping a climate of ethical conduct. HR very likely interfaces with every employee and contractor throughout the employment life cycle. Put in the time now to talk through how you’ll work together to help the organization hire compliance-minded employees, train them throughout their tenure, and offboard them when it’s time for them to leave. Here are some areas you can focus on in your conversations:

Pre-employment screening: Who is doing your sanction checks? What happens when a possible match is identified? Who makes decisions about exceptions in the hiring process?
Interviewing: How do you communicate your compliance culture in the interview process? How do you ensure you’re hiring compliance-minded people, especially at the leadership level?
Compensation: How is compensation for newly employed providers determined and how is fair market value (FMV) established and documented?
Onboarding: How does HR embed compliance and Ethics in the onboarding process? Does Compliance have an opportunity to speak with every onboarded employee? How are new hires trained on the Code of Conduct and how to report concerns?
Training and Education: Is Compliance training embedded in ongoing training and education? How often is your training curriculum refreshed?
Annual reviews and compensation: How are instances of non-compliance considered in the annual review process? If a leader has ongoing compliance issues occurring within another department, does that affect that leader’s review and compensation? How is FMV considered in ongoing provider compensation? (Related: Shawn DeGroot on recent DOJ guidance for compliance-related incentives)
Investigations: How do you collaborate on investigations of reported concerns that apply to HR and Compliance? Who makes recommendations and decisions about disciplinary action arising from substantiated compliance violations? How are investigative materials archived? Do certain issues carry over into an employee’s HR file?
Exits: How do you ensure timely cutoff of systems access? What conversations do you have with people to see how the culture affected their decision to leave? When leaders leave, how do you ensure their compliance-focused work is ready to transition to their successor?

I worked in one organization where an IA audit found that IT systems access for exiting employees was not being terminated in a timely manner. Obviously, this was a considerable risk for that enterprise. In fact, some former employees had access to sensitive and proprietary corporate data and patient-specific information. I worked with HR, IT, and other needed stakeholders to mitigate that risk. We developed automation to disable each exiting employee’s access rights at midnight on his/her last day of employment. If IA had been operating in a vacuum or tried to solve the problem on its own, we wouldn’t have had such an elegant solution, and the risk would have remained.

Quality

The central mission of Quality is to standardize systems and processes, so the organization delivers repeatable and efficient outcomes and the highest quality patient care. Compliance also routinely measures standardization and adherence to existing policy and process. At this fundamental level, there is tremendous synergy between the two functions.

Acute care hospitals are required to participate in the Hospital Inpatient Quality Reporting (IQR) program. Quality is typically involved in the gathering, synthesis, and reporting of those required IQR process and outcome measures. When the reporting of any quality measure directly affects how your organization delivers a high-quality patient experience and gets paid, Compliance needs to be attuned.

Compliance can, of course, play a key role in ensuring that IQR program data is accurately reported. You can accomplish this through ongoing or periodic reviews of the processes through which Quality gathers and reports IQR measures. IQR outcomes affect governmental reimbursements, so issues identified in IQR measure reporting can result in overpayment liability.

Care is delivered by humans. At times, things go wrong. When a care event results in patient harm, Compliance can also be a key partner to Quality and others in mitigating possible legal and reputational risks to the enterprise. Compliance can verify whether internal policies and procedures were followed. Compliance can also take steps to ensure that any necessary external reporting is accurate and timely. Lastly, Compliance can ensure that care which directly results in patient harm is not billed.

Building and Maintaining Relationships Across Healthcare Departments

The most successful and respected Compliance officers I know have been great at building and maintaining relationships with others. No program can be effective in a vacuum. The more you invest in learning about the top priorities of other risk assurance leaders, the more you increase your understanding of your organization. An amazing byproduct of that is that other risk assurance leaders will become ambassadors for Compliance, thus expanding your reach into all levels of the enterprise.

How YouCompli can help

Use YouCompli to give yourself time back to focus on relationships and listening. Build a scalable, repeatable change management process to enable your team and colleagues to focus on their expertise rather than the minutia of monitoring and reading regs.

Never miss an article about compliance officer effectiveness – register to receive emails from YouCompli.

The post Healthcare Compliance is Everyone’s Business: Legal, Internal Audit, Human Resources and Quality first appeared on YouCompli.

Preparing for the End of the Public Health Emergency

Sharon Parsley, JD, MBA, CHC, CHRC — Wed, 29 Mar 2023 20:44:51 +0000

CMS Updates to beneficiary PHE waivers that matter to healthcare compliance

Sharon Parsley, JD, MBA, CHC, CHRC, contributes regularly to the YouCompli blog. In this article, she discusses several issues that hospitals and health systems need to consider as a result of the scheduled end of the COVID-19 public health emergency.

The U.S. Department of Health & Human Services (HHS) reports that 80% of the U.S. population previously received at least one COVID-19 vaccination. HHS also advises that daily COVID-19 cases are down 92%, and that COVID-19 related deaths are down more than 80% since the peak of the January 2022 Omicron variant surge.

As a result, the COVID-19 public health emergency (PHE) declared under Section 319 of the Public Health Service act, is expected to end officially on May 11, 2023. HHS made this announcement on February 9, 2023, along with the publication of a transition roadmap.

During the PHE, the Centers for Medicare and Medicaid Services (CMS) relied on emergency authorizations, waiver authorities, regulatory processes, and sub-regulatory guidance to create numerous waivers and flexibilities. These were designed to expand access to care and to create additional healthcare capacity to optimize care for COVID-19 positive patients. CMS has also issued guidance detailing which waivers and flexibilities will continue and those that will end with the expected end of the PHE.

The remainder of this article will summarize the waivers that hospitals and health systems should be mindful of and address. (Find the details here: Hospitals and CAHs (including Swing Beds, DPUs), ASCs and CMHCs: CMS Flexibilities to Fight COVID-19. Finally, note that these issues are specific to Medicare and Medicaid beneficiary patients only.

PHE Waivers Ending in May 2023

The following waivers will end in May 2023:

The waiver of the requirement for a medically necessary 3-day prior inpatient hospitalization for Medicare coverage of a skilled nursing stay.
Blanket waivers of various provisions of the Stark Law for financial relationships and referrals directly related to the COVID-19 PHE. As a result, all health entities and physicians will be expected to unwind or restructure any relationship that doesn’t fully comply with an applicable Stark Law exception.
The “hospitals without walls” waiver, which enabled hospitals to provide bed and board, nursing and other hospital services at hotels, malls, and other community facilities.
The waiver permitting hospitals to create new or relocate existing provider-based departments (PBD) without regard to applicable Conditions of Participation (CoPs) and PBD requirements. Additionally, the “extraordinary circumstances” PBD relocation policy established in May 2020 will end. The expectation is that most PBDs that relocated during the PHE will return to their original locations.
Many waivers of CoPs requirements will end. Those include:
Flexibilities regarding detailed discharge planning requirements.
- Allowing a 48-hour period to authenticate verbal orders.
- Allowing up to 30 days post-discharge to complete medical records.
- Waiver of the requirement that a hospital has an approved utilization review (UR) plan and a UR committee to evaluate admission and services, medical necessity and length of stay.
- Flexibility allowing used face masks to be removed and reused in sterile processing compounding areas.
- Waivers of certain quality assessment and performance improvement (QAPI) program requirements.
- Flexibilities regarding patient-specific nursing care plans.
- Waivers about facility policies and procedures for outpatient departments not requiring the continuous presence of a registered nurse.
- Allowing Medicare inpatients to be under the care of a physician’s assistant or nurse practitioner (rather than a physician).
- Permitting physicians whose privileges would have expired and new physicians to practice prior to full medical staff and board approval.
- Flexibilities in federal requirements for minimum personnel qualifications for clinical nurse specialists, nurse practitioners, and physician assistants.
- Flexibilities about written designation of personnel authorized to perform respiratory care procedures and how those services are supervised.
- Waivers relating to emergency preparedness plans and therapeutic diet manuals for surge capacity sites.
Flexibilities permitting hospitals to establish offsite community COVID-19 screening locations.
Flexibilities that allowed select hospital employed professionals to provide infusions, wound care, behavioral health care and education services, including partial hospitalization, to Medicare beneficiaries in their homes.
A waiver that permitted a hospital to register beds as skilled nursing swing beds for Medicare patients needing a step down from acute care to a skilled nursing bed.
Waivers of certain requirements that permitted acute care hospitals to bed inpatients in excluded distinct part units (DPU). Conversely, waivers allowing hospitals to place inpatient psychiatric and inpatient rehabilitation patients who would normally be admitted to a DPU in an acute care bed unit will also end.
Additional payments for approved drugs and biologicals to treat COVID-19 in a hospital outpatient setting during the PHE will be packaged into the primary Comprehensive Ambulatory Payment Classification payment. After the PHE, no separate payment will be made.
Payment for temporary HCPCS code C9803 (hospital outpatient clinic visit specimen collection for severe acute respiratory syndrome coronavirus 2 (sars-cov-2) (coronavirus disease [covid-19], any specimen source).
Each Medicare Administrative contractor will have discretion about coverage of FDA authorized COVID-19 diagnostic serology testing.
Certain waivers of eligibility requirements for sole community hospitals and Medicare-Dependent Small Rural hospitals.

PHE Waivers that Last Beyond May 2023

The end of the PHE doesn’t mean the end of all waivers. Here are some that survive, at least for a while:

Many telehealth flexibilities have been extended through December 31, 2024, pursuant to the Consolidated Appropriations Act of 2023.
Payments for COVID-19 vaccinations administered to Medicare beneficiaries in outpatient settings will continue to be approximately $40 per dose. These payments are tied to the end of the emergency use authorization (EUA) for COVID-19 drugs and biologicals.
Payment for vaccinations administered in a Medicare beneficiaries’ home will remain at approximately $76. This amount will be adjusted annually and is not tied to the end of the PHE.
Pursuant to section 3710 of the CARES Act, enhanced payments to hospitals for the care of eligible inpatients requiring products authorized to treat COVID-19 will end at the end of the fiscal year in which the PHE ends.
Medicaid programs will continue to cover COVID-19 testing without a patient cost-sharing obligation until at least September 30, 2024.
Hospitals’ COVID-19 data reporting requirements will continue through April 30, 2024; however, the reporting frequency is likely to change.
Rulemaking will occur to adjust policies which currently allow DEA-registered practitioners to dispense controlled substances via telemedicine with no prior face-to-face encounter.

Recommendations and Next Steps

Obviously, hospitals are facing a LOT of regulatory change as they unwind all these waivers quickly. While in some cases you and your colleagues are reverting to business as usual, many of your colleagues may barely remember pre-pandemic practices.

If you have a joint commission readiness team, work with them to tackle the CoPs waivers and come up with a game plan to address each applicable issue. Look to your internal compliance committee to take on some or all other waivers. They can also help you identify individuals best able to create and implement action plans for those that require attention.

Your operational colleagues should be prepared to address the waivers tied to specific service lines.

Regardless of approach, compliance needs to be at the table to support, assist, and advise on how to efficiently deal with the policy, process, contractual, and operational changes that may be necessitated by the end of these waivers.

Related: Wondering how to get your seat at the table? Check out Lisa Herota’s article, Transforming Compliance to a Department of Yes

This summary is not a comprehensive analysis of every waiver or flexibility change for hospitals, but it does give you a sense of some of the most critical waivers to watch for. Be sure to review the fact sheets I linked to from CMS. If your organization is not a hospital or healthcare system, be sure to review the CMS guidance for other provider types.

Help Working with Operations

YouCompli subscribers can manage tasks and activities related to the end of the public health emergency with our workflow tool. Compliance can send notifications of regulatory changes to operations. Our solution enables the right people in the right departments to update policies and procedures as well as monitor the progress of the required changes. The YouCompli dashboard, embedded in our verify feature, enables Compliance to monitor the process and verify that the work gets done by the deadline. Find out how.

The post Preparing for the End of the Public Health Emergency first appeared on YouCompli.

Healthcare Compliance is Everybody’s Business: Clinical, Revenue Cycle, IT, Sales and Marketing

Sharon Parsley, JD, MBA, CHC, CHRC — Wed, 14 Dec 2022 20:46:36 +0000

Build relationships with key clinical and operational areas

Sharon Parsley, JD, MBA, CHC, CHRC contributes a monthly post on compliance officer effectiveness for the YouCompli blog. In this article she looks at specific ways to engage and communicate with Nursing, Physicians, Sales & Marketing, Revenue Cycle, and IT.

Many people in our discipline love the slogan “compliance is everybody’s business.” As a practical matter though, how do we make that a reality within our organizations? With limited budgets, perpetual resource constraints, and a constant need to “prove” our value to the enterprise, one way to maximize our reach and influence is by building strong relationships with key clinical and operational areas of our organizations.

Nursing and Healthcare Compliance

Nursing represents the largest team in many healthcare organizations, so we must build strong relationships here. In an inpatient setting, nursing is going to be a 24×7 business. That means you have to find ways to raise compliance awareness for nursing teams who work 7pm to 7am weekend shifts, not just those who work during business hours. Consider scheduling periodic weekend rounding on different units. You could also publish a weekend open forum or office hours schedule and encourage your nursing team to stop by for a quick coffee. Given the intensity of nurses’ workday, keeping your messaging concise, specific, and relevant is imperative.

Meet regularly with nursing leadership. This will help you understand the key issues facing them. I find that the more time I spend with colleagues during times of relative calm, the better our work together goes when an issue does arise. If a policy change results in a need to alter nursing processes or procedures, work closely with nursing leaders to develop communication plans and methods to monitor adherence to the process change at issue.

Physicians and Healthcare Compliance

I’ve seen a very broad spectrum of relationships with physicians and licensed independent practitioners (LIPs) over the past 20 years. I bet you have too. For me, that spectrum has ranged from positions of trust and mutual respect, to begrudging acceptance, to a few that bordered on being openly hostile. Nonetheless, we have to work together. And in contentious relationships, it is usually on me to find a way to smooth things out.

The practice of medicine has, largely, become more business than science, but few physicians really enjoy being told what to do or how to practice. Who can blame them? How can we get them to comply without being perceived as adding to their administrative burden? That answer will vary depending on the nature and size of your organization but try starting small. Finding just one physician who is willing to truly champion compliance to his or her peer group can be pivotal to the success of your compliance reach into your physician and LIP ranks.

Related: Investing time with clinical and operational colleagues improves relationships

For me, that has sometimes been the Chief Medical Officer or a physician CEO who really understood what I was trying to do. On other occasions, though, it has been practitioners who have stepped over a line or cut a few corners which resulted in a compliance issue. In several of those circumstances, once an issue was brought forward that practitioner collaborated with me to prospectively modify the behavior in question. In the process, they became compliance champions.

Seize every opportunity to demonstrate that compliance is not the police. We are trained professionals tasked with protecting the organization from risk and supporting the mission of providing excellent patient care. Yes, a big part of that is preventing, detecting, and remedying misconduct. But we also identify opportunities to improve processes based on regulatory guidance and we can help protect revenue and income. Help your physicians and LIPs understand your mission and how it can complement their oath to do no harm.

Sales and Marketing Healthcare Compliance

Sales and marketing in healthcare is, as we all know, unique. In most industries, treating a prospect to a nice evening meal, hosting him or her for a round of golf at your country club, or inviting the prospect to a local sporting event is not only permissible, but common. In healthcare, however, those same activities can potentially run afoul of federal and state laws.

If you are in the medical device or pharmaceutical space, your industry groups have published codes of ethics that create some boundaries for what sales and marketing can and cannot do. For most of the rest of us, we usually attempt to distill the applicable law and regulation into policies. Understanding and articulating the Stark law and its exceptions and the Anti-kickback law and its safe harbors is tricky. Your sales and marketing teams are not likely to be well versed on these regulatory issues and how they may limit certain activities.

Meet with them regularly and offer an onboarding tailored to new sales and marketing department personnel. As much as possible, offer specific examples of what is ok, what is not, and the “why” behind each category. Can your sales team provide lunch for everyone working in a community physician’s office? If so, does some portion of that then need to be included in a Stark non-monetary compensation tracking tool? Does the answer change if it is a lunch-and-learn? Can your marketing team sponsor a mall walker program? If so, can they provide a step counter to enrollees in the program? Can marketing give holiday gifts to physicians? If so, is it non-monetary comp that must be tracked, a medical staff incidental benefit or neither? Providing specific examples tailored to your enterprise helps raise awareness.

Revenue Cycle and Healthcare Compliance

Nurturing a strong partnership with your revenue cycle team is imperative. Governmental and commercial payers have developed extremely sophisticated data mining programs that often identify coding and billing aberrations even before we find them internally. Understanding how to distinguish coding-specific payment denials from medical necessity denials is an important skill. Those issues can help with early identification of localized and more systemic issues.

Everyone in our discipline is likely aware of the possibility of “reverse false claims” liability. Here, any overpayment from a governmental payer source must be returned within 60 days of its identification. If it is not, the organization can be assessed penalties and be responsible for treble damages. Establish a regularly scheduled meeting among compliance and revenue cycle to discuss areas of vulnerability, patterns of denials, and emerging areas of revenue integrity risk.

Information Technology and Security

Information technology and information security departments are instrumental in protecting the organization’s data assets. Ransomware, phishing, and cyberattacks are in the news frequently now that hackers have targeted the healthcare community. Virtually all healthcare companies deal with some subset of data which contains protected health information or PHI. Here is one major area where compliance and IT functions may overlap. As your IT group develops strategies to mitigate cyber risk, your privacy function should be involved to ensure that all applicable federal and state privacy laws and regulations are considered. If your organization maintains student health records, you may also need to ensure that FERPA regulations are understood and heeded. If credit card data is used and stored, there are likely PCI requirements that need to also be incorporated into these tactics and strategies.

IT often recommends the adoption of certain tools and technologies that impact your electronic medical records. Compliance needs to be part of the evaluation committee for new products to ensure that PHI is properly identified and safeguarded. If your organization conducts an annual risk assessment, this is one area for close collaboration between Compliance and IT. Risk assessment processes vary greatly from one organization to another. Understand new and emerging areas of cyber risk and what issues are “top of mind” for your IT and data security teams. Based on those risks, you can develop targeted training and education and build auditing and monitoring activities to identify potential issues and mitigate risks.

The more you can help your colleagues across departments see how you help them achieve their goals, the more invested they will be in compliance. The investment of time and collaborative energy on your part will pay off in a more effective compliance program, better overall patient experience, and revenue protection for the organization.

How YouCompli can help

Never miss an article about compliance officer effectiveness – register to receive emails from YouCompli.

The post Healthcare Compliance is Everybody’s Business: Clinical, Revenue Cycle, IT, Sales and Marketing first appeared on YouCompli.

Can I hear you now?

Sharon Parsley, JD, MBA, CHC, CHRC — Wed, 16 Nov 2022 15:14:46 +0000

Strengthen your listening skills to improve your effectiveness as a healthcare compliance officer

Sharon Parsley, JD, MBA, CHC, CHRC’s writes a monthly series on compliance officer effectiveness for the YouCompli blog. This post covers different listening styles – a critical consideration for the various situations compliance officers work through.

Most of us have had the experience of preparing for an important conversation or interaction, only to leave it feeling defeated, misunderstood and not even really heard. Can you think of a person in your life who, regardless of the topic, always manages to steer the dialogue so that it is all about him or her? Now think about the detrimental effect that feeling can have on the trust you need to build in your healthcare relationships.

Fortunately, being a better listener is possible. In this article, we will examine a few of the main types of listening discussed in detail here 7 Types of Listening That Can Change Your Life and Work (betterup.com).

1. Discriminative Listening:

Pay attention then adapt to your audience when speaking to healthcare leaders

Say you are conducting a one-hour live training for a large group of physicians. Ten minutes into the hour you see that most of them are glued to their cell phones or whispering to each other, and only a few appear to be giving you their full attention. This is a tough situation to find yourself in, but what would you do? Soldier on with your scripted remarks? Embarrass a member of the audience by calling him or her out?

2. Sympathetic Listening

Connect with colleagues to deepen relationships

Betterup.com describes sympathetic listening as hearing behind the spoken words to understand the emotions of the speaker. This listening style can deepen your human connection with the speaker as she or he is more likely to feel heard, valued, and validated.

During the early days of the pandemic, I had numerous interactions with patients and their family members. Some of those conversations were initiated due to patient safety or quality of care concerns. Others were about privacy or another compliance matter. What was universally true in every one of those conversations is that the person I was speaking with was scared. Scared that we were fighting an unseen, unknown virus with rapidly changing public health and agency guidance. Scared that they might not be able to say goodbye to their spouse of 50 years because their spouse was in the Covid ICU and had been intubated during the night. Or maybe they were scared because the discharge instructions that an exhausted ER nurse handed to the wrong patient contained sensitive information about their terminally ill child.

3. Empathetic Listening

Connecting with compassion for your colleagues

During the course of the conversation with your team member, you learn that her spouse lost his job a few weeks ago, and that they are caring for a parent who has Alzheimer’s disease in their home.

Should she have alerted you to the possibility of missing a key deadline? Of course. However, you can also tell that she is frightened about now being a single income household and exhausted as she is a full-time mom, now part-time caregiver, as well as one of your trusted team members. It is possible to turn that conversation into a more open dialogue and put yourself in her shoes. Missing the deadline still needs to be addressed, but it can be done in an empathetic and compassionate way.

4. Critical Listening

Understand root issues during initial compliance or hotline reports

Finally, betterup.com talks about critical listening skills. This listening skill is imperative to help us analyze complex information. Here, we apply critical thinking skills to aid us in evaluating what is being said. Critical listening is key to problem-solving and handling complex projects.

Imagine getting a hotline phone call at 5:00 pm on Friday from an oncology research assistant. That reporter makes allegations about unsafe lab practices, discrimination, sexual harassment, and says that insurers and patients are erroneously being billed for research-related services. Whew. That is a lot to unpack.

Maybe only the billing allegation falls into your purview. If so, help the caller understand the appropriate reporting channels for the other concerns.
Then, focus attention on the billing issue. You know that research billing is notoriously difficult to get right. You know that your oncology department does a lot of industry sponsored phase 3 research and perhaps some phase 1 and 2 government-funded research.
Maybe you also heard that the individual who was doing Medicare coverage analyses for the oncology research area was recently promoted.

You may have no probability of resolving the concern about research billing without gathering information from a variety of organizational stakeholders. Your application of critical listening skills here, however, might help you to readily understand some possible root causes of the issue and aid you in developing an action plan to investigate the concern.

Better listening hygiene

Give yourself time back to focus on relationships and listening. Build a scalable, repeatable change management process to enable your team and colleagues to focus on their expertise rather than the minutia of monitoring and reading regs.

Never miss an article about Compliance Officer Effectiveness

The post Can I hear you now? first appeared on YouCompli.

Five steps to conduct an effective healthcare compliance investigation

Sharon Parsley, JD, MBA, CHC, CHRC — Tue, 18 Oct 2022 19:02:06 +0000

Get our checklist for effective healthcare compliance investigations

Sharon Parsley, JD, MBA, CHC, CHRC, writes a monthly series on compliance officer effectiveness for the YouCompli blog. This is part two of two covering lessons she learned from healthcare compliance investigations that have not gone according to plan. Part one: Make sure you are starting the investigation off right. Part two: Five steps for conducting an effective healthcare compliance investigation.

You have a report that merits investigation, and you have got the people in place to help you investigate. Now what?

Now, you need to plan your investigation, conduct interviews, close out the investigation and follow up. Basic, right? As always, these are nuanced steps. Here are my five steps for conducting an effective healthcare compliance investigation.

1. Develop a healthcare compliance investigation plan and keep it updated.

It is my humble opinion that even a straightforward issue should have a basic plan to keep its investigation on track. If you have a very visible reporting system, chances are you will have numerous matters that require investigation each year. Having a scalable, repeatable process for investigations will help you address each report methodically.

The plan should discretely lay out the issues, name the involved parties, possible witnesses, and investigators, and should have a preliminary target completion timeline attached. As the investigation proceeds, the plan should be adjusted to include subsequently involved persons and actors. The worst of all outcomes is that a reported issue gets the attention of your senior executives, board, the media or a third-party regulator and your documentation of the original investigation does not accurately or adequately demonstrate the good faith efforts to prove or disprove the allegations. Even if you need to backtrack and create or update the investigation plan mid-course or after the fact, it is often time well-spent.

Some investigations seem so unique that they stay with you years later – there are some where I can still recite the facts, findings, and outcomes. They seem so completely one off that you cannot imagine needing documentation of how it played out.

What I have found over time, though, is that the same or similar issue may resurface months or years in the future. If you have well-organized documentation and a solid document retention strategy, you may save yourself or a successor from reinventing the wheel totally the next time a once-in-a-lifetime issue surfaces. If the plan to investigate an issue today is accessible and clear, it might well serve as a benchmark for evaluation of future issues.

2. Consider both retrospective and prospective elements of the healthcare compliance issue.

Many issues take time to evaluate. Say you are dealing with what appears to be an ongoing and systemic billing issue. If there are actions that can be taken today to mitigate future exposure, as well as demonstrate your good faith efforts to quickly mitigate the ongoing issue, discuss and implement game plan to do that. Sometimes, it may just require education or initiating a quality assurance process. Other times though, you may need to have a difficult conversation. You may recommend putting a bill hold in place or suspending a service until the matter can be satisfactorily resolved. Then consider how to scope out and evaluate any retrospective liability that may exist.

3. Be thoughtful about your investigation interviews.

Entire books have been written on the topic of effective workplace interviews. Do not assume that every potential investigator fully understands how to conduct a fact-based interview. Interviewees are often nervous, reactive, and emotional. They may fear retaliation or retribution. Consider whether to make a video or audio recording of the interview and/or whether to include a witness or scribe in the discussion. If it makes sense to do so, accommodate an interviewee’s request to meet at a neutral location or during non-business hours. Particularly in a 24×7 care setting, be respectful of clinical interviewees’ work schedules. Choose a time when they are most likely to be well rested and able to focus without distraction. This might mean offering meeting times outside of normal business hours.

Most importantly, enter every interview with an open mind. It is easy to rush to judgment or conclusion based on the observations of a single interviewee who comes across as honest and trustworthy. Other interviewees who may not be as polished may still have needed valuable information that could dramatically alter your findings and outcomes.

As for the questions themselves, it is not possible to totally script an interview, but you owe it to yourself and the interviewee to be organized and use the time well. When possible, ask open-ended questions. Particularly near the beginning of the interview, it can be useful to get the interviewee to open up and feel comfortable with you. If you do not fully understand a response, ask for clarification until you do. Restate key points and facts and obtain the interviewees acknowledgement that your understanding is complete and accurate.

While there are times when you need to conduct a follow-up interview, do what you can to minimize the likelihood of that by having a prepared list of questions that you need responses to for every planned interview. If an interviewee becomes overly emotional, angry, or disruptive, consider ending the interview and advise the person that you will reschedule it.

4. Plan your compliance investigation documentation and retention methods.

Every full investigation warrants some type of report of findings. In my experience, most of those are narrative style reports or memorandum (even if it is a file memo). For bigger matters, consider having a trusted counterpart or peer review the investigation package and report of findings to see if they can glean an understanding of what the central issues were and what conclusions were reached.

Often, when we are completely immersed in an investigation, the facts are so embedded in our conscious minds that we presume we will always remember them. Take it from one who was once subpoenaed to testify about a matter years after the fact. Your recall of the specifics will dim over time and may be completely lost due to staff turnover, merger or acquisition, or software or system changes.

All that said, the best investigation documentation becomes useless if you are not able to locate it. There are some excellent issue resolution and management tools on the market today, but you have to implement them thoughtfully. Some tools have robust keyword search technology, location and department search and retrieve functions, and involved persons search capabilities. Ensure that whoever enters each matter into that software understands the importance of populating available fields so that future retrieval is quick and easy.

5. Communication, corrective action, and follow-up for healthcare compliance investigations.

Once you have completed your investigation and drawn conclusions about the merit of the allegations, you need to plan to communicate your findings. Findings and recommendations on big issues may be best cascaded top to bottom. Your board and senior executives may need the first briefings on your findings. Next, you will need to discuss the issues with the appropriate operational leaders. Certain issues may be appropriate to review with front-line personnel. When possible, circle back to the reporter to reiterate your appreciation for bringing the issue forward.

You have done most of the arduous work, and perhaps the reported issues were found to have merit. Maybe you need to deploy department-specific or enterprise-wide education or training. Other issues may require policy and process changes involving multiple departments, shifts, and physical locations. Figure out the who, what, when, where, and how. Then document it and track progress toward attainment. Over time, unfortunately, unpleasant habits can resurface. If feasible, your corrective action plan should account for future checkpoints to confirm that the corrective action taken has become hard-wired behavior.

The way you plan for and conduct investigations has a significant effect on the way the organization perceives and relates to the Compliance function. While we hope major investigations will be rare, the day-to-day handling of reports and your responsiveness to hotline calls can help build confidence in your program and in the organization as a whole. Download my checklist for effective healthcare compliance investigations. It can help you lock in a scalable, repeatable process for your investigations.

Download the Healthcare Compliance Investigations Checklist including the action items to consider at each stage of an effective compliance investigation.

Read Five Tips to Start an Investigation Off Right

A healthcare compliance investigation plan
Retrospective and prospective elements of the healthcare compliance issue
Investigation interviews
Compliance investigation documentation and retention methods
Communication, corrective action, and follow-up

Effective regulatory change management includes expertise, process, and skills for influence. YouCompli can help with your process – freeing up time for you to focus on relationships, influence, and impact.

Take Free RL3M Assessment (Regulatory Lifecycle Management Maturity Model)

RL3M Assessment

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Five steps to conduct an effective healthcare compliance investigation first appeared on YouCompli.

Five tips to start an investigation off right

Sharon Parsley, JD, MBA, CHC, CHRC — Wed, 14 Sep 2022 23:22:25 +0000

The prework to a healthcare compliance investigation

Sharon Parsley, JD, MBA, CHC, CHRC, writes a monthly series on compliance officer effectiveness for the YouCompli blog. This is part one of two covering lessons she learned from healthcare compliance investigations that have not gone according to plan. Part one: Make sure you are starting the investigation off right. Part two: Five steps for conducting an effective healthcare compliance investigation.

Over the course of my career in compliance, I have been involved in hundreds of investigations. Some of them went well and were brought to a logical and timely conclusion. Many of them ended up taking numerous unpredictable twists and turns, but eventually got to a rational outcome. A few of them, unfortunately, were a circus from start to finish.

No doubt we all know the basic steps involved in investigating a known or suspected compliance issue. First is intake, then gather and review relevant documents and information, conduct interviews, assess, and report findings. But we also all know that there is a lot of nuance in that basic outline. Over the next two months I will look at lessons I have learned from investigations that have not gone according to plan. First up: Making sure you are starting the investigation off right.

1. Ensure that you have a clear understanding of the concern before proceeding.

Sounds obvious, right? I have been responsible for investigations that went off the rails early on as the investigator did not clarify the concern adequately to properly scope and plan the investigation. If you do not have adequate information to assess whether the allegation, if factually accurate, represents a violation of law, regulation, or policy, you need to dig further before proceeding. For anonymously reported concerns, you may need to get creative about how you pin down the specifics of the issue. We know that some issues do not require a full and formal investigation. However, every reported concern requires appropriate follow up.

2. Ensure all participating parties understand who is responsible for what.

Every enterprise is unique with respect to departmental and organizational structure. In some instances, Compliance may be considered responsible for issues that are not traditional compliance or ethics issues. In other organizations, particularly in an academic medical setting, ethics issues may have different investigative mechanisms dependent upon who the alleged wrongdoer is.

We have all had those hotline calls (typically occurring at 5:00 on Friday) where the reporter alleges a hostile work environment, provider misconduct, unethical billing practices, or discriminatory employment practices. Reporters may make the same or a similar report to Human Resources, Legal, Risk Management, Compliance, and Operations. Worst case scenarios: no one acts on it – or multiple departments start investigating and form different opinions about the issue.

No matter how the complaint is received, do you know who is responsible for taking it forward? To thoughtfully analyze the issues, and ensure all investigating stakeholders understand what is expected of them?

If your organization is large, consider whether a structured or ad hoc investigation intake committee might be useful. Having an intake committee in place to periodically discuss material issues that have been reported can prevent awkward scenarios which occur when lines of responsibility are blurred, and duplicative investigations are initiated.

For smaller organizations, investigators may only include whoever is responsible for compliance and ethics and whoever is responsible for Human Resources (HR). Even then, collaboration between and among the departments is imperative. If HR is recommending disciplinary action for workplace conduct issues on unrelated matters while you are also investigating a reported compliance concern, a perception of retaliation can arise. This must be managed carefully.

3. Be mindful of confidentiality and requests for anonymity.

Obviously, there are times when a reporter’s request to treat a complaint anonymously cannot be fully observed. Ensure the reporter understands what circumstances may lead to having to divulge his or her identity as early as possible to eliminate surprises.

And make sure every investigating stakeholder group or department knows the enterprise standards for conducting workplace investigations and maintaining anonymity. In some organizations, there is an expectation that the operational leader be made aware when compliance will be investigating an issue in that person’s downline. In others, that notification would not be appropriate.

I have, unfortunately, seen situations when substantive relevant information or key witness observations are improperly destroyed, altered, or influenced by offline conversations with other witnesses. In another instance, a departmental leader carried knowledge of a pending investigation to the involved parties. Lastly, make it clear to interviewees the expectation that the substance of any interview is to be treated as confidential.

4. Communicate with the reporter as much as you can.

Always thank any reporter for bringing forward a concern, even if the issue reported is not one that Compliance has responsibility to investigate. Make a commitment to follow up with the reporter, even if it is merely to advise him or her that the investigation is continuing. Few things can damage the reputation of a Compliance team more quickly than news about a report investigation circulating through “the grapevine,” and that Compliance did nothing about it. You may never be able to divulge whether the reported issue was substantiated, or if disciplinary action was taken, but use every report as an opportunity to educate and help a reporter feel confident that they were heard.

5. Engage needed subject matter experts and gather information.

If you do not have the necessary skill set within your team to adequately review a concern, engage a trusted member of another department or an independent external resource. Your ability to bootstrap expertise on a given issue quickly is part of your success as a compliance professional. But do not let your confidence get you in trouble. When it comes to assessing the need for an investigation and building an investigation plan, be confident enough to say we need help from people with deep expertise.

Data analysis is a great example of the pitfalls of trying to do it yourself. Healthcare enterprises create vast amounts of data every day. That data can be useful in the context of an investigation only if we know how to find, manipulate, and interpret it. That might not be a skill set on your team. If it is not, partner with teams that can create an ad hoc report or analytic tool to assess the complaint. If the allegation is that Dr. Joe bills only level 5 new patient visits, check the data. You can quickly and factually determine if that is a valid issue with the right report. The data will show if Dr. Joe’s billing pattern makes him an outlier from his peer group.

The prework to an investigation can be just as important as the investigation itself.

Download the Investigations Checklist to make sure you answered four key questions before kicking off an investigation.

Read the next article in this series to learn

Investigation planning
Interviewing
Documenting and reporting of findings
Corrective action plan development and monitoring

Register for the YouCompli blog to make sure you don’t miss Sharon’s article next month!

The post Five tips to start an investigation off right first appeared on YouCompli.

Sharon Parsley, JD, MBA, CHC, CHRC » YouCompli

Four Critical Listening Skills for Compliance Officers

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management

Get the latest from healthcare compliance experts

Embrace Your Role as a Healthcare Compliance Project Manager

Initiation

Planning

Execution

Monitoring

Closure

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management

Sign up for our newsletter and explore other trending posts

Trending Posts:

The Why, What, Who, and When of Healthcare Risk Assessments

An effective compliance program requires risk mitigation.

Why conduct a risk assessment?

What is the process for risk assessment in healthcare?

Who needs healthcare risk assessments and who conducts them?

When should you conduct a risk assessment?

Get Started with a Risk Assessment Process

YouCompli can help manage risk

Get the latest from healthcare compliance experts

Healthcare Compliance is Everyone’s Business: Legal, Internal Audit, Human Resources and Quality

Build relationships across risk assurance functions.

Legal

Internal Audit

Human Resources

Quality

Building and Maintaining Relationships Across Healthcare Departments

How YouCompli can help

Never miss an article about compliance officer effectiveness – register to receive emails from YouCompli.

Preparing for the End of the Public Health Emergency

CMS Updates to beneficiary PHE waivers that matter to healthcare compliance

PHE Waivers Ending in May 2023

PHE Waivers that Last Beyond May 2023

Recommendations and Next Steps

Help Working with Operations

Healthcare Compliance is Everybody’s Business: Clinical, Revenue Cycle, IT, Sales and Marketing

Build relationships with key clinical and operational areas

Nursing and Healthcare Compliance

Physicians and Healthcare Compliance

Sales and Marketing Healthcare Compliance

Revenue Cycle and Healthcare Compliance

Information Technology and Security

How YouCompli can help

Never miss an article about compliance officer effectiveness – register to receive emails from YouCompli.

Can I hear you now?

Strengthen your listening skills to improve your effectiveness as a healthcare compliance officer

1. Discriminative Listening:

Pay attention then adapt to your audience when speaking to healthcare leaders

2. Sympathetic Listening

Connect with colleagues to deepen relationships

3. Empathetic Listening

Connecting with compassion for your colleagues

4. Critical Listening

Understand root issues during initial compliance or hotline reports

Better listening hygiene

Never miss an article about Compliance Officer Effectiveness

Five steps to conduct an effective healthcare compliance investigation

Get our checklist for effective healthcare compliance investigations

1. Develop a healthcare compliance investigation plan and keep it updated.

2. Consider both retrospective and prospective elements of the healthcare compliance issue.

3. Be thoughtful about your investigation interviews.

4. Plan your compliance investigation documentation and retention methods.

5. Communication, corrective action, and follow-up for healthcare compliance investigations.

Download the Healthcare Compliance Investigations Checklist including the action items to consider at each stage of an effective compliance investigation.

Read Five Tips to Start an Investigation Off Right

Take Free RL3M Assessment (Regulatory Lifecycle Management Maturity Model)

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management

Five tips to start an investigation off right

The prework to a healthcare compliance investigation

1. Ensure that you have a clear understanding of the concern before proceeding.

2. Ensure all participating parties understand who is responsible for what.

3. Be mindful of confidentiality and requests for anonymity.

4. Communicate with the reporter as much as you can.

5. Engage needed subject matter experts and gather information.

Download the Investigations Checklist to make sure you answered four key questions before kicking off an investigation.

Read the next article in this series to learn

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Get the latest from healthcare compliance experts 

Initiation 

Planning 

Execution 

Monitoring 

Closure  

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  