Abstract
This article outlines practical suggestions that home health care providers can utilize to develop an effective compliance program that meets the standards and requirements. The program model was designed to meet the New York State Medicaid regulations but is easily transferable to other state and federal compliance program requirements. By using these elements, a compliance program can be put in place for other state Medicaid programs providing services in the home care setting. The article is intended to expand the home health care provider’s organizational inquiry into identifying the most salient areas to be considered in the development of the compliance program’s eight required elements. Providers are encouraged to compare existing compliance programs to the required eight elements to assure ongoing comprehensiveness of their existing programs.
Effectiveness is a measure of the ability of a compliance program to produce a specific desired effect or result that can be qualitatively measured.
Introduction
The home health care providers changing compliance landscape has been shifting as if it were built on sand. This leaves many health care providers without sure footing relative to compliance effectiveness. Many providers believe that this shift will be burdensome. Previously, Medicaid home health care providers were under the mandates and stipulations of the United States Federal Sentencing Guidelines. Recently, New York State enacted new Medicaid regulations that require health care providers to adopt compliance program elements that include, but are not limited to, creating written policies and procedures containing a code of ethical conduct accessible by all staff, training all affected personnel, and establishing a culture in the agency that encourages questions and reporting. This new regulatory mandate also includes a stipulation that affects “70,000 providers, which is to be ‘certified’ annually so that they have an ‘effective’ Compliance Program in place.” This plan must be not only developed but also implemented. (Hussar, 2009)
From a broader perspective, what is most notable about the new regulations is their potential to prompt similar actions in other states; that is, acting as a dam breaker event that will encourage Medicaid and even charity regulators in other states to pursue similar regulations. This is particularly the case given both the federal- and state-level emphasis on reducing Medicare and Medicaid fraud and preserving charitable assets and the broader national focus on addressing health care quality issues both as a matter of governance oversight and compliance management.
History
The New York State [NYS] Governor issued Executive Order 140.1, which established the Office of the Medicaid Inspector General (OMIG) as an independent of the entity with the Department of Health in 2006. Their joint mission was “to improve the efficiency and accountability of the NYS Medicaid program by preventing and detecting fraudulent, wasteful, and abusive practices.” (Executive Order, 2006)
The NYS legislature recognized that there was a need to provide a comprehensive approach to compliance and that it needed to be cognizant of a wide variety of provider types in the medical assistance program. The legislation also recognized the need for compliance programs that reflect a provider’s size, complexity, resources, and culture. As a result, the NYS legislative promulgated a new Part 521, entitled “Provider Compliance Programs,” that was added to Title 18 of the Codes, Rules, and Regulations of the State of New York (NYS Comprehensive Code). One major inclusion was that the mandated compliance program be “effective” and include eight mandatory elements that would be needed to have an effective program. Prior to this legislation, affected home health care providers developed and implemented compliance plans pursuant to the seven steps that were part of the Federal requirements pursuant to the United States Sentencing Guidelines. The paradigm shift from seven steps to eight elements has stunned a significant number of providers and left them without sure footing as to the conformity of their existing compliance program.
The Office of the Medicaid Inspector General (OMIG) published final regulations for the New York State Provider Compliance Program on June 24, 2009. These regulations indicate that an acceptable Compliance Plan (i.e., one meeting the regulations) must include the following eight elements:
Written policies and procedures;
Designation of a compliance officer;
Training and education;
Communication lines;
Disciplinary policies;
Routine identification of risk areas;
Response plan;
Reporting Policies.
The Eight Elements of an Effective Compliance Program
Part 521 of Title 18 N.Y.C.R.R. lists eight essential elements that must be incorporated in the development and implementation of an effective compliance program.
Written Policies and Procedures
Compliance programs must include written policies and procedures that are in keeping with the provider’s code of conduct. The compliance program must also include guidance for employees on how to deal with potential compliance issues, the process of communicating and reporting of compliance issues, and the Medicaid investigation process. Merely having a code of conduct is not adequate, and providers that use preexisting programs developed pursuant to the United States Federal Sentencing Guideline, are urged to compare and evaluate the existing program to assure that these key compliance reporting requirements are included.
Home health care providers should question each of following areas:
Does the organization have a governance compliance bylaw that institutionalizes the corporate compliance effort? If not, one needs to be developed. The governance compliance bylaw goes to the heart of compliance effectiveness and accountability.
How does the provider ensure that the underlying source of information of the compliance program that is being distributed is accurate, reliable, and consistent?
Is the compliance plan readily accessible by all staff?
Are all compliance policies and procedures regularly and systematically reviewed and updated?
Have providers considered placing their policies and procedures on the web site?
Designation of a Compliance Officer
It is required that one individual is designated as the home health care providers’ Compliance Officer and must report directly to the Chief Executive Officer. This individual must also periodically report to governance on compliance activities. The Compliance Officer is responsible for the day-to-day operation of a compliance program and its organizational implementation and the individual’s position should be included in the organization’s insurance for Officers and Directors. In addition, the designated Compliance Officer MUST have direct access to the organization’s top governance individuals, including the Board.
In line with the designation of the Compliance Officer, it is advisable for the organization to create a Compliance Committee. The purpose of the Committee is to assist the Compliance Officer in the implementation of the compliance program. The Committee’s functions should include
Analyzing the organization’s internal and external health care environment, the legal and regulatory requirements with which it must comply, and organizational and compliance risk areas;
Assessing existing policies and procedures that address these areas for possible incorporation into the compliance program;
Examining governance bylaws to determine if, in fact, there is a buy-in at the governance level to institutionalize the compliance concept throughout the organization;
Working with internal departments to determine their risk assessment systems to determine their ability to assess compliance risk areas;
Possessing the requisite seniority and comprehensive experience within the respective area of each member to recommend and implement any necessary changes to policies and procedures.
Training and Education
A salient success factor in compliance is training. Careful attention should be paid to the design of the training to ensure that its content is consistent with the new Medicaid regulations and reflects its full scope, especially compliance policies. In addition to content, it is also important to evaluate the delivery of the training. If the training is not engaging it will not be received and remembered.
All employees, including management, governing board, and external vendors, must receive education and training about the organization’s compliance program. Training should be given at new employee orientation, be a part of the organization’s ongoing in-service education program and provide periodical regulatory alerts and updates to external vendors regarding compliance issues that directly affect their relationship. The education and training program should include organizational and personal expectations, new regulatory requirements and whom it affects and its impact on organizational culture, and where the potential risk factors are for the potential of fraud and abuse, both internally and externally.
When it comes to training, it’s important to avoid the trap of generality. Some commonality may exist in the curricula, but most employees will need help with specialized situations. For example, the training that a bank teller needs will differ from that required by an investment banker or securities trader within the same financial institution. (Deloitte, 2009)
Home health care providers should utilize the following training and education strategies:
The integration of compliance into the corporate ethics program;
The compliance officer’s role in maintaining records of all formal compliance program training undertaken by the home health care organization;
Retention of documentation of key education components, such as individual’s attendance, training session descriptions, copies of objectives goals, evaluation and content of all materials distributed relative to compliance training.
Communication Lines
The governance of the home health care organization and its Chief Executive Officer must set the tone and provide the guidance for the organization’s hierarchy. Both need to voice the same compliance message to achieve continuity and successful implementation. There must be a clear organizational chart that delineates how compliance issues are to be reported, whether it is the immediate supervisor, Compliance Officer, or members of the Compliance Committee. An intentional and strategic design of the organization must ensure that all organizational personnel understand the communication process for reporting potential compliance regulation violations and that all reporting is strictly confidential.
Home health care providers should take into account the following points to open lines of communication:
Confidentiality and nonretaliation policies should be developed, adhered to, and distributed to all employees.
The organizational culture must encourage questions and reporting.
A process for publicizing throughout the organization the “when” and “how” to report a complaint must be created and implemented.
Management accountability regarding the value of the compliance plan must be diffused through out the organization.
A follow-up to complaint process as a key component of open communication must be established.
A hotline/reporting mechanism must be made available and communicated to all employees, with emphasis on the anonymity of the reporting process. Employees should be permitted to report matters on an anonymous basis.
Disciplinary Policies
For the compliance program to be effective, home health care providers must aggressively and very intentionally promote active employee participation and compliance reporting enforcement. During new hire orientation, annual in-service training, and annual performance reviews, all employees must be advised that compliance is mandatory and that noncompliance with the organization’s compliance program will result in sanctions. Specific sanction areas are failure to report a compliance issue, participation in noncompliant or illegal behavior, and/or encouraging and facilitating a noncompliant act.
At the core of compliance is the organizational code of conduct. It is within the confines of the code of conduct that adherence to values, beliefs, and ethical judgment within the perimeters of the provider organization’s expectations of “right” and “wrong” is resonated. It is the adherence to the code of conduct that initially determines the breath and depth of the organization’s culture. Without this core foundation, the organization’s compliance program would become a fault line and the implementation of its effectiveness would be challenged and become very elusive.
The home health care provider should create incentives to encourage participation, that is, tie executive and CEO incentive bonuses and employee raises to achievement of compliance goals. In addition, home health care providers should take the following actions. Establish appropriate incentives to endorse strong ethical and compliance behaviors;
Establish a postincident evaluation process that enables the organization to learn from each incident.
A System to Routinely Identify Compliance Risk Areas
The home health care provider must demonstrate that it has a system of routine identification of compliance risk areas performed during a risk analysis that should be done during internal or external audits.
Home health care providers should take into account when designing this system to review and investigate the following areas:
Monitor home health care industry for current or new trends in risk management;
Review the United States Office of the Inspector General (United States –OIG) and New York State Office of the Medicaid Inspector General (NYS –OMIG) Annual Work Plans, audits, and so on;
Review external and internal audits and other pertinent reviews, benchmarks, and trends;
Access New York State Office of Medicaid Inspector General guidance documents (check web site, mailings, etc.);
Identify prior problem spots;
Search prior denials, including monitoring patterns and trends;
Utilize industry organizations, associations and publications;
Search out and join compliance-oriented membership organizations (such as the Health Care Compliance Association).
The home health care provider must also take into account risk areas, beyond Medicaid billings and payments, which should be included in the compliance program, such as,
Medical necessity;
Care quality;
Governance;
Mandatory reporting;
Credentialing; and
Other identified risk areas in internal and external risk audits.
A potential mistake that home health care providers can make when conducting internal compliance risk assessments is to limit the potential risk universe to preconceived checklists of likely high impact risks. Rather this risk assessment needs to include all risk areas, including those systemic to the organization, those unique to the health care industry, and other potential previously unidentified risks. The home health care provider must examine risk contextually. To be effective, the internal risk audit must take into account the ability to assess employees in positions of substantial authority to ascertain their ability to recognize and prevent fraud and abuse as it relates to compliance factors.
Response Plan—A System For Responding to Compliance Issues as They Arise
The home health care provider must demonstrate that it has a system for responding to and investigating potential compliance issues as they arise. The home health care provider must implement/conduct root cause analyses, develop corrective actions, which may result in new policies and procedures to reduce recurrence, and report findings and actions taken to governance as well as external bodies as required.
Home health care providers should be alert to
Protect health and safety;
Secure relevant evidence and documentation;
Coordinate all investigations by the designated Compliance Officer (unless a potential conflict of interest exists);
Conduct timely and thorough investigations and take timely corrective actions;
Determine if there is a need for repayment or self-disclosure!
Determine if there is a need for tracking routine billing refunds resulting from compliance monitoring efforts;
Determine if the investigation shows credible evidence of misconduct that may violate criminal, civil, or administrative law;
Promptly report to the appropriate legal or regulatory authority within a reasonable period, but not exceeding 60 days, when the investigation’s findings so warrants.
Effective January 1, 2010, home health care providers are subject to establishing new Self-Disclosure protocol . . . Under this new protocol, providers must follow specific steps with due diligence to determine if the omission discovered requires self-disclosure and self-disclose when needed.
Policy of Nonintimidation and Nonretaliation for Good Faith Compliance Program Participation
Home health care providers are required to establish corporate policies in the area of nonintimidation and nonretaliation within their organization. These policies are at the very core of creating a compliance culture that leads to the development of a safe environment in which each employee can in good faith participate in the compliance program.
The home health care provider should consider the following:
Policies must apply uniformly to all staff;
Policies must be publicized to all staff, including when and how to report and the consequences for violation;
The Compliance officer needs to coordinate the investigation of any violation of these policies (unless a potential conflict of interest exists);
The Compliance Officer must promptly secure all relevant evidence and corresponding documentation;
The Compliance Officer’s actions must result in prompt, timely, and thorough investigations and interventions.
Other Requirements
Mandatory Provider Annual Compliance Certification
Within the state of New York, certification of compliance with 18 NYCRR Part 521 stipulates that affected providers MUST be completed annually. This certification needs to include that the organization and its affiliates have adopted, implemented, and maintained an effective compliance program that meets the requirements of this Statute and also Social Services Law Section363-d. This annual certification is due annually on December 31 (N.Y. Comprehensive Codes, Rules & Regulations, Title 18 Section 517 et seq.).
This complete annual certification requirement did not appear in the 2006 legislation, which only required that certification of effectiveness was made on enrollment in the Medicaid program. (NY Social services Law Section 363-d (3)). The annual certification requirement raises many questions, including who within the home health care organization must make the annual certification and what amount of liability or responsibility that individual must have if the NYS Office of the Medicaid Inspector General determines, after the fact, that the home health care provider’s compliance program is not effective. (See OMIG web site)
Deficit Reduction Act Certification (DRA)
The Federal Deficit Reduction Act of 2005 (Public Law109-171 (2006), codified at 42 U.S.C Section 1396a(a) (68), was a first step toward mandating widespread compliance program implementation in the health care industry. (See OMIG website–DRA doc).
Under the certification requirement, home health care provider organizations receiving or making Medicaid payments in excess of US$5 million per year must certify that it and its affiliates have established and maintained written policies in accordance with 42 UC Section 1396(a)(68). Public Law 109-171 (2006). Such policies are to be included in any existing handbook in use by the entity and/or its affiliates and need to be properly adopted and published by the home health care provider and/or its affiliates and disseminated among employees, contractors and agents. The written policies and any employee handbook is be retained for a period of 6 years from the letter of the due date, or actual date of submission of the certification, or in keeping with federal or state specific requirements.
Effectiveness and Elusiveness
An effective compliance program assists a home health care provider in preventing inappropriate payments and avoiding costs, such as reimbursement paybacks with interest, penalties, and other adverse consequences that might otherwise be incurred due to violations. The effective standard requirement will also help to ensure that Medicaid funds are used properly and that payments are made only on legitimate claims; that home health care providers systematically identify, report, and return overpayments; that medical care, services, and supplies provided meet required standards of care; that individuals can report unacceptable practices, such as fraud, directly and safely; and that home health care providers establish accountability in governance structures.
The lack of a mutual accord between the New York State Office of the Medicaid Inspector General and home health care providers makes it appear that the home health care providers will be frozen out of the determination of their own effectiveness relative to their compliance program. At the point of an investigation, home health care providers need to demonstrate an effective compliance program. However it is in this discord that the notion of an effective compliance program becomes elusive!
Conclusion
The home health care industry is operating in a new environment in New York State, as in many states. The rules have fundamentally changed. Unfortunately, many providers have not adapted; yet adaptation will be a critical success factor. Many executives wait for an external event before taking action.
These are not failures of intention but rather of connection. What is missing is a link between operations and operational reality. Policies and procedures are drafted to satisfy accreditation, regulatory or legal requirement, with little consideration given to the ethical needs of the organization. The result? Compliance Plans that are not “effective.” Or even worse, irrelevant!
Organizations cannot simply buy a canned Compliance Plan and put it on the shelf nor can they write a Compliance Plan and believe they are finished. It is necessary to have not only a Compliance Plan but also a plan that is relevant and individualized to the organization and that is implemented and integrated into all operational and clinical aspects. Thus it is important that home health care providers link the compliance program to the day-to-day operations in a well integrated, blended, and practical manner.
This approach is necessary not only within New York State but also in many other states and in keeping with Federal guidelines and requirements. This approach is most likely to be adopted and applicable within all states’ Medicaid programs for implementation by the state’s Medicaid home health providers as well as for home care providers meeting Medicare Certification requirements.
Footnotes
The compliance program model is based on New York State Medicaid Regulations.
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
The author(s) received no financial support for the research, authorship, and/or publication of this article.