Healthcare Compliance Program Policies and Procedures

Healthcare compliance program policies and procedures are foundational to managing regulatory risk, supporting ethical operations, and demonstrating organizational accountability. Drawing from decades of healthcare consulting experience with hospitals, physician groups, and other healthcare organizations, The Fox Group has helped clients understand how compliance programs, policies, and codes of conduct fit into a broader culture of compliance and operational integrity.

What Are Healthcare Compliance Program Policies and Procedures?

Healthcare compliance program policies and procedures establish the framework organizations use to promote compliance with federal and state laws, reduce the risk of fraud and abuse, and support ethical business practices. While HIPAA privacy and security requirements are related to compliance efforts, they are only one part of a broader healthcare compliance program.

For many healthcare organizations, understanding what is actually required, versus what is recommended, can be challenging. Hospitals, physician groups, laboratories, home health agencies, billing services, and other providers often rely on guidance issued by the Office of Inspector General (OIG) when developing or strengthening compliance programs.

Regulations that Apply to Healthcare Compliance Program Policies and Procedures

The first question that comes to mind is, “What regulations apply to healthcare compliance program policies and procedures?” The short answer is: not many! In fact, the only healthcare organizations that are required by regulation to have a compliance program are skilled nursing facilities. Other healthcare organizations, including hospitals, home health agencies, laboratories, physician groups, third-party billing services, and ambulance companies, have guidance from the OIG on compliance programs.

Guidance from a regulatory agency is not the same as laws or regulations. Implementing a compliance program, even one based on the OIG guidance, is voluntary. But in this day and age, it could be considered managerial malpractice not to rely on the OIG guidance for your type of healthcare organization. After all, you want to implement an effective compliance program in a healthcare organization.

And more compliance programs required by regulation may be on the way. 

The Affordable Care Act (ACA) of 2010 required the Department of Health and Human Services (HHS) to issue regulations addressing healthcare compliance programs.

These regulations would describe requirements for compliance programs applicable to healthcare organizations billing Medicare for services or supplies.

The ACA is also the source of the compliance regulations issued for skilled nursing facilities.

OIG Guidance and Compliance Policies and Procedures

So what is the OIG guidance on healthcare compliance program policies and procedures? No matter the type of organization, all of the guidance issued by the OIG refers to the same seven elements of an effective compliance program in healthcare. Written standards of conduct, along with written policies and procedures, are one of those elements.

Content of Healthcare Compliance Program

One of the foundational policies of a compliance plan in healthcare is a policy describing the compliance program of the organization.  This policy will usually contain the key elements of the program such as:

• The commitment of the organization to compliance with all federal and state laws and regulations. It should also describe the organization’s commitment to avoiding fraud and abuse with respect to billing and claims activities.
• The roles and responsibilities of those accountable for oversight of the compliance plan. This usually includes the governing body, the Compliance Officer, and the Compliance Committee.
• The risk areas of the healthcare organization. For most healthcare organizations participating in Medicare and/or Medicaid, submitting correct claims is a major risk area. Other common healthcare compliance risk areas include:
  • Designated Healthcare Service that has a financial relationship with a physician who also refers patients to that Service has a risk related to the Stark Law and the Anti-kickback Statute. 
  • Medicare Cost Reports are a risk area for hospitals.
  • Returning credit balances or overpayments.
  • Employing staff members who have been previously excluded from participating in government healthcare programs.
• Periodic training for all staff members on the compliance standards of the organization. Training should be appropriate to the responsibilities of different groups within the organization, including:
  • Governing body members and executives who are responsible for oversight of the compliance plan.
  • Managers and employees involved in operational compliance activities
  • Clinical providers and other professional staff.
• Effective lines of communication. One of the consistent features of situations where an organization ran afoul of laws and regulations related to claims is the existence of whistleblowers. These individuals knew or suspected someone was making mistakes in the preparation or submission of claims to government programs.
  
  In some organizations, there is no effective process for reporting concerns. In others, concerns may be raised, but not adequately addressed.

More Content of Healthcare Compliance Program Policies and Procedures

• Enforcing policies through well-publicized Disciplinary Guidelines.
  A great deal is at stake for healthcare organizations if professionals or other employees are making mistakes in medical record documentation or billing/coding of claims. Staff can sometimes feel removed from the consequences of mistakes that result in repayments of previously received funds.
  
  The stakes increase considerably when there is actual wrongdoing involving processes tied to the organization’s risk areas. This makes it important for leadership at all levels to take mistakes and misconduct seriously — and to communicate that seriousness throughout the organization.
  
  Disciplinary actions should be fair and consistent when required. Failure to report mistakes or misconduct should also lead to disciplinary action.
  
• Auditing and monitoring.
  To paraphrase the OIG Compliance Program Guidance for Hospitals: The OIG believes that an effective compliance program in healthcare should incorporate thorough monitoring of its implementation and regular reporting to the senior hospital or corporate officers.
  
  Auditing is a formal process to determine if a process is working as expected in a given risk area.
  
  Monitoring is typically a self-assessment performed by a department or division, often following a corrective action plan after an issue has been identified.
  
  Organizations should focus audits on identified risk areas and report results to the governing body.
  
• Responding to Detected Offenses.
  The seventh element of an effective compliance program in healthcare is investigating failures to comply with federal or state laws.
  
  Compliance policies and procedures should describe:
  • When compliance investigations will be initiated.
  • How investigations will be managed.
  • The role of the Compliance Officer.
  • The use of Legal Counsel.
  • How and when to report potential violations or misconduct to governmental authorities.
    
    Organizations should also report the results of investigations to the governing body.

The Code of Conduct

A code of conduct is one of the other important documents when implementing healthcare compliance program policies and procedures. This policy addresses the requirement for compliance standards in the OIG Compliance Program Guidance for healthcare services.

Organizations often use a code of conduct (or code of ethical conduct) to emphasize standards that may already be covered in greater detail in other policies.

Consider getting your code of conduct professionally printed. These documents often include photos or graphics not usually found in institutional policies.

This approach can help communicate the organization’s values while still reminding staff members of their responsibilities.

Scope of the Code of Conduct

The scope of a code of conduct will vary depending on the type of healthcare organization. While hospitals and other providers may address different operational or regulatory issues, most codes of conduct cover common areas such as:

• Compliance Program and duty to report
• Quality of Care and Services
• Patient Confidentiality
• Safeguarding the Organization’s Assets
• Physician and Provider relationships
• Billing for Services
• Compliance for Employees, e.g., gifts, conflicts of interest, kickbacks or bribes
• Non-discrimination environment
• Confidentiality of the Organization’s Information
• Environmental Compliance
• Marketing and Advertising
• Financial Reporting and Records
• Investigations
• Disciplinary Actions

Like all policies, update the Code of Conduct should as needed, and include it in periodic training for employees.

Building a Culture of Compliance

Implementing healthcare compliance program policies and procedures is not a task for the fainthearted. This is especially true in organizations with little history of honest self-examination and dedication to improvement.

However, many healthcare organizations have successfully developed and implemented healthcare compliance program policies and procedures. These organizations often create a culture that supports doing the right thing and maintaining accountability throughout the organization.

A strong culture of compliance is also more likely to support continued improvement and excellence in patient care.

Download this free guide to Measuring an Effective Corporate Compliance Program. This may be the next best step for you.