Presented by James Cottos Senior VP Strategic Management Camella Boateng VP Strategic Management October 2, 2014 1Copyright by Strategic Management Services

1

Presented by

James Cottos Senior VP Strategic Management

Camella BoatengVP Strategic Management

October 2, 2014

Copyright by Strategic Management Services 2014

OUTSOURCING COMPLIANCE PROGRAMS

TO INTERIM AND DESIGNATED COMPLIANCE OFFICERS

2

PRESENTERS

James Cottos Camella Boateng


3

1. WHY COMPLIANCE OUTSOURCING IS PART OF A TREND

2. OIG POSITION ON THE CONCEPT

3. WHY OUTSOURCING ALL/PART OF CP MAY BE AN OPTION

4. WHEN IT MAY BE DESIRABLE TO CONSIDER THIS

5. TYPES OF OUTSOURCING (DCOs, ICOs, DCMs, DPOs)

6. BENEFITS OF OUTSOURCING COMPLIANCE FUNCTIONS

7. DEFINING SCOPE AND DUTIES FOR OUTSIDE EXPERTS

8. FACTORS TO CONSIDER IN USING A COMPLIANCE EXPERT

OBJECTIVES OF PRESENTATION


4

ACA mandates CP as condition of participation.

CMS standards will contain certain “core elements.”

“Game Changer” for those who have not developed a CP.

Executive leadership attestation/certification of CP likely.

Many are turning to using outside experts.

NEW MANDATE FOR CPs


5

For most hospitals, certification/attestation by senior management to having an effective CP will not be a huge problem as many have established programs.

For others to establish/certify their CP will be a big problem if they haven't fully developed one to date.

Many nursing homes, home health agencies, hospices, DMEPOS suppliers, emergency transport companies, and physician practices have deferred developing a CP.

MANDATES WILL HIT SMALLER ORGANIZATIONS HARDER


6

Outsourcing functions not directly involved in core business activities a major trend across all sectors.

Increasingly, organizations are exploring where it makes sense to outsource parts or all their CP.

Big considerations are saving time and costs and gaining access to better expertise.

Outsourcing CP functions has been a long practice, most notably hotlines and sanction screening.

Requires careful action to avoid serious problems later.

www.compliance.com/services/interim-compliance-officer/

GROWING TREND TO OUTSOURCE COMPLIANCE


http://www.compliance.com/services/interim-compliance-officer/

7

COs no longer can be an add-on duty.

Replacing COs more frequent (average tenure under 3 years).

CO not recognized profession is law, finance, audit, etc.

Profession still evolving with COs with variety of educational and professional backgrounds.

All this complicates time/effort to replace a CO.

Replacing a CO with one lacking experience/knowledge is dangerous.

USING OUTSOUCED COMPLIANCE EXPERTS


8

Hotlines

Sanction screening

Compliance training

Policy development

Auditing/monitoring

CP evaluations/assessments

Compliance surveys

If possible, look for package arrangements for discounts

www.complianceresources.com

MOST OUTSOURCE PARTS OF THEIR CP


http://www.complianceresources.com/

9

“For those that have limited resources, the compliance function could be outsourced to an expert in compliance.”

“In situations where staffing limitations mandate that the entity cannot afford to designate a person(s) to oversee compliance activities, the practice could outsource all or part of the functions of a compliance officer to a third party, such as a consultant.”

“One approach for ensuring compliance in a small health care organization would be to designate a staff person to serve as a liaison with an outsourced compliance officer.”

compliance.com/outsourcing/healthcare-compliance-program/

OIG RECOGNIZES OUTSOURCING


http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&docid=-MomgLDS-6mUMM&tbnid=bDBJiljwG15nFM:&ved=0CAUQjRw&url=http://www.hitechanswers.net/oig-2012-report-lists-top-10-challenges-facing-hhs/&ei=0_N0U7u_Oo2aqAbui4DwAw&bvm=bv.66699033,d.b2k&psig=AFQjCNHQ3iq-g2RE1uEIuajG0KuvNAYoHQ&ust=1400259923063212

10

1. INTERIM COMPLIANCE OFFICER (ICO) to fill gaps between permanent COs

2. DESGINATED COMPLIANCE OFFICER (DCO) full or part time

3. DESIGNATED COMPLIANCE MANAGER (DCM) to add support to the CO

4. DESIGNATED PRIVACY/SECURITY OFFICER (DPO/DSO) usually part time/on call

5. Advisory Consultants to provide assistance, guidance, and support (e.g. CP evaluation)

TYPES OF COMPLIANCE OUTSOURCING


11

More focus on core business activities.

CO as secondary duty usually has poor results.

Dangerous to use unqualified people to fill in as CO.

May be cost effective, full-time CO not justified.

Hard for one person to stay current and do all required.

Experts have already know how to get the job done.

VP level CO at $156,000 to $200,000, plus 25% overhead.

May require recruiting outside area with higher costs.

WHY OUTSOURCING MAY BE A SOLUTION


12

1. Would it be temporary or permanent position?

2. Is the need for full time or part time position?

3. How much time on site is necessary?

4. What kind of position do you need (ICO, DCO, DCM, DPO)?

5. Are there cost benefits to taking this course of action?

6. What advantages are you seeking in an outside expert?

7. What will it take to hire an outsider expert?

8. What do they bring that is not available in house?

9. How can you find the right expert?

QUESTIONS TO RESOLVE


http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&docid=rw2AuuQtJF7uxM&tbnid=pivnGsMzYAjjCM:&ved=0CAUQjRw&url=http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&docid=rw2AuuQtJF7uxM&tbnid=pivnGsMzYAjjCM:&ved=&url=http://www.gograph.com/stock-illustration/confusion.html&ei=tRd5U6utNsaSyASHuIHQCg&bvm=bv.66917471,d.aWw&psig=AFQjCNFxz9RfvXHYU_lpXClgWmpFb4JdIw&ust=1400531254234427&ei=9Bd5U-m3Ec-FqgaB3IG4Bg&bvm=bv.66917471,d.aWw&psig=AFQjCNFxz9RfvXHYU_lpXClgWmpFb4JdIw&ust=1400531254234427

13

More efficient, no learning curve on compliance.

Often less expensive than full time employee CO.

Avoids costs (recruiting, employee overhead/benefits).

Credibility likely higher than “in house” staff person.

Already current legal/regulatory requirements.

Benefit of having worked in a variety of settings.

Objectivity, no preconceived notions about personnel or programs.

Experience in working with leadership and Boards.

Brings "best practices" from broader experience.

Able to speak with authority.

Experience with proven methods to build sounder CP.

Risk assessments and claims analysis expertise.

Wide range of expertise (coding, claims, physician contracts).

OUTSOURCING BENEFITS


14

Interim Compliance Officers (ICOs) are temporary, serving until a permanent replacement is found.

Designated Compliance Officers (DCOs) serve as a full or part time substitute for an employee.

Determine costs in salary and overhead for employee versus outsourcing the function?

If cost of outsourcing is less, it is likely a sound decision to follow that route.

INTERIM vs. DESIGNATED COMPLIANCE OFFICERS


15

Developing/integrating the CP elements. Providing overall direction for the CP. Developing/updating the Code. Drafting/revising CP policies/procedures. Overseeing auditing/monitoring. Keeping Board/management informed on CP. Keeping management up to date on legal/regulatory environment. Providing ongoing compliance consulting support. Overseeing sanction screening and resolving any “hits.” Developing/delivering compliance training and education. Performing an assessment of the effectiveness of the CP. Assisting with ongoing auditing/monitoring of high-risk areas. Managing the hotline. Assisting in investigating and resolving compliance issues. Conducting risk assessments.

SCOPE OF DUTIES


16

Many COs are retiring or moving to new jobs. Filling a CO vacuum quickly. Manage CP until a permanent replacement is found. Government investigations often lead to hiring ICOs. CIA may result in a need to build a CP quickly/efficiently. Most organizations require only a part time ICO as a

placeholder. Leadership often turn to proven experts to promote/elevate

CP. Can assist in finding a qualified permanent CO. Can provide a fresh look and assessment of the CP. Should be temporary for a specific term, usually 4-12

months.

WHY INTERIM COMPLIANCE OFFICERS?


17

Extensive CP knowledge and experience? Multiple references evidencing of having worked as a CO? A firm with subject matter experts for support? Evidence of working at the executive and Board level? Intimate knowledge of the elements of an effective CP? Knowledge of AKS, Stark Laws, False Claims Act, HIPAA, etc.? Experience with managing hotlines and resolution of complaints? A history of conducting internal investigations/inquiries? Experienced with ongoing auditing/monitoring of high risk areas? Ability to develop/deliver compliance education/training

programs? Liability insurance coverage for their work?

QUESTIONS FOR SELECTING AN ICODoes the person have…


18

Unlike ICOs, not necessarily temporary.

Assume responsibilities for the CP.

May be an answer for those with limited resources.

Outsourcing to qualified experts worth considering.

Long been recognized as a valid option for providers.

OIG & HCCA co-sponsored roundtable agreed CP could be outsourced to independent compliance experts.

For larger entities and organizations, outsourcing the CP should not be considered a realistic option.

Most smaller organizations need only a part time DCO.

DESIGNATED COMPLIANCE OFFICER (DCO)


19

1. Ensure properly qualified/experienced.

2. Having served successfully as a CO on multiple occasions.

3. Experience with several organization is highly desirable.

4. Experience in CP development, implementation, management, evaluation.

5. Evidence of competence/authority to deal at executive level.

6. Preferable to be with an established firm with many SMEs.

7. Abundant references to evidence qualifications.

8. Should have liability insurance coverage of $1-3 million.

TIPS IN SELECTING A DCO


20

Have direct access to leadership and Board.

Be able to provide CP certifications to permit reasonable basis to attest the CP is effective.

Have a staff liaison to assist coordinating CP activities.

Evidence compliance with GAGAS standards for professional independence and objectivity.

COMPLIANCE EXPERT SHOULD….


21

Develop/implement/maintain privacy documents. Develop/conduct/ensure delivery of privacy training

and orientation. Provide ongoing auditing and monitoring of the privacy

program. Promote individual/entity awareness obligations. Oversee monitoring of data access. Conduct risk assessment; investigate breaches. Interface and coordinate with the Security Official.

KEY PRIVACY OFFICER RESPONSIBILITIES


22

Under HIPAA all covered entities must have a PO. Requires wide knowledge and expertise. Hard to find internally, or for hire. Often made a secondary duty (CO, HIM, HRM). Cost of someone devoted to this may be

expensive. Few possess needed range of knowledge. Work may fluctuate significantly over time. Makes sense to use outside experts.

www.compliance.com/hipaa-compliance

HIPAA DESIGNATED PRIVACY OFFICER (DPO)


http://www.compliance.com/hipaa-compliance

23

1. Expect the unexpected.

2. More serious problems exist than disclosed.

3. Pockets of hostility from past CO actions.

4. Surprising support from almost everyone.

5. Entity relief at having a neutral party fixing things.

6. Many still need education on CP importance.

7. Board and leadership need to invest more in CP.

8. Differing roles legal and CO need clarification.

9. Must establish credibility and value of a non-revenue generating line item.

DCO/ICO LESSONS LEARNED


24


James CottosStrategic Management Senior VP

[email protected]

Camella BoatengStrategic Management [email protected]

mailto:[email protected]

25

Thank you for attending our webinar on Interim, Designated, and Outsourced Compliance Officers. To learn more on what our experts have to say on these topics, you may be interested in the following articles:

Author(s) Journal Article

Camella Boateng and Jillian Bower

Meeting the Privacy Officer Challenge: Outsourcing Might Be the Answer published in the Journal of Health Care Compliance

Jim Cottos One Strategy for Rapidly Developing an Effective Compliance Program published in Managed Care Outlook

Jim Cottos Understanding the Role of an Interim Compliance Officer published in the Journal of Health Care Compliance

Cornelia Dorfschmid Coordinating External Requests for Information in the Compliance Office published in HCCA Compliance Today

Richard Kusserow No Managed Care Organization Should Allow a Gap between Compliance Officers published in Managed Care Outlook

Richard Kusserow Healthcare Compliance: Is Outsourcing Your Compliance Program An Option?

Richard Kusserow Outsourcing Compliance In Light of Health Care Reform published in the Journal of Health Care Compliance

Interested in other topics? Find us online at www.compliance.com and visit our publications page.


Documents

Presented by James Cottos Senior VP Strategic Management Camella Boateng VP Strategic Management October 2, 2014 1Copyright by Strategic Management Services