Compliance Requirements for Healthcare Carriers

Transcription

1 INFORMATION DRIVES SOUND ANALYSIS, INSIGHT REGULATORY COMPLIANCE ADVISORY Compliance Requirements for Healthcare Carriers Introduction With the introduction of the new healthcare exchanges in January 2014 as part of the implementation of the Patient Protection and Affordable Care Act (ACA), a greater proportion of insurance carriers books of business will be subject to federal contractor compliance requirements. For those carriers who provide coverage in the Medicare, Medicaid, or the Federal Employee Health Benefits (FEHB) Programs, participation in the healthcare exchanges will extend the application of the compliance requirements. Carriers who do not participate in either of the existing federal health programs will be required to build the necessary internal compliance processes to meet their new obligations as federal contractors. regardless of the existence of a compliance program, failure to maintain effective compliance controls may result in strong sanctions and expanded application of the federal False Claims Act, Civil Monetary Penalties Law, and the Anti- Kickback Law, and could potentially subject carriers to targeted fraud and abuse investigations and prosecutions by the federal government. The most effective way for carriers to mitigate the compliance risks that come with being a federal contractor is to establish an effective compliance program that meets the expected standards of the federal government. This white paper outlines the fundamental framework for building an effective compliance program. All carriers who participate in the healthcare exchanges will need to maintain robust compliance programs as the ACA will undoubtedly raise the bar for healthcare compliance measures. This requirement will apply, in varying degrees, to both the state-based and the federally-facilitated exchanges. Failure to implement a satisfactory compliance program will create additional exposure to regulatory and law enforcement scrutiny, as well as the potential risk to civil and criminal False Claims Act liability in the event of egregious compliance violations. In addition,

2 The Benefits of a Comprehensive Compliance Program In order to be certified as a Qualified Health Plan (QHP), carriers must attest to having a compliance program that adheres to all applicable laws and regulations by submitting copies of their compliance plans. In addition carriers must attest that their compliance plans are ready to be implemented and formally agree to adhere to their compliance programs. An effective compliance program is best organized as an integrated capability assigned to business functions/units while managed and overseen by individuals with overall responsibility and accountability. Compliance can be a daunting challenge, but it is also an opportunity to establish and promote operational excellence throughout the entire organization and significantly improve the overall operational performance. Broadly understood, compliance is an important mechanism that supports effective governance. An effective compliance program assures that the carrier is adhering to all fully promulgated state and federal laws and regulations. Compliance with regulatory requirements and the carrier s own policies are a critical component of effective risk management. Monitoring and maintaining compliance is one of the most important ways for a carrier to maintain its ethical health, support its long-term prosperity, and preserve and promote its values. An effective compliance program is the first line of protection to prevent the occurrence of compliance risks. In the event that compliance deviation does occur, an effective program enables the early identification of risks and reduces the impact of any occurrence. Carriers that have the ability to identify risks as they occur and respond quickly to correct the deviations help themselves avoid penalties for non-compliance. A demonstrated commitment to compliance and ethics, reinforced by comprehensive training programs for all employees, helps to promote a culture of compliance and deter fraud, waste, or abuse in the carrier s organization. In addition, an effective compliance program supports the carrier s business objectives, identifies the boundaries of legal and ethical behavior, and establishes a system to alert management when the carrier is approaching an obstacle that prevents the achievement of a business objective. A critical aspect of an effective compliance program is the establishment and maintenance of an ethical culture. A strong culture that provides important benefits would including a safety net for when formal controls are weak or absent, and an open environment of trust, accountability and integrity all of the ingredients that help drive overall workforce productivity. Like any other core capability, the compliance program should strive to deliver tangible benefits and outcomes for the carrier. These include an enhanced culture of trust, accountability and integrity, prevention of noncompliance, detection of noncompliance, response to noncompliance

3 and, equally important, protection from negative consequences should the government overstep its authority, create regulatory ambiguity, or misapply the regulations. An effective compliance program can provide a very valuable benefit to carriers in the event that regulations are either tardy or ambiguous, or in those instances where carriers are involved in legitimate disputes over the interpretation of applicable regulations. Given the magnitude of the ACA and the current gaps in regulatory clarity because federal and state regulators are behind schedule in releasing their regulatory guidance, it is inevitable that carriers will need to exercise their best judgments in administering their ACA products and activities. Furthermore, even after the regulations are published, carriers may dispute the legality or the government s application of the regulations. There are times when carriers legitimately protest that the government has overreached its authority. In those instances, carriers have the ability to take their disputes before an appropriate judicial forum, e.g., a board of contract appeals. Maintaining a rigorous and objective compliance discipline and a timely internal policy development structure provides carriers with the necessary documentation to sustain their positions in judicial hearings or to protect themselves in the event the government attempts to misclassify a legitimate dispute as a false claims allegation. agencies are reliable in their application and interpretation of governing laws and interpretations, occasionally agency administrators are incorrect in their guidance. There are also times when government inspectors general who are generally independent from agency administrators do not concur with the guidance the administrators have provided to carriers. If carriers, in good faith, should disagree with the government, they have the right to dispute an agency s guidance or an inspector general s conclusions. In so doing, carriers should internally coordinate their activities to move the dispute forward with the compliance officer, the compliance committee, and the governing board. In addition and this step in most important the carrier should fully and transparently disclose in writing its disagreement with the agency or the inspector general. Transparency is most important because it publically documents the dispute and protects the carrier from inappropriate false claims allegations. An effective compliance program is a great asset in these circumstances because it demonstrates to a judicial body hearing any disputes that the carrier is acting in good faith and is committed to its obligation to comply with governing laws and regulations. The requirement to comply with applicable laws and regulations is a responsibility that applies to government agencies as well as government contractors. While, in most instances, government

4 Elements of an effective compliance program The engaged involvement of key stakeholders is critical to the successful implementation of a compliance program. A robust dialogue and the building of a shared understanding among all major parties regarding the objectives, goals, and overall purpose of the program is critical to the project s effectiveness. By working together, compliance and ethics officers, executive management, and the board can help ensure a compliance program not only contributes to the improvement of the organization s governance practices but the success of carrier s strategy as well. An effective compliance program includes the following seven core elements: Written Policies, Procedures, and Standards of Conduct The centerpiece of an effective compliance program is written Standards of Conduct (SOC). The SOC articulates the carrier s commitment to comply with all applicable federal and state laws, regulations, and standards. The SOC should be widely circulated throughout the carrier s organization and should be a key topic covered in new hire orientations and training. A best practice among organizations fully committed to maintaining an ethical culture is to require every employee to review and sign a copy of the carrier s SOC on an annual basis. The following elements should be included in the written policies, procedures, and standards of conduct: A statement that articulates the carrier s commitment to comply with all applicable federal and state rules, regulations, and standards of conduct. A description of compliance expectations for employee standards of conduct. A description of the operational procedures of a compliance program. Guidance for employees, contractors, subcontractors, or other applicable entities on dealing with potential compliance issues. An explanation as to how compliance issues should be communicated to appropriate compliance personnel. A description of how potential or suspected compliance issues are investigated and resolved. A policy of non-intimidation and non-retaliation for good faith participation in the compliance plan, including, but not limited to: reporting potential issues, investigating issues, conducting self-evaluations, audits and remedial actions, and reporting to appropriate officials. In addition to the SOC, the carrier should maintain a set of written operating, administrative, and financial policies and procedures that are consistent with applicable laws, regulations, and standards. These corporate policies and procedures should be regularly reviewed to assure that the carrier remains compliant as the circumstances of business change and evolve.

5 Designation of a Compliance Officer and a Compliance Committee A key role in a carrier s compliance is the designation of the carrier s compliance officer (CO). The CO leads and oversees the activities and the operation of the compliance program. In order to assure the appropriate level of independence, the CO should report directly to the carrier s board of directors or to a senior governing body, e.g., the audit committee. As part of the Qualified Health Plan certification process, carriers are required to submit copies of their organization charts to demonstrate that the CO directly reports to the board of directors or an appropriate senior governing body. The CO should be supported by a compliance committee that advises the CO and assists with compliance program development, implementation, and oversight. Membership should reflect the organization s size and the scope. Typically, the committee will include knowledgeable staff members from the operations, finance, and legal areas. In some instances, carriers may supplement their internal staff with external professional experts. educational materials should be provided to all employees of all levels as well as to the carrier s contractors. Compliance training sessions should describe all aspects of the carrier s compliance program and include a comprehensive review of the Standards of Conduct, compliance policies and procedures, and the compliance reporting structure. The following elements should be included as part of compliance training and education sessions: Articulation of the carrier s commitment to federal and state laws, regulations, and guidance. A review of the carrier s compliance policies and procedures. An outline of the discipline guidelines for noncompliant behavior. A review of the procedures for asking questions or reporting potential noncompliance. An overview of the Health Insurance Portability and Accountability Act (HIPAA) and the privacy and security of personally identifiable information. A listing of the set of applicable laws and regulations and where to find them. Effective Training and Education A key element of an effective compliance program is continual employee training and education. An effective training program demonstrates the carrier s full commitment to its compliance program. Regular compliance training and Effective compliance training and education tools include new hire orientations, employee handbooks, webinars, online training, case scenarios, newsletters, posters, and bulletin boards. In addition to basic compliance education, specialized compliance training may be advisable for employees working in specific risk areas.

6 Effective Lines of Communication Effective lines of communication include both formal and informal mechanisms. Compliance program information, established protocols, and written policies and procedures should be formally communicated by the compliance officer (CO), the compliance committee, and management to all employees. The carrier should maintain well-publicized mechanisms for employees to communicate with the CO and the compliance committee, including options to report compliance issues anonymously. These mechanisms should also ensure confidentiality for managers and employees in reporting compliance issues to the CO, the compliance committee, or the governing body. Most importantly, the CO should be easily available and accessible to all employees. Well-Publicized Disciplinary Standards Carriers should establish, publish, and enforce disciplinary standards, which may include the following: Articulation of expectations for reporting compliance issues and providing assistance in their resolution. Possible disciplinary actions for failing to observe SOC, compliance policies and procedures, and federal or state laws. Provision for the effective enforcement of the defined standards when non-compliant or unethical behavior occurs. Disciplinary sanctions, when administered, should be reflective of the seriousness of the offense and enforced in a timely and consistent manner. System for Monitoring and Identifying Compliance Risks The carrier should maintain a formal system for the routine monitoring and identification of compliance risks. An effective system includes the following: A provision for internal monitoring and/or audits. A provision for external audits to evaluate the overall effectiveness of the carrier s compliance program. Monitoring strategies and the assignment of resources to minimize compliance risks. Compliance monitoring strategies may include: Conducting self-assessments to determine potential compliance risk within the organization. Developing an audit/monitoring plan. Producing periodic reports that summarize findings and results in a useful, actionable way. Examples of non-compliant or unethical behavior.

7 In addition, the carrier should monitor the overall effectiveness of the compliance program to ensure that the program is working as designed and to verify that the program is having the desired impact on the culture of the carrier s organization. Finally, the carrier should identify opportunities for improvement in its compliance program and make any necessary adjustments. Procedures and System for Response to Identified Issues The carrier should have an established process for responding to identified compliance issues. The minimal steps in this process should include the following: When issues are identified, investigate to determine if a violation has occurred. If needed, take appropriate action to respond to and correct the noncompliance condition. Procedures for voluntarily self-reporting potential fraud, misconduct, or other types of noncompliance. Conclusion Being a federal contractor brings unique risks that are different from those in regular commercial business. Carriers in the new healthcare exchanges who already participate in other federal contracts understand the unique responsibilities that come with being a federal contractor, and hopefully have robust compliance programs in place. For those carriers who are becoming federal contractors for the first time through their participation in the exchanges, the establishment of a comprehensive compliance program will contribute to overall performance and ensure that government compliance requirements will not become a burden on the business. Determine if the issue is reportable to the government or law enforcement authorities. Develop and implement an improvement plan. Document and keep a record of the investigation. The following provisions may demonstrate evidence of sufficient procedures to promptly respond to compliance issues: Self-evaluations and audits. A track record of conducting timely and reasonable inquiries into any evidence of misconduct. A consistent practice of implementing corrective actions in response to potential or actual compliance violations. Washington, DC 1600 K Street, Suite 202 Washington, DC Phone: Fax: info@optimityadvisors.com New York, NY 183 Madison Avenue, Suite 1205 New York, NY Phone: newyork@optimityadvisors.com