MD - Health Care Compliance Association

The OIG’s roadmap for effective compliance programs ...continued from page 39
6. Response to detected deficiencies
■ Has the hospital created a response team
to evaluate detected deficiencies
■ Are all deficiencies thoroughly and
promptly investigated
■ Are corrective actions taken to resolve
compliance violations
■ Are subsequent periodic reviews performed
to verify that corrective actions
have eliminated compliance problems
■ Are overpayments promptly identified and
returned to the fiscal intermediary or
other payors
■ Are compliance violations promptly reported
to the appropriate law enforcement
agency, if required
7. Enforcement of disciplinary standards
■ Are disciplinary standards publicized to all
hospital personnel
■ Are disciplinary standards consistently
enforced throughout the organization
■ Are enforcement actions of disciplinary
standards properly documented
■ Are employees, contractors, medical and
clinical staff checked routinely against the
government sanctions list
In summary, there are at least three ways a
hospital can evaluate the effectiveness of its
compliance programs. The first is for the hospital
to conduct an internal review using its
own personnel. Note: The OIG cautions that
the reviewers should be independent of linemanagement.
In other words, the reviews
should be conducted as independently and
objectively as possible.
The second way is to utilize external consultants.
This generally provides an independent
and objective evaluation of the compliance
program’s ability to meet the seven elements
required for effective compliance programs.
The third way is through a government
investigation. Government investigators have
the right to request copies of the compliance
plan and standards of conduct and to review
the hospital’s compliance activities to determine
if the compliance program is effective.
Without a doubt, hospitals should perform
their own compliance effectiveness reviews at
least annually to evaluate if their compliance
programs are operating properly. The OIG has
provided a good roadmap of its expectations
for an effective compliance program. Now,
hospitals are in the driver’s seat to develop and
maintain effective compliance programs. ■
A new value proposition ...continued from page 31
Legal and regulatory context
The emerging control frameworks converge
for the purposes of SOX section 404 and the
development of compliance programs.
Another common denominator is the focus
on antifraud programs and controls. Each of
the standards establishes criteria for evaluating
such controls from a distinct vantage point.
The COSO framework 3 establishes criteria for
internal control over financial reporting which
forms the basis of management and auditor
obligations under SOX 404. The standards
under the amended U.S. Sentencing
Guidelines for Organizations are designed to
address what prosecutors and courts look for
in determining whether an organization has
exercised due diligence in establishing a program
to prevent and deter violations of law.
The listing requirements of the stock
exchanges define certain control standards in
greater detail. Still, the various criteria share
similar characteristics that can be organized
under the overall COSO framework.
Sarbanes-Oxley and ensuing
regulations and standards
Reaffirming the obvious, Sarbanes-Oxley is
focusing attention on standards that will have
far-reaching governance and control expectations
on organizational compliance systems. It
is now abundantly clear that many of the principles
found in Sarbanes-Oxley overlap and
complement existing compliance guidances,
and those principles are being further adopted
and enhanced by other regulatory authorities.
To further restate what is well known, the
credibility of public company financial reporting
was undermined following a string of corporate
accounting scandals. These events led
to a number of proposals to improve the
financial reporting process and restore investor
confidence. In 2002, Congress passed the
Sarbanes-Oxley Act 4 to improve the integrity
of financial reporting and to restore public
confidence. Subsequently, the Securities and
Exchange Commission (SEC), various stock
exchanges, and the National Association of
Securities Dealers adopted rules and regulations
mandating processes tailored to meet the
requirements of the new law.
Failures in internal control, particularly over
financial reporting, were among the specific
concerns addressed by Congress in SOX. 5
Congress required that management affirmatively
report on a company’s internal control
over financial reporting, and that auditors
attest to the accuracy of management’s report.
The Act thus created the Public Company
Accounting Oversight Board (PCAOB) to
oversee the audits of public companies.
Organizations use internal controls as safeguards
and checks on a variety of processes
January 2006
40
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org