In traditional finance parlance the term "risk management" involves identifying events that can have adverse financial consequences and then taking action to prevent and/or minimize the damage caused by these events. Thus healthcare financial risk management typically involves dealing with matters such as the unique aspects of capitation, implementing physician incentive programs, protecting against employee fraud or embezzlement, and the like. This article takes that concept one step further and posits that smaller health care entities must add the possibility of government fraud investigations and associated penalties to that list. It further suggests that the only way to manage regulatory financial risk effectively is to create and implement a compliance program appropriate for the organization's particular size and business model.
As the health care community knows by now, compliance programs that were formerly discretionary will be mandatory under the Patient Protection and Affordable Care Act ("ACA"). Some implementing regulations have already been promulgated and more are certain to come. But, mandatory or not, it is also clear that compliance plans must be an important part of sound financial management for every health care organization no matter what its size.
Providers of health care services in the United States are today faced with a maze of statutory and regulatory requirements which are impossible to keep up with much less fully understand. As one federal judge aptly stated:
"There can be no doubt but that the statutes and provisions . . . involving the financing of Medicare and Medicaid are among the most completely impenetrable texts within human experience. Indeed, one approaches them at the level of specificity herein demanded with dread, for not only are they dense reading of the most tortuous kind, but Congress also revisits the area frequently, generously cutting and pruning in the process and making any sold grasp of matters addressed nearly a passing phase."
This quote, now twenty years old, was before the advent of Stark, before HIPAA, and certainly before the ACA just to mention a few.
On the other hand, the federal criminal statutes that are often used to prosecute health care providers and organizations (conspiracy, mail fraud, wire fraud and false claims to name just a few) have been around for a much longer period. And, more recently, Congress has added new criminal statutes (i.e., health care fraud). But whether old or new, they are all broadly worded so as to, theoretically, include any number of activities that healthcare entities or providers would otherwise not think to be criminal activities.
Finally, federal prosecutors are not reticent to indict for health care related fraud activities and over 95% of all indictments result in felony convictions which can result not just in prison time, but also large fines and almost certain debarment from federal health care programs such as Medicare.
Armed with these statutory and regulatory weapons, the Office of the Inspector General of the United States Department of Health and Human Services (OIG) continues to make fighting fraud, waste and abuse its number one goal. In doing so, OIG has been clear that it will use a multi-faceted approach of prevention, detection and deterrence which includes identifying and recovering improper payments and utilizing exclusions and referrals for debarment to protect HHS programs. To that end, OIG has also made it clear that one of its key focus areas will be to promote "compliance with Federal requirements and resolving noncompliances."
Because of the perilous complexity of the health care regulatory environment, it only makes sense to take prophylactic measures to avoid missteps which can have expensive if not catastrophic consequences to a health care provider. Indeed, Chapter 8 B2.1 of the Federal Sentencing Guidelines makes it clear by requiring that any organization, which includes any health care organization, to have
". . . an effective compliance and ethics program . . . which "shall be reasonably designed, implemented, and in force so that the program is generally effective in preventing and detecting criminal conduct."
The significance of these guidelines should not be taken lightly. There are any number of examples of health care organizations that have been investigated and, if not actually prosecuted criminally, have been required to enter into corporate integrity agreements which are far more onerous than the reasonable requirements of a well designed and fully implemented compliance program.
Of course, implementing a meaningful compliance program is not without expense. But the OIG has also made it very clear that compliance programs are scalable and that one size does not fit all. Thus, even smaller health care organizations such as a one or two physician practice can create and implement a compliance program that is not overly expensive and which should reasonably satisfy the requirements of both the OIG's compliance guidelines and the Federal Sentencing Guidelines.
The benefits are all too obvious. First, a meaningful compliance program is the foundation for inculcating an ethical culture throughout the organization. Second, while no compliance program is perfect, a true compliance culture will go a long way in preventing problems from happening in the first place. But, even if it does not, it will often lead to early detection of those problems and, therefore, quick resolution before those small problems become large problems. Third, given the premium that the federal government has placed on self-reporting, it will enable the organization to avail itself of the benefits of self-reporting at an early stage which this author believes will normally reduce the adverse consequences, perhaps dramatically. And, finally, it may well mitigate, if not totally prevent, catastrophic financial loss.
Rob Williams is a partner practicing in the Health Care Industry Group at Burr & Forman LLP, and has vast experience advising clients on healthcare-related matters.
Compliance Program, Office of Inspector General, financial management, risk management, fraud, abuse.
