Countdown to Compliance Week: Compliance Reporting, Investigations and Corrective Actions

We’re just days away from Corporate Compliance & Ethics Week, which starts on November 1.  We’re putting the finishing touches on some big announcements from Powers Knowledge but before we share those, check out Part 3 in our “Countdown to Compliance Week” series with responses to common questions on compliance reporting, investigations and corrective actions.

For health centers that have a well-used incident reporting system for patient safety and risk management, using one system for everything can seem simpler; however, combining them can create issues.

Incident reporting systems are built for clinical events, near misses, and safety concerns. They typically feed risk management and quality improvement. Depending on how the system is set up, incident reports may also be protected by state peer review or patient safety work product laws.

Compliance reporting systems have to meet a different set of expectations:

• Independence. Compliance concerns sometimes involve supervisors or leadership. If incident reports are visible to department managers, staff may not report what they see.
  
  
• Anonymity. The OIG expects health care providers to provide an anonymous reporting option (and New York’s OMIG requires it!). Many incident reporting systems require the reporter's name.
  
  
• Confidentiality. Even when reporters give their names, their identities and the details of their reports should be shared only with the people who need to know. Access should be limited to the compliance officer and others directly involved in reviewing the concern.
  
  
• Privilege. Some compliance matters should be investigated under the direction of legal counsel. Routing them through a quality or peer review process can complicate that, and adding compliance matters to a peer review system can weaken the protections that system was designed to provide.

In practice, the two will overlap. A medication error may reveal a billing problem, and a misdirected fax could be both a patient safety event and a possible HIPAA breach. What matters is that each report reaches the right person, quickly.

Our recommendations:

• Keep a separate compliance reporting channel, ideally including an anonymous hotline.
  
  
• Develop a written triage protocol between compliance and risk management so reports that belong to the other team are handed off, and meet regularly to review overlaps.
  
  
• Whichever channel a concern comes through, log the date it was received, acknowledge it, protect the reporter, evaluate the report and start the investigation promptly. 

Many compliance reports don’t fit neatly into one box (compliance, quality, or human resources) and health center budgets don’t allow for legal counsel to take the lead on every investigation. The right investigator depends on the core issue and the risk involved, not on who received the compliance report.

If the report involves high risk or sensitive matters (like possible fraud, allegations against leadership, whistleblowers or large financial exposure), it is important to first reach out to legal counsel.  An investigation directed by counsel to provide legal advice can be protected by attorney-client privilege and work product protection. When counsel directs an investigation, compliance, quality, or HR staff may still do much of the work, at counsel's direction.

Compliance typically leads investigations involving regulatory requirements, such as issues related to excluded individuals, use of grant funds, and disclosures of patient information.  Quality or risk management typically leads patient safety and clinical care investigations, such as adverse events, near misses or provider competence. HR responds to reports involving workplace conduct, like harassment, discrimination, or performance.

The challenge is when areas overlap. It’s important to identify a lead investigator, with other teams contributing as necessary. If the matter includes compliance components, the lead investigator should keep compliance informed. Investigation teams should take care to maintain protections – whether peer review or attorney-client – throughout the investigation process.  

Depending on what you found, you may need to report both outside and within your health center.
 

• External reporting: One issue can trigger more than one external reporting requirement. We recommend working with counsel to develop an external reporting path before contacting any agency. External reporting may include:
  • Reporting and returning overpayments, generally within 60 days of identification
  • Notifying affected patients and HHS of a HIPAA breach
  • Disclosing grant-related fraud, bribery, or gratuity violations
  • Informing your HRSA project officer of Health Center Program compliance issues
  • Giving notice to insurers, such as a cyber liability carrier after a data breach
    
    
  
  
• Staff Compliance Committee: The Committee should receive summaries of all reports received so members can track trends and corrective actions. Minutes should reflect that the Committee reviewed and acted on matters without restating investigation findings in detail. Members should be reminded about their confidentiality obligations. The Committee should determine whether additional auditing or monitoring should be incorporated into the annual compliance work plan. 
  
  
• Board: While the Board’s role is oversight, not investigating, members need to know enough to exercise their oversight. Compliance investigation policies should identify issues that require reporting to the Board, including those involving leadership, potential fraud, repayments above a certain amount, or matters likely to draw media attention. Urgent matters should go to the Board chair immediately, with a full report at the next meeting. If a matter involves the CEO, the compliance officer should report directly to the Board. If legal counsel is directing the investigation, they should generally brief the Board in executive session and written materials should be limited and labeled.