governance & total compliance
DESCRIPTION
Governance & Total Compliance. Regulators Expectations & Best Practices to Meet Them. Presented by: David M. Rottkamp, CPA – Partner, Not-for-Profit Practice Leader Alfonso P. Conti, MPA – Manager, Healthcare Management Consulting. - PowerPoint PPT PresentationTRANSCRIPT
Regulators Expectations & Best Practices to Meet Them
Presented by:
David M. Rottkamp, CPA – Partner, Not-for-Profit Practice Leader
Alfonso P. Conti, MPA – Manager, Healthcare Management Consulting
Governance & Total Compliance
The year ahead will be a pivotal one for Boards and audit committees
Many of the larger companies that failed:
o Were sabotaged by Board negligence;
o Were too optimistic;
o Had ill-informed Boards;
o Had Boards that spent too much time looking backwards than towards the road ahead.
Opening Remarks
Ex-CEO admits stealing from prominent NYC charity
The politically connected former CEO of a prominent city charity admitted Wednesdayhe helped steal more than $9 million from the organization in an insurance scheme that authorities linked to campaign contributions.
William Rapfogel pleaded guilty to grand larceny, money laundering and other charges in a case that had rattled city and state political circles.
Source: The Associated Press, April 23, 2014
Effective leaders are straight shooters who know that if performance or the ability to fulfill obligations is lacking, they must work to educate, demonstrate expectations, and critique behavior that is below the norm.
Opening Remarks
Audit Committees from both the For Profit and Not-For-Profit world agree that the Board:
o Cannot sit back and conduct business a usual!
o Must engage management to understand current and future challenges of the business.
o Must reduce the reactive nature to an issue and be more proactive and
o Ensure that the right people and skill sets are on the Board to enable the growth and protection of the organization.
Recent Surveys
60% of Boards surveyed replaced or added a director in the last 12 months.
52% of Boards do not oversee organizations social media strategy and can improve on their technical knowledge
14% of the Boards surveyed have removed a director due to poor performance/ evaluation
Boards are focusing on age limits and term limits for Board members
Trends in Governance
Does your Board consider or have in place:
o A Board Succession Process
o Constantly assess and challenge the members
o Optimizing the Board seat and rotate with term limits
o Board member recruitment
o Board Mentoring
Board Questions
Governor Cuomo emphasis on Ethics reform in government, it does not stop with the politicians!
Passage Not For Profit Revitalization Act implementation July 1, 2014
Appointment of James Sheehan to head the Charities Bureau -you remember the mantra educate / prosecute
Recent Media articles on CEO Kickbacks in NFP and Healthcare organizations!
OIG published 52 month average Jail time for Fraud and Abuse conviction.
Corporate Integrity Agreements are getting tougher!
Why all the Concern?
Fiduciary Duty: This means that the board member will act for the financial benefit of the organization.
Duty of Care: The board member will use a level of care that an ordinarily prudent person would exercise in a similar position when faced with similar circumstances.
Duty of Loyalty: This is an expectation that the governing board member will act in a manner he/she reasonably believes to be in the best interests of the organization.
Responsibility of theGoverning Board
Boards are being targeted for their focus on:
o Compliance and their direction of the Compliance Officer and Compliance Committee.
o Boards in general need to know what the annual compliance efforts Involves.
o Boards are ultimately responsible for the ethical conduct of the management.
Boards are Targets of theOMIG / OIG
So how does a Board avoid this embarrassment?
o The answer is culture, education, and continuous focus
o A structure where the Compliance Officer reports to the Board
o Getting harder and harder to oversee the challenges
Boards are Targets of theOMIG / OIG
A continuous stream of communication
Sharing of Compliance efforts
The Board assistance of the Compliance Officer
Potential Board Solution
Passed December 18, 2013 effective date July 1, 2014!
Addresses the growing concerns in the NFP industry! (Target)
Main Components of the Act:
o Mandatory Audit Committee or Board Audit Function Kickbacks.
o Mandatory Whistleblower and Conflict of Interest policies
o Other areas in the Act involve
Document everything
Not For Profit Revitalization Act
Does the board of directors need to approve ALL policies and procedures?
If not, what type of policies MUST have board approval?
Is annual compliance training required for the board of directors or is it best practice?
What training MUST board receive on an annual basis?
Is annual defined as “within 365 days” or is there some leeway, such as 13 months?
In the compliance audits conducted by the OMIG or other regulatory agencies, of which the OMIG is aware, what are some practical tools used by compliance officers /organizations to get board engagement?
OMIG FAQ’s Targets Boards
In successful businesses Boards need to set the
Tone from the Top!
What does that mean?
o Communicate to Management
o Insure Ethical behavior
o Provide Support
How Can Boards HelpManagement?
Where is your Compliance Officer in the Food Chain?
Compliance Officer position is more critical in 2014!
The Board should know the Compliance Officer!
The Board should know the Compliance Committee!
A Board members should sit on the Committee!
Boards and Their ComplianceOfficer
Charities Bureau:
o Effective February 1, 2014 the new head of the Charities Bureau (CB) is James Sheehan former head of the Office of the Medicaid Inspector General. One of his many charges will be the implementation of the NFP Revitalization Act.
o How does that affect the Board and Compliance Officer relationship?
The Compliance OfficerNew _ _ _ _ _
Facilitate Candid conversation at the Board and C-Suite
Develop ethical leaders
Build ethical leadership incentives
Train everyone in the organization starting with the Board
Form a Compliance Committee that will assist the CCO
Assess the organization risk areas
CCO has an independent voice
Chief Compliance OfficerResponsibility
Governance Involvement
Compliance Committee Meetings
Continuous Compliance Education of Staff
Annual Risk Assessment by Departments
Work Plan Update
Auditing and Monitoring Program Internally and Externally
Reporting to Governance
Current Practices
The function of the Bureau of Compliance is to insure providers of Medicaid services have an effective Compliance program in place.
They enforce the year-end certification of compliance programs.
“The goal of these reviews is to assess if providers have compliance programs that meet the requirements of applicable laws, regulations, rules and policies of the Medicaid program” per their introduction letter.
OMIG Bureau of Compliance
Contact information of the Compliance Officer
Contact Information Senior Administrative Official
Document Request
Compliance Officer information
Copy of the Organization Chart
Bureau of ComplianceRequest
The turn around time is usually 1 week.
They want to see:
o Minutes of the Compliance Committee
o Training conducted with staff
o A work plan that identifies the risks identified
o A summary of reviews performed
o Reporting to Governance
Bureau of ComplianceReporting
Schedule a site-visit
Purpose:
o Meet with a member of Governance
o Speak with Management
o Discuss with the Compliance Officer what their role is
o Perform a walk around
Bureau of ComplianceFollow-Up
Year-end Certification is backed up
The Bureau in their review always finds something
A Discussion Draft is issued
No submission, a final letter is issued
The Bureau suspects lax and non-adherence to compliance
What Happens If …?
Review existing Compliance Plan Documentation
Conduct a review of all supporting policies and procedures
Conduct a comprehensive self-assessment of the program
Prepare an updated work plan on the risk areas identified
Report on a quarterly basis on reviews performed
Compliance Summary
The Final HITECH Regulations went into effect on March 26, 2013. DHHS is allowing Covered Entities (“CEs”) and Business Associates 180 days to come into compliance. This means, unless otherwise noted, CEs and Business Associates must be compliant by September 23, 2013.
The Date has Passed!
Other Piece of ComplianceHIPAA
So now you see the Circle of Life as seen by the OMIG!
o Governance
o Management
o Compliance Officers
You know we are there for You…
Nervous Yet or Relieved?
The Breach Notification Requirements
Business Associates
Privacy Notice Changes
Marketing / Fundraising / Sale of Protected Health Information (PHI)
Various Miscellaneous Privacy Provisions
Enforcement and Penalties
MEGA Rule - Impact
46% loss is of laptops with PHI
42% loss due to employee mistakes or unintentional action.
Effectiveness training is questionable
OCR Study on Breaches
Do you have a Social Media Policy?
Limit access from devices to critical systems
Require the user to read/sign an acceptable use policy
Limit or restrict the download of PHI
Scan devices for viruses/malware software
Require anti-virus/anti malware prior to connection
Scan devices removing apps that present a security threat
Mobil Devices
Steps to prepare for it:
o Conduct a security risk assessment and privacy review
o Identify PHI locations throughout the organization
o Create a work plan to mitigate top risks identified
o Ensure Business Associate agreements up to date
o Update policies and procedures for HITECH rule
o Appropriately assign an Officer to oversee
Compliance with HIPAAStandards
Recently Skagit County signed off on the CAP after paying $215,000 settlement:
A three year program
HHS must approve policies and procedures
o Breach Notification policyo Accounting for Disclosureso Hybrid Entity Business Associate Documentationo Security Management Processo Update all policies for Federal complianceo Provide Training for all workforce and certify performanceo Reportable events if any workforce member does not comply with
these requirements
OCR Corrective Action Plan
Annually a Report is submitted NLT 60 days after signing date of CAP containing summary of security mgt., reportable events and attestation by an officer of the County
Institute a document retention requirement for 6yrs.
OCR Corrective Action Plan
What are your HIPAA goals?
Meet compliance
Mitigate risk
Improve your security posture
Evaluate your team’s response capabilities, all good responses.
HIPAA Goals / Questions
However, pretend for a moment you have completed an assessment what are some questions to ask yourself:
What do you hope to show management when reporting results?
Is there something you are trying to prove?
Do you need to test your external network devices?
Are you looking for a thorough review of your web applications?
Do you want to test the security culture of your organization?
Do you have a specific technical area of your environment you need to evaluate that you don’t have the right skillset in-house for?
HIPAA Goals / Questions
Forward looking Boards must remain:o Vigilant
o Energetic,
o Wary of bad habits.
o Objective
o Built on Ethics and Culture
Successful boards will be those that work in the spirit of continuous improvement at every meeting, while always keeping the long range goals in mind.
By creating forward thinking Boards, organizations can avoid the failures and potholes discussed today.
Summary
Building a real, substantive compliance and ethics program will demonstrate to the government, shareholders, employees, rating agencies, and others that your company is indeed, committed to integrity.
Summary
VACCINE
For more information…
David M. RottkampPartner, Not-for-Profit Practice Leader
Alfonso P. ContiHealthcare Management Consulting Manager
Grassi & Co.516-336-2471