Remote Compliance: Maintaining Effectiveness During Crisis

Prepared for HCCA Richmond Regional Healthcare Compliance Conference Page 0

© 2020 PYA, P.C.

WE ARE AN INDEPENDENT MEMBER OF HLB—THE GLOBAL ADVISORY AND ACCOUNTING NETWORK

Remote Compliance:

Maintaining Effectiveness During Crisis

HCCA Richmond Regional Healthcare

Compliance Conference

December 11, 2020

Presented by:

Lori Foley, CMA, CHC®, PHR, SHRM-CP

Kristen Davidson, MHA, CCEP-I®, CHC®, CPHQ, RHIA®

Prepared for HCCA Richmond Regional Healthcare Compliance Conference

Agenda

1. Identifying and Prioritizing Risk During a Crisis

2. Managing Compliance Programs and People Remotely

3. More with Less – The Effects of Furloughs and Layoffs

on Compliance

4. Questions and Group Discussion

0

1

Prepared for HCCA Richmond Regional Healthcare Compliance Conference

Identifying and Prioritizing Risk During a Crisis


The Compliance Officer

In the Age of COVID-19

• Changed and/or relaxed regulatory and legal requirements are

creating confusion

• Active participant in decision making regarding the use of various

pandemic disaster relief tools

• Must establish a process to report, track, document, and follow-up

on all procedural changes

• Serve as the guardian of the crucial repository of information

necessary to validate waivers, exceptions, etc.

• Often the primary source of regulatory information for the

organization

2

3


• Compliance is now fully engaged in managing the day-to-day

COVID-19 firefighting.

• Compliance teams need to quickly pivot and consider the risks and

challenges created by these rapid and radical changes.

• It is imperative for Compliance to perform a risk assessment in order

to quickly understand the new circumstances and address the risks.

• Compliance must manage the changing risks through expedited actions:

• Seeking relief from regulators

• Updating policies and internal controls

• Properly escalating issues

• Compliance professionals must pull together teams and relevant

information for informed conversations about new and emerging risks.

The New Normal


Fraud, Waste, and Abuse

Relief Funding Top Fraud Schemes

Free COVID-19 Testing

Whistleblowers

4

5


https://oig.hhs.gov/about-oig/strategic-plan/COVID-OIG-Strategic-Plan.pdf

OIG Strategic Plan


OIG Strategic Plan Goals

✓ Assist in and support ongoing COVID-19 response efforts, while maintaining independence

✓ Fight fraud and scams that endanger HHS beneficiaries and the public Round II –$20 billion

✓ Assess the impacts of HHS programs on the health and safety of beneficiaries and the public

Goal 1: Protect People

✓ Prevent, detect, and remedy waste or misspending of COVID-19 response and recovery funds

✓ Fight fraud and abuse that diverts COVID-19 funding from intended purposes or exploits emergency flexibilities granted to health and human services providers

Goal 2: Protect Funds

✓ Protect the security and integrity of IT systems and health technology

Goal 3: Protect Infrastructure

✓ Support the effectiveness of federal, state, and local COVID-19 response and recovery efforts

✓ Leverage successful practices and lessons learned to strengthen HHS programs for the future

Goal 4: Promote Effectiveness

6

7

https://oig.hhs.gov/about-oig/strategic-plan/COVID-OIG-Strategic-Plan.pdf


1

1

1

2

2

2

2

3

3

3

4

25

0 5 10 15 20 25 30

FOOD & DRUG ADMIN

SUSTANCE ABUSE/MENTAL HEALTH SERVICES ADMIN

HEALTH & HUMAN SERVICES (HHS)

HEALTH RESOURCES & SERVICES ADMIN

OFFICE OF THE SECRETARY (OS)

CENTERS FOR DISEASE CONTROL (CDC)

ASST SEC PREPAREDNESS & RESPONSE

ACF/CDC/HHS

OS, CDC, HEALTH RESOURCES & SERVICES ADMIN

INDIAN HEALTH SERVICES

ADMIN FOR CHILDREN & FAMILIES (ACF)

CENTERS FOR MEDICARE & MEDICAID

OIG COVID-Related Workplans

as of 11/30/20


• Infection Control at Home Health Agencies During the COVID-19

Pandemic

• Audit of Medicare Payments for Inpatient Discharges Billed by

Hospitals for Beneficiaries Diagnosed With COVID-19

• Audit of CARES Act Provider Relief Funds—General and Targeted

Distributions to Hospitals

• Infection Control and Emergency Preparedness at Dialysis Centers

During the COVID-19 Pandemic

• A Review of Medicare Data To Understand Hospital Utilization During

COVID-19

CMS Focused Workplans

Note: Represents reviews conducted by Office of Audit Services;

additional reviews are conducted by Office of Evaluation and Inspections

8

9


• End Stage Renal Disease Networks' Responsibilities During COVID-19

• Medicaid: Expedited Provider Enrollment During COVID-19 Emergency

• Centers for Medicare & Medicaid Services and States Implement Policy

Modifications To Ensure That Medicaid Beneficiaries Continue To

Receive Prescriptions

• Medicaid—Telehealth Expansion During COVID-19 Emergency

• Audit of Nursing Homes' Reporting of COVID-19 Information Under

CMS's New Requirements





• Audit of Nursing Home Infection Prevention and Control Program

Deficiencies

• CMS's Internal Controls Over Hospital Preparedness for Emerging

Infectious Disease Epidemics Such as Coronavirus Disease 2019

• Medicaid-Audit of Health and Safety Standards at Individual Supported

Living Facilities

• Health and Safety Standards in Social Services for Adults

• Medicaid Nursing Home Life Safety and Emergency Preparedness

Reviews




10

11


• Considerations

• Paycheck Protection Program

• Medicare Accelerated and

Advance Payments

• CARES Act Provider Relief Fund

• FEMA Assistance

• State relief programs

• Each of these programs

has specific eligibility and

performance requirements,

including attestation and

documentation requirements.

Federal and State Assistance

Ensure the organization can demonstrate that it satisfies all eligibility requirements prior to application to any assistance program.

Action

Understand all conditions for use of funds, develop processes to ensure compliance with same.

Action

Develop and execute processes to track and document all fund uses.Action

Ensure completeness and accuracy of all reports submitted regarding use of funds; ensure timely and appropriate response to any queries from same.

Action


• Considerations

• Privacy/security breaches

• Unauthorized use/disclosure

of PHI

• 42 CFR Part 2 Program (Part

2) – Substance Use Disorder

(SUD) Confidentiality and

Disclosure policies

HIPAA

Ensure a hospital’s documented process is in place to demonstrate that certain sharing of protected health information (PHI) outside of the HIPAA Privacy Rule requirements is applied to situations which required conditions.

Action

Ensure the use of a HIPAA-compliant communication, transmission, and social media solution and application of best practices that protect critical information and safeguard patient privacy.

Action

Thoroughly document and report any breach investigation within 60 days of discovery. Complete documentation and root cause analysis of a breach should also support attempts to prevent, control, and respond to the spread of COVID-19.

Action

Develop or update organizational processes to ensure the provisions of the CARES Act for 42 CFR Part 2 SUD information are in place.

Routinely audit use and disclosure of Part 2 information to ensure that the CARES Act provisions have been appropriately implemented.

Action

12

13


• Considerations

• Numerous Section 1135 blanket

waivers of specific regulatory

requirements to ease

administrative burden

• Interim Final Rule easing other

requirements

• https://www.cms.gov/about-

cms/emergency-preparedness-

response-operations/current-

emergencies/coronavirus-

waivers

CMS Waivers and Flexibilities

Ensure managers are aware of those waivers and flexibilities applicable to their operations.

Action

Develop policies for documenting use of the waivers when changing established operations.

Action

Develop process for unwinding arrangements dependent upon waivers and flexibilities following the end of the COVID-19 PHE.

Action


• Considerations

• Organization must have adequate

emergency disaster protocols

• Waiver Considerations

• CMS waivers address the

requirement to develop and

implement emergency

preparedness policies and

procedures for surge sites at

hospitals and Critical Access

Hospitals (CAHs).

• This addresses the current

requirements for a communication

plan that includes all staff, entities

providing services under the

arrangement, patients’ physicians,

other hospitals and CAHs, and

volunteers.

Emergency Disaster Protocols

Develop or update the emergency disaster protocol to ensure it is multi-disciplinary and multi-agency.

Action

Conduct tabletop exercises to test the protocols.Action

Revise protocols as necessary to adequately address emergency disaster plans and response.

Action

14

15

https://www.cms.gov/about-cms/emergency-preparedness-response-operations/current-emergencies/coronavirus-waivers


• Considerations

• The organization has a

process for the relocation of

individuals for screening at

alternative locations, as well

as the transfer of individuals

who have not been stabilized.

EMTALA Waivers

Develop and implement a documented process that meets the requirements of the EMTALA Waiver if alternative locations will be used for screening pursuant to the state’s emergency preparedness plan.

Action

Develop and implement a documented process for the transfer of an individual who has not been stabilized, if the transfer is necessitated by the circumstances of the declared federal PHEfor the COVID-19 pandemic.

Action

Document both the EMTALA Waiver activation and any patient transfers in the medical record and monitor regularly to ensure waiver requirements are met.

Action

NOTE: While a facility can inform patients of alternative treatment locations, once a patient presents to an Emergency Department (ED), EMTALA applies, and the medical screening examination must be provided at that location.

Action


• Considerations

• The organization has a process

in place to allow for provisional

credentialing to expedite the

ability to provide necessary

patient care services.

Provider Credentialing and Licensing

Develop and implement a process for expedited credentialing, orientation, and onboarding of supplemental staff or shared staff.

Action

Ensure the organization has a policy that establishes the threshold for use and priority listing for supplemental staff (e.g., shared organizational staff, followed by similarly credentialed and licensed staff, followed by Medical Reserve Corps, etc.).

Action

WAIVER CONSIDERATION: CMS waivers address the requirement that a physician or non-physician practitioner be licensed in the state in which he/she is furnishing services.

Action

The waivers also address the application fees for prospective and revalidating institutional providers, fingerprint-based criminal background checks, and on-site visits and reviews of providers or suppliers.

Action

16

17


• Considerations

• The organization has a process in

place to accommodate provisions

for emergency provider enrollment

in Medicare in order to meet

patient care needs.

Medicare Provider Enrollment

Secure the necessary provider information to initiate temporary billing privileges in accordance with the Medicare Provider Enrollment Relief provisions.

Action

Ensure the organization has a process in place to document all emergency provisions used during the COVID-19 crisis, and complete an enrollment application for full Medicare billing privileges once the PHE declaration is lifted.

Action


• Stark Law Waiver Considerations

• The organization has a plan in place to

address necessary changes in physician

compensation methodology that is based

on a productivity-based compensation

formula adversely affected by

postponement of elective surgeries and

decreased outpatient visits.

• This includes preparing employment

agreements and documentation of short-

term compensation arrangements with

physicians who are hired or redeployed

to help in the medical response crisis.

• The organization has a plan in place to

evaluate appropriate application of blanket

waivers to other physician relationships

including real estate, professional service

arrangements, and non-monetary

compensation.

Physician Financial Arrangements

Prepare for rapid decision-making for physician employment issues, including compensation adjustments, retention arrangements, hiring decisions, and patient care assignment changes.

Action

Ensure that all conditions of each blanket waiver are appropriately understood and satisfied in order to rely on the resulting flexibility and relief.

Action

Ensure reliance on any waiver or modifications to any process subject to the Stark Law and Anti-Kickback Statute has appropriate approvals and supporting documentation.

Action

WAIVER CONSIDERATION: Providers may request from CMS specific individual waivers to certain requirements under Stark, but must be able to address the dissolution of these actions upon the end of the PHE.

Action

18

19


• Considerations

• The organization has a documented

process in place to provide for the

use of staff in alternative positions,

or the use of unlicensed staff as

allowed by state statute.

• The organization has a plan in

place to accommodate a dramatic

increase in patients entering the

facilities, as well as patients

needing to cancel appointments

and procedures, all requiring

additional patient access staff,

technology, personal protective

equipment (PPE), and training.

Alternative/Additional Use of Staff

Develop and implement a process to use available staff (i.e., in alternative positions and, as state executive orders allow, by engaging unlicensed temporary staff) where needed during the emergency period.

Action

Employ a robust monitoring program related to the use of staff in such a manner to ensure proper patient care is delivered and documented.

Action

Ensure the organization’s disaster plan provides for alternative staffing for patient access, as well as adaptable technology. Additionally, develop and provide training to re-allocated staff for patient access services.

Action


• Considerations

• The organization has processes

in place that allow non-essential

employees to work from home

and ensure that confidential and

proprietary information is

safeguarded.

Telecommuting

Ensure the organization has a plan for resources, communications, expense reimbursement, etc.

Action

Review insurance policies (e.g., employee benefits, workers compensation, cyber, etc.) to ensure appropriate and adequate coverage.

Action

Confirm IT infrastructure can support remote work and that data privacy and security is ensured with work-from-home arrangements consistent with the organization’s information security policies and procedures.

Action

Implement additional auditing of privacy and security safeguards, and regularly provide employees critical reminders.

Action

20

21


• Considerations


in place to pause face-to-face

research activities except those

that affect the safety and well-

being of the subjects, or those

related to COVID-19.


in place to review and approve

studies and funding related to

COVID-19 research.

Research Activities

Notify the affected individuals of the required pause in current research studies involving human subjects, as deemed appropriate based on COVID-19 guidance.

Action

Ensure a process is in place to review and approve research opportunities specifically related to COVID-19.

Action

Incorporate detailed auditing of COVID-19 studies into the compliance work plan to ensure that funding sources are appropriately vetted, new research programs are based on scientific and societal needs, and the study complies with existing clinical study requirements.

Action


• Considerations

• The organization has processes in place

to meet the expanded use of telehealth,

including appropriate documentation and

the accurate use of procedure codes,

modifiers, and place of service.


to facilitate appropriate billing for all

COVID-19-related treatment.

• The organization has a process in place to

meet requirements to post its cash price

for COVID-19 testing on its public website.


to manage a significant increase in

uncompensated care and to track costs for

delivering COVID-19-related care for the

uninsured.

• The organization has a process to ensure

“balance billing” protocols for COVID-19-

related testing and treatment are in

accordance with regulatory guidance.

Documentation, Coding, and Billing

Implement processes to accurately provide telehealth and COVID-19-related services, including documentation, coding, and billing.

Action

Develop a plan to assist patients with financial clearance to determine if they are eligible for charity, Medicaid, or other insurance.

Action

For uninsured patients, track COVID-19-related testing and treatment costs for proper billing and reimbursement under the CARES Act.

Action

Review financial assistance policies to ensure that any adjustments made during a PHE are clearly delineated both as to application and the time period for the adjustment to be in place.

Action

22

23


• Considerations

• Given the exigent circumstances

unique to COVID-19, the OIG

indicated that certain free or

reduced rate provisions present

a low risk of fraud and abuse

under the AKS and could

improve beneficiaries’ access to

medically necessary services.

Free/Reduced Rate Services and Items

Carefully review provisions of free or reduced-rate services and items, which will fill critical gaps due to COVID-19, but could be construed as violations of AKS and potentially implicate the Beneficiary Inducements CMP.

Action

Ensure these arrangements do not take into account referral volumes, do not provide referral incentives, and do not involve any ownership interests.

Action

Ensure documentation demonstrates: 1) patient care needs are directly related to the COVID-19 PHE; 2) the time period for the arrangement is limited to the COVID-19 PHE; and 3) the provisions are not contingent on referrals that may be reimbursable in whole or in part by the federal healthcare program, either during or after the COVID-19 PHE.

Action


• Considerations


in place to collect data on

incidents (patients, visitors, etc.)

and associated events related

to COVID-19 exposure and

treatment in the Patient Safety

Evaluation System (PSES) to

identify issues of patient safety

and quality improvement to be

evaluated under the Patient

Safety Act.

PSO Incident Reporting

Evaluate and update the PSES intake tool to ensure that appropriate COVID-19 data is collected for analysis by the PSO.

Action

Ensure events are appropriately reported and analyzed for future patient safety improvements.

Action

24

25


• Considerations


in place to protect against

faulty/inferior/unsafe products

and services and to confirm that

products offered by vendors are

registered with the Food and

Drug Administration (FDA).


in place to document any

exceptions made to its vendor

policies and purchasing

decisions.

Vendor Due Diligence

Ensure that products are registered with the FDA, with the exception of items temporarily permitted for emergency use in healthcare by the Centers for Disease Control (CDC), i.e., industrial N95s.

Action

Document all allowed exceptions to existing vendor policies and purchasing decisions, and communicate these to administration, medical staff, nursing staff, pharmacy staff, the purchasing department, and key stakeholders.

Action


• Considerations


in place to detect email and

marketing scams related to

COVID-19.

Email and Marketing Schemes

Ensure policies and procedures are in place to monitor, identify, and protect important systems supporting COVID-19 response efforts.

Action

Examples include a workforce trained in using caution with email attachments and avoiding social engineering and phishing scams and the verification of authenticity of electronic data received by the organization through use of malware and virus protection software.

Action

Other examples include the recognition and use of trusted sources, such as government websites, for information, rather than unknown sources purporting to provide financial, product, and services assistance.

Action

26

27


• Considerations

• The organization has a process in

place to monitor all avenues of

regulatory guidance affecting

activities during and post-pandemic.

Monitoring Regulatory Guidance

Ensure monitoring for updates, changes and new developments has been effectively assigned, that monitoring continues, and that updates are communicated and evaluated for applicability.

Action

Guidance for other areas subject to compliance implications is also available, including:

- Swing Beds

- Interoperability Rule flexibilities

- Data sharing with state and federal officials

- Infection control considerations

- Management of elective procedures

- Extension of quality and cost report filing deadlines

Action


Managing Compliance Programs

and People Remotely

28

29


Rethinking Historical Approaches…

Permanently?


Rethinking Historical Approaches

Investigate

Assess EducateCommunicate

Evaluate Test

30

31


• Review and update key policies and procedures to incorporate new

processes and situations created by telecommuting

• Evaluate compliance training processes and materials

• Develop and incorporate education focused on remote workforce; determine

what positions require training

• Test the awareness and efficacy of hotline reporting mechanisms

• Have reports gone up or down since significant % of workforce went remote?

• Is an awareness campaign needed?

• Evaluate how to stay connected with leadership and departments,

especially since walking around and being physically present/available

for “hallway chats” is limited or not an option

• Increase monitoring and check points to evaluate whether historical

controls are still working as intended

• Does having remote employees create need for changes of key controls?



• Update/modify processes for handling of complaints/investigations

remotely

• Continuum of risk/scenarios that can be investigated remotely versus those

that require in-person investigation

• Evaluate investigation work steps that will require modification when

conducted virtually including

• Scheduling/conducting interviews

• Ensuring parties are in setting conducive to confidential discussions, free of

disruptions or concern of being overheard

• Determine whether interviews will be recorded and if not, how to notify interviewee

that the discussion should not be separately recorded

• Train compliance team, other key managers on specific risks/considerations


32

33



• Reeducate employees on key

policies that may be compromised

by remote workers

• Privacy policies

• Data security

• Protection of proprietary information

• What can/can’t be printed

• Document destruction

• Physical safeguards of home

office/organization’s information


• Privacy and personal information considerations:

• Review existing privacy policies to ensure the policies cover the disclosure of

PII to governmental agencies for requested emergency purposes, including

public health.

• Consider what information an organization discloses if employees or

customers have tested COVID-19 positive.

• Data protection and cybersecurity considerations:

• With many employees working from home, there are increased cybersecurity

issues or risks.

• Consider infrastructure support, remote access requirements and policies,

training, and auditing.

• COVID-19 has opened a gate to hackers using the current circumstance

for nefarious purposes.

• Send regular security reminders to all employees and other relevant personal

to be vigilant against potential cyber-scams, phishing and attack.

Data Privacy, Protection, and Security

34

35


• Once lockdowns lift around the country, compliance teams must tailor

preventative measures for the organization to:

• Reduce risks for employees returning to the workplace; and

• Respond rapidly and effectively if an infection occurs.

• As organizations develop plans for the return of staff, compliance

teams need to help determine the arrangements ensure that necessary

health and safety standards are met while ensuring compliance with

regulations.

• CDC and state and local health departments have guidance on the

issues to consider for that strategy of returning staff to the workplace.

Returning to Work


More with Less – The Effects of Furloughs and

Layoffs on Compliance

36

37


Traditional Compliance Program

Challenges

• Inadequate resources

• Technology (e.g. policy management system, COI software, training software)

• Budgets

• Staffing

• Board support

• Impact

• Compliance work plan challenges

• Increased organizational risk

• Staff burnout


COVID-19 Compliance Program

Challenges

• Similar but added complexity…

• Decreased or frozen budgets

• Staffing furloughs or layoffs

• Distraction from compliance concerns due to pressing patient care matters

• Significant increase in compliance risks that exacerbate work plan challenges

• Increased organizational risk

• Staff wearing multiple hats that may not apply to compliance

• Staff burnout/fatigue at a different level

38

39


Decreased Resources = Reassessment

• Compliance department and work plan re-evaluation required:

• Assess current skills of active compliance work force.

• Determine realignment of departmental responsibilities.

• Re-evaluate and re-prioritize work plan items based on risk. Incorporate new

high-risk areas, shift low-risk areas to “parking lot”.

• Present the modified work plan to the Board for evaluation and approval.

• Temporary or Permanent?

• Determine anticipated length of time operating under constrained resources.

• Evaluate need for, and ability to secure, external supplemental resources to

effectively mitigate risk.


Interim Solutions, Long-term Impacts

• Collaborate with leaders responsible

for key risk areas:

• Who have they assigned to monitor

regulatory changes, operational impacts?

• What tools are they using to stay

current?

• How are they validating, sharing

information?

• What mechanism can be established so

compliance team is kept abreast of key

activities/changes, how they’re being

identified, managed, monitored?

40

41



• Review workplan to develop capacity for evaluating new risk areas:

• Who has subject matter expertise to assess risk?

• What information do they need to learn?

• Evaluate how the organization’s compliance needs will evolve due to

COVID-19.

• Example: HHS Provider Relief Funds = interdepartmental approach

• Compliance team

• Regulatory programs team

• Finance team

• Internal audit team

• Operations

• Billing and collections

• Patient registration



• Evaluate how to supplement compliance team with additional resources

to expand bandwidth, allow “highest and best use” of remaining

resources

• Outsource review of COI

• Contract review (regulatory compliance elements)

• Revising policies and procedures

• Draw on specific SME resources

• Ensure high-risk areas are not placed on the back burner

• Corporate Integrity Agreement process, monitoring and reporting requirements

• Monitoring and refunding overpayments

• Ensuring provider relief funds are used or returned appropriately

• Due diligence activities are conducted on transactions that continue to move

forward

42

43


Post COVID-19

• Evaluate how “compliance shuffle” worked before returning to a

pre-COVID-19 state:

• Are there tools/processes/resources that should remain as part of a

go-forward plan?

• Were there areas where the compliance department was actually more

efficient, more impactful during the strain? How can this be harnessed and

carried forward?

• Were there silos that were torn down/new collaborations created that should

be fostered for the betterment of the organization?

• Did the department employ “precision medicine” resources to get the right

skill sets (internal or external) on key areas/issues, allowing individuals to

play to their strengths and contribute differently?


Compliance Officer’s Role

During COVID

44

45


Image Source: Shutterstock

Questions and Group Discussion


A T L A N T A | K A N S A S C I T Y | K N O X V I L L E | N A S H V I L L E | T A M P A

pyapc.com

800.270.9629

Thank you!

Lori FoleyCMA, CHC®, PHR, SHRM-CP

Principal

[email protected]

Kristen DavidsonMHA, CCEP-I®, CHC®,

CPHQ, RHIA®

Manager

[email protected]

46

47

Remote Compliance: Maintaining Effectiveness During Crisis

Documents

Transcript of Remote Compliance: Maintaining Effectiveness During Crisis