Risk Considerations in Health Care for 2021

1. Culture/Governance

   1. Culture/Tone at the Top

   2. Policies and Procedures

   3. Roles and Responsibilities

   4. Compliance Function

   5. Board Oversight for Compliance

   6. Board Effectiveness/Knowledge

   7. Management

   8. Executive Compensation/Performance Incentives/Alignment

2. Institutional Compliance Program

   1. Code of Conduct

   2. Training and Education

   3. Communication

   4. Disciplinary Action

   5. Policies and Procedures

   6. Auditing and Monitoring

   7. Response and Prevention

3. Departmental Compliance

   1. Pharmacy

   2. Emergency Department (EMTALA)

   3. Wound Care

   4. Cancer Center

   5. Laboratory

   6. Radiology

   7. PT/OT/ST

   8. Operational Departments

4. Contract Management/Third-Party Risk

   1. Physician Arrangements

   2. Joint Ventures

   3. Vendor Agreements

   4. Contract Repository

   5. Third-Party Vendor Management

5. Conflict of Interest

   1. Board-Level

   2. Executive Leadership and Management

   3. Nonemployed Physicians

   4. Foreign Support

6. Clinical Research

   1. Research Compliance Program

   2. Clinical Trials Billing

   3. Human Subject Protection

   4. Scientific Misconduct

   5. Grant Management

   6. Research Conflict of Interest

   7. Institutional Review Board (IRB) Oversight

7. Quality/Performance Improvement

   1. Patient Safety

   2. Medical Errors

   3. Patient Satisfaction

   4. Value-Based Care

   5. Quality Indicator Monitoring and Reporting

   6. Joint Commission Accreditation

   7. HACs and Readmissions

   8. Opioid-Related Monitoring

   9. Fraud, Waste, and Abuse Prevention

8. Hospital Coding and Billing

   1. Inpatient Coding (“compliance DRGs”)

   2. Short Stays/Observation

   3. Computer-assisted Coding

   4. Admitting Privileges/Appropriate Admission Orders

   5. Outlier Payments/Payments > Charges

9. Professional Coding and Billing

   1. Training and Education

   2. Physician Documentation and Coding

   3. Auditing and Monitoring

   4. Computer-Assisted Coding

   5. Use of Scribes

   6. Incident-to, Split-Shared, etc.

10. Privacy and Security

    1. Access and Permissions

    2. Physical and Device Security

    3. Privacy, Security, and Compliance

    4. Phishing, Ransomware, and Breach Response Readiness

    5. Risks with Automation, Artificial Intelligence

    6. System Acquisition/Implementation

11. Materials Management/Procurement

    1. 340B Drug Pricing Program

    2. Retail Pharmacy Pricing

    3. Vendor Background Checks

    4. Vendor Vulnerability (Single-Source)

    5. Vendors with PHI Access/Business Associate Agreements

12. Specific Compliance/Regulatory Risks

    1. Recovery Audit Contractor Readiness

    2. Provider-Based Status

    3. Durable Medical Equipment

    4. Cost Reporting

    5. Stark & Anti-Kickback

    6. Medical Device Management

    7. Manufacturer Credits for Medical Devices

    8. Medical Necessity

    9. Sanctioned Providers

    10. HIPAA Privacy & Security

    11. Kickbacks

    12. Physician Arrangements/Contracting

13. Alternate Payment Models/Delivery

    1. Accountable Care Organization Reporting

    2. Telehealth and Virtual Care Compliance

    3. Price Transparency

    4. Population Health

14. Other Programs/Services

    1. Inpatient Psychiatry

    2. IP Rehabilitation

    3. Ambulance Services

    4. SNF, Hospice, Home Health (Requirements for Certification/Payment)

15. Medical Education

    1. Program Quality & Accreditation

    2. Affiliation Management

    3. Faculty Recruiting & Retention

16. Revenue Cycle

    1. Scheduling/Verifications

    2. Registration/Admitting

    3. Charge Description Master (CDM)

    4. Charge Capture

    5. Patient Billing/Collections

    6. A/R, Denials, Bad Debt

    7. Credit Balances & Refunds

    8. CMS PEPPER Monitoring

    9. Payer Audits

    10. In-House vs. Outsourced Functions