When Kelly Sauders arrived in the world of compliance, the list of risks was manageable, and it didn’t feel like a risk assessment would kill that many brain cells.
“I remember we worried about Physicians at Teaching Hospitals and DRG upcoding and lab unbundling,” said Sauders, a partner at Deloitte & Touche LLP. “I never thought I’d wish for the good old days. Now there is way more to get through than anyone can.”
That exerts more pressure on compliance departments to have a risk assessment process that brings the most important risks to the top, she said at a Nov. 10 webinar sponsored by Health Care Compliance Association.[1] A more comprehensive, systematic risk assessment will help identify the high-risk compliance areas that belong on your work plan, said Leslie Boles, director of compliance audit at Waud Capital Partners, at the webinar.
For starters, they said organizations should consider risks from various sources:
-
Internal sources of regulatory information. This includes findings from The Joint Commission, recently updated policies (e.g., conflicts of interest), contract requirements and past compliance audit results.
-
External sources of regulatory information. This includes reports and guidance from the HHS Office of Inspector General, Department of Justice settlements, HHS Office for Civil Rights activities, and CMS and other regulations.
-
Past compliance risk information. Compare risks from previous work plans to identify what lingers.
-
Past experience. This includes investigations, refunds and disclosures.
-
What’s happening in the industry. COVID-19 is a biggie. Boles said she is “focused on vaccines and now the mandates,” and the waivers are also on her radar because policies and procedures will have to be monitored for compliance when the public health emergency ends. Another area that “creates organizational risk that’s lurking everywhere is the great resignation,” Sauders said. Suppose the hospital loses its only person with deep expertise in the 340B drug discount program. That kind of situation is why “you have to think about potential risks as broadly as you can.”[2]
