Complete Healthcare Compliance Manual

I. INTRODUCTION

A key objective of the Office of Corporate Compliance (Corporate Compliance) is to continuously reassess risk areas, reprioritize compliance projects that are most critical to the mission of the X, and to report compliance developments and compliance audit findings to the Board of Trustee’s Audit and Corporate Compliance Committee, the full Board of Trustees as appropriate, the Executive Audit and Compliance Committee, the Chief Executive Officer and other members of Senior Management.

Compliance risk is mitigated through internal review processes. Monitoring and auditing provide early identification of program or operational weaknesses and substantially reduce exposure to government or whistleblower claims. Although many assessment techniques are available, one effective tool is the performance of regular, periodic compliance audits by internal or external auditors.

The purpose of the 2021 Risk Assessment Guide is to describe briefly the various sources utilized by Corporate Compliance to identify and assess potential risk areas for the 2021 Corporate Compliance Work Plan. The planning process for this Work Plan is ongoing and dynamic, Corporate Compliance continually evaluates new data throughout the year to identify and reassess the likelihood of any potential risk to X.

II. ROLE OF THE BOARD OF TRUSTEES—CORPORATE COMPLIANCE

The role of the Board of Trustees is to oversee the management of the Compliance Program, to actively support the Compliance Program, and ensure implementation of the Compliance Program’s activities. Corporate Compliance is charged with the operational responsibility for the Compliance Program which includes designing and implementing tools and initiatives to sustain an effective compliance program.

Corporate Compliance has a finite amount of resources to focus on compliance matters each year. Accordingly, Corporate Compliance judiciously allocates its resources based on what the Board of Trustees and management believe to be the greatest compliance risks to X. In addition, new legal and compliance developments occur throughout the year which may require a refocusing of compliance priorities.

III. METHODOLOGY OF 2021 CORPORATE COMPLIANCE RISK ASSESSMENT

Resources: The 2021 Compliance Risk Assessment utilized numerous internal and external resources to help determine which risk areas should be evaluated. Two important data resources are the Office of the Inspector General for the United States Department of Health and Human Services’ (OIG) FY 2021 Work Plan and the Office of Medicaid Inspector General (State) 2020-2021 Work Plans. Corporate Compliance utilizes these work plans, which provide roadmaps of the agencies’ planned audit activities. It is an industry standard for healthcare providers to review the OIG and State Work Plans annually and to evaluate their own entities for these potential risk areas.

For the 2021 risk assessment process, Corporate Compliance also conducted interviews with key departments and individuals to identify and assess potential risks throughout the X. In addition, Corporate Compliance evaluated financial data for reimbursement trends, prior X audit data, government data trends, state and federal enforcement agencies’ audit reports and regulatory notices, and internal surveys on various topics to identify other areas of potential risk.

IV. BRIEF SUMMARY OF THE CORPORATE COMPLIANCE RISK ASSESSMENT ANALYSIS

Similar to our 2020 risk assessment, the compliance risk assessment indicates that compliance resources should be placed on X issues as they remain at “X” risk. Under F-SHRP, the Federal-State Health Reform Partnership, the State is mandated to generate $644 million in fraud and abuse recoveries in 2021, its highest financial target to date. In addition, as part of a recent state regulation, X is required to perform risk reviews and audits on facilities that bill over $500,000 in Medicaid billings. We anticipate that the State will audit the effectiveness of X’s compliance program.

The 2021 risk assessment places X at a “X” risk.

This year the X’s vulnerability with respect to X was moved from X to X as a result of current audits. In addition, the 2020 federal health care legislation places an emphasis on ancillary services and will require mandatory compliance programs for these services.

For 2021, inpatient billing is in the “X” risk category since the volume within the organization is great and there is an increase in government audits and investigations, including the launch of new RAC audits. However, prior Corporate Compliance and government audits had not detected any significant audit findings in this area.

X and other new businesses are listed as a separate area of risk because the X has not had an opportunity to complete enough audits to fully assess its internal controls to mitigate potential billing errors.

X also remains a risk category because the government is devoting more enforcement resources in this area. Both federal and state regulators are moving towards quality-based audits, some of which already have resulted in multi-million dollar settlements. These audits are focused on various quality issues, including medical necessity, such as whether a patient should be treated as an inpatient versus an outpatient. X is working on ways to further collaborate between quality and compliance to ensure that we are jointly monitoring quality-related issues.

Issues relating to X remain a “X” risk area because the law is a strict liability statute and the government continues dedicate enforcement resources to reviewing physician arrangements. In 2020, the Department of Justice collected $108 million from an Ohio hospital for unlawful payments to physicians in exchange for cardiac patient referrals. The recently-enacted health care legislation will make it even easier for the government to pursue Stark and anti- kickback claims against healthcare providers.

In addition, the compliance risk assessment found that more resources should continue to be placed on creating a greater awareness of the Compliance Program including its policies related to privacy issues. In 2020, X had a number of privacy breaches despite employee education and awareness initiatives.

See the graph below to view the general risk areas. See the enclosed 2021 Corporate Compliance Work Plan to view the planned compliance and audit initiatives to address potential risks.

The purpose of this graph is to provide a visual depiction of high risk issues which may impact the X based upon our analysis. The graph does not include all proposed audits, initiatives or risks, but provides a high-level overview of the compliance risks that may impact X.

INTRODUCTION

In order to have an effective Corporate Compliance Program, it is necessary to continuously assess risk, re-prioritize compliance projects and report compliance developments and audit findings to the Board’s Audit and Corporate Compliance Committee, the full Board of Trustees as appropriate, the Executive Audit and Compliance Committee, the Chief Executive Officer, and the General Counsel. This 2021 Risk Assessment Guide briefly describes some of the various sources utilized by Corporate Compliance to identify and assess potential risk areas. See Exhibit A for a listing of the primary resources consulted for this review.

SWOT ANALYSIS

In 2020, Corporate Compliance assessed the resources available to ensure an effective compliance program at the X. One of the assessment tools utilized was the Strengths, Weaknesses, Opportunities and Threats (SWOT) analysis, depicted below. The primary weakness identified is X. To address this risk, Corporate Compliance did X.

Other weaknesses identified by the Compliance risk assessment include X. To address this risk, Corporate Compliance did X. In addition, X plans to implement the following measures: X; X; and, X to further mitigate this risk.

The primary threats identified demonstrate there are a number of external agencies that are likely to focus various audits at the X facilities. The amount of government resources dedicated to review the X’s coding and billing continues to increase at an accelerated rate because of the new federal legislation. In addition, the government may continue to specifically focus on facility X because of past audits.

Despite these threats, X’s Compliance Program has continued to receive national awards as having the best compliance practices. The Compliance Program also has opportunities in the future to further improve upon its efforts. For example, X may improve throughput times to audit coding records and conduct HIPAA audits. In addition, we can continue to improve our transparency efforts by starting to build X.

X 2020 FINANCIAL DATA

Analyzing X financial data is a key component of Corporate Compliance’s risk assessment process. We review inpatient and outpatient revenue trends including net patient revenues and payor and case mix. For purposes of this guide, financial data is for year-to-date data from January 1, 2020, through and including October 31, 2020. Data is analyzed at the facility level for net patient revenues (net of provision for bad debt), payor mix, and case mix to determine potential external audit risk and allocation of Corporate Compliance Audit resources.

The graph above depicts the payor mix.

The X’s tertiary centers receive the largest amounts of federal healthcare program revenues and therefore have a higher likelihood of being audited by government agencies. The community hospitals also receive a significant portion of their inpatient revenue from federal dollars. Clinics outside the four walls of the hospitals also have a high likelihood of being audited by state agencies. X will also focus its Medicaid specific audits at facilities that bill over $500,000 of Medicaid revenue.

The graph above depicts the net inpatient service revenue for all X facilities.

The graph above depicts the net outpatient service revenue for all X facilities.

FY 2020-2021 OIG AND STATE WORK PLANS

Two key work plan resources are the OIG FY 2021 Work Plan and the State SFY 2020-2021 Work Plan. Each year, these governmental agencies release audit work plans which provide a roadmap of their planned audit activities. It is an industry standard for healthcare providers to review the OIG and State Work Plans annually and to evaluate their own entities for these potential risk areas. Corporate Compliance reviewed these work plans and incorporated any applicable audit categories into its 2021 Work Plan.

CORPORATE COMPLIANCE AND INTERNAL AUDIT RISK ASSESSMENT INTERVIEWS

Corporate Compliance, along with Internal Audit (IA), performed interviews of key leaders with the goal of including these individuals in the overall risk evaluation and discussion. After completion of the interview phase, both Corporate Compliance and IA create individualized audit work plans that are shared between them before finalization to avoid audit overlap. Audit results are shared throughout the year between the departments.

RECENT PRIOR X AUDITS

Professional Fee Services

• XXXX

• XXXX

• XXXX

• XXXX

• XXXX

• XXXX

Corporate Compliance Audit also is responsible for various investigative audits that are requested by management or are referred through the Compliance HelpLine or other referrals. These audits are conducted throughout the year on an as-needed basis. All requests are evaluated and referred to the appropriate member of the audit team for review. In 2020, there were X investigative audits, a decrease from the X investigative audits in 2019. X of the X investigations are closed and resulted in no material findings.

During 2020 Corporate Compliance Audit’s findings were generally non-material in nature and were communicated to key stakeholders. Corrective actions were recommended to the appropriate management and any identified overpayments were refunded. In 2021, Corporate Compliance Audit plans on auditing more relevant potential risk areas through the use of data mining.

The graph above depicts the trend of audits from 2016 through 2020 for Part A, Part B and Investigative audits.

VOLUNTARY DISCLOSURES

The OIG, State and Medicare’s Fiscal Intermediaries have processes for health care providers to voluntarily disclose and rectify overpayments received. The benefits of self disclosure include forgiveness or reduction of interest payments, extended repayment terms, waiver of penalties and/or sanctions and possible preclusion of a subsequently filed State False Claims Act qui tam action based on the disclosed matter. As a result of the internal review processes and our proactive Corporate Compliance Program, the X discovered a number of overpayments during 2020 which arose as a result of inadvertent incorrect billing, documentation problems and other issues. X made voluntary disclosures to Medicare or Medicaid of X matters and repaid (or has proposed to repay) an approximate total of $X. This figure does not include items that are not routinely disclosed during our normal audit process.

GOVERNMENT AUDIT SUMMARY

X continues to be audited by government agencies on a regular basis. In 2020, the number of government audits increased significantly, which is not a surprise given the vast amount of new resources the government has dedicated towards ensuring healthcare providers submit accurate claims to Medicare and Medicaid. The number of audits increased by over X percent when compared to 2019. The following grid depicts the status of all government audits at all facilities as of December 2020. Please note this grid does not include the recent RAC requests.

PAYMENT FOR EVALUATING PAYMENT PATTERNS ELECTRONIC REPORT (PEPPER)

PEPPER is an electronic report available from the federal government containing hospital- specific data for target areas that have been identified as high risk for payment areas (i.e., specific diagnosis-related groups [“DRGs”] and discharges). It is suggested that anything above the 80^th percentile or below the 20^th percentile, as compared to National, State and Jurisdiction (i.e., Regional) benchmarks, should be reviewed. The grid below identifies those areas highlighted in red, green, blue and gray for the X. The outliers listed below are facility- specific and no trends were identified as X-wide issues.

Even though a facility may be red (i.e., at or above 80th percentile for National, State or Jurisdiction) for a certain DRG, it does not mean the facility’s coding is inappropriate. A facility could have a higher ranking because of demographic or other environmental reasons. In 2019-2020, Compliance and Quality conducted audits in several of these areas including: X, X, X, X, X and X.

The grid above demonstrates that there are several areas that are above the 80^th percentile (red) and within or below the 20^th percentile (green) in comparison to the national, State and Jurisdiction. Corporate Compliance will conduct data mining activities in this area to ensure the potential risk areas are appropriately addressed.

RECOVERY AUDIT CONTRACTOR (RAC) AUDITS

RAC audits recently began after a long delay. Based on the RAC demonstration project (2005-2008), the Centers for Medicare and Medicaid Services (CMS) has identified Medicare payments that were not medically necessary and coded incorrectly for numerous hospitals. During the demonstration project, CMS recouped a total of approximately $X from the X from various audits after the appeals process.

The newly-appointed RAC contractor began requesting charts from X for review this summer. To date, over X records have been requested. CMS-approved audit issues for our region include transfer of care, MS-DRG validation, durable medical equipment, and other services such as pharmacy supply and dispensing fees, clinical social worker services, urological bundling and ambulance services. Currently, there are 71 approved issues listed by DCS for review. The RAC also intends to audit physician documentation and billing in the future. In addition, the RAC plans to use its discretion to extrapolate its findings in certain cases. Extrapolation is the process that Medicare contractors use to estimate a total overpayment based on an audit of a relatively small subset of claims. As a result, even a relatively small finding could result in a potentially large overpayment in the future.

Moreover, the recently enacted Patient Protection and Affordable Care Act (PPACA) also includes the expansion of the RAC program to Medicaid claims. States must implement RACs for Medicaid and must use a contingency fee payment system. The original implementation deadline was December 31, 2020. X has not selected a RAC vendor to audit Medicaid claims, but is expected to do so in 2021. This will be in addition to the Medicaid Integrity Contractors (MICs) that CMS already contracts with to audit Medicaid claims to ensure claims were appropriately coded and paid and the voluminous audits that the state conducts at our facilities.

MEDICARE CASE MIX

The graph above depicts the case mix trend for X for 2017-2020.

The case mix index represents the complexity of a hospital’s patients’ cases and indirectly demonstrates the average level of care provided to its patients in a given time period. Case mix is an effective tool to help identify compliance trends because when monitored over time, trends may indicate changes in coding practices, patient population, and services offered. The frequency of shifts should be minimal and when a shift occurs, management response is required.

Corporate Compliance reviewed the Medicare case mix index. The case mix for a few of X’s facilities increased slightly in 2020.

COMPREHENSIVE ERROR RATE TESTING (CERT)

The Comprehensive Error Rate Testing (CERT) program was initiated by CMS to achieve the agency's mission to emphasize accountability, pay claims appropriately, and to provide a renewed focus on the customer. The program produces national, contractor-specific, and service-specific paid claim error rates, as well as a provider compliance error rate. The paid claim error rate is a measure of the extent to which the Medicare program is paying claims correctly. The provider compliance error rate is a measure of the extent to which providers are submitting claims correctly.

The program has independent medical reviewers periodically reviewing representative random samples of Medicare claims that are identified as soon as they are accepted into the claims processing system. The independent reviewers medically review claims that are paid. Claims that are denied are validated to ensure that the decision was appropriate.

PROFESSIONAL FEE DOCUMENTATION AND BILLING

In 2019, Corporate Compliance identified X as a high risk area and hired an additional resource to help assist in monitoring faculty practice’s coding and billing. Also, a large number of new physicians will be joining the X in 2021. As a result, additional physician documentation and billing audits will continue to be a high priority and a focus of the Corporate Compliance Work Plan based upon this and other factors. In addition, X has budgeted two additional full-time employees to be dedicated to conduct additional coding and billing audits to mitigate risk.

CORPORATE COMPLIANCE NON-CODING INITIATIVES

Corporate Compliance spearheaded several non-coding initiatives in 2020 as part of its Work Plan. Among other items, these initiatives included reviewing X, creating additional controls to X, revamping X, launching additional compliance X, and implementing X. These initiatives helped to further enhance the X Compliance Program.

OFFICE OF THE MEDICAID INSPECTOR GENERAL

The core function of State is to conduct and supervise activities to prevent, detect and investigate Medicaid fraud and abuse with the goal of assuring integrity in the Medicaid program. Fraud and abuse control activities are shared with a variety of state agencies including, but not limited to, the Department of Health, the Office of Alcoholism and Substance Abuse, the Office of Mental Health and the State Education Department. These agencies coordinate their work with the State Attorney General’s Medicaid Fraud Control Unit and the State Comptroller.

2019 State Annual Report

State leads the nation in Medicaid fraud, waste and abuse prevention and detection, and serves as a role model for other states to emulate. For FY 2019-20, the Legislature has established a goal of $870 million in state-share recoveries and cost avoidances for State nearly three times the amount assigned in 2016-17.

To achieve this goal, State worked throughout the last year to develop accurate, reliable measures of cost avoidance, and developed new techniques to identify potential for cost avoidance in every part of the agency and the Medicaid program.

State saved $1.61 billion “through cost-savings activities” last year, according to the agency's 2019 annual report, which also shows State exceeding a federal target to recover hundreds of millions of dollars in Medicaid funds as required under the Federal-State Healthcare Reform Partnership agreement (F-SHRP).

Under F-SHRP, State and other agencies are responsible for recouping “fraud and abuse” payments totaling $429 million in 2020 and $644 million in 2021. These recovery goals are in addition to targets set in the State budget for collection of back payments from responsible third-payers – targets which were recently increased by more than $150 million as part of the Deficit Reduction Plan.

The graph above depicts the percentage of statewide recoveries for fraud financial investigations, civil recoveries, provider audit recoveries and system match recoveries.

The graph above depicts the top five categories for the 2019 provider audits.

The graph above depicts the top three categories for the State rate audits for 2019.

The graph above depicts the top five categories of the State’s activities related to system match and recovery.

THE PATIENT PROTECTION AND AFFORDABLE CARE ACT (PPACA)

On March 23, 2010, President Obama signed into law the PPACA. This law will increase the risk levels of all health care providers, including our X, given the vast amount of resources and enforcement weapons created by this bill. PPACA includes approximately $300 million of new funding over the next six years to further supplement the government’s already large arsenal of enforcement resources.

One example of the new PPACA enforcement tools is the requirement that health care providers maintain mandatory compliance programs. The Secretary of the U.S. Department of Health and Human Services (HHS) will be rolling out specific standards for various industries. Durable medical equipment and home health providers will likely be among the first to be subject to this requirement since they were highlighted in PPACA as being high risk areas.

Other new enforcement laws include enhanced screening requirements of applicants for enrollment, a requirement that physicians be enrolled in Medicare to order durable medical equipment or certify home health services, more expansive revisions to the anti-kickback statute and False Claims Act, and new Civil Monetary Penalties laws for new health care areas that are subject to fraud and abuse. There is also a plan to introduce a new bill to double the penalties for Medicare fraud which are already significant in nature. This proposed legislation also include changes how long a health care provider has to submit a claim for reimbursement. Facility claims must now be submitted within one year from the date of service, which may impact our ability to recoup funds for services we have provided. In addition, CMS has now been given the authority to suspend payments during a pending fraud investigation. PPACA also includes changes to how health care providers should address overpayments.

Historically there has been no express duty to refund innocent overpayments. However, the PPACA now imposes an express duty to refund and report overpayments 60 days after over- payment is identified or when the cost report is due. The failure to report and return may lead to False Claims Act liability. Taken together, these provisions clearly signal the government's intention to aggressively pursue and prevent fraudulent and abusive activities and to maximize recovery when overpayments are identified. While these changes will not materially change the approach the X uses to identify and address potential compliance risks, the new legislation will further increase the risk level of any non-compliance with the applicable regulations.

CONFLICTS OF INTEREST

The new PPACA legislation also includes the Physician Payment Sunshine provisions, which requires drug, medical device, biological and medical supply manufacturers to disclose direct payments or transfers to physicians and teaching hospitals that are $10 or more (or total over $100 in a calendar year). It also requires those manufacturers to disclose any non-public ownership or investment interests of physicians and their immediate family members in the manufacturers. Those reporting requirements do not take effect until March 31, 2013 and the information will be available online to the public. Also, many states already have proposed or passed similar laws regarding physician financial relationships, including New York and New Jersey.

In order to address this issue, the X recently revised its Gifts policy to make it more stringent. In essence, the new policy is a “no gifts” policy and allows physicians to serve as consultants to health care manufacturers only under appropriate circumstances. In addition, the X has recently implemented a more robust electronic conflict of interest reporting form that our physicians and key employees will be required to fill out on an annual basis and update as appropriate throughout the year.

UNITED STATES SENTENCING COMMISSION - FEDERAL SENTENCING GUIDELINES

Federal law enforcement authorities will often refer to the Federal Sentencing Guidelines (Guidelines) when determining whether to criminally prosecute an organization at the conclusion of a criminal investigation or to pursue the organization on civil grounds. Certain provisions of the Guidelines contain specific compliance plan guidelines that are generally regarded as the template from which effective corporate compliance programs are based. In fact, the OIG based its Compliance Guidance for health care providers on these Guidelines.

The Guidelines are also likely to be considered by corporate governance regulators and private plaintiffs in determining whether to pursue the members of a governing board for breaches of their fiduciary duties to oversee the compliance plan. For these reasons and others, these Guidelines are generally recognized as the benchmark of an "effective" organizational corporate compliance plan. In April 2010, the United States Sentencing Commission proposed amendments to the Guidelines to further strengthen the role of the compliance officer which went into effect in 2010. In short, the new amendments make clear that in order for a corporation to be eligible to receive a reduced sentence it also must have in place the following at the time of a potential criminal act:

• The compliance officer should have a "direct reporting obligation" to the board or subgroup thereof (e.g., the compliance or audit committee);

• The compliance program detected the criminal conduct before it was discovered or was reasonably likely to be discovered outside of the organization (i.e., by regulators);

• The organization promptly reported the offense to the federal government;

• No corporate compliance officers were involved with, condoned or were willfully ignorant of the criminal offense; and,

• The organization conducted an assessment of its existing compliance program, including modifications to the program as may be appropriate to prevent the occurrence of similar conduct.

The amendment specifically refers to the use of outside professional advisors to ensure the adequacy of the assessment efforts. Also, the Commentary to this amendment defines "direct reporting obligation" as one which provides the compliance officer with express authority to communicate personally with the governing authority: (1) promptly on any matter involving criminal or potential criminal conduct; and, (2) no less than annually on the implementation and effectiveness of the organization's compliance plan.

The X already has in place reporting measures that meet the intent of these Guidelines. However, X from the State, also recently recommended that the compliance officer provide an in-person presentation to the full board at least on an annual basis. We will implement this reporting in 2021. These changes are a reminder of the federal government’s focus on enhancing governance controls in organizations.

KEY 2021 REIMBURSEMENT CHANGES

There have been a number of key reimbursement changes which can impact compliance initiatives. Below is a summary of some of them which Corporate Compliance will be evaluating as part of its 2021 risk assessment.

THE CMS MEDICAID INTEGRITY PROGRAM (MIP)

The MIP was established via the Deficit Reduction Act and substantially increased funding dedicated to Medicaid program integrity efforts. This program is the first national strategy to detect and prevent fraud and abuse in the history of the Medicaid program and efforts will yield significant savings to help sustain the program. Funding of $255 million will be allocated over five years (2016-2020) and $75 million annually beginning in 2021. CMS will implement this program through Medicaid Integrity Contractors (MICs). Audit targets include physicians, home health/skilled nursing, hospice, nursing facility/nursing home, renal dialysis, durable medical equipment, transportation/ambulance, labs/X-ray and pharmacy.

MIP is the first federal program created to conduct Medicaid provider audits. Its purpose is to support program integrity to the states, and conduct post-payment audits of providers and identify overpayments. MIP is working with the State on joint Medicaid audit projects and is expected to target our state this year. To date, MIP has conducted X audits.

ZONE PROGRAM INTEGRITY CONTRACTORS (ZPICs)

CMS has consolidated the work of Medicare's Program Safeguard Contractors and Medicare Drug Integrity Contractors with new ZPICs. Nationally, there are a total of 7 zones with 3 contractors awarded to each Zone. The new contractors will be responsible for ensuring the integrity of all Medicare claims under Parts A and B (hospital, skilled nursing, home health, provider and durable medical equipment), Part C (Medicare Advantage health plans), Part D (prescription drug plans), and Medi-Medi (Medicare-Medicaid data matches). The advantages of consolidating these efforts include improved data and document information sharing, enhanced project and case tracking in the Federal Investigation Database, and enhanced fraud, waste and abuse leads. To help address this risk, X has invested in an internal data mining tool to help detect irregular coding and billing patterns.

MEDICARE ADMINISTRATIVE CONTRACTORS (MACS)

As required by section 911 of the Medicare Prescription Drug, Improvement and Modernization Act of 2003, CMS is replacing its current claims payment contractors (fiscal intermediaries and carriers) with new contract entities called Medicare Administrative Contractors (MACs). State home health and hospice claims will be processed through X. All Part A and Part B claims will be processed through X.

DATA MINING

The government utilizes sophisticated data mining tools to target health care providers whose claims are not in full compliance with all applicable regulations. Both the federal government and State also plans to specifically invest millions of dollars to further ramp up its ability to effectively data mine aberrant claim patterns.

Corporate Compliance is currently working with a data mining software vendor that will provide the ability to effectively analyze large quantities of data. The goal of this analysis is to allow a heightened focus on identified risk areas that will be audited by optimizing existing resources. This product was implemented on X.

Corporate Compliance plans to mine data related to OIG and State topics and conduct probe audits pertinent to data mining results. Corporate Compliance also identified potential risk areas in the grid tot the right through data mining activities that will be audited in 2021. Prior and current audits have already addressed the majority of the items detected through internal data mining.

2020 HOTLINE TREND ANALYSIS SUMMARY: HELPLINE AND INTERNAL CASES

The Corporate Compliance HelpLine is an avenue by which individuals or interested parties may report any issue or question associated with any of the X’s policies, conduct, practices or procedures believed by the employee to be a potential violation of criminal, civil or administrative law, or any unethical conduct. Inquiries can be made via the HelpLine 24 hours a day, seven days a week. Individuals are encouraged to report any problem or concern either anonymously or in confidence via the HelpLine as they deem appropriate.

To date, the number of internal and HelpLine cases received in 2020 was slightly higher than last year. Over X reports were received through the HelpLine and by other means, including walk-ins, mail and telephone. This translates to a rate of approximately 10 calls per thousand System employees, which is above the national average. However, only X% of the employees surveyed knew how to contact the compliance office to report an issue. The grid describes the general categories of reports received in 2020. The largest number of issues arose in the category of X followed by X, X and X.

ANNUAL MANDATORY COMPLIANCE TRAINING

In 2020, over X% of the X employees (including per diem employees) completed the annual mandatory compliance training program. Please note that a few facilities operate on a different training schedule due to internal reasons and their completion rates are estimated based upon past performance and data received to date this year. The program was created in-house and features the X’s Code of Ethical Conduct and X policies and procedures. This year the training highlighted X policy which won a national media award for its content. Among other topics, the X and X rules were also highlighted. In a survey that over X employees completed, approximately X% of the employees agreed or strongly agreed that the compliance training gave them a better understanding of the X’s Compliance program and found the training program effective.

The program includes broadcast news reports on compliance-related health care issues and an original video segment regarding X. New employees of the X are required to complete the Compliance online orientation program before or shortly after they commence work. A list of X employees who have not completed the annual compliance training has been provided to Human Resources to assess appropriate disciplinary action in addition to their managers reflecting this on their annual performance evaluations.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

The enactment of the Health Information Technology for Economic and Clinical Health provisions of the American Recovery and Reinvestment Act (HITECH) has dramatically changed the landscape for compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. HITECH included significant expansion of HIPAA Privacy and Security requirements to address concerns related to confidentiality in electronic health information storage and exchange. These provisions place new compliance obligations not only on covered entities, but also on their related business associates. HITECH includes provisions to dramatically increase penalties for violations to a maximum of $1,500,000 per violation per calendar year. In addition, the State has been given concurrent jurisdiction with the federal government to enforce HIPAA. This means that the number of enforcement actions under HITECH will likely increase.

The HITECH Act includes a requirement that covered entities must notify individual patients, and the Secretary of HHS in some cases, if unsecured protected health information is inappropriately disclosed and harm to the patient may result. The federal government is in the process of issuing new guidance to comply with the recent changes in the HITECH law. In response to these new legal requirements, Corporate Compliance has implemented a new policy regarding breach notification. As a result of the heightened enforcement environment and new law, the X has reviewed, streamlined and consolidated over X HIPAA policies and forms.

In 2020, the X will report a total of X HIPAA breaches to the Secretary of Health and Human Services to comply with its annual reporting requirement pursuant to the regulatory provisions of the breach notification law. In addition, the X will report a total of X breaches to the state in instances where the breach involved the potential compromise of a patient’s Social Security data. Examples of the breaches that occurred in the X include X, X, X, X, and X.

All of these breaches have been thoroughly investigated and managed in Corporate Compliance with the X Human Resources disciplinary procedures and supporting policies. Further education on the importance of the privacy and security of patient information and new X policies and forms to improve compliance with HIPAA regulatory requirements is ongoing. In addition, the X conducted several HIPAA audits in 2020 and will continue to do so in 2021 to further monitor this area.

COMPLIANCE POLICIES

Based on the gap analysis of compliance policies conducted last year, Corporate Compliance drafted and the X adopted a number of new and revised policies. Of greatest significance is the new “Gifts and Interactions with Industry Policy,” which represents a major change from the X’s previous policy. The policy bans all gifts, including food, from industry to X employees and places new restrictions on consulting arrangements between employees and industry. This policy became effective in May, 2020. The X also reviewed, streamlined and consolidated over thirty X HIPAA policies and forms. In 2021, Corporate Compliance will be reviewing all of its core compliance policies and Code of Ethical Conduct to ensure they are up to date.

OTHER REGULATORY TOPICS

CONCLUSION

In conclusion, the compliance risk assessment indicates that the majority of compliance resources should be placed on X. X should continue to conduct audits at facilities in the areas of X. The compliance risk assessment also demonstrates that the need to continue to audit X due to the potential financial impact on X and the increased government scrutiny despite a favorable historical auditing record.

In addition, the compliance risk assessment found that more resources should continue to be placed on creating a greater awareness of the Compliance Program including X. Also, additional controls should be placed on X. To address these issues, the Work Plan has audits or compliance initiatives focused on X.

EXHIBIT A