A simple revolution: Rethinking an effective code of conduct

By Darrell Contreras, Esq., CHC-F, CHPC, CHRC

Darrell Contreras (darrell.contreras@millenniumhealth.com) is Chief Compliance Officer at Millennium Health in San Diego, CA.

The code of conduct or standards of conduct (SOC) document outlines the core behavioral expectations of the organization. Ideally, all employees would regularly read and refer to the SOC, understand what they read, and know where it can be found. However, it is possible that in an effort to provide expansive guidance, an SOC becomes so lengthy and difficult to read, it is rarely accessed by employees except during annual trainings or attestations. Moreover, after completing training, employees may quickly forget the information contained in the SOC or even where to locate the document if asked to do so. Simply stated, for many organizations and employees, there is a risk that the SOC does not get the desired attention and use.

Most importantly, the lack of awareness of the SOC can result in employees’ decision-making being based on their own idea of correct standards instead of the organization’s SOC. The challenge, therefore, is improving the SOC to create a more purpose-driven document that is a valuable source of guidance. What strategies can be used to simplify an SOC to cover the required information and convey it in a manner that is easily accessible to all employees? Could an SOC be distilled into a single-page document that would integrate into an employee’s daily workflow? At Millennium Health, we simplified and streamlined our 24-page Business Code of Conduct into a single-page document that provides guidance for our key compliance areas and addresses all of the compliance program effectiveness measures. In addition, through departmental involvement in the development of the SOC, we created organization-wide ownership of our SOC.

Obtaining leadership buy-in

Effective SOCs communicate the organization’s expectations in a simple format that can be referenced and used to guide decision-making. Creating one begins with buy-in from the organization’s leadership, compliance committee, and board of directors. For some organizations, it may be difficult to consider a single-page document, because they are used to having the lengthy, detailed one. To help address that concern and prompt consideration of a single-page SOC, consider asking the board and the compliance committee the following questions:

Do you know the official title of the current SOC?
Do you know how many pages are in the current SOC?
Do you know what topics are included in the current SOC?
Does the current SOC address the Anti-Kickback Statute?
Was the answer to question four based on your specific knowledge of the current SOC, or was it based on the expectation that the Anti-Kickback Statute should be addressed in the SOC?
Could you recite a standard from the current SOC?
Could you identify a standard that is not in the current SOC?

These questions are not intended to embarrass anyone, but rather are meant to generate discussion about whether the existing SOC is providing daily decision-making guidance. Moreover, by identifying the challenges these seven questions pose with the board and the compliance committee, a compliance officer can question whether it is realistic to expect employees to be familiar with and reliant upon the current SOC. This exercise can help establish buy-in for the concept of a simplified, single-page document.

SOC requirements

To prepare for a single-page SOC, we must start by reviewing the relevant guidance regarding the SOC. Several key criteria are included in the Office of Inspector General (OIG) compliance program guidance documents and can be divided into three categories: commitment, communication, and expectations.

Commitment requires:

A “clearly delineated commitment to compliance”^[1] by the members of the organization;
Organization’s “commitment to comply with all Federal and State standards, with an emphasis on preventing fraud and abuse”;
“Organization’s mission, goals, and ethical requirements of compliance”;
Clear expectation and requirement of all organization members to comply with the SOC; and
Participation and involvement from senior leadership in the development of the SOC.

Communication means an understandable SOC document that is:

Written in simple language that is appropriate for all levels and is translated into all relevant languages;
“Posted and distributed”^[2] to all organization members;
“Regularly updated”; and
“Details the fundamental principles, values, and framework for action.”

Expectations:

Certification that employees “have received, read, and will abide by the organization’s [SOC]”;^[3]
Obligation to report all suspected noncompliance with the SOC;
The freedom to ask questions and seek guidance related to the SOC; and
A commitment to a nonretaliation policy.

For organizations under a corporate integrity agreement, there may be additional criteria that must be included in the SOC. The Millennium Health Corporate Integrity Agreement requires us to:

Distribute “a written [SOC] to all Covered Persons”;
Demonstrate the “commitment to full compliance with all Federal health care program requirements,” including preparation and submission of accurate claims;
Require all Covered Persons “to comply with all Federal health care program requirements, as well as Millennium’s own Policies and Procedures;”
“Convey the expectation that all ‘Covered Persons’ report to the Compliance Officer, or other designated individual, “suspected violations of any Federal health care program requirements or Millennium’s own Policies and Procedures;” and
“Inform all ‘Covered Persons’ of their right “‘to use the Disclosure Program…and the Millennium’s commitment to nonretaliation and to maintain, as appropriate, confidentiality and anonymity [for] such disclosures.’”

In addition to the compliance program guidance, the HCCA-OIG Effectiveness Resource Guide^[4] includes additional criteria to be used when assessing the effectiveness of the SOC. Among the 401 measurement criteria listed in the Effectiveness Resource Guide, Section 1.41 et seq include the following criteria:

The SOC is written, reviewed, and approved by the board (directed by Section 1.3 to be written at no higher than a 10^th-grade reading level) ;
Attestations are received from all affected persons—employees, employed physicians, allied health professionals, independent (contracted) physicians, volunteers, and vendor/contractor/consultants in the organization—t hat they have received, read, and will abide by the SOC;
The SOC is consistent with the mission and vision statements of the organization and are accessible via website/intranet to all affected persons;
Test/survey of affected employees on awareness of the SOC, the content of the SOC, and how to locate the SOC;
Evidence of distribution of the SOC to all affected persons;
New affected persons are oriented on the SOC within 30 days of joining the organization; and
Understanding of the SOC is assessed and measured through post-training test scores.