PYA Principal Shannon Sumner and Consulting Manager Susan Thomas presented “Regulatory Compliance, Risk Management, and the Trustee’s Role.” In this presentation, they will: Describe the evolving compliance and risk management landscape, including government agencies’ expectations for compliance oversight. This presentation will: - Outline recent government investigations and settlements. - Provide key takeaways regarding responsibilities for ensuring an effective compliance program. - Connect trustee duties to specific elements of enterprise risk management. - Empower trustees with questions to ask leadership teams in preparation for playing a more active role in the compliance program.

1. 2019 Montana Hospital Association Health Summit
April 3, 2019
Presented by:
Shannon Sumner, CPA, CHC®
Susan Thomas, CHC®, CIA, CRMA, CPC®
Regulatory Compliance, Risk
Management, and the Trustee’s Role

2. Prepared for Montana Hospital Association Health Summit Page 1
Objectives
 Former emphasis of
healthcare compliance
 Government’s expectations
for board oversight
 Current risk focus areas
 Other areas of compliance
consideration
Image Source: Freepik (2019) Freepik.com

3. Source: HCCA Oversight of the Health Care Industry Flowchart Found at: https://www.hcca-info.org/Resources/View/tabid/451/ArticleId/4930/Oversight-of-the-Health-Care-Industry-Flowchart.aspx

4. Prepared for Montana Hospital Association Health Summit Page 3
Previous Focus of Compliance Efforts
1. Medical record documentation
 Signatures
 Legibility
 Timeliness
2. Physician and hospital coding
3. Billing for services

5. Prepared for Montana Hospital Association Health Summit Page 4
Medical Record Documentation

6. Prepared for Montana Hospital Association Health Summit Page 5
Physician and Hospital Coding
GOAL: Ensure that all coding for diagnosis and
procedures complies with coding rules and guidelines
 Coding errors can trigger the False Claims Act,
resulting in a base fine and treble damages for each
incorrect claim
 Hospitals and physician practices must establish
adequate internal procedures to ensure the accuracy
of claim submissions

7. Prepared for Montana Hospital Association Health Summit Page 6
Billing for Services Rendered
Issues of non-compliance in billing:
 Items or services not rendered or not provided
 Equipment, medical supplies, and services that are not reasonable and
necessary
 Double-billing
 Billing for non-covered services
 Misusing provider identification numbers
 Unbundling
 Improper use of modifiers
 Professional supervision
 Clustering
 Failing to refund credit balances
 Billing a higher level of service than was provided

8. Prepared for Montana Hospital Association Health Summit Page 7
Government’s Expectations for Board Oversight
 Practical Guidance for Health
Care Governing Boards on
Compliance Oversight (Handout)
 Federal Sentencing Guidelines
 OIG’s Compliance Guidance
 Corporate Integrity Agreements
 DOJ’s Evaluation of Corporate
Compliance Functions (Handout)

9. Prepared for Montana Hospital Association Health Summit Page 8
Board Accountability and Mandatory Certifications
Source: Individual Accountability/Mandatory Certifications/Expansions of “Covered Persons” – Signature Health CIA
“The Board of Directors has made a reasonable inquiry
into the operations of Signature’s Compliance Program,
including the performance of the Compliance Officer
and the Compliance Committee. Based on its inquiry
and review, the Board has concluded that, to the best of
its knowledge, Signature has implemented an effective
Compliance Program to meet Federal health care
program requirements and the obligations of the CIA.”

10. Prepared for Montana Hospital Association Health Summit Page 9
DOJ’s Evaluation of Corporate Compliance
Root Cause
Analysis =
“Who?”
Compliance
Leadership
Across All
Service Lines
Compliance
Expertise on
Board
Stature of
Compliance
Program
Quality of Risk
Assessment
Process
Training in High-
Risk Areas
Transparency of
Disciplinary
Actions
Quality of
Internal
Investigations
Incentivize
Compliant
Behavior
Control Testing
of Compliance
Issues
Outsourced
Service
Providers
Resolution of
Transaction
Due Diligence
Findings

11. Prepared for Montana Hospital Association Health Summit Page 10
Individual Accountability in the News
Hospital CEO to Pay $1.25 Million
False Claims Tab; a Chilling
Reminder for Health System
and Hospital Leadership

12. Prepared for Montana Hospital Association Health Summit Page 11
DOJ Recovery Statistics
Source: https://www.justice.gov/civil/page/file/1080696/download
Footnotes:
1. Non qui tam settlements and judgements do not include matters delegated to United States Attorneys' offices. The Civil Division maintains no data on such matters.
2. Relator share awards are calculated on the portion of the settlement or judgement attributable to the relator's claims, which may be less than the total settlement or judgement. Relator share awards
do not include amounts recovered in subsection (h) or other personal claims. See 31 U. S. C. § 3730(h).
0
0.5
1
1.5
2
2.5
3
3.5
2010 2011 2012 2013 2014 2015 2016 2017 2018
InBillions
Annual Totals
Settlements and Judgements (Total Qui Tam and Non-Qui Tam) Relator Share Awards (Total)21

13. Prepared for Montana Hospital Association Health Summit Page 12
Current Compliance Risk Focus Areas

14. Prepared for Montana Hospital Association Health Summit Page 13
Physician Financial Arrangements
 Risks
 Stark Law violations
 Referrals for DHS
 Anti-Kickback Statute
 Pay, offer, solicit, or receive
remuneration
 Use of NPPs
 Supervision and productivity
boosts
 Shift of responsibility
 From hospital to physician
 Controls
 Fair market value and
commercial reasonableness
 No tie to current or expected
referrals
 Legal counsel review
 Duties and responsibilities
defined
 Oversight
 Compensation committee
 Monitoring and auditing

15. Prepared for Montana Hospital Association Health Summit Page 14
Real Estate and Leasing
 Risks
 Inconsistent and variable
execution and management
 Stark Law and Anti-Kickback
Statute requirements
 Time share/Space share
 Provider-based clinic
regulations
 Controls
 Structured to meet exceptions and
safe harbors
 Standardized, systematic processes
 Standard lease policies and
documents
 Formal review and approval process
 FMV Opinion and Market Rent
Study
 Walking the leased space and
annual attestations
 Reconciliations of operating
expenses

16. Prepared for Montana Hospital Association Health Summit Page 15
Cybersecurity
 Risks
 Budget and resource limitations
 Legacy equipment in use
 Crime as a business – high value,
ease of compromise
 Ransomware
 Lack of an adequate cybersecurity
response team
 Inadequate cybersecurity
insurance coverage
 Staff concerns (i.e., patch
management, work-arounds)
 Employees are the weakest link
 Controls
 Investment in qualified information
security personnel with robust
leadership
 Use of current, fully supported,
secure operating systems
 Secure design and implementation
of connectivity solutions
 Identify and address potential
vulnerability that can impact patient
care and organizational operations
 Educate, educate, educate

17. Prepared for Montana Hospital Association Health Summit Page 16
HIPAA Security Risk Analysis and Meaningful Use
 Risks
 Medical record integrity and
impact on patient care
 Patients’ right to privacy
 Inappropriate PHI access and
disclosure
 Reportable breach
 Improper incentive payments
 Controls
 Implementation of HIPAA
privacy and security standards
 Policies and procedures
(review OCR findings)
 Robust Monitoring and
auditing, including Business
Associate Inventory
 Follow through on HIPAA
Security Risk Analysis Action
Plans!

18. Prepared for Montana Hospital Association Health Summit Page 17
Vendor Management
 Controls
 Ethical standards and rule of engagement
for all vendors
 Assure that no vendors are excluded
entities
 Robust procurement process
 Accountability
 Contract language standardization
 Invoice controls
 Monitoring and auditing of high-risk vendor
relationships
 Contract termination process
 Create a third-party or vendor management
checklist:
 Reference checks
 Financial solvency
 Liability coverage
 Regulatory compliance
 Verification of delivery, service, and expertise
 Risks
 Conflicts of interest
 Excluded vendors
 Contractual non-compliance
 Management of Vendors as Business
Associates

19. Prepared for Montana Hospital Association Health Summit Page 18
Post-Acute Care Services
 Risks
 Improper billing and
reimbursement
 Staffing – turnover, scope of
practice
 Quality-of-care issues
 Controls
 Assurance that patient choice is
provided for the selection of post-acute
care options
 Policies and procedures to address
CMS requirements for patient
admissions, care plans, transfers, and
discharges
 Documentation, coding, and billing
integrity are a primary focus
 Implement processes to audit and
monitor bundled payments
 Robust quality reporting
 Patient safety, including neglect and
abuse, is an organizational priority

20. Prepared for Montana Hospital Association Health Summit Page 19
Outsourced Services
 Risks
 Regulatory requirements
 FCA
 AKS
 Business continuity
 Legal liability
 Privacy and security
 Controls
 Vendor/third-party risk
assessment process
 Outsourced services inventory
 Contract negotiation with
favorable language
 Liability insurance
requirements
 Audit vendor compliance
 Vendor due diligence

21. Prepared for Montana Hospital Association Health Summit Page 20
Other Compliance Risk Considerations…
Noted by PYA in recent risk assessments
 Compliance resources including data analytics
 Risk assessment process – comprehensive, prioritization
 501(c)(3) Requirements for Hospitals
 Integrity of quality reporting
 Strategic planning
 EMTALA and EMS services
 60-Day Overpayment Rule
 1557 Nondiscrimination Notice and Language Assistance
 CMS Open Payment Registry

22. Prepared for Montana Hospital Association Health Summit Page 21
Emerging Issues…
On the horizon – worthy of notice
 Opioid epidemic and controlled substances
 Medical technology
 Due diligence for mergers and acquisitions
 Workplace violence
 Human trafficking
 Political activities – federal and state
 Medical marijuana
 Payment reform and price transparency
 Natural disasters
 Aging population

23. Prepared for Montana Hospital Association Health Summit Page 22
Looking Back to the Future . . .
Compliance focus areas may have evolved over time, but
the fundamental issues remain . . .
 Know the applicable rules and regulations (and keep up to date)
 Invest adequate resources into organizational compliance
 For every $1 spent on compliance, $5.21 can be saved
(rework, sanctions, reputation, personnel, etc.)1
 Culture and conduct at the top matter
 Auditing and monitoring are crucial to detect issues before the
oversight agencies find them
 Educate, educate, educate
1.Determining the Effectiveness & ROI of Your GRC Program: Bob Conlin, SCCE Regional Conference, 2012

24. Prepared for Montana Hospital Association Health Summit Page 23
Questions?

25. PYA, P.C.
800.270.9629 | www.pyapc.com
Thank you!
Susan Thomas
CHC,® CIA, CRMA, CPC®
Manager
sthomas@pyapc.com
Shannon Sumner
CPA, CHC®
Principal/Compliance Officer
ssumner@pyapc.com