On January 17, 2017, HCCA-OIG and HHS recently issued new guidance regarding how to effectively comply with HIPAA and other compliance regimes. This is the second in a series of three posts that responds to how the HIPAA Survival Guide's methodology aligns with the guidance with respect to "Elements 2." The first post can be found here.
Element 2: Compliance Program Administration |
|||
What to Measure |
How to Measure |
HIPAA Survival Guide (HSG) |
|
Board of Directors: |
|||
2.1 |
Active Board of Directors |
· Review minutes of meetings where Compliance Officer reports in‐person to the Audit and Compliance Committee of the Board of Directors on a quarterly basis |
See self-audits. See Checklists. CO required to report to Executive Team on numerous topics on a periodic basis. |
· Conduct inventory of reports given to board and applicable committees. |
Id. |
||
2.2 |
· Review of training and responsibilities as reflected in meeting minutes and other documents (training materials, newsletters, etc.). Do minutes reflect board’s understanding? |
Id. |
|
Board understanding and oversight of their responsibilities |
· Review/audit board education – how often is it conducted? Conduct interviews to assess board understanding. |
Executive Team responsible for reporting to Board on an as needed basis; no formal process for that. |
|
2.3 |
Appropriate escalation to oversight body |
· Review minutes/checklist in compliance officer files |
See self-audits. |
2.4 |
Commitment from top |
· Review compliance program resources (budget, staff). |
Id. |
|
· Review documentation to ensure staff, board and management are actively involved in the program. |
Id. |
|||
· Conduct interviews of board, management and staff. |
Id. Interviews only go as far up as the Executive Team. |
|||
2.5 |
Process for escalation and accountability |
Process review (document review, interviews, etc.). Is there timely reporting and resolution of matters? |
Id. |
|
Compliance Budget: |
||||
2.6 |
Appropriate oversight of budget |
Review charter of governing body (Board) to verify it includes approval of compliance budget |
Budget approved at the level of the Executive Team. |
|
2.7 |
Budget is based on an assessment of risk and program improvement/effectiveness |
Is the Board’s approval of the budget based on identified risks and effectiveness evaluation/program improvement? |
Latest Risk Assessment conducted in Expresso™ serve as input to the budget process. |
|
2.8 |
Sufficient compliance program resources (budget, staffing) |
Review budget and staffing to ensure significant risks are managed appropriately |
Id. |
|
Compliance Committees: |
||||
2.9 |
Active involvement of compliance committee members |
Track percentage of attendance of each compliance committee member over the last year |
Executive Team owns the HCI in many substantive respects, including approving budget and resources. |
|
2.1 |
Assure that the compliance oversight committee goals and functions are outlined |
Review charter of committee |
No charter unless Executive Team deems it necessary to create one. |
|
2.11 |
Committee structure |
Review documentation of structure of committees as well as charters. Ensure no conflicting charters. |
Id. Executive Team functions as the governance committee. |
|
2.12 |
Compliance committee composition and attendance |
Review charter and minutes to assure attendance. |
Id. |
|
2.13 |
Cascade administration of compliance program throughout the organization |
Different operational areas give some certification/disclosure to the compliance office |
Feedback is sought from distinct functional groups on an as needed basis especially during the performance of self-audits. |
|
2.14 |
Composition of Compliance Committee |
Review organizational chart to validate correct composition |
See self-audits. |
|
2.15 |
Effectiveness of compliance committee meetings |
Keep executive report card by member qualitative/quantitative with indicators of contribution on topics |
Tracking of the HCI is kept is the following Scorecards: (1) Privacy Rule; (2) Security Rule; (3) Breach Notification Rule; and (4) Cloud, Social Media, and Mobile. |
|
2.16 |
Engagement |
In the last two years, have the compliance committee meetings been held in accordance with the charter? |
See self-audits. |
|
2.17 |
Engagement of Directors/Managers |
Review committee structure to evaluate how directors/managers are participating in Compliance Operational Committee(s) meeting includes agenda, minutes, attendance and reports from subcommittees |
See self-audits. See required reporting to the Executive Team. |
|
2.18 |
Executive Leadership engaged in Compliance Program |
Review frequency of meetings, membership, attendance, agenda and minutes over the past year of the Compliance Executive Committee to include all members of the Senior Executive team receiving information directly from the Compliance Officer |
Id. |
|
Accountability: |
||||
2.19 |
Leadership accountability |
Audit documentation and conduct interviews. Some examples might include: |
Id. |
|
· Employee education completion rates |
See Workforce training; |
|||
· Demonstration of promotion of compliance (e.g., town hall meeting presentations, newsletters, etc.) |
See self-audits. Process requires security reminders in compliance with the HIPAA Security Rule. |
|||
· Completion of audit or review action items within established time frame |
See self-audits. |
|||
2.2 |
Management accountability for compliance |
Process and document review and interviews. |
Id. |
|
· Is there a mapping of operational or management responsible for championing compliance? |
See Executive Team governance committee. |
|||
· Is there a mapping of management responsible for key areas of compliance to ensure accountability? |
Id. |
|||
· Does top management support the compliance team? |
Id. |
|||
Compliance Officer: |
||||
2.21 |
Competency |
· Certification (CHC, CHPC, CHRC) |
Our Subscription Plan offers a certification program based on over 200 questions corresponding to over 15 courses. |
|
· Annual evaluation, coaching, corrective action, professional development |
CO’s are encouraged to attend our FREE monthly webinars where review past topics and discuss either new guidance or changes in the law. |
|||
2.22 |
Is the compliance officer a key stakeholder in the strategic initiatives of the organization |
· Review participation of compliance officer in strategic planning process and due diligence processes. |
See self-audits. See Executive Team governance committee. |
|
2.23 |
Compliance department involvement in enterprise‐ wide initiatives/entities/strategies (e.g., involvement or penetration in joint venture initiatives and other organizational inventory) |
· Process review, including review of organizational chart to ensure compliance captures enterprise‐wide entities. |
Id. |
|
· Interviews with compliance and other committees. |
||||
2.24 |
Compliance independence/compliance structure |
· Does the reporting structure reflects the "express" authority required? |
Id. |
|
· Audit program charters (compliance program or Audit committee) |
Id. |
|||
2.25 |
Compliance integration |
Audit to determine the extent to which compliance officer is involved in training, policy development, marketing and other operational aspects of the business |
Id. |
|
2.26 |
Compliance Officer reporting structure and oversight to ensure direct access to C suite and board |
· Document review ‐ Look at organizational chart and conduct interviews. |
Id. |
|
· Review board minutes and documentation that there are regular meetings with CEO and or appropriate parties. |
Responsibility of Executive Team. |
|||
· Ensure compliance officer has authority and is comfortable to go to board. |
Responsibility of Executive Team. |
|||
2.27 |
Compliance officer’s independence/objectivity |
· Review compliance officer’s job description. Does s/he report directly to CEO, board (not CFO or Legal)? Conduct interviews, focused groups, audit. |
See Executive Team governance committee. |
|
· Seating location of compliance with the business, senior teams are together, and dotted line on org chart |
Id. |
|||
· Interview compliance officer to see if they feel they have independence, do they document disagreements, is there executive session for audit committee. |
Id. |
|||
· Interview the board, review minutes, and interview the CCO |
Responsibility of Executive Team. |
|||
· Review of written organizational structure |
Id. |
|||
· Verify the Compliance Officer has the independent authority to retain outside legal counsel |
Id. |
|||
· Review if there is screening of compliance officer material to the Board of Directors |
Id. |
|||
· Regular executive session of the Compliance Officer with the Audit and Compliance Committee of the Board |
Id. |
2.28 |
Credibility of compliance officer |
Job Description review, ongoing training of compliance officer, basic competencies, certifications, reporting structure |
Id. See our certification program. |
|
2.29 |
How much authority does the compliance officer have to start a working group to look at changes? |
· Have needed changes been made, and if not, why not? |
See Executive Team governance committee. |
|
· What authority does the compliance officer have and how does he or she exercise it? |
Id. |
|||
· Where is the compliance team with regards to identifying working groups to help attack a new compliance risk? |
Id. |
|||
2.3 |
How supported the compliance officer feels |
· Interview compliance officer; |
Id. |
|
· Documentation review. |
Id. |
|||
2.31 |
Organizational perception of compliance officer and corporate compliance program |
Survey employees regarding: |
||
· Their perception of the compliance officer role. |
Id. |
|||
· Whether they know who the compliance team is, how to get to them and, what to tell them. |
Id. |
|||
· Is the compliance staff approachable? |
Id. |
|||
· Are the compliance staff solution facilitators or looked at as the organizational police force? |
Id. |
|||
2.32 |
Compliance problem solving and adequacy of process |
Process review |
Id. See also Breach Notification methodology; policies. |
|
Staffing: |
||||
2.33 |
Adequacy of staffing and resources |
· FTEs assigned to compliance function |
Responsibility of Executive Team. |
|
· Review compliance matters and if they have been addressed timely. |
Id. |
|||
· Review and ensure policies and procedures are implemented and being followed. |
Id. |
|||
· Review documentation of reports to committee(s) and board. |
Id. |
|||
· Assess status of work plan and any delays. |
Id. |
|||
· Ensure documentation of risk assessment. |
Id. |
|||
· Review documentation regarding discussions at board level regarding budget. |
Id. |
|||
· Review benchmarking data from similar entities. |
Id. |
|||
2.34 |
Assurance of staffing |
Review qualifications of staff; ratio of compliance staff to business, compensation to the business |
Id. |
|
2.35 |
Adequacy of compliance staff based on risk assessment |
Risk assessment considers the number and competency of staff required to address risk |
Id. See also certification program available to all compliance staff. |
|
Compliance Plan: |
||||
2.36 |
Compliance plan assessments |
· Document review, including compliance plan and policies. |
See self-audits. |
|
· Is there an external review conducted periodically? |
Id. External review recommended periodically. |
|||
· What is the role of internal audit with regarding to compliance? |
Role is to ensure that policies, processes and tracking mechanisms are being followed for each requirement of the Rules. |
|||
· How does internal audit interact with compliance? |
The Executive Team nominate the personnel to conduct self-audits. Includes Workforce members from various functional areas. |
|||
· Benchmark program with similar sizes within the same industry |
None. |
|||
2.37 |
Compliance plan process |
Audit process for development of the annual compliance plan. |
See self-audits. |
|
2.38 |
Compliance organization |
Assess the positioning and effectiveness of the compliance organization staff, titles, organizational chart, pay, promotion records compared to other areas within the organization |
Id. |
|
2.39 |
Document that establishes the authority of the program |
Document review, meeting minutes for approval. |
Id. |
|
2.4 |
Perception of compliance program |
Survey employees |
Id. |
|
Culture: |
||||
2.41 |
Accountability |
SURVEY ‐ Does the compliance department have an impact on how you do your job? (Yes/No/Don't know) |
Id. |
|
2.42 |
Accuracy and Trust in Monitoring |
SURVEY: Do you believe the information from your department is reported with a high degree of integrity and accuracy? (Yes/ No/Don’t know) |
||
2.43 |
Culture |
Conduct cultural survey (interviews, confidential surveys, focus groups, etc.) and report findings to compliance committee and board. Review minutes to ensure report out and action plan established. |
Id. |
|
2.44 |
Effectiveness of compliance program in the field |
Survey of field compliance people |
Id. |
|
2.45 |
What is company doing to drive compliance culture? |
Surveys: |
Id. |
|
· What does company incentivize? |
Id. |
|||
· What does the company promote and look down on? |
Id. |
|||
· Is compliance program tied to mission, vision, values? |
Id. See also Executive Team governance committee. |
|||
2.46 |
Employee comments from “Rounding” |
Audit the tracking of what employees report when proactively asked by compliance department (or leadership, etc.) and how this information is managed and reported. |
Id. |
|
2.47 |
Measuring effectiveness of executive communication on compliance |
Track on‐line engagement (clicks) and survey audience |
Id. |
|
Incentives: |
||||
2.48 |
Aligning performance management system (promotion system) with ethics and compliance objectives |
Audit criteria of promotion, bonuses and assignments |
Id. |
|
2.49 |
Compliance and Ethics Role/participation for developing the incentive system |
Have an outside independent expert audit the incentive system and compliance officer's participation |
None. |
|
2.5 |
Is incentive system consistent with compliance program |
Employee Survey |
None. |
|
Performance Evaluations: |
||||
2.51 |
Proper alignment of compliance objectives with organizational performance incentives (promotions/performance appraisals/bonuses) |
· Audit disciplinary records and performance evaluations for consistency with compliance |
See self-audits. |
|
· Audit/Review of process for performance incentives (promotions/performance appraisals/bonuses) criteria to include compliance components |
Id. |
2.52 |
“Compliance” as a performance appraisal element |
· Audit performance appraisals. Some options include: o Acknowledgment of no disciplinary action o Education completion o Documentation of promotion of compliance |
||
· Are merit increases tied to performance? |
Id. |
|||
· Does completion of compliance education, promotion of compliance through words, actions or no documented disciplinary action and/or, completion of corrective action plans within the due dates play a role into the calculation of merit increase? |
Id. |
|||
· Compliance is part of the annual performance evaluation and HR knows how to evaluate issues for compliance |
Id. See also |
|||
2.53 |
Manager performance evaluations |
Managers have open door policy, communicate compliance directives/initiatives, address compliance matters and effectiveness is noted in performance evaluation. |
See Executive Team governance committee. |
|
2.54 |
Is compliance taken into account in promotion decisions? |
Review promotion lists and documentation to support promotion. Did the individual actively promote compliance? |
Id. |
|
2.55 |
Organizational Retaliation |
Track whistleblower promotion, bonuses, sick days, disciplinary, corrective action measures and exit interview over long term |
Id. |
|
Risk Assessments: |
||||
2.56 |
Compliance Resource knowledge and competence |
Survey, focus groups and interviews |
Expresso also for Risk Assessment to be conducted as needed. Historical Risk Assessments can be accessed for reporting purposes. |
|
2.57 |
Compliance staff knowledge of current regulatory changes and laws |
Document review and interviews. Review certificates of attendance at conferences/other educational events, “tools” used to keep compliance staff current, compliance budget (to support access to current regulatory changes and laws). |
See certification program available to all staff. |
|
2.58 |
Monitoring of regulations that impact the organization |
Document and process review, interviews. |
See self-audits. |
|
· Is there a policy and procedure? |
Id. |
|||
· Is there evidence that regulations, etc. are disseminated and implemented? |
Id. Signatures required for all policies by all Workforce members. |
|||
· Are there designated individual(s) that monitor laws, regulations, policies that impact organization? |
There is the responsibility of the CO. |
|||
· How do they get the information and what do they do with it to make sure it gets to the right people? |
Certification through training. Monthly newsletters, webinars, etc. |
|||
2.59 |
Risk Assessment Cycle |
· Audit adherence to risk assessment cycle |
Expresso™ |
|
· Annual documented risk assessment has been communicated to oversight committee |
Id. |
|||
2.6 |
Risk based work plan that covers compliance plan elements with board approval and regular reporting on those projects to board |
Compliance Committee and board minutes review. |
See Executive Team governance committee. |
|
2.61 |
Work plan development based on risk assessment |
Process and document review. |
Id. |
|
2.62 |
Prioritization of risk and consultation with applicable risk partners (i.e., legal, HR, IT, risk management, etc.) |
Documentation and process review. Is there a risk based plan? How was it developed? |
Id. |
|
2.63 |
Exit interview |
Compliance concerns that come up in exit interviews are addressed |
Id. |
Compliance Work Plan: |
||||
2.64 |
Compliance work plan |
Audit to ensure the work plan is developed and implemented and it is followed‐through and outcomes are reported to compliance committee or to governing body |
Id. |
|
2.65 |
Effectiveness of compliance program |
Written annual work plan that includes minutes |
Id. Based in part on last Expresso™ Risk Assessment. |
|
Legal Counsel's Role: |
||||
2.66 |
Role of counsel in compliance process |
Interview counsel regarding their involvement. |
See self-audits. Monthly newsletters, webinars, etc. |
|
· When they are brought into matters? |
As required. |
|||
· Where is counsel situated in relation to compliance officer on organizational chart? |
N/A |
|||
2.67 |
Existence and adherence to policy on involvement of legal in handling matters under privilege |
Review policy and sample areas that were referred to legal followed the policy |
As required. |
|
Other: |
||||
2.68 |
Job descriptions of management |
Review of management job descriptions. Do managers have concrete compliance deliverables other than training and abiding by Code of Conduct? |
See Executive Team governance committee. |
Comments