SAMPLE COMPLIANCE PLAN. Last revised. Sample only for educational purposes/does not constitute legal advice

Transcription

1 SAMPLE COMPLIANCE PLAN Last revised

2 COMPLIANCE PLAN TABLE OF CONTENTS 1. INTRODUCTION COMPANYNAME S COMMITMENT TO COMPLIANCE BENEFITS OF THE COMPLIANCE PLAN COMPLIANCE WITH LAWS, POLICIES, AND PROCEDURES LAWS, REGULATIONS AND INTERPRETATIONS CODE OF CONDUCT OTHER POLICIES, PROCEDURES AND PROTOCOLS POTENTIAL RISK AREAS [IDENTIFY SUBSTANTIVE RISK AREA BASED ON ENTITY/PROVIDER/ SUPPLIER TYPE. REVIEW OIG GUIDANCE. INCLUDE SPECIFIC BEHAVIORS TO BE AVOIDED AND/OR CROSS-REFERENCE SPECIFIC POLICIES OR STATUTES/REGULATIONS TO BE FOLLOWED] [IDENTIFY SUBSTANTIVE RISK AREA BASED ON ENTITY/PROVIDER/ SUPPLIER TYPE. REVIEW OIG GUIDANCE. INCLUDE SPECIFIC BEHAVIORS TO BE AVOIDED AND/OR CROSS-REFERENCE SPECIFIC POLICIES OR STATUTES/REGULATIONS TO BE FOLLOWED] [IDENTIFY SUBSTANTIVE RISK AREA BASED ON ENTITY/PROVIDER/ SUPPLIER TYPE. REVIEW OIG GUIDANCE. INCLUDE SPECIFIC BEHAVIORS TO BE AVOIDED AND/OR CROSS-REFERENCE SPECIFIC POLICIES OR STATUTES/REGULATIONS TO BE FOLLOWED] DESIGNATION OF COMPLIANCE OFFICER & COMPLIANCE COMMITTEE COMPLIANCE OFFICER COMPLIANCE COMMITTEE EDUCATION AND TRAINING LINES OF COMMUNICATION/REQUIRED REPORTS AUDITING AND MONITORING COMPLIANCE INVESTIGATIONS OF POTENTIAL NONCOMPLIANCE PURPOSE OF AN INVESTIGATION RESPONSIBILITY FOR INVESTIGATIONS INVESTIGATIVE PROCESS ENFORCEMENT OF STANDARDS CREATION AND RETENTION OF COMPLIANCE-RELATED DOCUMENTATION COMPLIANCE AS AN ELEMENT OF EMPLOYEE PERFORMANCE EVALUATIONS ADOPTION/REVIEW OF COMPLIANCE PLAN... 11

3 EXHIBIT A CERTIFICATION AND AGREEMENT OF COMPLIANCE EXHIBIT B CODE OF CONDUCT... 14

4 1. INTRODUCTION 1.1 COMPANYNAME S COMMITMENT TO COMPLIANCE COMPANY NAME ( COMPANY ) is dedicated to [MISSION STATEMENT]. COMPANY has established this Compliance Plan (or Plan ) to underscore COMPANY s commitment to conduct its operations, and pursue it mission, in compliance with all laws, rules, regulations that apply to its business, including but not limited to [the federal Medicare and Medicaid fraud and abuse statutes, the Stark physician self-referral law, the federal and state false claims act and laws, the Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) and the HITECH Act,] and COMPANY s policies and procedures (each a Rule and, together, the Rules ). The Compliance Plan applies to all of COMPANY s owners, managers/board members, officers, employees, and independent contractors (together, Personnel ). The Compliance Plan is not intended to be a comprehensive explanation of the Rules; nor will it provide answers to every legal or policy issue that may arise. Rather, it is intended to sensitize COMPANY Personnel to potential legal problems and concerns so that those problems and concerns can be promptly identified and investigated, and then addressed or corrected. COMPANY expects all Personnel to read the Plan with care, and to execute the acknowledgment form attached to the Plan (as Exhibit A) to signify that they have read and understood the Plan. Equally importantly, COMPANY expects all Personnel to comply fully with the letter and spirit of the Compliance Plan and to adopt the behaviors it embodies. The Plan will be monitored on a regular basis and reviewed no less frequently than annually by the Compliance Committee (described below) to determine if the Plan is meeting its objectives. The Plan will be revised as considered necessary or appropriate. 1.2 BENEFITS OF THE COMPLIANCE PLAN Properly implemented, this Compliance Plan will: a. Establish and implement internal controls designed to ensure compliance by COMPANY and all Personnel with applicable Rules (i.e., statutes, regulations, rules, policies, procedures and contracts); b. Increase the likelihood of identifying and preventing unlawful and/or unethical behavior, including by encouraging Personnel to ask questions and report potential problems (including Rule violations); c. Establish procedures that allow prompt, thorough investigation of alleged misconduct by any Personnel, and implementation of corrective action if/as appropriate;

5 d. Enhance COMPANY s ability to quickly react to expressed or identified compliance concerns and effectively target resources to address those concerns; e. Establish a centralized locus for obtaining and making available information on compliance issues, including applicable statutes, regulations, court and agency rulings, program directives, and modifications thereto; f. Provide a mechanism to optimize internal communications regarding compliance matters; g. Reduce the prospect of losses to COMPANY, the government, and third parties in terms of time, effort, reputation, and dollars associated with avoidable audits, investigations, administrative reviews/actions, and/or litigation; h. Enhance [patient/client/employee] satisfaction and safety; and i. Demonstrate COMPANY s commitment to honest and responsible [corporate/provider] conduct. 2. COMPLIANCE WITH LAWS, POLICIES, AND PROCEDURES 2.1 LAWS, REGULATIONS AND INTERPRETATIONS All Personnel shall comply with all federal and state laws, regulations and official interpretations thereof that are applicable to COMPANY and such Personnel s activities on behalf of COMPANY. 2.2 CODE OF CONDUCT All Personnel shall adhere to COMPANY s Code of Conduct, which is attached hereto as Exhibit B. [Drafter s note: Review Code of Conduct against the Plan to ensure that they are in harmony.] 2.3 OTHER POLICIES, PROCEDURES AND PROTOCOLS All Personnel shall comply with applicable COMPANY policies, procedures, protocols and contractual obligations. COMPANY s policies, procedures and protocols are set forth in the COMPANY s policy and procedure manuals, this Compliance Plan, and other COMPANY publications and communications. A copy of COMPANY s policies, procedures and protocols is maintained by, and available upon request from, COMPANY s Compliance Officer. [Drafter s note: consider cross-referencing and/or attaching specific, relevant COMPANY policies and procedures.] 2

6 3. POTENTIAL RISK AREAS The following are subjects, processes and/or laws that may represent compliance and/or liability risks for COMPANY and/or entities similar to COMPANY, and that warrant particular attention to ensure that Personnel are aware of the risks and are prepared to avoid, or at least minimize, COMPANY and Personnel exposure to those risks. The following list is not intended to be, indeed cannot be, exhaustive or all-inclusive. The Compliance Officer will establish and implement procedures for the periodic review of bulletins, alerts and announcements issued by [Medicare, Medicaid,] COMPANY contractors and others and, as significant new potential risk areas are identified, add Risk Areas into this Compliance Plan. 3.1 [IDENTIFY SUBSTANTIVE RISK AREA BASED ON ENTITY/PROVIDER/ SUPPLIER TYPE. REVIEW OIG GUIDANCE. INCLUDE SPECIFIC BEHAVIORS TO BE AVOIDED AND/OR CROSS- REFERENCE SPECIFIC POLICIES OR STATUTES/REGULATIONS TO BE FOLLOWED] 3.2 [IDENTIFY SUBSTANTIVE RISK AREA BASED ON ENTITY/PROVIDER/ SUPPLIER TYPE. REVIEW OIG GUIDANCE. INCLUDE SPECIFIC BEHAVIORS TO BE AVOIDED AND/OR CROSS- REFERENCE SPECIFIC POLICIES OR STATUTES/REGULATIONS TO BE FOLLOWED] 3.3 [IDENTIFY SUBSTANTIVE RISK AREA BASED ON ENTITY/PROVIDER/ SUPPLIER TYPE. REVIEW OIG GUIDANCE. INCLUDE SPECIFIC BEHAVIORS TO BE AVOIDED AND/OR CROSS- REFERENCE SPECIFIC POLICIES OR STATUTES/REGULATIONS TO BE FOLLOWED] [EXAMPLES OF RISK AREAS FOR HEALTH CARE PROVIDERS INCLUDE, E.G., UNLAWFUL INDUCEMENTS, KICKBACKS, AND/OR SELF-REFERRALS; BILLING, CODING, AND UPCODING; FALSE CLAIMS; HIPAA PRIVACY AND SECURITY; MARKETING. FOR, E.G., UNLAWFUL INDUCEMENTS, KICKBACK, AND SELF-REFERRALS, THE COMPLIANCE PLAN MIGHT INCLUDE LANGUAGE LIKE THE FOLLOWING: COMPANY s contracts and arrangements with actual or potential referral sources shall be reviewed for compliance with the federal and state anti-kickback statutes, the Stark physician self-referral law, and other relevant federal and state anti-kickback, self-referral and similar laws. COMPANY/Personnel will not submit or cause to be submitted to federal or state health care programs claims for items or services that resulted from referrals by individuals or entities having financial arrangements with COMPANY unless the arrangements are deemed to comply with such laws. In addition, neither COMPANY nor Personnel will offer or provide gifts, free 3

7 services, or other incentives to patients, relatives of patients, physicians, hospitals, contractors, or other potential referral sources for the purpose of inducing referrals in violation of the antikickback statute, Stark physician self-referral law, or similar federal or state statutes or regulations. ] 4. DESIGNATION OF COMPLIANCE OFFICER & COMPLIANCE COMMITTEE 4.1 COMPLIANCE OFFICER COMPANY [shall designate/has designated] a Compliance Officer to serve as the coordinator of COMPANY s compliance activities. The Compliance Officer shall be a highlevel official within COMPANY with direct access to the [President], COMPANY Board [of directors], and COMPANY counsel. [Drafter s note: the terms of this section should be consistent with the Compliance Officer s job description/contract.] The Compliance Officer shall have the authority to review all documents and other materials and information that are relevant to his/her compliance activities, and the authority to undertake the responsibilities of the Compliance Officer as set forth herein. The Compliance Officer s responsibilities shall include: a. Oversee and monitor implementation of the Compliance Plan and COMPANY s compliance activities; b. Report periodically to the Compliance Committee, senior management, and the COMPANY Board on COMPANY s compliance activities and status, and assist COMPANY to establish methods to improve the Compliance Plan and compliance performance, and reduce COMPANY s vulnerability to fraud, abuse and waste; c. Coordinate internal compliance reviews and monitoring activities, including annual reviews of policies and procedures; d. Periodically recommend to the COMPANY Board the modification of the Compliance Plan and/or related policies and procedures in light of experience, changes in COMPANY s needs and/or activities, and/or changes in the Rules affecting COMPANY and its Personnel; e. Develop, distribute and communicate to Personnel, as appropriate, COMPANY compliance-related policies and procedures; f. Develop, coordinate and participate in a multifaceted educational and training program that focuses on the elements of the Compliance Plan, and seek to ensure that all relevant employees and management receive this mandatory training and understand and comply with pertinent federal and state standards (it shall be the Compliance Officer s responsibility to ensure that Personnel receive the appropriate level/type of training commensurate with their responsibilities, and 4

8 the Compliance Officer, in cooperation with the Compliance Committee, shall determine the materials and training that each type of Personnel shall receive); g. Confirm that all Personnel have received and read the Compliance Plan; h. Ensure that independent contractors and agents who furnish services to COMPANY or its clients, are aware of the requirements of COMPANY s Compliance Plan; i. [In conjunction with COMPANY s Human Resources office, ensure that the National Practitioner Data Bank and the OIG and GSA List of Excluded Individuals and Entities have been checked with respect to all Personnel, as appropriate;] j. Develop policies and programs that encourage Personnel to report suspected or actual non-compliance with Rules, and report other improprieties without fear of retaliation; k. Participate with legal counsel in reporting on self-discovered violations of Compliance Plan requirements; l. Investigate and exercise responsibility for the remediation of matters related to compliance (including corrective actions, as appropriate); and m. Serve as [a member/chair] of COMPANY s Compliance Committee. 4.2 COMPLIANCE COMMITTEE COMPANY shall appoint a Compliance Committee to work with and advise the Compliance Officer and assist in the implementation of the Compliance Plan. The Compliance Committee shall be comprised of members representing such key areas of COMPANY as operations, finance, human resources, patient care, IT, legal and other important operating departments. The functions of the Compliance Committee include, but are not limited to, the following: a. Identify (i) the legal/regulatory requirements that govern COMPANY s business and operations, and (ii) specific legal risk areas that warrant the COMPANY s/committee s focus; b. Conduct reviews of existing COMPANY policies and procedures to assess the need for modifications and/or additions to those policies and procedures to better support and/or ensure compliance with legal/regulatory requirements and address risk areas; c. Work with appropriate COMPANY departments/personnel to develop recommendations for new and/or modified standards of conduct and 5

9 policies/procedures to promote compliance with applicable legal and ethical requirements and the Compliance Plan, and make recommendations to COMPANY s Board for new and/or modified standards, policies and procedures (including the Compliance Plan); d. Assist the Compliance Officer to oversee and monitor the development and implementation of internal systems and controls to carry out COMPANY s Compliance Plan and policies, and to detect and evaluate (and pursue, if necessary) potential violations thereof; e. Work with the Compliance Officer to develop and monitor a system to solicit (or encourage), and then evaluate and respond to, complaints and reports of Rule violations and other compliance concerns; f. Assist the Compliance Officer to conduct investigations and, when deemed appropriate, implement corrective actions; g. Participate in annual reviews of compliance-related policies and procedures, the Compliance Plan, and the formulation of reports to COMPANY s Board and senior management regarding the same; and h. Assist the Compliance Officer to establish, implement, monitor, and, if necessary, modify an education and training program to educate Personnel about COMPANY s Compliance Plan and related policies and procedures. The Compliance Committee shall meet at least [quarterly] (or more frequently as determined by the Compliance Officer, COMPANY s President, or COMPANY s Board) to carry out the functions set forth above and to discuss, review and resolve such other compliance issues as the Compliance Officer, Compliance Committee or COMPANY Board deems appropriate. Compliance Officer and Compliance Committee actions are subject to approval by COMPANY s Board. [The Compliance Officer shall serve as chair of the Compliance Committee.] 5. EDUCATION AND TRAINING All Personnel shall be required to attend compliance education and training at (i) the time of hire (or engagement, as appropriate), (ii) annually, and (iii) on an as-needed basis. COMPANY education/training programs will include: (a) basic training, including sessions highlighting COMPANY s Compliance Plan and related policies and procedures, the key laws and regulations that govern COMPANY s business, key risk areas, and the duty to report known or suspected Rule violations or other non-compliance; and (b) targeted trainings for particular Personnel, which shall differ for different Personnel, depending on the functions performed by such Personnel for COMPANY. For example: [for Billing Personnel, trainings on: claims development and submission processes; documentation to support billing and coding; proper documentation in clinical and/or financial records, etc. 6

10 COMPANY SHOULD LIST OTHER TARGETED TRAINING INITIATIVES, BY PERSONNEL TYPE OR CATEGORY, AS APPROPRIATE] COMPANY shall establish minimum requirements for all Personnel for compliance education and training, which requirements may (as indicated above) vary among Personnel based on the functions they perform for COMPANY. Education/training requirements may include mandatory attendance at specific training programs and/or the mandatory review of specified written or other material. The Compliance Officer shall document attendance at (and the subjects covered during) mandatory training programs, and shall document the completion of mandatory reviews of written and/or other materials. Personnel are expected to certify their attendance at mandatory training programs and their receipt and review of mandatory written or other materials through such means as may be established by the Compliance Officer. The Compliance Officer shall promptly respond to any questions from Personnel regarding compliance programs, materials and education/training requirements. The failure of Personnel to comply with applicable education and training requirements may result in disciplinary action, including possible termination [pursuant to a progressive discipline policy]. Adherence to the education and training requirements described herein will also be a consideration in the annual (or other, as applicable) evaluation of all Personnel. 6. LINES OF COMMUNICATION/REQUIRED REPORTS Maintaining an open and trusted line of communication between Personnel and the Compliance Officer is essential to the success of this Compliance Plan. [Drafter s note: consider identifying/publicizing an open door policy.] To foster open communication, COMPANY has established confidentiality and nonretaliation policies that are applicable to all Personnel. All Personnel are encouraged to seek clarification of their job or contractual responsibilities and their responsibilities under (and/or requirements of) the Compliance Plan. In addition, any Personnel who become aware of a potential problem or questionable practice which is or is reasonably likely to be in violation of or inconsistent with any Rule, is required to report the problem or practice to the Compliance Officer or Compliance Committee. Any such report may be made orally or in writing, and may be made on an anonymous basis. The Compliance Officer/Compliance Committee will promptly document receipt of any report submitted pursuant to this Section, including by initiating a log of each report, which shall reflect all pertinent details relating to the reported incident/act, including the time and date, person or persons involved, and description of the incident/act. Each report will thereafter be investigated as set forth in Section 8, below and, if deemed appropriate, corrective action or remediation will be taken in a manner consistent with COMPANY policy. The log for each report will be updated to reflect the nature and extent of the investigation and the results of the investigation, including any corrective action or remediation taken. Personnel, including Personnel who initiate a report, are expected to cooperate fully in any investigation (and in any audit) conducted in connection with this Compliance Plan. 7

11 COMPANY shall strive to maintain the confidentiality of any Personnel s identity if such Personnel has made a report hereunder on an anonymous basis. However, COMPANY cannot guarantee that a reporter s identity will not become known during an investigation or corrective action, or that a reporter s identity will not have to be revealed to complete a comprehensive investigation or implement corrective action or remediation. PERSONNEL WHO IN GOOD FAITH REPORT ACTUAL OR POTENTIAL COMPLIANCE ISSUES WILL NOT FACE ANY PENALTIES OR OTHER FORMS OF RETRIBUTION OR RETALIATION FROM OR BY COMPANY WHEN THEY MAKE ANY SUCH REPORTS TO THE COMPLIANCE OFFICER AND/OR COMPLIANCE COMMITTEE. Moreover, any Personnel who is found to have threatened retaliation against any other Personnel who reports a known or suspected Rule violation or non-compliance pursuant to this Plan will be deemed to have violated COMPANY policy and shall him/herself be subject to appropriate discipline/corrective action. Any Personnel who knowingly files a false or misleading report pursuant to this Plan will also be subject to discipline/corrective action. 7. AUDITING AND MONITORING COMPLIANCE An ongoing evaluation/audit process is also critical to the success of the Compliance Plan. An evaluation/audit process facilitates COMPANY efforts to detect deficiencies in the Plan (including non-compliance) that might not otherwise be detected through the reporting process described in Section 6 above. COMPANY shall conduct (or cause to be conducted) evaluations of the effectiveness of the Compliance Plan, and shall, if/as determined by the Compliance Officer in consultation with the Compliance Committee, conduct audits of compliance with selected procedures and standards of conduct established by the Plan. Compliance audits shall examine whether the Compliance Plan s compliance elements have been satisfied (e.g., has the Compliance Plan been disseminated to all Personnel?, are education and training programs conducted as scheduled, and is attendance taken?, are internal investigations of alleged noncompliance initiated timely and is there appropriate documentation and disposition of noncompliance allegations and investigations?, is COMPANY monitoring and enforcing its non-retaliation policies?). Audits will also inquire into COMPANY s and Personnel s compliance with, e.g., (i) specific Rules that are the focus of regulators who oversee COMPANY s business and (ii) key COMPANY contracts. [Depending on COMPANY s business focus, COMPANY s audit program could evaluate, e.g., billing and coding processes, medical record content, employment, payor and vendor contracts, etc.]. Audits shall be directed by the Compliance Officer and, whenever practicable, shall be conducted by in-house personnel. However, under appropriate circumstances, the Compliance Officer may engage outside auditors to conduct audits. If an audit discloses actual or potential Rule violations or misconduct and further evaluation is deemed necessary or appropriate, such actual or potential Rule violations or misconduct shall be investigated as provided in Section 8, below. 8

12 Audit results shall be distributed to the Compliance Officer, Compliance Committee, COMPANY Board and such other recipients as the Board shall determine. The Compliance Officer shall, as appropriate, and with the assistance of the Compliance Committee, take steps to ensure that COMPANY policies and procedures are updated and additional training is provided where necessary in response to deficiencies identified through an audit process. 8. INVESTIGATIONS OF POTENTIAL NONCOMPLIANCE Upon his/her receipt of reports or audit results suggesting possible Rule violations (including this Plan and COMPANY policies, procedures and contractual obligations), the Compliance Officer shall follow the investigation policies and procedures set forth below: 8.1 PURPOSE OF AN INVESTIGATION The purpose of an investigation shall be to identify any situation in which Rules may not have been followed, whether knowingly or inadvertently, and to gain a sufficient understanding of the facts and circumstances to: facilitate the correction of any non-compliant practices; implement policies and procedures to better ensure future compliance; protect COMPANY in the event of civil or criminal enforcement action; and implement any additional corrective action or remediation deemed necessary or appropriate. 8.2 RESPONSIBILITY FOR INVESTIGATIONS The Compliance Officer shall be responsible for directing investigations; provided, however, that the Compliance Officer may, following consultation with legal counsel, request that legal counsel direct any investigation. In conducting an investigation, the Compliance Officer or legal counsel may solicit the support of internal and/or special legal counsel and other internal and external resources with knowledge of the Rules or circumstances at issue. These persons shall function under the direction of the Compliance Officer or legal counsel and may be requested to submit relevant evidence, notes, findings and conclusions to the Compliance Officer or legal counsel, depending upon who is directing the investigation. The Compliance Officer or legal counsel shall treat all documentation relating to the investigation as proprietary, confidential and/or privileged to the extent practicable. 8.3 INVESTIGATIVE PROCESS Investigations shall be initiated as soon as practicable following receipt of a report or adverse audit finding (in the latter case, if additional investigation is deemed appropriate). The following steps are suggestions that may be followed, although the scope of any investigation should be tailored to the facts and circumstances at issue: a. A review of the Rule(s) applicable to the activity in question, to determine whether or not a problem actually exists. b. A review of applicable or representative documentation, including, as applicable, contracts, cost reports, invoices, ledgers and other documents, to help determine the nature and extent of the problem, if any, the duration of the problem, and its potential magnitude. 9

13 c. Interviews of the person or persons who appear to have played a role in the potential violation or appear to have knowledge of the activities in question. The purpose of the interviews shall be to determine the facts related to the alleged problem or incident. d. If the Compliance Officer believes that the integrity of an investigation may be at risk because of the continued COMPANY-site presence of Personnel under investigation, such Personnel may be relieved of their current COMPANY responsibilities pending completion of that portion of the investigation. In consultation with Human Resources, if appropriate, such Personnel will be reassigned, or suspended, with pay, pending the outcome of the investigation. In addition, the Compliance Officer shall take appropriate steps to secure or prevent the destruction of documents or other evidence relevant to the investigation. e. Preparation of a summary report (at the direction of legal counsel, if involved) which: defines the nature of the allegation/violation, summarizes the investigation process, summarizes the findings and conclusions of the investigation, including, if applicable, by identifying any person/personnel who the investigator believes to have violated a Rule, and, if practicable, estimates the nature and extent of the resulting harm to COMPANY or individuals, if any. i. If the investigation results in conclusions or findings that the alleged or suspected conduct is permitted under applicable Rules or that the alleged problem or incident did not occur, the investigation shall be closed. ii. If the investigation concludes that improper activity is occurring or has occurred, or that practices are occurring (or have occurred) which are contrary to applicable Rules, corrective action shall be taken in accordance with Section ENFORCEMENT OF STANDARDS If, upon conclusion of an audit or investigation, it is determined that there are genuine compliance violations or concerns, the Compliance Officer shall, working together with the Compliance Committee, immediately formulate and initiate implementation of a corrective action plan, consistent with COMPANY policy. The corrective action plan shall be designed to ensure that the specific concerns identified by the investigation are addressed and, to the extent possible, that similar problems do not occur again. If credible evidence of misconduct is found, and particularly if there is reason to believe that the misconduct may violate criminal, civil or administrative law, the Compliance Officer will promptly notify legal counsel and take such steps as are required or appropriate to satisfy applicable legal requirements. Personnel who are found by COMPANY to have violated a Rule and/or the Plan, shall be subject to discipline pursuant to COMPANY policy. [Drafter s note: consider progressive discipline policy.] Violations include: failures to report suspected improper activity in the manner described in this Plan; and the commission of improper acts. Corrective action or 10

14 remediation may range from verbal counseling, to: oral or written warning; a mandatory training plan; modification of assigned duties; suspension; or termination. Corrective actions should be consistent for similar offenses, but shall, in each case, take into account the particular facts and circumstances of the offense at issue. Any corrective action shall be documented in COMPANY s files, including its Human Resources Department files when appropriate, along with a statement of the reasons underlying the action. Any issue for which a corrective action plan is implemented shall be specifically targeted for monitoring and review in future audits of the affected COMPANY department or area. The Compliance Officer shall periodically report to the Compliance Committee and the COMPANY Board or its designee on the nature of the investigations that have been conducted, the findings, and any corrective actions that have been recommended or implemented. 10. CREATION AND RETENTION OF COMPLIANCE-RELATED DOCUMENTATION Documentation of compliance efforts will include, as appropriate, copies of the Plan and COMPANY policies and procedures (and amendments thereto), minutes of the Compliance Committee and COMPANY Board (and other COMPANY bodies) relating to compliance issues, schedules of education and training sessions and of the dissemination of education/training materials (and evidence of attendance and/or use), reports of known or suspected Rule violations, investigation logs and reports, audit reports, and other documentation relating to problems identified and corrective actions taken. COMPANY shall secure this documentation in a safe, secure place and implement appropriate safeguards for said documentation to protect its privacy and security, in accordance with applicable federal and state law and contractual obligations. 11. COMPLIANCE AS AN ELEMENT OF EMPLOYEE PERFORMANCE EVALUATIONS The promotion of, and adherence to, this Compliance Plan shall be a factor in COMPANY s evaluation of all Personnel. Managers and supervisors are required to: discuss with all supervised Personnel and relevant contractors the compliance policies and legal requirements pertinent to their functions; inform all supervised Personnel that strict compliance with this Plan, those policies and procedures, and applicable laws is a condition of their service to COMPANY; and inform such Personnel that COMPANY will take disciplinary/corrective action, up to and including termination, for violation of the Plan or the Rules. Managers and supervisors shall be held accountable under COMPANY s performance management policies for failing to adequately supervise or instruct their subordinates and/or relevant contractors as described herein, and for failing to detect noncompliance with applicable Rules, where reasonable diligence would have led to discovery of such noncompliance. 12. ADOPTION/REVIEW OF COMPLIANCE PLAN 11

15 This Compliance Plan has been reviewed and approved by COMPANY s Board and constitutes official COMPANY policy. Any alterations or additions to this Plan must be approved by COMPANY s Board. 12

16 EXHIBIT A CERTIFICATION AND AGREEMENT OF COMPLIANCE I certify that I have received and read COMPANY s Compliance Plan (the Compliance Plan ), Code of Conduct, and related policies and procedures, and that I understand the requirements set forth in those documents. I agree, when carrying out my duties for COMPANY, to comply with COMPANY s Compliance Plan, Code of Conduct, and policies and procedures, and with all state and federal laws applicable to COMPANY s business and my duties for COMPANY, as they all may be modified from time to time (together, referred to in this Certification as the Rules ). I understand that I may be subject to disciplinary or corrective action, up to and including termination of my employment or other business relationship with COMPANY, if I violate the Rules, or if I fail to report violations of the Rules. As of this date, I have no knowledge of any transactions or events that appear to violate the Rules. I acknowledge my obligation to adhere to the Rules, and to report any known or suspected violations of the Rules to COMPANY s Compliance Officer or on COMPANY s Compliance Hotline. Name (Print) Signature Date 13

17 EXHIBIT B CODE OF CONDUCT (attach) 14