Governance & Total Compliance Regulators Expectations & Best Practices to Meet Them Presented by: David M. Rottkamp, CPA Partner, Not-for-Profit Practice Leader Alfonso P. Conti, MPA Manager, Healthcare Management Consulting
Opening Remarks The year ahead will be a pivotal one for Boards and audit committees Many of the larger companies that failed: o Were sabotaged by Board negligence; o Were too optimistic; o Had ill-informed Boards; o Had Boards that spent too much time looking backwards than towards the road ahead.
Ex-CEO admits stealing from prominent NYC charity The politically connected former CEO of a prominent city charity admitted Wednesday he helped steal more than $9 million from the organization in an insurance scheme that authorities linked to campaign contributions. William Rapfogel pleaded guilty to grand larceny, money laundering and other charges in a case that had rattled city and state political circles. Source: The Associated Press, April 23, 2014
Opening Remarks Effective leaders are straight shooters who know that if performance or the ability to fulfill obligations is lacking, they must work to educate, demonstrate expectations, and critique behavior that is below the norm.
Recent Surveys Audit Committees from both the For Profit and Not- For-Profit world agree that the Board: o Cannot sit back and conduct business a usual! o Must engage management to understand current and future challenges of the business. o Must reduce the reactive nature to an issue and be more proactive and o Ensure that the right people and skill sets are on the Board to enable the growth and protection of the organization.
Trends in Governance 60% of Boards surveyed replaced or added a director in the last 12 months. 52% of Boards do not oversee organizations social media strategy and can improve on their technical knowledge 14% of the Boards surveyed have removed a director due to poor performance/ evaluation Boards are focusing on age limits and term limits for Board members
Board Questions Does your Board consider or have in place: o A Board Succession Process o Constantly assess and challenge the members o Optimizing the Board seat and rotate with term limits o Board member recruitment o Board Mentoring
Why all the Concern? Governor Cuomo emphasis on Ethics reform in government, it does not stop with the politicians! Passage Not For Profit Revitalization Act implementation July 1, 2014 Appointment of James Sheehan to head the Charities Bureau - you remember the mantra educate / prosecute Recent Media articles on CEO Kickbacks in NFP and Healthcare organizations! OIG published 52 month average Jail time for Fraud and Abuse conviction. Corporate Integrity Agreements are getting tougher!
Responsibility of the Governing Board Fiduciary Duty: This means that the board member will act for the financial benefit of the organization. Duty of Care: The board member will use a level of care that an ordinarily prudent person would exercise in a similar position when faced with similar circumstances. Duty of Loyalty: This is an expectation that the governing board member will act in a manner he/she reasonably believes to be in the best interests of the organization.
Boards are Targets of the OMIG / OIG Boards are being targeted for their focus on: o Compliance and their direction of the Compliance Officer and Compliance Committee. o Boards in general need to know what the annual compliance efforts Involves. o Boards are ultimately responsible for the ethical conduct of the management.
Boards are Targets of the OMIG / OIG So how does a Board avoid this embarrassment? o The answer is culture, education, and continuous focus o A structure where the Compliance Officer reports to the Board o Getting harder and harder to oversee the challenges
Potential Board Solution A continuous stream of communication Sharing of Compliance efforts The Board assistance of the Compliance Officer
Not For Profit Revitalization Act Passed December 18, 2013 effective date July 1, 2014! Addresses the growing concerns in the NFP industry! (Target) Main Components of the Act: o Mandatory Audit Committee or Board Audit Function Kickbacks. o Mandatory Whistleblower and Conflict of Interest policies o Other areas in the Act involve Document everything
OMIG FAQ s Targets Boards Does the board of directors need to approve ALL policies and procedures? If not, what type of policies MUST have board approval? Is annual compliance training required for the board of directors or is it best practice? What training MUST board receive on an annual basis? Is annual defined as within 365 days or is there some leeway, such as 13 months? In the compliance audits conducted by the OMIG or other regulatory agencies, of which the OMIG is aware, what are some practical tools used by compliance officers /organizations to get board engagement?
How Can Boards Help Management? In successful businesses Boards need to set the What does that mean? Tone from the Top! o Communicate to Management o Insure Ethical behavior o Provide Support
Boards and Their Compliance Officer Where is your Compliance Officer in the Food Chain? Compliance Officer position is more critical in 2014! The Board should know the Compliance Officer! The Board should know the Compliance Committee! A Board members should sit on the Committee!
The Compliance Officer New _ Charities Bureau: o Effective February 1, 2014 the new head of the Charities Bureau (CB) is James Sheehan former head of the Office of the Medicaid Inspector General. One of his many charges will be the implementation of the NFP Revitalization Act. o How does that affect the Board and Compliance Officer relationship?
Chief Compliance Officer Responsibility Facilitate Candid conversation at the Board and C-Suite Develop ethical leaders Build ethical leadership incentives Train everyone in the organization starting with the Board Form a Compliance Committee that will assist the CCO Assess the organization risk areas CCO has an independent voice
Current Practices Governance Involvement Compliance Committee Meetings Continuous Compliance Education of Staff Annual Risk Assessment by Departments Work Plan Update Auditing and Monitoring Program Internally and Externally Reporting to Governance
OMIG Bureau of Compliance The function of the Bureau of Compliance is to insure providers of Medicaid services have an effective Compliance program in place. They enforce the year-end certification of compliance programs. The goal of these reviews is to assess if providers have compliance programs that meet the requirements of applicable laws, regulations, rules and policies of the Medicaid program per their introduction letter.
Bureau of Compliance Request Contact information of the Compliance Officer Contact Information Senior Administrative Official Document Request Compliance Officer information Copy of the Organization Chart
Bureau of Compliance Reporting The turn around time is usually 1 week. They want to see: o Minutes of the Compliance Committee o Training conducted with staff o A work plan that identifies the risks identified o A summary of reviews performed o Reporting to Governance
Bureau of Compliance Follow-Up Schedule a site-visit Purpose: o Meet with a member of Governance o Speak with Management o Discuss with the Compliance Officer what their role is o Perform a walk around
What Happens If? Year-end Certification is backed up The Bureau in their review always finds something A Discussion Draft is issued No submission, a final letter is issued The Bureau suspects lax and non-adherence to compliance
Compliance Summary Review existing Compliance Plan Documentation Conduct a review of all supporting policies and procedures Conduct a comprehensive self-assessment of the program Prepare an updated work plan on the risk areas identified Report on a quarterly basis on reviews performed
Other Piece of Compliance HIPAA The Final HITECH Regulations went into effect on March 26, 2013. DHHS is allowing Covered Entities ( CEs ) and Business Associates 180 days to come into compliance. This means, unless otherwise noted, CEs and Business Associates must be compliant by September 23, 2013. The Date has Passed!
Nervous Yet or Relieved? So now you see the Circle of Life as seen by the OMIG! o Governance o Management o Compliance Officers You know we are there for You
MEGA Rule - Impact The Breach Notification Requirements Business Associates Privacy Notice Changes Marketing / Fundraising / Sale of Protected Health Information (PHI) Various Miscellaneous Privacy Provisions Enforcement and Penalties
OCR Study on Breaches 46% loss is of laptops with PHI 42% loss due to employee mistakes or unintentional action. Effectiveness training is questionable
Mobil Devices Do you have a Social Media Policy? Limit access from devices to critical systems Require the user to read/sign an acceptable use policy Limit or restrict the download of PHI Scan devices for viruses/malware software Require anti-virus/anti malware prior to connection Scan devices removing apps that present a security threat
Compliance with HIPAA Standards Steps to prepare for it: o Conduct a security risk assessment and privacy review o Identify PHI locations throughout the organization o Create a work plan to mitigate top risks identified o Ensure Business Associate agreements up to date o Update policies and procedures for HITECH rule o Appropriately assign an Officer to oversee
OCR Corrective Action Plan Recently Skagit County signed off on the CAP after paying $215,000 settlement: A three year program HHS must approve policies and procedures o Breach Notification policy o Accounting for Disclosures o Hybrid Entity Business Associate Documentation o Security Management Process o Update all policies for Federal compliance o Provide Training for all workforce and certify performance o Reportable events if any workforce member does not comply with these requirements
OCR Corrective Action Plan Annually a Report is submitted NLT 60 days after signing date of CAP containing summary of security mgt., reportable events and attestation by an officer of the County Institute a document retention requirement for 6yrs.
HIPAA Goals / Questions What are your HIPAA goals? Meet compliance Mitigate risk Improve your security posture Evaluate your team s response capabilities, all good responses.
HIPAA Goals / Questions However, pretend for a moment you have completed an assessment what are some questions to ask yourself: What do you hope to show management when reporting results? Is there something you are trying to prove? Do you need to test your external network devices? Are you looking for a thorough review of your web applications? Do you want to test the security culture of your organization? Do you have a specific technical area of your environment you need to evaluate that you don t have the right skillset in-house for?
Summary Forward looking Boards must remain: o Vigilant o Energetic, o Wary of bad habits. o Objective o Built on Ethics and Culture Successful boards will be those that work in the spirit of continuous improvement at every meeting, while always keeping the long range goals in mind. By creating forward thinking Boards, organizations can avoid the failures and potholes discussed today.
Summary Building a real, substantive compliance and ethics program will demonstrate to the government, shareholders, employees, rating agencies, and others that your company is indeed, committed to integrity.
VACCINE
For more information David M. Rottkamp Partner, Not-for-Profit Practice Leader 516-918-5942 drottkamp@grassicpas.com Alfonso P. Conti Healthcare Management Consulting Manager Grassi & Co. 516-336-2471 aconti@grassicpas.com