On November 6, 2023, the Office of Inspector General (OIG) released an updated General Compliance Program Guidance (GCPG) manual, the first significant update in 15 years. The updates made provide clearer guidance on what an effective compliance program is, and how healthcare organizations can implement them. The following seven elements make up an effective compliance program.
- Written policies and procedures
- Compliance leadership and oversight
- Training and education
- Effective lines of communication with the Compliance Officer and disclosure program
- Enforcing standards with consequences and incentives
- Risk assessment, auditing, and monitoring
- Responding to detected offenses and developing corrective action initiatives
Written Policies and Procedures
Policies and procedures outline how your organization and employees are expected to behave. In healthcare, policies and procedures are essential for several reasons. They ensure that patient information is handled correctly and secured, help to create a safe work environment for employees while protecting patients, and ensure ethical billing practices by preventing fraud, waste, and abuse.
Compliance Leadership and Oversight
Compliance leadership and oversight, through the designation of a Compliance Officer and Compliance Committee, ensures that your organization follows policies, procedures, and standards of conduct. They are also responsible for handling responses to reported breaches or incidents, and implementing corrective actions.
Training and Education
All healthcare employees must receive compliance training. Employee training protects both employees and patients. Without effective training, your organization is vulnerable to breaches and incidents, and staff and patients could experience an injury or illness that would otherwise have been prevented.
Effective Lines of Communication with the Compliance Officer and Disclosure Program
Effectively communicating compliance obligations to staff members is essential. The OIG promotes transparency to ensure employees can confidentially communicate compliance concerns to authority figures. Effective communication also ensures that employees are aware of safety expectations, reporting procedures, and that a mechanism exists to report deviations in safety and compliance confidentially.
Enforcing Standards: Consequences and Incentives
Employees must be aware of the consequences of failing to follow compliance guidelines. Without well-publicized disciplinary guidelines, enforcing compliance can be difficult and lead to unequal treatment of employees should a violation occur.
Risk Assessment, Auditing, and Monitoring
Ensuring employees are following compliance standards prevents violations and costly fines. Risk assessments, auditing, and monitoring of compliance efforts are also significant in compliance. Risk assessments and auditing identify where your policies, procedures, or standards of conduct are lacking. When there is a change in your business practices, conducting a risk assessment is essential to identify new areas of vulnerability. Monitoring compliance efforts also ensures that your ongoing compliance efforts are effective.
Responding to Detected Offenses and Developing Corrective Action Initiatives
There are standards for reporting and responding to compliance incidents. Under HIPAA, breaches of patient information must be reported promptly. A breach affecting 500 or more patients must be reported within 60 days of discovery to the Office for Civil Rights (OCR). Breaches that affect less than 500 patients should be noted throughout the year and reported by March 1st of the following year. In both cases, patients must be informed within 60 days of discovery.
Under OSHA, injury and illness reporting requirements differ based on the severity of the incident. Some injuries must be reported immediately, whereas others give organizations a grace period to do so. Fraud, waste, and abuse must also be reported. When organizations fail to meet ethical billing practices, fines can be costly and can lead to being added to the OIG exclusion list.
Contributed by Compliancy Group
Track and manage all your healthcare compliance requirements with customizable software. Compliancy Group’s software offers a robust toolset, advanced program customization options, and risk analysis to optimize the execution of ongoing compliance objectives. Get an overview of your compliance readiness and easily generate reports to prove your compliance efforts. Expedite incident reporting and response management, record all the efforts, and identify organizational risk with a complete set of ticketing, tracking, and analysis tools.
