Session #8: Trustee Accountability and Liability: The Compliance Hot Seat

Transcription

1 Session #8: Trustee Accountability and Liability: The Compliance Hot Seat Speakers: Lori Wink and Larry Coon Saturday, Jan. 13, :15 a.m. 12:15 p.m. Hennepin 1-2

2 Lori A. Wink Lori Wink is a shareholder with Hall, Render, Killian, Heath & Lyman, the nation s largest law firm focused exclusively on matters related to health care organizations. She assists clients in the analysis of general health law matters and regulatory issues, including accreditation, certification, licensure, billing and payment, compliance, Medicare appeals, fraud and abuse and Stark. She advises a variety of health care clients including health care systems, hospitals, group practices, diagnostic centers and long-term care facilities. Lori's undergraduate degree is in Accounting and Finance, and she has her CPA license. Prior to practicing law, she was a manager in the audit department of KPMG and was a member of KPMG's Healthcare Practice Group. Lori obtained her law degree from the University of Minnesota, and has been practicing health law for almost 25 years. Lori chairs the Medicare and Compliance Issues Committee for the Wisconsin chapter of the Healthcare Financial Management Association, and is a frequent speaker on regulatory issues. Lawrence K. Coon Larry Coon counsels health care providers in corporate, business and strategic matters, including affiliations, joint ventures, contractual arrangements, acquisitions and other growth strategies. He also provides guidance and assistance regarding payor/provider contracting and operations, and other relationships between health care providers and the purchasers of health care services. Larry regularly works on behalf of hospitals and health systems in the creation, operation and expansion of integrated care delivery systems. His practice frequently includes counseling on corporate and governance matters, and assessments regarding antitrust, fraud & abuse, Stark, tax exemption and related regulatory matters. He has been recognized in The Best Lawyers in America publication every year since 2007 and was named a 2016 Lawyer of the Year recipient for Health Care Law in Milwaukee. Larry is also a certified public accountant.

3 Trustee Accountability and Liability: The Compliance Hot Seat Minnesota Hospital Association Trustees Conference January 13, 2018 Presented by Lori A. Wink, Esq. and Lawrence K. Coon, Esq. Hall, Render, Killian, Heath & Lyman, P.C. Overview Current Compliance Environment and Enforcement Trends Board Duties & Boards Responsibility for Effective Compliance Program Consequences of Noncompliance Enforcement Topics What s a Board to Do? 2 1

4 View From 50,000 Feet 3 Current Environment Virtually every week, there is news concerning the government's investigation of a health care provider or organization Congress has significantly increased funding for health care fraud and abuse enforcement efforts DOJ announced focus on individual accountability for corporate wrongdoing and there have been settlements with such individuals OIG believes fraud and abuse liability can be reduced through effective compliance and quality programs 4 2

5 Increased Enforcement and Scrutiny Enforcement on both federal and state level -IRS, DOJ, CMS, OIG, state AG, HRSA, OCR, ZPIC, MAC, etc. Whistleblowers/qui tam relators Civil claims, criminal liability, stiff penalties Media and public scrutiny 5 Board Duties Corporate Law (a quick review) Board Oversight of Compliance Program Functions (a quick review) Effective Compliance Program Quality and Safety Goals 6 3

6 Board Duties Corporate Law Board Responsibilities Pursuant to Corporate Law A Trustee must act reasonably, prudently and in the best interests of the organization, avoid negligence or fraud and act to avoid conflicts of interest Fiduciary Duties Duty of Care Duty of Loyalty Duty of Obedience 7 Board Duties Corporate Law Steps a Director Should Take Act in good faith Ask questions/be Curious/Be Proactive Report any compliance issues you encounter to Compliance Department and/or Legal Counsel and follow through with the process Follow proper procedures for conflicts of interest 8 4

7 Board Duties Compliance Program Oversight Compliance Oversight In1998, the OIG released guidance re: the seven elements that should be present in a good compliance program 1. Standards of Conduct/Written Policies and Procedures 2. Compliance Officer and Committee 3. Effective Training and Education 4. Effective Lines of Communication (Reporting) 5. Auditing and Monitoring 6. Enforcing Disciplinary Guidelines 7. Responding to Detected Offenses and Taking Corrective Action 9 Board Duties Compliance Program Oversight Setting the Tone at the Top Compliance programs are part of doing business and signify a provider's commitment to good corporate citizenship The Board's, the Compliance Committee's and senior management's commitment to the compliance program is essential for its effectiveness Maintaining a "tone at the top" sends a message throughout the organization that compliant practices are how you conduct business 10 5

8 Board Duties Compliance Program Oversight Board Should Ensure the Following: Reporting Systems - That there are appropriate reporting systems to the Board Benchmarks and Functions -There are appropriate benchmarks and functions of an effective compliance program Regulatory Landscape and Operating Environment -They understand the regulatory landscape and operating environment Substantive Expertise - That substantive expertise is available to the Board Roles and Reporting Relationships -They understand the role, structure and reporting relationships related to compliance Reporting to the Board - They enforce expectations for compliance reports Identifying and Auditing Potential Risk Areas That management and the Board have a process for identifying risk areas and confirming audits of potential risk areas Encouraging Accountability and Compliance That process are in place to encourage accountability and communication 11 Board Duties OIG Guidance to Boards of Directors 2015 Practical Guidance for Health Care Governing Boards on Compliance Oversight 2012 A Toolkit for Heath Care Boards 2011 The Health Care Director's Compliance Duties: A Continued Focus of Attention and Enforcement 2009 Driving for Quality in Acute Care: A Board of Directors Dashboard --Government-Industry Roundtable 2007 Corporate Responsibility and Health Care Quality -A Resource for Health Care Boards of Directors 2004 An Integrated Approach to Corporate Compliance: A Resource for Health Care Boards of Directors 2003 Corporate Responsibility and Corporate Compliance: A Resource for Health Care Boards of Directors 12 6

9 Board Duties Effective Compliance Program In March 2017 the OIG released a publication titled "Measuring Compliance Program Effectiveness: A Resource Guide" Board must act in good faith in its oversight responsibility ensure: (1) information and reporting system exists; and (2) the reporting system is adequate to ensure the Board gets appropriate information Board should be aware of, and evaluate, the adequacy, independence and performance of different functions within the organization (such as audit, legal, compliance) Board should receive regular reports on compliance efforts Evaluate how management works together to address risk, including identification, investigation and corrective action Resource Guide available at: 13 Board Duties Effective Compliance Program Standards, Policies and Procedures Annual review and Board approval of Compliance Plan Review and Board approval of the Code of Conduct and appropriate policies Compliance Program Administration Report compliance program activity to the governing board/committee Board understands its responsibility as it relates to the compliance program and culture Maintain an independent reporting structure to the governing body 14 7

10 Board Duties Effective Compliance Program Compliance Program Administration Considerations Is the Board active in compliance matters? Does the Board understand its oversight responsibilities (training and education)? Is there appropriate escalation to Board and accountability? Is there demonstrated commitment from the top? Is budget approved by the Board and is budget based on risk assessment? Is there an appropriate reporting structure and oversight of the Compliance Officer? Is the Compliance Officer independent/objective? Is there Board approval of work plan? 15 Board Duties Effective Compliance Program Screening and Evaluation of Employees, Physicians, Vendors and other Agents Communication, Education, and Training on Compliance Issues Board has appropriate competencies Board members receive compliance orientation Board members receive appropriate education Regular compliance communication with the Board 16 8

11 Board Duties Effective Compliance Program Monitoring, Auditing, and Internal Reporting Systems Board receives reports about hotline activity Board receives results of investigations and reviews There is a process for escalating matters to the Board There is Board approval and assessment of the Work Plan 17 Board Duties Effective Compliance Program Discipline for Non-Compliance Investigations and Remedial Measures Significant investigations are reported to the Board Corrective action is reported to the Board 18 9

12 Board Duties - Quality The OIG emphasizes two primary theories of liability: Provision of medically unnecessary services Provision of substandard care Examples of wrongful conduct: Failure to investigate medically unnecessary procedures Inadequate credentialing and peer review Chronic understaffing Reckless imposition of budgetary restraints that impair patient care 19 Board Duties - Quality Director's obligations may arise in two distinct contexts The Decision-Making Function: Directors must apply duty of care principles to specific decisions or board actions For example, obligations related to supervising medical staff credentialing decisions The Oversight Function: Directors must apply duty of care principles in overseeing the operations of the organization including emerging quality of care issues Basic governance obligation is to guide and support executive leadership in the maintenance of quality of care and patient safety Directors must "keep a finger on the pulse" of the activities of the organizations including: issues of patient safety and levels of care cost reduction and reimbursement collaboration requirements between physicians and mid-level providers 20 10

13 Board Duties - Quality Give quality of care the same importance as financial and regulatory compliance Understand relevant patient safety and quality issues, and ensure the organization has a system of performance goals and monitoring elements to ensure compliance Consider including someone on the Board that is knowledgeable in this matter that is able to understand and interpret information given to the Board Ask questions! OIG's guidance provides questions as a resource for directors to educate themselves, design compliance procedures, evaluate and monitor its effectiveness, and correct deficiencies 21 Consequences of Non-Compliance Repayment, Fines, Exclusion, etc. Corporate Integrity Agreements Personal Obligation and the Yates Memo 22 11

14 Repayment, Fines, Exclusion, etc. False Claims Act (FCA) What is the FCA? Imposes liability on persons who "knowingly and willfully make materially false, fictitious or fraudulent statements in connection with the delivery or payment of health benefits " Knowledge = actual knowledge, reckless disregard or deliberate indifference Criminal or civil penalties, up to 5 years imprisonment, and exclusion from participation in federal health care programs Civil penalties include up to $21,916 per false claim and up to 3x the amount of damages 6-year statute of limitations In 2009 expanded FCA liability for knowingly retaining Medicare or Medicaid overpayments Requires repayment of "identified" overpayments within 60 days 23 Examples of False Claims Billing for services not delivered or not in the manner documented "Double billing" or filing duplicate claims "Upcoding" to more complex procedures than were performed or documented Falsely indicating a provider attended a procedure or that services were otherwise given in a manner they were not Billing for care that does not meet the standard of care Unbundling using multiple billing codes instead of one bundled code Submitting claims based on services of an excluded provider 24 12

15 FCA Protection for Whistleblowers FCA allows everyday people to bring suits against groups and/or individuals that are defrauding the government through programs, agencies or contracts Lawsuits filed under the FCA are often referred to as Whistleblower lawsuits The FCA protects anyone who lawfully acts in investigation of, initiation of, testimony for, or assistance in a false claim. 25 Corporate Integrity Agreements What is a Corporate Integrity Agreement ("CIA")? OIG negotiates CIA with health care providers as part of the settlement of Federal health care program investigation Providers (or entities) agree to the obligations in the CIA, and in exchange, OIG agrees not to exclude the provider from participation in Medicare, Medicaid, or other Federal health care programs Imposes specific structural and reporting requirements related to compliance Can include requirements for the Board including: Quarterly Board/committee meetings to review and oversee compliance program requirements and CIA obligations Adoption of Board resolutions concluding that, after reasonable inquiry, the Board believes the compliance program is effective Individual certifications from Board/committee members that each member agrees with the Board's resolution 26 13

16 Personal Obligation and the Yates Memo Yates Memo: On September 9, 2015, Deputy AG Sally Yates of the DOJ released to the public an internal DOJ Memorandum the "Yates Memo" addressing individual accountability for corporate wrongdoing The primary message is that the government will hold accountable those individualswho are responsible for corporate misconduct Essentially, the government has concluded that monetary penalties (no matter how large) do not deter misconduct in large organizations The DOJ believes individual accountability is important to: Deter future illegal activity and incentivize changes in corporate behavior Ensure that proper parties are held responsible for their actions Promote the public's confidence in the federal justice system 27 Six Key Factors In the Yates Memo, the DOJ identified six key factors regarding individual accountability Factor 1 Eligibility for any cooperation credit is dependent on the corporation supplying all information about individuals involved in the corporate misconduct Entities under federal investigation should identify all individuals involved in, or responsible for, the misconduct if the entity does not, the entity will not have its cooperation considered as a mitigating factor Will apply to both civil and criminal corporate investigations 28 14

17 Factor 2 Civil and criminal investigations will focus on individuals from the beginning of the investigation Maximizes Government s ability to ferret out the full extent of corporate misconduct Increases the likelihood that employees will identify responsible persons higher up the corporate chain of command Improves the chances of a criminal or civil conviction 29 Factor 3 Routine communication will occur between criminal and civil attorneys handling the investigation Ensures that a full range of potential government remedies are carefully considered and promotes the most appropriate resolution of each case 30 15

18 Factor 4 No corporate resolution will provide protection from criminal or civil liability for any individual Barring extraordinary circumstances, the DOJ will not resolve the investigation against the corporation in a way that will prevent or dismiss charges against any culpable individual 31 Factor 5 Corporate cases will not be resolved without a clear plan to resolve individual cases If the DOJ decides not to bring an action against an individual, the reasons must be memorialized and approved in writing by the responsible U.S. Attorney 32 16

19 Factor 6 Civil attorneys should consistently focus on individuals as well as the company, and evaluate whether to bring suit against an individual based on considerations beyond that individual s ability to pay DOJ doesn t want just fines and repayment, it wants to punish those deemed responsible and create a visible deterrent effect 33 Reports from the Field Aggressive pursuit of individuals in the course of investigations, including senior executives, physicians and consultants Mandated cooperation provisions require the settling institution to turn over internal investigation records and otherwise assist the government in pursuing the individuals involved Delays in resolution of corporate investigations while the DOJ decides fate of individuals More recently, inquiries about responsible individuals and corporate discipline in response to voluntary self-disclosures 34 17

20 Obvious Conflict Situation If an entity wants to cooperate with the government (and receive a more lenient penalty), it may need to provide incriminating information about its own management Internal investigations may reveal conflicts between individuals and the corporation, thereby increasing the need for separate representation Will employees be more (or less) willing to cooperate? 35 Summary Mandated focus on individuals throughout the entire investigation This is real Government will not release individuals from liability through settlements or Corporate Integrity Agreements Desire for individual accountability to drive changes in behavior Not expected to change dramatically under the current administration The organization s compliance program is the best protection against governmental investigations Board should understand the role and benefit of a robust Compliance Program and support compliance initiatives 36 18

21 Topics of Enforcement Fraud and Abuse Laws Anti-Kickback Statute Stark Law Electronic Health Record ( EHR ) Documentation HIPAA 37 Anti-Kickback Statute (AKS) Prohibits: Knowingly and willfully soliciting, receiving, offering or paying (directly or indirectly, overtly or covertly) any remuneration (anything of value, in cash or in-kind) in exchange for or to induce the referral of any item or service for which payment may be made in whole or in part under Medicare, Medicaid or other government health care programs "One Purpose Test" Intent-based requires a "guilty mind" Safe Harbors: Transactions fitting w/in a safe harbor are immune, regardless of intent Failure to meet a safe harbor does not necessarily mean the conduct is prohibited; facts and circumstances analysis Civil and criminal liability 38 19

22 Example Contract for medical director services The services are badly needed and the physician is exceptionally qualified and would do a great job Hospital also offers the contract to show its appreciation to the physician for his/her previous referrals and to encourage future referrals Physician will look to refer his/her patients elsewhere if the hospital does not show its appreciation for his/her loyalty over the years QUESTION: IS THIS A PROBLEM? What if: Applicable safer harbors are met (e.g., in writing, at least 1 year, payment fixed in advance at fair market value) 39 Stark Law In General --If a physician has a "financial relationship" with a hospital, then that physician is prohibited from making Medicare referrals to the hospital and the hospital is prohibited from billing Medicare, unless an appropriate exception is met Stark Law questions: Is there a "Physician"? Is the Physician making a "Referral"? Is the Referral for "Designated Health Services" (DHS)? Are the DHS being furnished by an "Entity"? Does the Physician (or immediate family member) have a "Financial Relationship" with the Entity? Are the DHS payable by Medicare? If yes to the above, then an exception MUST be met INTENT IS NOT REQUIRED! STRICT LIABILITY! 40 20

23 Is a physician making a "referral"? "Referral" includes: A request for an item or a service by a physician A request by physician for consultation with another physician, and any tests or procedures the other physician orders, performs or supervises A request by a physician for a plan of care "Referral" does not include services personally performed by a physician 41 Is the physician s referral for a "Designated Health Service" ("DHS")? "DHS" includes the following, when payable by Medicare/Medicaid: Inpatient and outpatient hospital services (encompassing almost every type of medical procedure) Clinical laboratory services Physical therapy and occupational therapy services Radiology or other diagnostic services (including MRI, CAT scans) Radiation therapy services Durable medical equipment Parental and enteral nutrients, equipment and supplies Prosthetics, orthotics and prosthetic devices Home health services Outpatient prescription drugs 42 21

24 Is the DHS referred by the physician furnished by an "entity"? "Entity" means: An entity that bills for a DHS service An entity that performs a DHS service. Typically, hospitals and physician groups are "entities." 43 Is there a "financial relationship" between the physician who referred the DSH and the entity that furnishes the DSH? A "financial relationship" includes: Ownership interests (through equity, debt, or other means); Compensation arrangements Very broad definition: includes direct or indirect remuneration (i.e., personal service contracts, employment, medical directorships, lease agreements, etc.) 44 22

25 Stark Law Exceptions Common Stark Law Exceptions: Rental of Office Space or Equipment Physician Recruitment Personal Service and FMV Exceptions Bona Fide Employment In-Office Ancillary Services Common Elements of the Stark Law Exceptions (e.g., Medical Director or space lease): In writing Signed by the parties Term of 1 year Specify duties Compensation is "set in advance," is at fair market value and commercially reasonable, and does not "take into account" volume or value of referrals 45 In Summary: If a physician has a "financial relationship" with an "entity,"and the physician "refers" patients to the "entity" for"dhs," the"financial relationship" between the physician and the "entity" must comply with an "exception" or the "referral" is prohibited under Stark

26 Comparison on AKS and Stark Anti-Kickback Statute Intent-based Criminal liability Broad application implicates physicians and others Safe harbors "should" Stark Strict liability Civil liability Applies only to a "financial relationship" with "physicians" Exceptions "must" 47 AKS and Stark Penalties Type of Penalty Anti-Kickback Statute Stark Law Civil Monetary Penalties Program Exclusion False Claims Act (FCA) 3 times the loss that the government suffered as a result of the violation; plusup to $73,588 for each violation Risk of exclusion from Medicare and Medicaid Violation is a basis for FCA prosecution 300% of damages plus a per-claim penalty of up to $21,916 Criminal Sanctions Fines of up to $25,000 per violation 5 years imprisonment Up to $23,863 per item or service; plus Fine of up to $159,089 for a "circumvention scheme" Risk of exclusion from Medicare and Medicaid for knowing violations Violation is a basis for FCA prosecution 300% of damages plus a per-claim penalty of up to $21,

27 Examples of Violations of Fraud and Abuse Laws INTERMOUNTAIN (2013): $25.5 million noncompliant leases and physician bonuses that took into account referrals JOHNSON & JOHNSON (2013):$2.2 billion promoting off-label use of drugs and providing kickbacks ADVENTIST (2015): $115 million compensation not commercially reasonable LEXINGTON MEDICAL CENTER (2016): $17 million improper compensation arrangements eclinicalworks (2017): $155 million electronic medical record vendor misrepresented its product's capabilities, leading to false claims TEAMHEALTH (2017): $60 million upcoding leading to false claims NORMAN REGIONAL HOSPITAL (2017): Health system and individuals to pay $1.6 millionto settle false claims allegations 49 EHR Documentation Issues The use of medical records has evolved Historically had primarily a clinical purpose Today also used for billing, compliance and data collection Copying, cloning and prepopulated templates are being used in the EHR to promote efficiency and accuracy Cloning is copying and pasting or otherwise duplicating information from one source to another within EHR software Can result in inaccuracies and inconsistencies leading to quality of care and compliance concerns 50 25

28 EHR Documentation Issues Overdocumentation and/or failure to ensure accuracy can result in questions about medical necessity and improper payments The OIG has identified cloning as an area of increased scrutiny Medicare Contractors consider cloning grounds for denying payments and will recoup overpayments 51 EHR Documentation Issues Provider s progress note for inpatient stay: "Intubated during night by RT due to respiratory distress" This note is repeated in the provider s progress notes for four consecutive days Patient H & P states "family history of lung cancer." Provider copies from H & P "history of lung cancer" omitting "family." The patient s record incorrectly states history of lung cancer 52 26

29 HIPAA Regulations have been in effect now for over 10 years In 2009, HITECH regulations increased and tiered range of penalties for civil HIPAA violations and enhanced HIPAA enforcement Areas of Greatest Risk: Mobile devices Social media What does "identifiable" mean? If there is a reasonable basis to believe the information can be used to identify the individual, it is identifiable Business Associates Discharge papers 53 HIPAA Penalties Penalty structure (NOTE: numerous factors can add to these minimum penalties): Reasonably unaware: $100/violation; $25,000 maximum/violation within a calendar year Reasonable cause: $1,000/violation; $100,000 maximum Willful neglect: $10,000/violation; $250,000 maximum if corrected within 30 days Willful neglect (not corrected within 30 days): $50,000/violation; $1,500,000 maximum: Breach Notification: Covered Entities must notify individuals of a breach of unsecured PHI Often leads to investigations Consider impact on public relations Increasing trend toward private lawsuits 54 27

30 HIPAA Penalties.... It is critical to not only identify potential security gaps in mobile devices, laptops and storage devices but to implement corrective remedies in a timely manner In determining the amount of a HIPAA enforcement action penalty, OCR may consider the length of time that a known compliance deficiency remained uncorrected It is critical to ensure breach notification is made without undue delay and no more than 60 days from the date a breach is discovered 55 HIPAA Enforcement Activity Office for Civil Rights ("OCR") announced on February 1, 2017, that it imposed a HIPAA civil money penalty of $3.2 millionon a Texas medical center ("Medical Center") The Medical Center filed breach notification reports that stemmed from the loss of an unencrypted, non-password protected personal device and the theft of an unencrypted laptop from a Medical Center location OCR announced a $5.55 million settlement with an Illinois integrated health care system OCR investigated after the system notified OCR of three breaches which included theft of four desktop computers containing the unsecured ephi of nearly 4 million individuals 56 28

31 So What s a Board to Do? Run and hide? 57 So What s a Board to Do? Meet the issues head on: Embrace appropriate transparency Encourage board discussion and dialogue Ask questions Trust management to do their job Pay attention to hot topics Review and adopt adapted best practices 58 29

32 Current Hot Topics HC Directors should be asking about policies and practices regarding: Corporate Compliance Patient Safety & Quality Compensation Audit & financial practices EHR Compliance HIPAA Compliance 59 Hot Topics: Corporate Compliance OIG Guidance to Boards Healthcare has Unique Challenges Heavily regulated Consequences of non-compliance can be large Personal liability Questions directors should be asking about compliance Structure of compliance program Operational effectiveness Response to discovered violations 60 30

33 Hot Topics: Quality/Safety More OIG Guidance for Directors ask questions about: Q/S goals, metrics, benchmarks Management accountability link Management & clinical leaders responsible Integration into overall policies Board orientation & continuing education Coordination with compliance program Protections to those raising issues Policy/practices for reporting adverse events 61 Best Practices Consider: Mission Statement Code of Ethics/Code of Conduct Duty of Care Duty of Loyalty Transparency Financial/Compliance Audits Compensation Practices Document Retention Policy Compliance Reporting 62 31

34 Please visit the Hall Render Blog at more information on topics related to health care law. Lori A. Wink 111 East KilbournAvenue, Suite 1300 Milwaukee, WI Direct: (414) Mobile: (414) Lawrence K. Coon 111 East KilbournAvenue, Suite 1300 Milwaukee, WI Direct: (414) Mobile: (414) This presentation is solely for educational purposes and the matters presented herein do not constitute legal advice with respect to your particular situation. Anchorage Annapolis Dallas Denver Detroit Indianapolis Louisville Milwaukee Philadelphia Raleigh Seattle Washington, D.C. 32