Management and Structural Analysis of Health Care Organizations #2

5Journal of Health Care Compliance — September–October 2019 5

Skilled Nursing Required Compliance and Ethics

Programs—Changes and Key Components

John Dailey is president of Management Advisors Inc. He can be

reached at 859/353-2900.

John Dailey / Sean Fahey

P rior to July 2019, the skilled nursing world had its countdown clock set for November 28, 2019, as the implementation date for the new compliance and

ethics program requirement. There was a collective gasp when the announcement was made on that mid-July day that the Centers for Medicare & Medicaid Services (CMS) would be issuing revisions to the new require- ment. Almost three years earlier, the October 4, 2016 Federal Register spelled out, in detail, the new require- ment that each skilled nursing facility in the country create and implement an effective compliance and eth- ics program. Skilled nursing facility (SNF) providers had a new lexicon thrust upon them with words like compli- ance liaison and compliance officer. As quickly as those words appeared in the 2016 final rule, they vanished in the 2019 proposed rule. So, exactly what changed, what didn’t, and how does all of this impact a skilled nursing facility’s compliance efforts? A look to the past may shed some light on where we are headed.

A Look BAck In 2000, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) issued its memo titled “Publication of the OIG Compliance Program Guidance for Nursing Facilities” (OIG Memo). The voluntary guidance contained elements that the OIG determined to be necessary for an effective com- pliance program for nursing facilities, including specific risk areas. In 2008, the OIG issued supplemental guid- ance with new compliance recommendations and an expanded list of risk areas. As in 2000, this supplemen- tal guidance was voluntary.

The benefits of creating and implementing a compli- ance program in SNFs may seem common sense today, but prior to the OIG guidance, few SNF providers had

Sean Fahey is an attorney with Hall, Render, Killian, Heath & Lyman, P.C and can be reached at 317/977-1472 or by

email at [email protected].

Journal of Health Care Compliance — September–October 20196

Skilled Nursing Required Compliance and Ethics Programs

a formal compliance plan. While many of the compliance elements, like auditing and monitoring, have been a staple of SNF oper- ations for years, the concept of a formalized “Compliance Program” was foreign to many in the nursing facility world. Nevertheless, some providers did begin implementing programs based on the 2000 and 2008 volun- tary OIG guidance. Others took a wait-and- see approach. The waiting ended with the passage of the Affordable Care Act (ACA).

SNFs were first required to create and maintain compliance and ethics programs under Section 6102 of the ACA, which added Subsection 1128I(b) to the Social Security Act. The ACA called for SNF compliance and ethics programs to be reasonably designed, implemented, and enforced so that they are likely to be effec- tive in preventing and detecting criminal, civil, and administrative violations under the ACA and in promoting quality of care. In 2016, CMS issued final regulations to Part 483 to Title 42 of the Code of Federal Regulations the Requirements for States and Long-Term Care Facilities (RoPs) that included compliance and ethics program regulations. These RoP changes were the first major change in almost three decades. The first requirements for nurs- ing facilities were published in 1989 with few revisions and updates since that time. Substantial changes have taken place in this service delivery setting with increas- ing diversity and clinical complexity of the nursing facility population. The 2016 regulatory changes were so sweeping that the implementation dates were divided into three phases. The compliance and ethics program requirements were under Phase 3 with a date of November 28, 2019.

JuLy 2019 ProPosed ruLe On July 18, 2019, CMS released proposed revisions (proposed rule) to the RoPs. CMS stated that it identified a number of existing SNF requirements that could reduce unnec- essary burdens on facilities if they were simplified or eliminated. The proposed

rule would alter over a dozen sections of the RoPs, including: (1) resident rights; (2) admissions transfers and discharges; (3) quality of care; (4) nursing services; (5) behavioral health; (6) pharmacy services; (7) food and nutrition services; (8) facil- ity assessments; (9) physical environment; (10) compliance and ethics programs; (11) Quality Assurance and Performance Improvement (QAPI) programs; and (12) infection control. The proposed rule also proposes to delay implementation to some of these Phase 3 provisions until one year following the effective date of the pro- posed rule. One of the areas significantly impacted by the proposed rule includes compliance and ethics programs (§483.85).

The ACA and proposed rule call for skilled nursing compliance and ethics pro- grams to be reasonably designed, imple- mented, and enforced so that they are likely to be effective in preventing and detecting criminal, civil, and administra- tive violations under the ACA and in pro- moting quality of care.

The statutory and regulatory require- ments for skilled nursing compliance and ethics programs are different from volun- tary compliance programs of many health care providers. SNF providers need to consider establishing a separate program and operations for their skilled nursing facilities.

required comPonents under the ProPosed ruLe The regulations set out 10 required compli- ance and ethics program components: In outlining each of the components, note the references to the proposed rule (2019), the final rule prior regulations (2016), and the voluntary guidance OIG Memos (2000 and 2008).

1. Assignment of Oversight of Compliance and Ethics Program

Section 483.85(c)(2) of the proposed rule demands that a facility assign the

Journal of Health Care Compliance — September–October 2019 7

Skilled Nursing Required Compliance and Ethics Programs

overall responsibility to oversee compli- ance with the operating organization’s compliance and ethics program’s stan- dards, policies, and procedures to a spe- cific individual or individuals within the high-level personnel of the operating organization.

The proposed rule removed prior regu- lations that identified that the individual who oversees the compliance and ethics program may be: (a) the chief executive officer (CEO); (b) a member of the board of directors; or (c) a director of major divisions in the operating organization. The proposed rule continues to define a “high-level personnel” as an individ- ual who has substantial control over the operating organization or who has a substantial role in the making of pol- icy. All facilities must have an employee that has specific compliance oversight responsibilities.

In its 2000 OIG Memo regarding vol- untary compliance, the OIG set out a list of the compliance officer’s recom- mended primary responsibilities, which include: (a) reporting on a regular basis to the facility’s governing body, CEO, and compliance committee (if applicable) on the progress of implementation; (b) peri- odically revising the program in light of changes in the organization’s needs and in the law and policies of government and private payor health plans; and (c) devel- oping, coordinating, and participating in a multifaceted educational and training program.

2. Written Compliance and Quality of Care Policies and Procedures

The proposed rule requires that the operat- ing organization for each facility develop, implement, maintain, and establish writ- ten compliance and ethics standards, pol- icies, and procedures that are reasonably capable of reducing the prospect of crim- inal, civil, and administrative violations under the Act.

The voluntary guidance found in the 2000 OIG Memo may shed more light on the written policies and procedures requirement calling for facilities to develop a “Code of Conduct,” a corporate statement of principles that will guide the operations of the facility. The Code of Conduct acts as a constitution, a foun- dational document that details the facil- ity’s fundamental principles, values, and framework for actions.

3. Sufficient Resources and Authority to Ensure Compliance

Section 483.85(c)(3) of the proposed rule requires that each facility develop, implement, maintain, and establish an effective compliance and ethics pro- gram that contains sufficient resources and authority to its “high-level person- nel” to reasonably assure compliance with the facility’s compliance and eth- ics program standards, policies, and procedures. The OIG Memo recognized that some nursing facilities might not be able to adopt certain elements to the same degree as others with more exten- sive resources.

4. Screening Process for Positions with Discretionary Authority

The proposed rule requires that a facility take care not to delegate substantial dis- cretionary authority to individuals who the facility knew, or should have known through the exercise of due diligence, had a propensity to engage in criminal, civil, and administrative violations under the Social Security Act. OIG and CMS have identified patient abuse, patient neglect, and misappropriation of property as widespread problems that cause harm to long-term-care residents. The OIG Memo identifies that facilities are required by federal, and in some cases state, law to investigate the background of certain employees.

Journal of Health Care Compliance — September–October 20198

Skilled Nursing Required Compliance and Ethics Programs

5. Effective Communication and Training of Compliance Standards to Staff, Contractors, and Volunteers The proposed rule requires that a facility take steps to effectively communicate the standards, policies, and procedures of the compliance and ethics program to the staff; individuals providing services under a contractual arrangement; and volunteers, consistent with the volunteers’ expected roles. The communication requirements include mandatory participation in train- ing or orientation programs or dissemi- nating information that explains, in a practical manner, what the compliance program requires.

This component relates to the train- ing regulation at 42 C.F.R. Sec. 483.95(f) in the proposed rule, which requires that a facility have an effective way to com- municate that program’s standards, poli- cies, and procedures through a training program or in another practical manner which explains the requirements under the program.

The OIG Memo emphasized that spe- cific training on issues such as claims development and submission processes, residents’ rights, and marketing practices should be targeted at those employees and contractors whose job requirements make the information relevant.

6. Procedures to Promote Compliance—May Include Monitoring and Auditing Systems

The proposed rule also requires that facil- ities utilize auditing and monitoring sys- tems that are designed to detect criminal, civil, and administrative violations under the Act. The auditing and monitoring sys- tem is to ensure compliance with facility policies and procedures and applies to staff and individuals providing services under a contract.

The regulations detail the type of auditing and monitoring that is required, which includes: (a) implement an

auditing and monitoring system rea- sonably capable of detecting violations under the Act; (b) the system of audit- ing and monitoring to detect suspected violations applies to staff, individu- als providing services under a contrac- tual arrangement, or volunteers; and (c) implement a reporting system that allows individuals to report suspected violations within the operating organiza- tion without fear of retribution.

The OIG Memo recommends that the extent and frequency of the monitor- ing should take into account the facil- ity’s resources, prior compliance history, and other risk factors particular to the facility.

7. Consistently Enforced Disciplinary Actions

The proposed rule requires that a facility have consistent disciplinary mechanisms in place, including, as appropriate, disci- pline of individuals responsible for the fail- ure to detect and report a violation (which the ACA describes as an “offense”) to the compliance and ethics program contact in the organization.

The OIG Memo advises that each situa- tion be addressed on a case-by-case basis to determine the appropriate disciplinary measures and that the written standards of conduct address how disciplinary prob- lems will be handled and who is respon- sible for handling them.

8. Appropriate Response to Violations and Prevention of Similar Future Violations

The proposed rule requires that after a violation is detected, the facility take all reasonable steps identified in its pro- gram to respond appropriately to the violation and to prevent further simi- lar violations, including any necessary modification to the operating organi- zation’s program to prevent and detect

Journal of Health Care Compliance — September–October 2019 9

Skilled Nursing Required Compliance and Ethics Programs

criminal, civil, and administrative viola- tions under the Act.

The OIG Memo provides that, once reports of suspected violations are received, it expects the compliance offi- cer to immediately investigate to deter- mine if a violation has occurred. The type of corrective action would be determined on a case-by-case basis but would include a corrective action plan, return of any overpayments, reports to state and local government or a referral to criminal or civil law enforcement.

9. Alternate Method of Reporting Suspected Violations Anonymously

The proposed rule requires that the facil- ity have an alternate method of reporting suspected violations anonymously. While this requirement may pose some chal- lenges to some operators, it echoes the voluntary 2000 OIG Memo for the creation and maintenance of an effective line of communication, including a process, such as a hotline or other reporting system, to receive complaints, and the adoption of procedures to protect the anonymity of complainants and to protect whistleblow- ers from retaliation.

10. Periodic Review and Update of the Compliance Program

The proposed rule requires that a facil- ity review its compliance and ethics pro- gram periodically and revise its program as needed to reflect changes within the oper- ating organization and its facilities. The prior regulations required that the operat- ing organization for each facility review its compliance and ethics program annually and revise its program as needed to reflect changes in all applicable laws or regula- tions and within the operating organization and its facilities to improve its performance in deterring, reducing, and detecting vio- lations under the ACA and in promoting quality of care.

AdditionAL requirements for orgAnizAtions with five or more fAciLities And fAciLities with corPorAte LeveL mAnAgement of muLti-unit chAins The proposed rule addresses additional requirements for operating organizations with five or more facilities and facilities with corporate level management of multi- unit nursing home chains. An operating organization is defined as the individual(s) or entity that operates the facility. The regulations set forth what is required for operating organizations with five or more facilities and facilities with corporate level management of multi-unit nursing home chains, which includes: (a) having a more formal program that includes established written policies defining the standards and procedures to be followed by its employees; and (b) developing a compliance and eth- ics program that is appropriate for the com- plexity of the operating organizations and its facilities. The prior regulations required these operating organizations and facilities to (a) conduct a mandatory training on the operating organization’s compliance and ethics program; (b) designate a compliance officer that reports directly to the operating organization’s governing body, who must not be subordinate to the general counsel, chief financial officer, or chief operating officer; and (c) compliance liaisons must be located at each of the operating organi- zation’s facilities.

interAction with qAPi ProgrAm And fAciLity Assessment In CMS’s responses to public comments on the RoPs, CMS wrote that facilities should be integrating the information and data they collect or that arises out of their compli- ance and ethics programs into their Quality Assurance and Performance Improvement (QAPI) program. The proposed rule revised many of the requirements of QAPI, and providers need to carefully review the impact of these changes on their program. CMS also expects that all facilities will also

Journal of Health Care Compliance — September–October 201910

Skilled Nursing Required Compliance and Ethics Programs

use the Facility Assessment when develop- ing and maintaining their compliance and ethics programs.

risk Assessment Although not addressed in the proposed rule or prior regulations, the risk assess- ment is an important piece of develop- ing an effective compliance program. For those skilled nursing facilities that are just getting started or for those that are looking to make their program more effective, an accurate risk profile is essential to a healthy compliance program. Taking the time to assess common industry risks (external) and the risks specific to each SNF (internal) can reap huge benefits. A risk assessment also guides application of the required ele- ments. What policies are needed? What should be audited? What content is crucial in education and training? Look to the risk assessment for answers. Start with a simple list of both internal and external risks and rank according to potential impact at the facility level.

engAgement It’s no secret that skilled nursing facili- ties have a multitude of regulations. New requirements often mean new policies. New policies require new procedures. There is a tendency when new regulations and laws are made to write the policy, put it in a binder, and file it away. The check- mark is made, and operators move to the next thing on their ever-growing “to-do” list. The Phase 3 Compliance and Ethics Program requirement is not just a checklist item. Providers who take the time to build an effective program can potentially reap benefits in all areas of operations, includ- ing improved quality of care, better regula- tory outcomes, protecting reimbursement,

and guarding the organization’s reputation. To have a truly effective compliance and ethics program, it must start at the top with company owners, boards, and executives. If leadership does not think it’s important, the workforce will know. If compliance becomes a paperwork checklist item, the frontline folks will know. Top leadership must believe in the value of compliance and engage the entire organization to have a truly effective program.

imPLementAtion timefrAme And survey guidAnce Under the proposed rule, beginning on November 28, 2020, surveyors determine whether a facility’s compliance and eth- ics program fulfills the requirements in the proposed rule. CMS, however, has not yet issued significant interpretive guidance on Section 483.85.

where we go from here Although some requirements of the com- pliance and ethics component of the RoP have changed and effective dates delayed, skilled nursing facilities that do not already have a compliance and ethics program should begin putting one in place so that they are ready for survey enforcement. Facilities that have implemented compli- ance and ethics programs should review the proposed rule requirements against their existing programs and revise as necessary. Reviewing the voluntary OIG Guidance memos from 2000 and 2008 may also help enrich a facility’s compliance plan. Using QAPI and the Facility Assessment can help enhance compliance efforts. Consider the risk assessment as a starting point for the rest of the program. Engage top leadership so that the plan is truly effective. Finally, don’t forget to reset your countdown clock!

Copyright of Journal of Health Care Compliance is the property of Aspen Publishers Inc. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.