A little over a month ago the Office of Inspector General, U.S. Department of Health and Human Services (“OIG”), in collaboration with a number of other independent health care organizations, issued what it deemed to be “practical guidance for health care governing boards on compliance oversight.” This document is intended to assist governing boards in carrying out their compliance program oversight function under the applicable health care laws, rules and regulations.

Boards are charged with ensuring the organization has a proper compliance program. Clearly such programs are not “one-size fits all.” The Board, in collaboration with other key individuals, should make certain that the health care organization’s program complies with previous guidance issued by the OIG governing such programs. Additionally, according to the OIG, “[a] Board must act in good faith in the exercise of its oversight responsibility for the organization,” which includes making sure a system of reporting exists and information is being adequately reported such that the Board can ask proper questions and respond appropriately to issues of potential liability or otherwise. In essence, pursuant to OIG guidance, the Board has five main functions with respect to compliance. These are as follows:

  1. The Compliance Function whereby the Board promotes the “prevention, detection, and resolution of actions that do not conform to legal policy, or business standards.”
  2. The Legal Function whereby the Board advises the organization on the legal and regulatory risks of its business strategies and operations.
  3. The Internal Audit Function whereby the Board provides an objective evaluation of the organization’s risk and internal controls to ensure the organization is operating within appropriate parameters.
  4. The Human Resource Function whereby the Board ensures the organization manages the recruiting, hiring, and training of employees and others appropriately.
  5. The Quality Improvement Function whereby it is the Board’s responsibility to ensure the organization provides consistent, safe, and high quality care.

What the OIG and its collaborators did not do was provide specific operational guidance to health care boards indicating that there is no uniform approach to compliance. The key is that the board must be actively overseeing the undertakings of the organization. However, there are certain practical considerations that the Board can take as the OIG alluded to in its guidance document. Some of these considerations include the following:

  1. Develop subject matter expertise. It is beneficial if the Board is independently knowledgeable about issues that affect a health care organization (i.e. human resource matters, the Stark Law). It is up to the Board and/or its members as to how this is accomplished. It can be through the background and expertise of one or several Board members or the Board can seek guidance from counsel or other “experts” in applicable areas. The Board should stay up-to-speed on the ever-changing health care regulatory environment and be apprised of potential risk areas affecting the organization (i.e. referral relationships, conflicts of interest, billing problems, patient privacy, and quality of care issues).
  2. Ensure information is adequately reported. Boards should receive a balance of information that helps them to evaluate business activities, assess organizational compliance and risk, and ensure quality operations. Moreover, the Board should take time to thoroughly review the materials presented prior to and/or at Board meetings. Attention to detail is critical. This includes evaluating audit results and findings, the organization’s quality scores, employment matters, as well as other compliance materials. The more time the Board spends with such materials, the more likely the Board is to identify any discrepancies, issues, concerns or other matters where additional follow-up and/or further investigation may be warranted.
  3. Embrace the duty. The Board needs to be active. The OIG makes it clear that there is an expectation that Boards will take an active role in ensuring an organization is operating in compliance with all applicable laws, rules and regulations. The government is looking for accountability and health care organization boards will need to demonstrate the efforts and measures taken to oversee the activities of the organization. It will not be acceptable to simply standby and rubber stamp issues presented without fully evaluating the organization’s activities and/or potential compliance concerns.
  4. Ask questions. This goes back to the basic saying which is, there are no bad questions. According the OIG, “a critical element of effective oversight is the process of asking the right questions of management to determine the adequacy and effectiveness of the organization’s compliance program.” It also includes asking the right questions to determine whether the organization’s day-to-day or business operations in general are being conducted in compliance with all legal and regulatory requirements.
  5. Encourage Accountability. The Board must provide clear expectations of management and others in key compliance roles in an organization. These individuals are responsible for the legal and regulatory compliance of the organization and should regularly report such activities to the Board. The Board should hold such members of management accountable for executing the compliance program, identifying and mitigating the organization’s compliance risks, and implementing any and all corrective or remedial measures as needed. The Board should also have an active role in setting the organization’s compliance expectations for employees. 
  6. Promote Candor. The Board should promote candor throughout the organization by encouraging a culture of compliance. Management, employees and others within the organization must be empowered and encouraged to bring potential compliance matters forward for review and resolution and without fear of retaliation. Also, the Board should promote candor within its own discussions which can include the use of executive sessions or the recusal of members from certain discussions when such Board members have a conflict of interest. 
  7. Tackle tough decisions. Boards often need to make tough decisions in order to act in the best interest of the organization. It is important that Boards be able to look past competing interests such as personal relationships or budgetary concerns when it comes to ensuring the organization’s legal and regulatory compliance.
  8. Memorialize the Board’s activities. It should go without saying, but the Board must document its compliance oversight activities. Detailed minutes should be kept such that the Board can show it was actively engaged in assessing and evaluating the organization’s business operations, compliance activities and overall performance.

Certainly this list is not exhaustive, but it provides a good starting point for health care boards to begin to operationalize their role and duty in overseeing organizational compliance. This may be of even greater significance given the continued scrutiny of this issue by the OIG.