Compliance Perspectives

By Adam Turteltaub

The Organization for Economic Co-operation and Development, better known as the OECD, has long played a role in the fight against corruption. It’s Convention on Combating Bribery of Foreign Public Officials in International Business Transactions has led to the proliferation of anti-corruption laws around the globe and encouraged compliance efforts.

In this podcast the OECD’s Ingrid Hampe (LinkedIn), Lead Policy Analyst, and Santiago Wortman Jofre (LinkedIn), Team Lead – Anti-Corruption and Integrity in State-Owned Enterprises , share information about another initiative of the OECD: Compliance Without Borders. A part of the Global Initiative to Galvanize the Private Sector as Partners to Combatting Corruption, and developed in partnership with the US Department of State, it pairs a compliance professional from the private sector with a relevant professional in a state owned enterprises (SOE) for three to six months. During this time the private sector provides hands-on support to help build structures within the SOE to decrease corruption.

The key to success for these partnerships is creating the right match of partners. Each participant fills out a detailed form which captures their expertise or needs. The match is made accordingly, with care to ensure that it is compatible on other levels as well and that there are no potential conflicts of interest.

The program is part of a growing wave of collective action efforts designed to create new strategies for stemming corruption.

Listen in to learn more about this effort, and be sure to take a look at the Compliance Without Borders Handbook.

For further information you can contact:

Rita Guelzim at the OECD via email.

Listen now

By Adam Turteltaub

Healthcare lives on data. Getting it to the patient and providers is essential for delivering quality care, but that can be a challenge.

As Eden Avraham-Katz (LinkedIn), Vice President, Legal and Compliance at 1upHealth explains in this podcast, the CMS Interoperability and Prior Authorization Rule helps standardize how health plans and payers share information with individuals, in-network providers and other providers as well. Animating the rules is the goal of empowering the individual with relevant information so that they can make better, more informed decisions as well as benefit from more affordable care.

Complying with the rule will require the development of multiple APIs to ensure data moves smoothly. To further ease the flow, the Fast Healthcare Interoperability Resources (FHIR) standard has emerged for structuring data, which helps ensure an accurate transfer.

To ensure your organization meets its compliance obligations, she recommends beginning at once. You’ll need APIs to facilitate patient, provider and payer access plus another one for handling prior authorizations.

You will also need to focus on your opt-in/opt-out process. Listen in to learn more about how best to address these issues and others to ensure compliance with the Interoperability and Prior Authorization Rule.

Listen now

By Adam Turteltaub

Dan Longhouse, founder and president, LHT Learning, wants organizations to change their definition of successful compliance training. Rather than just being about avoiding risk, he believes the training strategy should be designed to help employees understand why compliance is critical to business success. They need to see, he argues, that compliance isn’t just about avoiding negative consequences. It’s there to help them do their jobs better and make informed, ethics-driven business decisions.

So, what’s the formula for success? His recipe includes:

A one-to-three year vision for your training program

Ready data to inform the training roadmap

Training customized for roles, including relevant content and a media format that works for them

The ability to address emerging issues

A commitment to promoting retention

Listen in to learn more about how to improve the effectiveness of your training initiatives. He also recommends podcasts.

Listen now

By Adam Turteltaub

What should you ask when first approached about a job by a recruiter? What should you ask during the interview to ensure that there is a cultural fit, and that the compliance program has management support? What skills do hiring managers want in compliance officers? And what’s the overall market like?

To get answers to these questions we sat down with a professional recruiter who specializes in compliance positions, Jamie Browne, Managing Director, Corporate Governance, Leonid Group.

He had good news: there is strong demand for compliance professionals, especially in hot areas like export controls. But there is also strong demand for a broad range of knowledge, with compliance teams globally being asked to oversee directly or indirectly a wide range of legal and regulatory risk areas.

For a compliance officer looking to test the waters or approached by a recruiter, he recommends by asking for as many details about the compliance program as possible right at the start. That includes understanding why there is an opening.  Is this a new position?  Is it a replacement, and if so, why is there now an opening?

Be sure not to be shy and to ask early about the sometimes awkward but important practical considerations: what is the salary range, is the job in office, remoter or hybrid and will they pay for relocation? You don’t want to go down the road just to have one of these potential deal breakers get in the way.

Once you are in the door and talking to the organization, he also encourages candidates to ask about the compliance culture to determine how strong it is. Also, ask about the overall culture so you can get a better feel for the company and the people you will be working with.

He also advises asking about the travel budget. For one, the ability to see things firsthand and build rapport is crucial. Second, it can be a sign of the organization’s commitment to the compliance program.

Listen in to learn more about these topics and the value of a legal degree in the current market.

Listen now

To hear Jamie’s advice to employers on recruiting the best candidate, click here.

By Adam Turteltaub

When we think of third parties we tend to immediately think of the risks. But what if it is a third party that differentiates itself by the rigor of its compliance program?

Such is the case with Swiss-based DKSH, which serves the consumer goods, healthcare, performance materials and technology industries. Tal Freilich, Vice President, Group Governance, Risk & Compliance for the company, explains that the strength of its compliance efforts have been a value add for the company and a selling proposition.

So what does he see as a third party being vetted by another company? For one, he learns a lot about the company vetting DKSH. The due diligence process gives him a sense of whether the prospective business partner truly is committed to compliance or whether it might pose a risk to DKSH’s own reputation.

He also sees common mistakes such as reliance on a one size fits all due diligence process. There is also an over-dependence on a process of asking prospective third parties for information which is already available online. It is annoying for the third party and time consuming for both. DKSH increased its use of web-based due diligence tools and was able to reduce its own due diligence process in many cases from months to days.

He also has found blind spots in many companies’ due diligence processes. They have not yet woken up to expanding requirements in areas such as responsible procurement, including human rights, child labor and carbon footprints.

Listen in to learn more about how to improve your third party vetting and to understand the third party’s perspective.

Listen now

By Adam Turteltaub

Jay Anstine (LinkedIn), President of Bluebird Healthlaw Partners, recently wrote a blog post I spotted entitled How to Sell Compliance Without “Selling” Compliance. It struck home, and I asked if he cared to do a podcast about it.

He said yes and explained in the interview that compliance is often seen as the “hall monitor” rather than a welcome party to business conversations. To overcome that he recommends we focus on several methods for changing perceptions.

Establish Rapport

Be more intentional about truly getting to know the business people. Learn about the market, the business partners and competitors that they have. Show them that you understand the business issues that they face. Take the time as well to better know them as people.

Do Your Homework

Know your audience and their operation. Understand their point of view and the issues that they face. Walk a mile in their shoes. When he faced an issue with hospital registrations, he spent several hours working the registration desk to understand the situation better.

Anticipate Questions

Think like a healthcare leader, not a compliance officer, and how they may respond to what you plan on telling them.

Package Your Communications

Bring them both the problem and the solution. That helps alleviate anxiety and gets you closer to achieving the change you are seeking.

Listen in to learn more about how to sell your compliance program internally.

Listen now

By Adam Turteltaub

In 2023 the US Securities and Exchange Commission adopted rules “requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy and governance.”

Michael Leach, Director, Global Compliance, for data security firm Forcepoint explains that with the rules comes a new focus on transparency. This was help markets and individuals better understand what publicly-traded companies are doing to manage this risk and in response to breaches. The rules also raise pressure on organizations to increase their cybersecurity efforts since no one wants to have to disclose a weak cybersecurity regime or worse, a breach..

The rules, he explains, have real teeth, with fines ranging from the $1000’s to the millions. More importantly, the required disclosures are likely to have significant reputational impact on companies.

So what should companies be doing in light of the rules? In addition to making any required disclosures he recommends taking the time to understand the impact a cyber incident would have on the organization as a whole. Then, from a hands-on data perspective, make the effort to identify high risk, high value data and invest in the tools to secure it.

Listen in to learn more about the rules and what companies need to do to comply.

Listen now

By Adam Turteltaub

At Transparency International’s International Anti-Corruption Conference I had the good fortune of meeting Olusoji Apampa, CEO of Integrity Nigeria. I appreciated hearing his insights on corruption risk in Nigeria, and, to share them with a wider audience, we sat down for this podcast.

The risk, of course, is real and high. Worse, many have bought into the idea that there is nothing that can be done, which leads to more corruption. But, happily, he reports that you absolutely do not have to engage corruption to do business there.

How? First, he advises understand the risk level; it varies considerably. The picture is very different in Abuja than it is in Lagos, and Lagos is not the Niger Delta. Economic sector matters as well. Doing business in the education sector is very different than doing so in oil and gas or banking.

The size of the corporation also has an impact on the corruption risk profile. Generally speaking, larger corporations ore better able to resist the pressure to pay bribes than small or medium-sized ones.

So what should companies do? First, take a hard look at the specific risks of where they do business and what industry they are in. Second, don’t embrace corruption as a strategy. Aside from being illegal, paying one bribe can lead to demands for ever more. Third, stick to and be clear about what your principles are, and have a compliance program backing them up

He also urges companies to think outside the box and never go it alone. Instead, they should embrace collective action, working with others who share a commitment to doing business the right way.

Listen in to learn more about the risks and how to mitigate them when doing business in Nigeria.

Listen now

By Adam Turteltaub

Melanie Fontes Rainer recently marked the completion of her second year leading the Office for Civil Rights at HHS. In this podcast she shared some of the accomplishments over this time as well as what the health care community can expect next.

She recounts the six rules that have been issued, ranging from reproductive rights to Section 1557 of the Affordable Care Act, which covers nondiscrimination and is inclusive of sex, race, disability, national origin, religion and color. Also of note have been activities designed to ensure access to documents in languages other than English.

She also shares what OCR has been doing to engage with the provider community through in-person meetings, webinars, YouTube videos and resources on their site.

Looking to the future, the Director warns that health care providers are likely to continue to be attractive targets for data breaches and ransomware attacks. She advises covered entities to do what they can to make themselves less attractive by having a risk plan and implementing it.

Listen in to learn more about what OCR has been and will be doing.

Listen now

By Adam Turteltaub

There isn’t one way to handle conflicts of interest. Much depends on the research the organization is doing, its history and other systems. Hilary Kitson, Research Compliance Business Partner at Saint Luke’s Health System, reports that typically the starting point is Title 42 PART 50 Subpart F in the Code of Federal Regulations. It lays out time points when disclosures are necessary:

Annually

When discovering or acquiring a new financial conflict of interest (COI)

At the time of application for PHS-Funded research

Disclosures aren’t enough, though. There needs to be investigators and a review committee who are competent to examine potential conflicts and are sensitive to the confidentiality of the information involved.

And what if there is a conflict? She advises involving regulatory and other professionals who can help develop a management plan, if one is necessary.

Listen in to learn more about the very complex issue of conflicts of interest in research.

Listen now