Compliance Perspectives

Post by Adam Turteltaub

Privacy is always a hot topic in healthcare, but even so, some areas are hotter than others. In this podcast Kara L. Hillburger, Privacy Compliance & Digital Accessibility Team Leader and Managing Director of the Octillo law firm, shares insights into the areas the enforcement community is currently focused on.

It’s not just the federal government that’s of concern these days, she points out.  State attorneys general are becoming more active in this arena. Under the HITECH Act they can bring actions of their own for HIPAA Violations, which has resulted in substantial financial penalties.

The pandemic has also led to changes in the enforcement landscape. With the rules for telemedicine changed and more data collected on patients, several states have increased their enforcement activity. For compliance and legal teams that means taking the time to understand both the federal and state perspective.

Data governance is, at the same, growing more difficult. On the one hand, ever-increasing cyber risks argue for locking down as much information as possible. At the same time, though, OCR is calling for greater data portability and transparency.

So what should organizations do?  In this podcast she suggests:

* Making the effort to stay on top of the legal and regulatory changes.

* Ensuring that there is a strong data governance structure in place

* Having a clear delineation of roles and responsibilities: Figure out who is doing what and hire the right people.

* Keeping your policies and procedures up to date.

* Planning on annual policy reviews that reflect the realities of both in-office and at-home workers.

* Identifying proper resource.

* Providing regular data privacy and security training and document it.

* Having consequences in place for violations.

* Knowing your vendors and what they are doing to safeguard your data.

Listen in to learn more about what’s especially hot in healthcare privacy compliance.

Post by Adam Turteltaub

To get a better understanding of the state of antitrust enforcement we sat down with Andrew Mast, Counsel to the Assistant Attorney General for Antitrust at the US Department of Justice. In this podcast he shares key priorities of the Antitrust Division.

First up is a discussion of the Supply Chain Initiative, which is a partnership between the DOJ and FBI. Supply chain disruptions have caused prices to increase, as we have all seen, and the Initiative is tasked with determining whether the disruptions have been used as a cover for collusive conduct. As he notes, past disruptions, ranging from the Great Recession to a spike in the price of tuna, have led to collusive behavior.

To help protect consumers and businesses dependent on their supply chains, the Initiative is taking a proactive approach, working closely with the governments of the United Kingdom, Canada, Australia and New Zealand, sharing intelligence and working cooperatively.

The DOJ is also reaching out to the business community, providing education about antitrust laws, encouraging the development of compliance programs, and sharing details about the Antitrust Division’s leniency program. Under it, the first conspirator in a price-fixing conspiracy can avoid criminal prosecutions. But, he warns, companies must report promptly after discovering collusive behavior to enjoy the full benefits.

To help business understand the program fully, a new FAQ is now available.

Another priority for the Department of Justice is labor market collusion. Their goal is to ensure workers gain the benefits of competition. In the Department’s view, no-poach and similar agreements lead to lower wages, reduced mobility and less ability for workers to negotiate watches. Several firms have already been indicted.

Finally, he discusses the Procurement Collusion Strike Force, founded in the wake of increased government spending such as the $1.2 billion infrastructure bill. The goals of the Task Force are to deter antitrust activity and to facilitate more effective prevention, investigation and prosecution. Over 20,000 individuals have been trained as a part of this initiative, and it covers both US procurement domestically and internationally.

Listen in to learn more about what the DOJ is doing, and what compliance teams should be thinking about.

Post by Adam Turteltaub

Compliance programs continue to evolve, seeking new and better ways to prevent and detect violations of law. It was in that spirit, reports Chris Audet, Senior Director, Research at Gartner, that they began examining ways to improve program effectiveness.

At the time the survey began, many of their clients were dealing with peak Covid challenges, which included limits on training and the creation of new policies. Enhancing controls emerged as a potential alternative means of preventing problems. Of particular interest were embedded controls because they can both mitigate risk and reduce the burden on the workforce. Rather than training everyone on an issue or employees having to search for information, the control could flag a potential issue and help both the compliance team and the individual employee act appropriately. For example, travel and entertainment management software could automatically flag an issue and ask the proper questions.

As Gartner studied the issue they discovered that compliance burdens tended to fall disproportionately on department and management levels not identified as high risk:  research and development, engineering teams, strategy, planning and others. Because these groups were least attended to, individuals working in them needed to work the hardest to understand their compliance obligations.

Senior and Executive Vice Presidents also tended to be overly burdened because they are often trained less than others on compliance issues. As a result, they frequently struggle determining what to do in a given situation.

To reduce the compliance burden the Gartner report recommends three things;

* Help employees remember better by putting controls closer to decision making.

* Reduce the number of judgement calls

* Help employees execute

Listen in to learn more about easing the compliance burden.

Posted by Adam Turteltaub

Being a compliance department of one can be a lonely job, but not for Susan Freccia, Director of Compliance at Oregon State University. Working in a small compliance department doesn’t feel like a challenge.

For one, she is not fully alone. There are compliance partners – professionals who have at least some compliance responsibilities – across the campus. More importantly, rather than focusing on her lack of a compliance team of her own she works at creating collaborative relationships far and wide. That includes the compliance partners, staff, HR, legal and audit.

For others in solo situations she advises not falling into the temptation of thinking, “If only I had X or Y the compliance program could be better.” Instead, she recommends focusing on how to work effectively and continue to improve processes.

She has also found success comes from the ability to help others get “unstuck” in their efforts.  She frequently meets with various individuals and teams to help figure out what the challenge is and to find a solution. She also may serve as a bridge between departments who may share responsibility in an area, helping them to collaborate more effectively.

Susan also advises against seeking perfection. It’s unattainable. Incidents will always occur. She notes that even the Sentencing Guidelines reflect that reality with several elements addressing how a program responds to the inevitable problems.

In sum, to make a small program work, take a collaborative, problem-solving approach. It will be more effective and help people see compliance not as the cause of problems but the solutions to them.

Posted by Adam Turteltaub

The Navex 2022 Risk & Compliance Hotline & Incident Management Benchmark Report provides a fascinating look into what’s going on in compliance in general and how employees are using helplines specifically.

The 2021 report had illuminating insight into the impact of the pandemic. To learn what is in the data from the latest report, we again sat down with Carrie Penman, Chief Risk & Compliance Officer from NAVEX.

This year’s report, which covers data from 2021, revealed four key trends, she reports:

* Whistleblowers are more emboldened. They are more likely to use their names, rather than remaining anonymous, when making a report. Viewed against the SEC’s reported near doubling of leads to the Office of the Whistleblower, it’s clear that workers are more willing than ever to come forward. What is unclear is why the change. It may be due to employees feeling that it would be easy to find another job if they were retaliated against.

* Reports of retaliation have increased. The question here is whether retaliation has increased or employees are more willing to report it. One theory is that employees are much more attuned to issues of workplace civility.

* COVID continues to have an impact. While the number of calls to helplines has increased, they are still below pre-COVID levels.

* ESG related reporting is notably low. This may be due to employees not fully understanding ESG, or believing that those issues don’t need to be brought to compliance or the helpline. In both cases, more training may help affect the numbers

Finally, looking to the future, Carrie anticipates the possible recession leading to turmoil.  Fear levels rise when layoffs occur, and people see less opportunities to find new work. Managers may place excessive pressure on employees to make the numbers, despite the economy.

All of these factors could lead to a great deal of work for compliance teams, and a very different report for 2023.

Posted by Adam Turteltaub

Good and bad decisions are at the heart of compliance efforts. So much of our work is dedicated to helping people make better informed choices.

In this podcast, Rupert Evill, Founding Director of EthicsInsight shares practical advice for making good decisions.

He begins, though, with outlining several factors that lead to bad decision making. Pressure is, not surprisingly, a very large factor, whether it is time-based or financial.  Ethical hazing wrongly gives people permission to do something that they shouldn’t. Faulty assumptions are another persistent challenge. Still another factor is failure to plan. Not taking the time to foresee issues can leave individuals suddenly confronted with circumstances where it is already too late to do the right thing.

So how do we encourage and make good decisions?  He lays out four steps:

* Consider possible outcomes. Take the time to assess what might happen and encourage diverse opinions. One handy trick he recommends is asking people to write down ideas rather than sharing them publicly. That can lead to more diverse thinking.

* Consider the likelihood of each outcome. When doing so, he recommends using a numerical scale rather than words like “it’s possible.” That phrase can mean very different things to different people.

* Rank the preferred outcomes and their likelihood. Look for assumptions in decision making and test them to see if they are true. Consider carefully your strategy for achieving your goals.

* Consider what can be done now to favorable affect the outcome. Think through what the options are, don’t show your cards too soon and remember that there is usually more than one option.

Listen in to learn more. It could be the best decision you make today.

Post by Adam Turteltaub

Ever-increasing sanctions of Russian individuals and entities are looking to be a long-term challenge for compliance teams.  That’s not surprising since, they are a part of a war of attrition, according to Oleksandr Pomoshnikov, Head of International Business Development for Ukraine-based YouControl, which offers RuAssets, a tool for tracking Russian and Belarusian assets.

In this podcast he underscores the importance of adopting a three lines of defense model and paying close attention to the origins of funds.  Russian companies have been actively changing beneficial owners to persons in neighboring jurisdictions and opening business units there as well.

This can lead to very complicated and hard-to-trace business structures, he explains, not just because there may be multiple holding companies.  Many of the jurisdictions in the region have closed systems, making it difficult to determine ownership and identify politically exposed persons.

Listen in to learn more.  But do listen carefully.  Oleksander was in Poland with a challenging internet connection while recording.

Post by Adam Turteltaub

When we talk about communications in the world of compliance, we tend to focus on training and other forms of mass information sharing. Not as often discussed, but just as important, are the individual one-to-one conversations between the compliance team, leadership, management, and frontline personnel. Getting these interactions right is essential to the success of a compliance and ethics program.

Donna Schneider (LinkedIn), Vice President, Corporate Compliance and Internal Audit, Lifespan, has been running a series of six columns in Compliance Today magazine focused on communication done well. In this podcast she touches on a few of the key topics that she addresses.

Her first piece of advice: stick to the facts. It's very important to be factual because if you do not rely on facts there is a tendency to tell yourself a story. By analogy she points out that when someone cuts you off driving we tend to come up with reasons why the person did it, even though all we know is that they cut us off. Likewise in a crucial conversation it's good to focus on what you know definitively:  the things you saw, heard or read yourself.

She also shares how to handle one of the ongoing challenges when it comes to compliance:  setting expectations for leadership. Often, management is eager to come to a quick resolution and put the issue behind them. That is not always the best course since a thorough investigation takes time. For that reason, she advocates consistent communication, establishing a collaborative rapport and setting reasonable expectations.  Periodic updates are also exceedingly important.

Before a difficult conversation she advises thinking through what outcome you want for yourself, others or the organization. Consider, too, the relationship between you and the person you are speaking to. Don't focus on the specific issue you are talking about but what you want to happen. Are you in a dialogue, do you want to share facts or are you there to learn facts? Think about your intent and then ask yourself: how would I behave to achieve that goal? Think through, too, both what verbal and nonverbal communication skills you will need.

Think through also how you would respond if the conversation went south. What would you say or do to bring it back to the direction that you want?

Listen in to learn more about how to best prepare for difficult conversations, including the power of “do” and “don't do” statements.

Posted by Adam Turteltaub

You just started leading a compliance program.  Whether you are new to the company or new to compliance, you probably have a lot of questions to ask as you get started, but where do you begin?

In this podcast, Beverlin Hammett (LinkedIn), Compliance Regulatory Risk Officer at Habersham Medical Center, offers an intriguing answer.  She met with leadership around the organization and asked them three questions:

* How long have you been with the hospital?

* What are your main issues?

* What do you think I am here to do?

The first question helped her understand how much experience the person had both within the organization and their role.  This helped her gain an understanding of how much expertise the person had as well as the issues, challenges and triumphs that they had experienced.

Asking what the main issues they saw was a more subtle question than it appears.  It provided insights into their perspective on the institution and its challenges and helped her understand their focus.

The final question, “What do you think I am here to do?” helped illuminate attitudes towards compliance and begin laying the foundation for the idea that compliance is here to help solve problems.

The exercise helped her both get off on the right foot with operations and to better understand the challenges and opportunities.  It also helped illuminate several issues within the organizations that she was able to successfully address immediately.

Listen into learn more about her intriguing approach and the benefits it could have for other organizations.

By Adam Turteltaub

When it comes to encouraging internal whistleblowers, there are two main barriers to coming forward, reports Jeb White, CEO, Taxpayers Against Fraud.  First, is the belief that their concerns won’t be heard.  Put another way:  why bother.  The second is the fear that by sticking their necks out they risk getting their heads chopped off. Their careers could be ended.

Even for those who do come forward, there is always the challenge of keeping their trust so that they do not then go outside the organization to the press or regulators.

To solve these challenges he recommends embracing communication and transparency.  To the extent that you can, keep whistleblowers in the loop.  Let them know that the investigation is proceeding.  Embrace the lesson from food delivery apps that let you know that your pizza is in the oven.  Let the whistleblower know that the investigation is ongoing and active.  And, to the extent you can, let them know what the final disposition was.

If the organization does not find wrongdoing, he recommends sharing with the employee the broader context as to why what he or she saw was legal and proper.  Perhaps explain the laws involved. That will help them both understand the organization’s decision and stay engaged.

If the organization does find wrongdoing, Jeb is a strong advocate for sharing the lesson internally.  It will help demonstrate that the organization takes wrongdoing seriously.

It also helps mitigate the risk of a dysfunctional culture, in which the words in the code of ethics are nothing more than words, employees are afraid to speak up, and lines of communication are shut down.

Listen in to learn more about how you can improve your own internal whistleblowing efforts.