Compliance Perspectives

Post By: Adam Turteltaub

Corporate cultures tend to be organic, living things, but where do they come from?  According to Ruth Steinholtz of AreteWork, interestingly enough they come from imitation.  The author of Ethical Business Practice and Regulation reveals in this podcast, that people tend to mimic the behaviors they see in their leadership.  And, often, patterns of behavior within an organization even reflect senior executives who have long since departed.

As cultures evolves, some, obviously can grow toxic.  A blame culture, in which the tendency is to look for individuals to blame for mistakes, is particularly dangerous.  So, too, those filled with abrasive behavior, disrespect, and fear.

To keep culture moving in the right direction she advises engaging actively with leadership as well as other functions that can have a significant impact:  HR, legal, sustainability, internal communications and internal audit.  The board can also play an important role, as can regulators as well as customers.

Listen in to increase your understanding of how cultures can and should be shaped.  And, for those interested, here is the publication she refers to in the podcast:  Performance Management for an Ethical Culture

Post By: Adam Turteltaub

A hospital has a patient with COVID-19. Can it share this information with the media if the patient isn’t named?

A patient in the ER hears the person in the next room coughing. He asks if that person has COVID-19. Can you tell him?

An employee tells her boss she has COVID-19. What can the boss tell the rest of the office?

The corona virus pandemic has led to endless questions about what is and isn’t permissible in both healthcare and other settings. Tackling the issues in this podcast are Joan Podleski, Chief Privacy Officer, Children’s Health; Marti Arvin, Executive Advisor, CynergisTek; and Adam Greene, Partner, Davis Wright Tremaine.

As they explain, for healthcare organizations, there needs, as always, to be great sensitivity to HIPAA and what is considered personal health information (PHI). For employers in the rest of industry, HIPAA generally doesn’t apply but the American with Disabilities Act (ADA) may limit what you can and cannot share. It can even affect how you store the information about a COVID-19 patient in your systems.

Compliance teams need to be alert to these and many other potential issues.

Our podcast guests also advise compliance teams to ensure that IT systems are being used properly by remote employees. The family sitting around the dinner table is great at dinner, but not if there is PHI that the kids can see.

Listen in to learn more about permissible, impermissible and accidental disclosures in the time of COVID-19.

Post By: Adam Turteltaub

There are few businesses seen as more essential today than FedEx. Its trucks have become a lifeline for many. But just because a company can and must operate, doesn’t mean it enjoys carte blanche to do what it likes. The rules still apply.

So how do you keep your organization within the lines? Justin Ross, Staff Vice President and Chief Compliance Officer of Federal Express, advises in this podcast that compliance professionals first realize that employees are distracted, under pressure both at work and at home, and receiving copious amounts of information from all sides. As a result, compliance teams have to be strategic about their communications, focusing on the biggest risks and how they are relevant in the current environment.

Other advice includes:

* Fall back on the cultural foundation of the organization, especially if it’s a strong one

* Make sure that acting quickly doesn’t mean cutting corners

* Remember that the usual risk areas – FCPA, sanctions, export controls -- don’t disappear during a crisis

* Make it safe for employees to come forward

Listen in to learn more about managing today and what the future is likely to hold.

Post By: Adam Turteltaub

As healthcare moves increasingly from fee for service model to one focused on outcomes and value-based payments, the traditional fraud and abuse laws, such as the Anti-Kickback Statute and the Stark Law, pose obstacles to this transition. As a result, the Department of Health and Human Services (HHS) issued a proposed rule to make changes to these statutes’ regulations as part of its Regulatory Sprint to Coordinated Care. These changes both address facilitating the transition to value-based payments and also reduce regulatory burden by proposing new or amending safe harbors and exceptions. The Stark Law proposed rule also includes new or revised definitions of key terms, such as fair market value, the “volume or value of referrals,” and commercial reasonableness.

In this podcast, Katherine Bowles, a registered nurse and healthcare attorney at Nelson Hardiman and Tony Maida a partner at McDermott Will & Emery explain these proposed changes and how to consider preparing for a final rule. This preparation could include exploring potential partnerships to create a value-based enterprise.

Even if the proposed rules are finalized, compliance with the Anti-Kickback Statute and Stark Law will remain an important part of an organization’s compliance program. The panelists discuss ways for compliance programs to address these issues, such as having a sound approval process and monitoring contract performance.

Finally, our panelists also discuss how the COVID-19 pandemic has impacted compliance with these laws, including the rise of telemedicine and the Stark waivers and Anti-Kickback policy statements.

Listen in to learn more.

Post By: Adam Turteltaub

A lot has changed with he COVID-19 pandemic, but what if your organization is under a monitorship? Have the rules changed there, too?

According to John Hanson, President of the International Association of Corporate Monitors and a Managing Director at BDO, they have and they haven’t. The government recognizes that things are different now and are willing to work with monitors and companies if there is a genuine need to. But, this isn’t a new phenomenon. Instead it is a part of a broader recognition by the government that things do come up that are outside of an organization’s control.

However, that doesn’t mean that organizations under integrity agreements are likely to get a blanket “Get out of Jail Free” card. In fact, if an entity has been uncooperative in the past, the government is likely to be very skeptical if it now tries to lean on COVID-19 as an excuse.

In this podcast, John provides further insights on managing a monitorship through these challenging times, including advice to monitors to see what the organization is achieve despite the pandemic.

Post By: Adam Turteltaub

There is a great deal of advice available for organizations seeking to assess the effectiveness of their compliance and ethics program. The US Department of Justice put out new guidance in 2019, and the Health Care Compliance Association along with the Office of Inspector General at HHS have provided help as well.

What is all boils down to, says Ruth Krueger, Principal of Compliance Coach, are a few key questions including:

* Does the training hit the mark in terms of actual behaviors that reduce violations?

* Do employees know how to report wrongdoing?

* Do they feel comfortable doing so?

To answer these questions and others you’ll need to know  both what data is helpful and what data isn’t. For example, several pieces of data only provide part of the evidence and could be misleading. These include training completion rates, the volume of helpline calls and audits completed. Even employee surveys, if done poorly, can be misleading.

Listen in to learn more about what you need to know, and what you don’t, to determine if your compliance program is operating effectively.

Post By: Adam Turteltaub

On May 6, 2020 the US Department of Education announced major changes to Title IX that greatly impact the way colleges and universities will need to address incidents of sexual harassment and assault.

In this podcast, Dan Schorr, Managing Director of Ankura Consulting provides insights into the key changes and the likely implications for compliance programs including:

* The change of the definition of harassment from severe or pervasive to severe and pervasive

* The requirement for written notification to the accused, the opportunity for the accused to select an advisor and access to evidence

* Live hearings including cross examination of witnesses

* The option for schools to choose between two standards: “preponderance of evidence” or “clear and convincing”

* The challenges schools face in putting these changes in place by the August 14 deadline

Listen in to learn more about the requirements and what compliance programs will need to do to ensure that their institutions meet these new obligations.

Post By: Adam Turteltaub

We talk a great deal in compliance about privacy and data risk, often interchangeably it seems. But Jordan Fischer, Co-Founder and Managing Partner of XPAN Law Group points out in this podcast that there are key differences when assessing the risk.

When it comes to data risk, organizations need to ask:

* What data do I have?

* Where did I get it?

* What am I doing with it?

* And whom am I giving it to?

For privacy risk there are some different questions including:

* Who is accessing the data and shouldn’t be?

* Is the data being used in improper ways?

Addressing all of these issues, he suggests, starts with teaching people that data matters, and that there’s a human on the other end of it whose life could be greatly impacted.

Listen in to learn more about data and privacy risks, as well as the increased challenges posed by the present remote-working environment.

Post By: Adam Turteltaub

Companies are struggling to survive and boards are stretched beyond belief.  So how do you get the governing team to focus on compliance? According to Nell Minow -- dubbed the “Queen of Good Corporate Governance” by BusinessWeek Online and Vice Chair of Value Edge Advisors -- compliance teams need to remind the board and leadership that compliance is not an add-on or a nice-to-have, but a need-to-have and an essential part of risk management.

At these times the risks for organizations are grave an include operational risk and new financial risks, especially for companies that accept money under the CARES Act.

To ensure compliance plays a role in managing these risks and others that will follow as business resumes, she recommends that all sides work to ensure that compliance is at the foundation. In addition, and very importantly, as incentive plans change to meet the new realities of business, compliance needs to be on top of those plans to identify the risks that they create.

Listen in to this podcast to gain more of her wisdom for making the compliance-board relationship work. And, also, get a very good movie recommendation. On the side, she’s a noted film critic.

Post By: Adam Turteltaub

It’s tough complying with data privacy laws. You spend gazillions of dollars complying with GDPR, and then you have to spend a bunch more in response to the California Consumer Privacy Act (CCPA). Job done, right?

Not necessarily. There seems to be a never-ending number of new laws and, as Peter Yared, CEO & Founder of InCountry explains in this podcast, those laws may be in conflict with each other.

As a result, simply choosing to follow the highest standard may not be enough.  Compliance teams need to be sensitive to issues such as demands that the data be held and processed in the country where it is collected.

So what do you do? First, know the laws. Then start looking at what data you have, where it is stored and who has access. And, along the way, start thinking like you’re opening up a new outlet for a fast food restaurant. Yes, you read that right. Listen in to figure out why such a strange suggestion makes a lot of sense when it comes to managing data.