Compliance Perspectives

Post By: Adam Turteltaub

What if your sales team couldn’t escape compliance training, literally?

It’s a dream for many compliance leaders, and it’s one that came true for Katrina Church, Global Chief Compliance Officer at Merz, and her team. Faced with the challenge of needing to do some in-depth training for the salesforce, they thought outside of the box, by putting the sales team in a box. They designed escape rooms that the sales team could only leave after they solved the various puzzles designed to drive home key compliance points.

In this podcast Katrina explains the extensive planning that went into making this initiative a complete and surprisingly popular success. It included a visit to a local commercial escape room and extensive testing of their own design. Also involved was a great deal of partnership with other departments.

And the results? Everyone wants to know they plan on topping the training next time.

Listen in to learn more about this very creative compliance training initiative.

Post By: Adam Turteltaub

The California Consumer Privacy Act (CCPA) is the strongest privacy law in the US.  It significantly expands the rights of consumers and requires more transparency of businesses when it comes to what they are doing with all the data that they are collecting.

The good news, explains, Ray Pathak, Nymity CEO of TrustArc, is that organizations that have already undertaken efforts to comply with the European General Data Protection Regulation (GDPR) will find themselves well prepared to deal with the CCPA.

In this podcast Ray shares:

* What organizations the CCPA applies to (and it’s not just those based in California)

* The notifications required under the law

* Consumer rights to access and delete data

* The potential fines and the private right of action under the law

* Other state laws across the US that are likely to follow

Just as importantly, he also explains what organizations need to be doing, starting with inventorying the data being collected and how it is stored.

Listen in to learn more about the requirements of CCPA.

Post By: Adam Turteltaub

For years In re Caremark was the definitive decision from the Delaware courts on board oversight of compliance programs. Decided in 1996, the Delaware Court of Chancery held that directors had a duty of care. However, as Rebecca Walker of the firm Kaplan & Walker explains in this podcast, the bar was still a bit low. The Board could only be held responsible, the Court found, if it utterly failed to implement monitoring and reporting systems, or consciously failed to oversee them.

Now, though, thing seem to have changed. In Marchand vs. Barnhill, the Delaware Supreme Court held that, if boards fail to put in place a reasonable system of monitoring and oversight in key compliance risk areas, they may be subject to liability for related compliance failures. The Court wrote: “Caremark does have a bottom-line requirement that is important: the board must make a good faith effort—i.e., try—to put in place a reasonable board-level system of monitoring and compliance."

Listen in as she outlines the Court’s decision and the implications for board oversight of compliance programs. And, to learn more, SCCE members can look up her article in the SCCE magazine or on Cosmos.

Post By: Adam Turteltaub

When Mary Schaefer stepped in as Chief Compliance Officer for the Drug Enforcement Administration (DEA) she found lots of policies in place with thought behind them and developed with subject matter experts. That was the good news.

The bad news was that the policy process was decentralized with each division managing its own. Worse, the development process was cumbersome, and many policies were outdated.

In this Compliance Perspectives process she provides a case study for other compliance leaders who find themselves in similar situations.  She explains how the compliance team identified all the policies in place, updated those that needed it, archived policies that were ready to be retired, and set about creating a new, more coherent structure.

She also provides insight into how to create buy-in from the organization and keep the workforce up to date on new or changed policies.

Listen in for ideas for how to make your policy process more coherent.

Post By: Adam Turteltaub

When responding to COVID-19, it’s important to both scrub your hands and also scrub your data practices.

As Jonathan Armstrong, partner at Cordery Compliance explains in this podcast, organizations – and not just those based in the EU -- need to keep the European General Data Protection Regulation (GDPR) in mind during this crisis.

That’s especially true when it comes to how employee data is handled. For one, organizations need to be particularly careful when sharing employee data even with the government. It’s also important to recognize data collected for one purpose cannot simply be used for other purposes without conducting a Data Protection Impact Assessment (DPIA). For example, employees may understand the company keeps track of gifts and entertainment for anti-corruption purposes. But, if the company then starts using that to track who the person met with for evaluating possible COVID-19 exposures, there may be compliance risk.

Health data requires even more sensitivity, and it’s imperative that organizations look closely as to who has access to it.

Listen in to learn more about practices to watch out for and some specific steps to start taking right away.

Post By: Adam Turteltaub

**The Second of Two Podcasts about the COVID-19 Virus and Compliance Programs**

In Part I of this two-part series, Sheryl Vacca laid out implications for health care providers struggling to respond to the COVID-19 corona virus outbreak while remaining compliant. In this episode we look at how all organizations can and should respond during chaotic, fast-changing times.

Marjorie Doyle, long-time SCCE Academies faculty member, 25-year veteran of DuPont, and now an active consultant to compliance teams and boards, advises companies to look to their values as a starting point. They provide consistency and serve as an anchor during rough seas. In addition, they provide guidance for situations where the laws are unclear, or there may be no laws at all.

Values also have an added benefit: they speak to the company’s brand. This helps business-people better understand their importance to the organization.

Listen in to learn more about how values can guide decision making and bring order in times of seeming chaos.

Post By: Adam Turteltaub

**The First of Two Podcasts about the COVID-19 Virus and Compliance Programs**

Healthcare providers aren’t just on the front line of dealing with COVID-19 coronavirus.  They are also on the front line of the compliance challenges that come with it.

As Sheryl Vacca, Senior Vice President and Chief Risk Officer of Providence St. Joseph Health, explains in this podcast, there are issues emerging already. The latest scientific evidence for treating people affected by the disease may conflict with long established rules, processes and procedures.

In addition, local government agencies are pushing healthcare providers for data so that they can track and manage how the epidemic is evolving.

What should compliance professionals do? First, put the safety of patients, caregivers and the public first. Second, she advises working closely with all the teams addressing the crisis to ensure that efforts don’t end up crossing any compliance lines, even inadvertently. You can have much more of an impact, she notes, if compliance considerations are taken into account at the start of the initiative, rather than after it’s up and running.

Listen in to learn more about what you should be thinking about, and the importance of taking care of yourself during this challenging time.

By Adam Turteltaub

A good investigation begins well before the first allegation, according to Scott Moritz, Senior Managing Director at FTI Consulting. It begins with the creation of a proper framework for how investigations will be conducted.

In the latest Compliance Perspectives podcast he recommends that the investigation policy framework should begin by considering the different categories of likely cases: HR, privacy, cyber, and others. Each may require its own team, processes and legal considerations. Understanding these factors in advance helps ensure a faster start and a more thorough investigation.

When it comes to deciding whether to handle the investigation in-house or to engage outside resources, he notes that sometimes the answer is clear, such as when the allegation involves senior leadership. In other cases, multiple factors need to be assessed. But he points out, it doesn’t always have to be a decision made as soon as the allegation is made. Sometimes it is more prudent to do an initial investigation and then decide based on what the preliminary evidence indicates.

Listen in to discover more about how to create the framework that can help improve your investigation processes from the initial review of the allegation right down to the final report.

Post By: Adam Turteltaub

Lake Buena Vista, FL was home to the 2020 Managed Care Compliance Conference, which saw an enormous increase in attendance.

Before the meeting took place Jenny O’Brien, Chief Compliance Officer for UnitedHealthcare provided a preview of what was to come. As the conference wound down we discussed some of the critical insights that conference attendees were able to take home with them:

* Audits are taking up more and more of the time of both providers as well as the government. Both sides saw a need to work together to promote more efficiency.

* Program integrity; fraud, waste and abuse; and strong partnerships between industry and government were all central themes.

* Network adequacy was a very hot topic, with concerns expressed about access to care for rural populations as well as for Medicare and Medicaid members

* Hiring and developing compliance talent

Listen in to learn more. It’s not the same as attending the Managed Care Compliance Conference, but it’s a start.

Post By: Adam Turteltaub

As business continues to increasingly embrace the concept of risk management, where does compliance fit, particularly in the context of broader Enterprise Risk Management (ERM) frameworks? It’s a tough question that James Rose, Managing Director of Sunhawk Consulting tackles in this Compliance Perspectives podcast.

As he explains, ERM starts with an organization’s overall strategic and financial objectives. It is much more internal in its orientation that compliance risk management, which is driven by externally imposed regulatory frameworks.

But while this is a key difference, both are intertwined, with each requiring prioritization of efforts. More, compliance likely will find itself competing for resources as part of the broader ERM discussion.

As a result, compliance leaders need to have a deep understanding of the organization’s approach to ERM, and where compliance fits, to ensure that the compliance program gets the resources it needs.

Listen in to learn more about the risks and opportunities where ERM and compliance risk management meet.