Compliance Perspectives

By Adam Turteltaub

Scott M. Giordano, VP, Data Protection, Spirion

Session P14:  GDPR Compliance Post-Mortems:  Lessons Learned from Facebook, Uber and Others

September 15, 2019, 10:30 AM – 12:00 PM

GDPR has been in effect for just months but already tens of thousands of breaches have been reported to data authorities.  Scott Giordano, Vice President of Data Protection for Seattle-based Spirion reports in this podcast that this is a sign that business is taking GDPR seriously.

It also reflects a key requirement of the legislation: the rule requiring notification of a breach – whether by a hacker or even due to a contract violation – within 72 hours.  That requirement forces companies to act quickly.  It is also a mandate that is spreading, with US laws and regulations also increasingly requiring similar notification timelines.

Along with the new legislation has already come enforcement.  Google ran afoul of CNIL, the French data regulator, for the way in which users provided consent to the use of their data.  CNIL concluded it was too difficult for consumers to determine how their data was being used and stored.

In general, Giordano recommends that organizations err on the side of caution.  They should take practical steps to ensure that they are handling data properly, starting with asking the basic question:  is there any reason to question the integrity of the data in their care?

Businesses need to practice information security 101 – both to safeguard the data and to avoid running afoul of regulators – and to conduct a data inventory and risk assessment.

Finally, looking to the future, Giordano counsels businesses to expect more legislation coming from states across the US.  Many have already taken notable steps to ensure that consumer data is protected.

Listen in to help understand how your organization can better meet the challenges of GDPR and the ever-increasing number of data protection laws.

By Adam Turteltaub

When designing a compliance and ethics program, organizations want one that not only will prevent, find and fix problems, but also one that will pass muster with the US Department of Justice if there is an incident.

The Criminal Division of the DOJ recently released an updated version of its Guidance document “Evaluation of Corporate Compliance Programs.”  The document is “…meant to assist prosecutors in making informed decisions as to whether, and to what extent, the corporation’s compliance program was effective at the time of the offense…”

It is also a goldmine for the compliance community, providing a roadmap for what a program should contain.  As importantly, it provides support to compliance officers, enabling them to show management why they need the resources that they are asking for.

In this comprehensive podcast – it’s more than twice the length of our typical one – Orrick partner Billy Jacobson provides an analysis of what the Evaluation document says.  Billy brings to this discussion his broad and deep experience in compliance, having served as a chief compliance officer, general counsel, outside counsel and a prosecutor in the FCPA unit at the DOJ.

Listen in as he highlights the key provisions of the document, what’s new vs. the previous iteration, insights into how the government’s thinking has evolved, and why even companies based outside the US should study the new Evaluation guidance closely.

And, if you want to learn more, be sure to attend his session on this topic at the 2019 Compliance and Ethics Institute.

Note:  Apologies for the technical problems that caused the echo you may hear.

By Adam Turteltaub

When designing a compliance and ethics program, organizations want one that not only will prevent, find and fix problems, but also one that will pass muster with the US Department of Justice if there is an incident.

The Criminal Division of the DOJ recently released an updated version of its Guidance document “Evaluation of Corporate Compliance Programs.”  The document is “…meant to assist prosecutors in making informed decisions as to whether, and to what extent, the corporation’s compliance program was effective at the time of the offense…”

It is also a goldmine for the compliance community, providing a roadmap for what a program should contain.  As importantly, it provides support to compliance officers, enabling them to show management why they need the resources that they are asking for.

In this comprehensive podcast – it’s more than twice the length of our typical one – Orrick partner Billy Jacobson provides an analysis of what the Evaluation document says.  Billy brings to this discussion his broad and deep experience in compliance, having served as a chief compliance officer, general counsel, outside counsel and a prosecutor in the FCPA unit at the DOJ.

Listen in as he highlights the key provisions of the document, what’s new vs. the previous iteration, insights into how the government’s thinking has evolved, and why even companies based outside the US should study the new Evaluation guidance closely.

And, if you want to learn more, be sure to attend his session on this topic at the 2019 Compliance and Ethics Institute.

Note:  Apologies for the technical problems that caused the echo you may hear.

By Adam Turteltaub

In October 2018 Assistant Attorney General Brian Benczkowski of the US Department of Justice issued a memo entitled “Selection of Monitors in Criminal Division Matters.”  Some took the memo to herald the end of corporate monitorships.

Not so, says Eric Feldman of Affiliated Monitors.  In this podcast he explains that, instead, the memo was designed to improve both the selection of monitors and the process for determining whether having a monitor is appropriate.

Over the years it had become the default to have a monitor when a Deferred Prosecution Agreement was put in place.  Now a cost/benefit analysis will be conducted before going down this often long road.  The DOJ will be examining factors such as who was involved in the wrongdoing and what progress the company has made on its own to strengthen its compliance efforts.

The memo calls for compliance programs and controls to be tested, Eric explains.  In addition, prosecutors will be asked to assess whether there has been a change in the culture.

Listen in to learn what the Benczkowski says and, as importantly, what it doesn’t say.

By Adam Turteltaub

In October 2018 Assistant Attorney General Brian Benczkowski of the US Department of Justice issued a memo entitled “Selection of Monitors in Criminal Division Matters.”  Some took the memo to herald the end of corporate monitorships.

Not so, says Eric Feldman of Affiliated Monitors.  In this podcast he explains that, instead, the memo was designed to improve both the selection of monitors and the process for determining whether having a monitor is appropriate.

Over the years it had become the default to have a monitor when a Deferred Prosecution Agreement was put in place.  Now a cost/benefit analysis will be conducted before going down this often long road.  The DOJ will be examining factors such as who was involved in the wrongdoing and what progress the company has made on its own to strengthen its compliance efforts.

The memo calls for compliance programs and controls to be tested, Eric explains.  In addition, prosecutors will be asked to assess whether there has been a change in the culture.

Listen in to learn what the Benczkowski says and, as importantly, what it doesn’t say.

By Adam Turteltaub

Roy Snell must have written a book’s worth of material each year as the CEO of The Society of Corporate Compliance and Ethics and Health Care Compliance Association, but it wasn’t until recently that he wrote an actual book.  The Accidental Compliance Professional is the first, of potentially several, from Roy.

He sat down for a podcast, along with the book’s editor, Karen Latchana Kenney to discuss how the book was developed and written.  It started out, they explained, with the idea of giving some history of compliance but quickly evolved into a vehicle to tell stories and share what Roy had learned along the way.

Listen in as they discuss:

* How even accidental compliance professionals may have ended up in the job for very good reasons

* The genesis and purpose of Roy-isms and Roy’s rules

* The value in learning from mistakes

* The importance of compliance officer independence

* How conflicts of interest can get in the way of preventing, finding and fixing problems

By Adam Turteltaub

Roy Snell must have written a book’s worth of material each year as the CEO of The Society of Corporate Compliance and Ethics and Health Care Compliance Association, but it wasn’t until recently that he wrote an actual book.  The Accidental Compliance Professional is the first, of potentially several, from Roy.

He sat down for a podcast, along with the book’s editor, Karen Latchana Kenney to discuss how the book was developed and written.  It started out, they explained, with the idea of giving some history of compliance but quickly evolved into a vehicle to tell stories and share what Roy had learned along the way.

Listen in as they discuss:

* How even accidental compliance professionals may have ended up in the job for very good reasons

* The genesis and purpose of Roy-isms and Roy’s rules

* The value in learning from mistakes

* The importance of compliance officer independence

* How conflicts of interest can get in the way of preventing, finding and fixing problems

By Adam Turteltaub

Kim Brandt, Principal Deputy Administrator for Operations at the Centers for Medicare & Medicaid Services (CMS) shared with the attendees at the 2019 HCCA Compliance Institute what the latest is from CMS, and what to expect in the coming months.

For those who missed her talk, she was kind enough to sit down for a podcast and provide us with an extensive look at what CMS has done and will be doing.  Listen in as she shares:

* The vast number of comments received on provider burdens, and how extensively CMS is actively addressing them

* The comprehensive review of Medicare Conditions of Participation with the goal of removing obsolete, duplicative or unnecessary requirements

* Progress on the Patients Over Paperwork initiative

* CMS’s efforts to make data more transferable and accessible for patients

* What CMS is doing to stem the opioid epidemic, including for new opioid prescriptions

* Exploration of new value-based models

* The new Medicaid program integrity strategy, and the audits that followed

There’s a lot to learn.  Don’t miss the chance to learn directly from her.

By Adam Turteltaub

Kim Brandt, Principal Deputy Administrator for Operations at the Centers for Medicare & Medicaid Services (CMS) shared with the attendees at the 2019 HCCA Compliance Institute what the latest is from CMS, and what to expect in the coming months.

For those who missed her talk, she was kind enough to sit down for a podcast and provide us with an extensive look at what CMS has done and will be doing.  Listen in as she shares:

* The vast number of comments received on provider burdens, and how extensively CMS is actively addressing them

* The comprehensive review of Medicare Conditions of Participation with the goal of removing obsolete, duplicative or unnecessary requirements

* Progress on the Patients Over Paperwork initiative

* CMS’s efforts to make data more transferable and accessible for patients

* What CMS is doing to stem the opioid epidemic, including for new opioid prescriptions

* Exploration of new value-based models

* The new Medicaid program integrity strategy, and the audits that followed

There’s a lot to learn.  Don’t miss the chance to learn directly from her.

By Adam Turteltaub

Steve Priest of Integrity insight International has been a part of the corporate ethics scene for decades now.  He’s worked with companies all over the world and is expert at assessing corporate culture.

In April 2019 we sat down for an atypical podcast.  Rather than dissecting one specific ethics or compliance challenge, we explored what’s concerning him these days.

The conversation began with a discussion of cellphones and how disturbing they can be, as well as the poorly understood data protection risks.

From there we moved on to the related and broad topic of another area where the understanding isn’t what it should be:  human psychology and behavior.  Steve argues that, for example, when it comes to training we tend to treat employees like children, telling them they shouldn’t do this or that.  He argues instead for a more prosocial approach, which goes hand in hand with the need to help employees better engage with the company.  That’s getting harder to do with so few employees staying with one employer for very long.

One potential solution for addressing these challenges:  get more professionally diverse voices in compliance, people with skills outside of legal and audit.

Along the way Steve also explains what he calls “The Three R’s” of putting in place a compliance program and the weakness of the fraud triangle.

Listen in and enjoy an illuminating and entertaining conversation.