Lawyers offer 7 boxes to check before hiring your next regulatory compliance officer
Hospitals are not the only healthcare entities competing over a limited pool of qualified compliance officers. Payers, vendors and others are in the race too. But it’s hospitals and their parent health systems that may have the most to lose if they let down their guard on adherence to regulatory rules.
Regardless of whose need is greatest, all CCO hiring committees do well to bear in mind the potential price tag for giving short shrift to their due-diligence duties. The costs of such laxity might include big-dollar settlements, Medicare restrictions and, in worst-case scenarios, patient harms.
The warning is from attorneys with the Shumaker law firm. In a June 30 web post, they offer tips for attracting, selecting and onboarding the right person for the job.
The legal advisors largely base their advice on HHS’s General Compliance Program Guidance, released by the agency’s Office of Inspector General in 2023.
“By evaluating candidates against the OIG guidance’s seven primary tenets, healthcare organizations can identify a compliance officer who will build and sustain a program that meets both the letter and the spirit of regulatory expectations,” write Shumaker subject-matter experts Grant Dearborn, JD, and Mara Rendina, JD.
Based on the OIG’s guidance, the attorneys note, any candidate under consideration for any compliance officer role should demonstrate meaningful experience across seven areas.
1. A strong candidate for compliance officer will have substantial experience drafting, reviewing and periodically updating compliance policies, procedures and standards of conduct.
Because policies are living documents that must remain current with evolving regulations and organizational changes, this experience also relates to Element 5 below (monitoring), Dearborn and Rendina write before commenting:
‘A capable compliance officer will know how to monitor adherence to policies and identify gaps and risks requiring updates or monitoring.’
2. The candidate should have prior experience serving in a compliance leadership role that included genuine independence and authority.
This means reporting directly to the board of directors or an audit/compliance committee, the attorneys maintain. Experience structuring the compliance function—including staffing, budget and reporting lines—is “critical,” they state.
More:
‘The candidate should understand the governance expectations the OIG articulates around compliance officer independence and the risks created when compliance is subordinated to business, legal or financial functions.’
3. A qualified candidate will have experience designing and delivering effective compliance training and education programs tailored to various audiences.
Training and education duties will likely include developing annual training plans and role-specific modules as well as tracking completion rates and assessing training effectiveness, the Shumaker subject matter experts explain.
More:
‘The candidate should be able to demonstrate how training programs have been adapted under his or her watch in response to identified compliance risks, audit findings or regulatory changes.’
4. The candidate should have experience building and managing reporting mechanisms that encourage employees to report concerns without fear of retaliation.
Such mechanisms might include compliance hotlines, anonymous reporting channels or open-door policies. “The candidate should demonstrate experience fostering a ‘speak-up’ culture, one in which employees at all levels feel safe raising compliance and ethical concerns,” the attorneys write.
More:
‘Qualifying experience will include implementing non-retaliation protections, publicizing reporting mechanisms, and tracking and triaging reports to ensure timely follow-up.’
5. The candidate must know his or her way around audits and internal monitoring practices.
“The ideal candidate will have conducted or overseen risk assessments to identify the organization's highest compliance risk areas, developed risk-based audit and work plans, managed claims and billing audits, overseen coding reviews and coordinated with external auditors,” Dearborn and Rendina advise.
More:
‘The candidate should be able to articulate how audit findings have been translated into corrective actions under his or her direction and how monitoring activities have been utilized to verify the effectiveness of those actions over time.’
6. A strong candidate will have experience designing and enforcing well-publicized disciplinary standards that are applied consistently across all levels of the organization.
This includes experience working with HR professionals in developing progressive discipline frameworks, advising human resources and management on appropriate disciplinary responses to compliance violations, and ensuring that disciplinary actions are documented and proportionate, the attorneys note.
More:
‘The candidate should understand that inconsistent coordination and enforcement undermine the credibility of the entire compliance program.’
7. The candidate must have experience conducting compliance investigations, performing root-cause analyses and developing corrective action plans.
Where appropriate, experience in this area of responsibility should include making self-disclosures to applicable government agencies such as the OIG (through its Self-Disclosure Protocol) or the CMS (through its Voluntary Self-Referral Disclosure Protocol), the Shumaker legal advisors offer.
More:
‘Candidates who have navigated government investigations, audits or corporate integrity agreements bring particularly valuable experience in this area.’
Dave P. has worked in journalism, marketing and public relations for more than 30 years, frequently concentrating on hospitals, healthcare technology and Catholic communications. He has also specialized in fundraising communications, ghostwriting for CEOs of local, national and global charities, nonprofits and foundations.