Gabriel Imperato (gimperato@broadandcassel.com) is Managing Partner and Anne Novick Branan (abranan@broadandcassel.com) is Of Counsel in the Fort Lauderdale law offices of Broad and Cassel LLP.
As the federal government continues to pursue healthcare organizations and dedicate resources to ferret out fraud and abuse, healthcare providers’ members of governing bodies must be vigilant in implementing, maintaining, and updating their organization’s compliance programs. Fueled by the private whistleblower movement, the potential for government identification of improper practices has resulted in an increased risk of liability for organizations and individuals alike. An expanded duty of care and duty of loyalty underlie what is required from a board of directors (board) to satisfy corporate oversight responsibility standards in a healthcare setting. Both must be satisfied, but the majority of a board’s oversight responsibilities fall under the duty of care. Boards must ensure that their organizations have implemented and maintain an “effective” compliance program.
The Federal Sentencing Guidelines for Organizations (FSGO) outline seven elements that are essential to an “effective” compliance program.[1] The second element — Compliance Program Administration — expressly addresses the role of the board and high-level personnel in compliance programs. The board must be “active” and knowledgeable about the organization’s compliance program to satisfy the standard. Although the other elements may not expressly implicate the board’s responsibilities, it is important to note the “oversight” role extends to other areas. These include the specific provisions surrounding communication, education, and training, as well as monitoring, auditing, and internal reporting systems. As a whole, knowledge regarding content and operations of the compliance program, coupled with oversight of the execution of the program to ensure effectiveness, form the foundation of the duties of the board.
The core of a director’s responsibilities in oversight of a compliance program fall under two general prongs: (1) implementation of an effective program; and (2) monitoring of the system in place to ensure timely communication and resolution of potential threats to compliance.[2]
Instituting an effective compliance program
The first step is to institute a compliance program that adequately meets the unique needs of the healthcare organization. There is no one-size-fits-all formula, so a board starting from square one may benefit from professional consultation to navigate the many resources and standards that govern compliance programs.
Prioritizing compliance and communicating a clear message to the employees of the organization from the top down is essential to the success of any program. Creating a culture of ethical conduct and compliance from the beginning not only unifies the diverse membership of an organization in accordance with the compliance goals of the board, but it fosters open communication, which ultimately yields effective risk management. Necessary actions include creating a code of conduct, designating a compliance officer and compliance committee, and conducting a risk assessment to determine and prioritize potential problem areas.[3]
The Department of Justice (DOJ) has recently published questions for consideration when developing and assessing the effectiveness of a compliance program in its Evaluation of Corporate Compliance Programs (DOJ Evaluation).[4] The DOJ suggests first looking at the organization’s history, to see how the company has previously designed and implemented new policies and procedures. This includes determining who were the key players involved at the design stage and whether any specific units or divisions were consulted to provide feedback prior to the implementation.
