SO - Health Care Compliance Association

Board of Trustees has adopted a policyon business ethics that is the basis ofour compliance program and is set outinitially in the compliance manual.Then the compliance manual walksthrough the various elements of thecompliance program and explains them.For example, the ability to confidentiallyor anonymously report problemsto the compliance office either directlyor using the hotline is explained in thecompliance manual. Rush’s policyagainst retaliation is also explained inthe manual, along with other complianceprogram activities like auditingand monitoring. We also have includedparagraph summaries of each of Rush’scompliance policies, and a section thatsummarizes some of the most importantlaws.Our hope is that people will walkaway from reading the compliancemanual with a good idea of what isexpected of them, and a good understandingof the compliance program,how it operates, and how to use it as aresource.OG:One of the components of theseven sentencing guidelines, is to havehigh level oversight of the compliancefunction. Does your compliance committeeperform that high level oversight?And if so, what types of peopledo you have serving on the compliancecommittee?SO:The compliance committee atRush really does help with meeting thissentencing guideline’s requirement.Rush’s compliance committee is madeup primarily of associate and assistantvice presidents from around the organization.People who are in roles that arekey to the compliance function. Forinstance, our Associate Vice Presidentfor Patient Finance sits on the compliancecommittee. An assistant VP fro mhuman re s o u rces is a member of thecommittee, as are several AV Ps from diffe rent operational areas of the hospital.Because of the high level positions ourcompliance committee members hold,they are very effective in keeping thecompliance function on track and inassisting the compliance office inresolving issues and conducting investigations.OG: Well, the new HIPAA privacyregulations create a number of issuesfor academic medical centers. Has Rushthought through some of these issues?And if so, how are you handling those?SO:Like many hospitals we are inthe initial stages of figuring out howwe’re going to handle HIPAA. We haveput together a high-level working groupwith key stakeholders from our generalcounsel’s office, from information services,and from the compliance office.We have not appointed a privacy officeryet, but it appears that what will probablyhappen is that the privacy officerrole will be assigned to our ChiefCompliance Officer, with the complianceoffice managing the complianceprogram-likeelements of HIPAA privacy.I think this is probably the mostsensible way of handling privacy, especiallyfor organizations with well-developedcompliance functions.OG:The sentencing guidelines talkabout proactive measures in compliance;could you tell us about some ofthe proactive measures that you haveimplemented at Rush.SO:One way that our ChiefCompliance Officer assured we weremeeting this sentencing guidelinesrequirement was to make internal auditan official part of Rush’s compliancefunction. Rush’s internal audit staffconducts a large portion of the auditingand monitoring functions of compliance.They work very effectively from arolling three-year auditing and monitoringplan that the Director of InternalAudit does a fantastic job of maintaining.Many of the internal audit staffhave been at Rush in other roles andContinued on page 1615July 2001