SO - Health Care Compliance Association

July 20018risk assessment for their organizations.All health care entities, regardless oftheir size or structure, encounter compliancerisk at some level of their organization.Compliance risk impacts manyactivities in the health care industry.According to the Office of InspectorGeneral's (OIG) Compliance ProgramGuidance, compliance risk should beidentified and analyzed. The guidancestates that policies and proceduresshould be developed to address thespecific risk identified.Identifying riskSo where and how does a complianceofficer begin to identify and analyzerisk? There are many ways of identifyingrisk in an organization. This discussionis not intended to be all inclusiveof the risk assessment methodologies,nor is it intended as a template or guidefor any specific compliance officer toutilize to conduct risk assessments intheir facilities. This discussion is merelyintended to help stimulate ideas thatother compliance officers may find use-By John FalcetanoEditor's note: Johnful as they workFalcetano, ComplianceOfficer, Univercationin their owntoward risk identifisityHealth Systemsinstitutions.of Eastern Carolina,is also the HCCAOne method thatRegion IV President.compliance officersHe may be reachedcould use to evaluateat 252/816-0125.compliance risk inOne task thatcomplianceofficers face on an annual basisis the task of conducting a compliancetheir institutions isknown as ControlSelf-Assessment(CSA). CSA is a process by which internalcontrols are examined and evaluated.CSA involves managers and lineemployees in the process of evaluatinginternal controls since they are theprocess owners.Begin with high-risk departmentsOne of the first places a complianceofficer could start when conducting acompliance risk assessment is with themanagers of high-risk departments suchas: Human Resources, Patient Billing,Health Information and ManagementServices, Information Systems,Pharmacy Services, Radiology, andLaboratory Services. These managersare responsible for ensuring compliancewith the rules and regulations that governtheir particular products or servicesand are most familiar with the processesin place to ensure compliance.The compliance officer should meetwith these managers to review thoseprocesses to identify if they have theproper internal controls in place tocomply with rules and regulations thatgovern their area. For example, whenmeeting with the director of HumanResources, the compliance officer mightquestion the director about the processesin place for complying with such regulationsas the:■ Civil Rights Act■ Equal Pay Act■ Age Discrimination Act■ Rehabilitation Act■ Pregnancy Discrimination Act■ Wage & Hour Act■ Americans with Disabilities Act■ Family and Medical Leave ActAfter the compliance officer hasreviewed the processes in place he/shemay also want to review the trainingdocumentation to determine if themanager has provided the necessary jobspecific training to line employees.OIG Work PlanOnce the compliance officer has completedthis task and identified some ofthe potential risk areas, the next placehe/she may want to examine is theOIG's annual Work Plan. The OIG'sWork Plan gives you an idea of whatcompliance-related issues the OIG willfocus on in the upcoming year. Thecompliance officer along with seniormanagement may want to review eachfocus area identified in the OIG's WorkPlan and ask the question, "Is this aproblem for our organization?" If theanswer is yes, or, we are not sure, thecompliance officer may want to placethat issue on the list with the otherpotential areas identified.The compliance officer may want toconsider meeting with senior managementto identify other potential organizationalcompliance risks. A good wayto achieve this is by having senior man-