2. Staff Structure Support HCCA Special Interest Group 1-28-03 New Regulations: A Strategy for Implementation Sharon Schmid Vice President, Compliance and Privacy Medica

3. n Multiple Levels of Obligations 3Multiple States’ Regulations 3Overlapping State and Federal Regulation  DOL ERISA Regulations  Privacy (GLB, HIPAA, Federal Privacy Act, State Law, NCQA) 3Accreditation Requirements n Type of Regulation 3Governs the Core of What We Do n Volume and Complexity of Obligations Governing Standards Framework: Challenges for Implementation

4. –Develop Method to Help Ensure Obligations Come to Life in the Business –Risk Based Approach to Implementation and Ongoing Compliance Assess Prioritize Resource –Compliance Project Management (“CPM”) Manage the Complexity Builds it into the Core of What We Do Implementation Process

5. –Builds on Traditional Project Management Practices - Adapted to Manage and Minimize Compliance Risk –Defined Analytical and Implementation Processes that Support:  Identify  Implement  Assess  Monitoring  Plan  Audit What is Project Management For Compliance? Document

6. –Central Oversight With Identified Compliance Staff in All Business Units - Departments Shared Accountability for Compliance and Business Ensures Compliance Expertise and Strong Understanding of Business –Process and Structure to Support Consistent, Documented, Completed Implementation –Tools and Training –Ongoing Support and Training What Makes CPM Successful

7. What are the Elements of Compliance Project Management? Understand the Legal/Regulatory/Governance Requirements Identify and Assess Current Business Practices Identify Operational Gaps Develop a Documented Action Plan Implement the Plan and Document the Implementation Activities Monitor the Results of the Implementation Document “How We Know” We Are in Compliance

8. How Will Compliance Project Management Help Us Reach Our Goal? Compliance Project Management Helps to Identify and Minimize Legal Risk Develops Consistency In Approach and Implementation Documents Work To Support Compliance Builds on Expertise of All Staff from all business areas Enhances Communication Creates Institutional Memory

9. The Higher the Level of Risk, As Determined by the “As-is” Assessment, the Greater the Need for Compliance Project Management Greater need for CPM Why Might You Want to Use The Project Management Approach?

10. Compliance Operations Project Management Phases  Intake  Assessment  Implementation Planning  Implementation  Post Implementation Management

11. How Does Compliance Project Management Help Manage Risk?

12. A Key Step in Any Compliance Effort - Whether It Is a Relatively Simple or Complex Obligation - Is Understanding, Defining, and Documenting the Issue. Key Tasks for Intake  Identify the “Obligation”  Initial Legal Analysis  Intake Information Completed - Including Obligation Summary Intake Phase

13. Compliance Project Life Cycle - Intake in Detail Competency Exit Criteria Tasks Intake  Identify obligation  Conduct initial legal analysis  Notify compliance operations of new obligation  Review legal analysis, enter obligation information in CPM, link relevant documentation  Conduct initial triage assessment and notify CO leads to conduct operational assessment  Required information completed in CPM and Compliance Operations notified  CO staff complete Archive Summary, if applicable Compliance Operations Legal Business Operations Business Operations Steering Council Deliverables  Documented legal analysis  Completed Intake information in CPM including Obligation Summary  Linked documentation in System  An Archive Report, if no further action is necessary Phase

14. The Operational Assessment Is a Review of Business Operations Against the Requirements of the Obligation  Compliance Ops Leads Conduct Operational Assessment online:  Products  Processes  Departments  Vendors  Background/History  Connections  Current Business Practices  Recommendations Assessment Phase

15. Assessment Summary Report The Assessment Summary Report Is a Compilation of All of the Information Entered As Part of the Operational Assessment This Report Can Be Invaluable for Focusing Resources and Expertise Helps to Identify Specific Action Steps or Tasks for Implementation. In Some Instances, the Assessment Summary Report Will Reflect That the Organization Is Already in Compliance With the Obligation’s Requirements and Will Provide the Necessary Information for Documenting Our Compliance.

16. Planning In the Planning Phase, the Project Manager Develops a Detailed Action Plan To: Create the Right Solution for Compliance and Business Establish Communication About Implementation Foster Involvement of Team and Key Stakeholders

17.  Review the Assessment Summary Report  Develop the Action Plan  Identify Team Members and Key Stakeholders  Schedule and Hold the Kickoff Meeting With the Project Team  Document Additional Tasks Based on Team Members Participation  Obtain Stakeholder Input for Plan  Define the Communication Protocols Planning Phase Key Tasks

18. The Purpose of the Implementation Phase Is to Perform, Monitor, and Control Project Work So That You Can Complete the Project on Schedule and Within Defined Quality Standards. In This Phase, Staff Implement and Manage Against the Action Plan, Making Enhancements and Changes to the Action Plan As Necessary to Accomplish the Project Goal(s). Implementation Phase

19.  Implement Project Plan  Communicate Status to Team Members and Stakeholders  Status Updates in Application  Training As Needed  Manage Project Changes as Needed  Escalate Barriers for Resolution  Summarize Compliance Implementation Phase Key Tasks

20. The Purpose of the Post Implementation Management Phase Is to Complete Commitments, Check the Success of the Implementation, Plan for Transitions, Conduct Evaluations, and Identify Lessons Learned That Can Be Carried Forward to Future Projects Post Implementation Management Phase

21.  Project Manager Ensures Project Documentation is Completed and Linked to Obligation in Application -Action Plan and Supporting Documentation -Policies and Procedures, training, process documentation, etc.  Post Implementation Evaluation  Monitoring Activities Completed According to Action Plan and Ongoing As Necessary Post Implementation Management Key Tasks

22. Compliance Project Management Supports Effective Compliance n Identify and Minimize Legal Risk n Develops Consistency In Effective Approach For Implementation n Documents Work To Support Compliance n Builds on Expertise of All Staff n Enhances Communication n Creates Institutional Memory