1. DMC’s Commitment to Compliance Comprehensive Compliance Program 2010
DMC Corporate Audit and Compliance Department
Detroit Medical Center©
February, 2010

2. Objectives In this module you will learn about:
The Detroit Medical Center (DMC) Compliance Program
The DMC Code of Conduct
The DMC Policies covering:
- Non-Retribution
- Compliance Hotline Operations
- Sanction Screening
- Education and Training
- Ethical Business Conduct
- HIPAA Privacy and Security
DMC Compliance Program
Code of Conduct
Policies

3. Your Role
Our Commitment to Compliance depends upon everyone’s participation for its continued success.
To fulfill your role, you must commit to the following:
Complete all annual compliance training assigned to you and
sign a commitment form.
Watch for problem areas (areas of non-compliance) while on
the job and report any areas of potential non-compliance.
As a condition of employment, agree to read and abide by the
Compliance Program, Code of Conduct and DMC policies and
procedures.

4. Compliance Program Oversight
The DMC Board of Trustees together with our President/CEO has appointed its Corporate Vice President Chief Compliance and Governance Officer to oversee the Compliance Program.
To assist the Vice President a Corporate Compliance Committee has been created. This committee is composed of members of DMC management and provides guidance, advice, resources and feedback on our efforts and programs.

5. DMC’s Compliance Program
Reflects our commitment to ethical behavior.
Depends upon everyone’s participation for its continued success.
Has the commitment of everyone at the DMC:
The Board of Trustees
Senior Management
Physicians
Employees
Volunteers
Vendors
Anyone else associated with the DMC

6. DMC’s Compliance Program Has Seven Elements
Policies and procedures to guide our compliance.
A Compliance Officer to oversee the program.
Education and training for employees on compliance issues.
Monitoring for unlawful activities within the DMC.
Reporting mechanisms when unlawful activities are discovered.
Written guidelines for dealing with employees who engage in unlawful activities.
Responding to detected offenses.

7. Code of Conduct
Under our Compliance Program, the DMC provides employees with a booklet called the Code of Conduct. A copy of the Code of Conduct is given to each employee upon hire, as part of their training. This booklet:
Provides guidance to ensure that our work is performed in an ethical
and legal manner.
Emphasizes the shared common values that guide our actions and
helps resolve questions about appropriate conduct.
Following the “Code of Conduct” is mandatory for all DMC
employees, staff and affiliated persons. While the Code of Conduct
provides a basic description of unacceptable conduct or performance
it does not cover all behaviors that may occur in the workplace.
Failure to comply with the code is a serious matter and can lead to
disciplinary action (up to and including termination).

8. DMC Nine Standards Quality of Care and Services
Privacy and Confidentiality
Coding/Billing Integrity and Record Keeping
Customer Service
Compliance with Laws and Regulations
Workplace Conduct and Employment Practices
Research
Conflicts of Interest
Protecting Property, Assets and Information

9. Compliance Policies
The DMC has policies and procedures in place to ensure compliance with laws and regulations.
The objectives of these policies are to:
Standardize the way we do business.
Demonstrate that the DMC has an effective Compliance Program.
The source of truth for policies is the DMC Intraweb:
Policy CD’s are available in the event the DMC Intraweb is unavailable.

10. Compliance Policies Policy Name Summary Non-Retribution
Policy # 1 CG-011
For employees to identify and report problems without fear of retaliation.
Employee Hotline Operation
Policy # 1 CG-012
Establishes an anonymous way to report suspected criminal activity, illegal or unethical conduct.
Sanction Screening
Policy # 1 CG-013
How we check physicians and staff to ensure that they are allowed to participate in the Medicare and Medicaid programs. The government excludes, or “sanctions” physicians and clinicians if they are convicted of a crime.

11. Compliance Policies Policy Name Summary Education and Training
Policy # 1 CG-014
How we inform staff of the compliance program and their responsibilities
HIPAA Privacy and Security
Policy # 1 CG-035
To ensure our patients’ rights regarding the privacy of their protected health information (PHI) according to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Ethics of Business Conduct
Policy # 1 CG-015
Outlines guidelines for conducting business and delivering healthcare in accordance with high ethical standards and compliance with laws and regulations.

12. Recent Compliance Initiatives
Ethics of Business Conduct (1 CG-015):
Prohibits employees from soliciting meals, theater, sporting events, or other entertainment from any person affiliated or doing business with the DMC, including vendors.
Prohibits covered persons from accepting and vendors from distributing, posting or leaving any type of promotional items (including pens, paper pads, prescription pads).
Prohibits covered persons from accepting and vendors from supplying food of any kind to covered persons at a DMC facility.
Prohibits covered persons from accepting monetary gifts, awards, bribes, incentives or other tangible benefits from vendors that would suggest or create any obligation.
Prohibits covered persons from soliciting or accepting non-monetary gifts from vendors.

13. Compliance Policies HIPAA Privacy and Security (1 CG-035):
Accessing your own health information online is inappropriate and may result in disciplinary action.
When using or disclosing PHI (name, social security number, birth dates, addresses) limit the PHI disclosed to the minimum necessary to accomplish the intended use or disclosure.
Use caution and respect patients’ privacy when discussing protected health information in public.

14. Securing Protected Health Information (PHI)
Privacy Rule
Do not share passwords or login ID.
Do not write down password where others may access it.
Log-off your computer when you will be away a significant period of time.
“Suspend” when you will be away from your computer for a short period of time.
Position monitors out of view of the public eye.
Security Rule
Change your password every 90 days.
Choose passwords that are not easily guessed.
Use password protected screensavers, suspense mode and keyboard locks.
Place disks or tapes in a secure location.
Immediately report anyone outside of DMC IS Security asking for your password.

15. Sending PHI and Electronic PHI (EPHI)
with PHI sent outside the DMC should be encrypted. To encrypt an
Type SECURE in capital letters in the subject line.
The will be sent to a secure holding site.
The receiver will get an notification with instructions on retrieving the secure .
Faxes
Double check fax number.
Use cover page which includes your contact information.
If fax is received by the wrong location, have the fax destroyed or returned to you.

16. Securing PHI On Wireless Devices
To secure information on Personal Electronic Communication Devices, Personal Digital Assistants (PDAs) and Laptops:
Always use password protected screen saver
Passwords should be kept secure and confidential
Back-up data
Consider encrypting PHI
Install and use virus protection software
The biggest risk to PHI on PDAs and laptops is theft. To prevent theft:
Lock devices in a secure location when not in use
If device is stolen, file an incident report

17. Employee Education and Training
Once your training is completed, you will:
Comply with the laws, policies and procedures.
Look out for potential compliance concerns, such as:
Unethical or illegal behavior
Unnecessary medical services being provided
Unfair of discriminatory treatment of patients or employees
Billing or coding errors that benefit the DMC
Unauthorized use or disclosure of PHI
Misuse of DMC property
Fraud, waste or abuse

18. Monitoring and Reporting
The DMC continues to review its business activities
to ensure that employees are complying with
applicable laws, regulations and established DMC
policies.
Examples of the DMC monitoring of its activities
include:
Performing background checks on new employees.
Auditing departments to ensure they are following established
policies and procedures.
The DMC encourages and expects employees to report any concerns or suspected violations.

19. Monitoring and Reporting DMC Non-Retaliation Policy states:
Employees should first talk with their supervisor or use their normal chain-of-command when reporting a compliance issue, any observed or suspected HIPAA breach, or concern.
DMC Non-Retaliation Policy states:
No one will be punished or terminated simply for calling the Hotline or reporting a compliance-related problem.

20. DMC Compliance Hotline
The DMC Compliance Hotline is available for employees to report suspected compliance violations. Employees who call the hotline will remain anonymous.
DMC Compliance Hotline:
- 7 days a week/24 hours a day
- Untraceable; anonymous
You may also call the DMC Corporate Audit and Compliance Department at:

21. Investigations All reported concerns will be reviewed.
A suspected violation brought to the attention of management will be reviewed promptly and reported to appropriate parties who will assist in resolving the problem.
All reported information will be kept confidential and only shared with those individuals who need to know in order to conduct an investigation, to correct the situation, or as required by law.

22. Penalties
If an organization or person is found to be in violation of HIPAA, fraud, waste, and/or abuse laws or regulations the penalties are severe:
Disciplinary action up to and including termination.
Exclusion from participation in Medicare and
Medicaid programs.
Jail sentences for employees, administrators, and
physicians.

23. Additional Training
For more information, to schedule a live presentation or to discuss any part of the DMC’s Commitment to Compliance:
Please contact DMC Corporate Audit and Compliance Department at:

24. Thank You
We hope this NetLearning course has been both informative and helpful. Please feel free to review this course until you are confident about your knowledge of the material presented.
Click the Take Test button, located on the left side of the screen, to complete the requirements for this course.
For future reference this module is available on the NetLearning Library under the 2010 Core Compliance category. The NetLearning Library link is found on the DMC Intraweb screen under the NetLearning drop-down list.