1. TOP TEN HEALTHCARE RISKS AND CHALLENGES Susan Walberg Vice President/National Director- Compliance

2. Page 2 Number 10 New Government Focus on Individuals, i.e. “The Yates Memo”. Risk: Government attorneys have now been instructed to pursue individuals in all corporate investigations.

3. Page 3 Number 10 Yates Memo-Individual Accountability for Compliance Violations: Recommendations – Conduct an objective review of the processes in place internally for reporting compliance violations. Are they effective? How are they being managed and reported? – Educate Board, leadership, and individuals in key roles about the changes in government focus. – Pay attention to complaints about compliance issues: those employees could become whistleblowers!

4. Page 4 Number 9 Observation Stays, again – Patient Notification – How to Identify those patients? – OIG Work plan Risk: RACs not reviewing, but OIG is… standards still evolving, but ‘Two Midnights’ has not gone away…documentation needs to support!

5. Page 5 Number 9 Observation Stays: Recommendations – Review processes for notifying patients of their status – Review how hospital identifies those patients for caregivers, staff – Conduct chart reviews for Observation patients. Is the record-keeping adequate? – Review recent lengths of stay for Observation patients. Are the lengths of stay in Observation being effectively managed?

6. Page 6 Number 8 Moving to Value-Based Reimbursement Risks: Reimbursement impact increases over time with evolving reimbursement models, with potential penalties. Methodologies differ across payers. Risk shifting from payers to providers.

7. Page 7 Number 8 Moving to Value-Based Reimbursement Recommendations – Develop strategic plan that includes input from all stakeholders – Include strategy to align physician’s compensation with new metrics on quality/value-based care – Care coordination critical – Data aggregation and tracking essential

8. Page 8 Number 7 Overpayments Risk: Under the Affordable Care Act, overpayments identified for government payers must be refunded within 60 days of identification or face potential False Claim Act liability

9. Page 9 Number 7 Overpayments Recommendations – Review processes to verify that identified overpayments are refunded promptly – Implement routine auditing and monitoring of complex and high-revenue services to identify potential overpayments – Impacted staff should be educated about risks – Don’t forget to manage credit balances!

10. Page 10 Number 6 Credentialing Risks: Medicare Conditions of Participation require criteria for medical staff privileges. Inadequate reviews have led to FCA liability in medical necessity cases. Ineligible persons, or excluded providers, cannot be hired or contracted with, mistakes can be expensive!

11. Page 11 Number 6 Credentialing Recommendations – Review adequacy of credentialing policies and procedures – Be wary of ‘grandfathering’ individuals – Verify process is consistently followed – Review policies and processes for checking the NPDB and the OIG’s LEIE database, and check that they are being followed.

12. Page 12 Number 5 Provider-based Status Risks: OIG work plan item, Joint Commission also increasing reviews. Do you know where your provider based entities are? Do they meet Medicare criteria? Free-standing physician groups owned by hospitals are subject to -3-day bundling rule. Is this being monitored to ensure compliance?

13. Page 13 Number 5 Provider-based Status Recommendations – Know the rules! – Claiming provider-based status too soon could result in repayments – Monitor claims for compliance with 3-day bundling rule and other requirements – Meaningful Use, EMTALA apply…verify compliance – Confirm integration of financial data and reporting

14. Page 14 Number 4 Mergers, Acquisitions, and Alignments Risks: For participants, a failure of due diligence and proper planning can result in a disjointed organization or risks to all based on weaknesses of some. Faulty compliance controls or poor credentialing practices are examples.

15. Page 15 Number 3 Mergers, Acquisitions, and Alignments Recommendations – Front end due-diligence helps protect merging organizations – Properly structure to minimize risk – Review structures and processes for all departments to create ‘system’ function that incorporates best practices (Don’t assume one party’s practices are superior without a thorough review). – Put effort into culture!

16. Page 16 Number 3 Electronic Health Records Risks: Rushed implementation can create sloppy processes, quality risks, and compliance challenges. OIG has identified risks, issued guidance, and will be reviewing

17. Page 17 Number 3 EHRs Recommendations – Review EHR contracts with vendors carefully to identify potential liability for poor design – Involve physicians. If the system is unwieldy, shortcuts will be used. – Be aware of risks with auto-populating fields and cut- and-pasting. Review records routinely to verify identical entries do not exist. – Monitor coding and billing to verify that the actual services justify the level billed. Cloned documentation does not meet medical necessity requirements.

18. Page 18 Number 2 Financial Arrangements Risks: Government scrutiny on arrangements with physicians and other referral sources is increasing, and settlements/penalties are HUGE. More whistleblowers with increased awareness.

19. Page 19 Number 2 Financial Arrangements Recommendations – Contract approval and management process is critical to ensure proper review and renewals, especially for physician contracts and contracts with referring entities – Use checklist for key risk areas to check, such as fair market value, no linkage to referral volume, etc. – Routinely audit physician contracts to verify amounts paid tie to the contract terms

20. Page 20 Number 1 Information Security/Privacy Breaches Risk: Government fines, loss of patient trust, bad publicity, identity theft, more government fines…

21. Page 21 Number 1 Information Security/Privacy Breaches Recommendations: – Make sure Security Risk Assessments are completed (Also required for Meaningful Use) – Review results of the assessments, make sure there is a Corrective Action Plan – MONITOR Corrective Action Plan and keep it moving – Ongoing education and communication. Privacy and Security breaches can happen in a multitude of ways.

22. Questions Thank You! 22 Susan Walberg, MPA JD CHC Vice President/National Director of Compliance swalberg@kohlerhc.com (301) 256-5010 – Cell Kohler HealthCare Consulting, Inc. www.kohlerhealthcareconsulting.com (410) 461-5116 – Office