Compliance Program Core Components: Identification and Response to Compliance Risks

Jeannine LeCompte, Publishing and Research Coordinator

The final component of a Medicare- and Medicaid-approved long-term care (LTC) facility’s legally mandated compliance program is a system which rapidly identifies and responds to any noncompliance event.

The identification system must be set up in such a way as to continually monitor and audit all aspects of the facility’s service delivery process to test and confirm compliance with Medicare regulations, sub-regulatory guidance, contractual agreements, and all applicable federal and state laws.

These monitoring activities must be part of the facility’s normal operations to confirm ongoing compliance and to ensure that corrective actions are undertaken within the shortest possible time. The compliance officer and compliance committee are key participants in this process.

The compliance officer must receive regular reports from the auditors, and it is this officer’s duty to provide updates on monitoring and auditing results to the compliance committee, the CEO, and the governing body.

Important areas of operations which need to be monitored include, but are not limited to:

  • Marketing and admissions violations
  • Agent/broker misrepresentation
  • Credentialing
  • Quality assessment
  • Appeals and grievance procedures
  • Benefit/formulary administration
  • Protected classes policy
  • Accuracy of claims processing

Each facility should identify the major risk categories applicable to its own particular operations, and once ranked, these risk areas must receive prioritization in the monitoring and auditing strategy accordingly. However, any risk areas identified through Centers for Medicare & Medicaid Services’ (CMS) surveys and oversight must automatically be classified as priority.

Once the risk areas have been identified and monitored, a rapid response procedure should be developed to deal with any compliance issues raised. This procedure must include the immediate reporting of any identified serious incidents to the governing body and, if applicable, to CMS and any other relevant authorities. The ability to rapidly investigate an identified incident is an important component of this process.

The response process should address any issues raised and ensure that steps are put in place to reduce the potential for reoccurrence. It is very important to fully document the process, as CMS could at any stage request further details.

Reporting to CMS is obligatory as soon as possible, and the inquiry has to be launched no later than two weeks after the discovery of the issue.