Assessing Compliance and Quality Risks

Central to the new OIG guidance is the importance of identifying risk areas and the measures needed to reduce those risks. When acting as the Compliance Officer, FSA now requires Compliance Committees to submit to us their Risk Assessment for the coming year. Based on the Risk Assessment, they will develop the annual Work Plan, which will be submitted to the Board for approval at the beginning of the year. At least quarterly, the Compliance Officer/Official should provide a compliance report to the Board reviewing the status of the Compliance Work Plan and the measures taken to reduce risks. The Work Plan should be revised throughout the year if additional areas of risk need to be prioritized.

The Board’s responsibility for oversight of the Compliance Program requires you to ask tough questions to ensure that the highest risk areas are addressed and sufficient measures are taken to effectively address those risks. The OIG recommends focus on the following four areas of compliance and quality.

Key Areas to Actively Question

Compliance with federal healthcare program requirements and fraud and abuse laws:

• What new government regulation and enforcement issues have arisen?
• How are compliance risks identified?
• How are “at risk” operations assessed from the compliance perspective?
• How is ongoing compliance monitoring performed and by whom?
• What evidence is there that the Code of Conduct is understood and accepted across the organization?
• What is the scope of compliance-related education and training?
• Does the Compliance Program undergo periodic independent evaluation for its effectiveness?
• What is the process for the evaluation of and response to suspected compliance violations?
• How do we ensure that disciplinary measures for violations are fairly implemented?
• What evidence is there concerning the effectiveness of the Hotline operation and follow-up investigations?
• How are we ensuring compliance with documentation and billing procedures for federal funding?
• Have we performed a formal HIPAA Security Risk Assessment?
• Has the CMS 855A form been updated to comply with the new transparency guidance?

Dedicating the necessary resources to the Compliance and Quality Programs:

• Does the Compliance Officer/Official have sufficient experience in leadership, compliance, and quality of care to be effective in their role?
• What is the level of resources necessary to effectively implement the Compliance Program?
• Does the Compliance Officer/Official have sufficient authority and resources to implement the Compliance Program?
• Does the Compliance Officer/Official attend Board meetings, including an annual executive session?
• Does the Compliance Officer/Official have a direct line of communication to the Board?
• Have compliance-related responsibilities been delegated across all levels of management?
• Are we allocating resources appropriately when resident acuity changes?
• Are there priority/high risk areas that we have not yet attended to due to lack of resources or capacity?

Providing a high quality of care:

• What are the goals of the QAPI program, and how are the goals linked to management accountability?
• How are adverse events identified, reported, and incorporated into the organization’s performance improvement standards?
• What benchmarks and metrics are used to identify improvements needed?
• How do we ensure the effectiveness of the Infection Control Program?
• How are we supporting and retaining staff to maintain the highest quality of care?
• How do we ensure coordination of activities between the Compliance and QAPI Programs?

Creating a safe and comfortable environment for all residents:

• How are resident safety issues identified and addressed?
• Do our competency assessment, training, credentialing, and peer review processes for staff adequately recognize clinical quality and resident safety issues?
• What processes are in place to promote self-reporting of errors?
• What processes are in place to promote the reporting of quality and safety concerns?
• How do we determine the residents’ and their representatives’ satisfaction with care?
• How are patterns of resident concerns identified and how are they addressed?
• How do we ensure the effectiveness of our Emergency Preparedness Plan?

Source Documents:

Nursing Facility Industry Segment-Specific Compliance Program Guidance, OIG, November 2024

Practical Guidance for Health Care Governing Boards on Compliance Oversight, AHIA, AHLA, HCCA, OIG, HHS, April 2015