Discipline for Noncompliance

Question 1

The determination to take corrective action against a provider as a result of credentialing activities should be made by:

Answer 1

A review committee with legal, compliance, and medical representation

Question 2

When should a provider be granted a hearing?

Answer 2

If corrective action or termination involves or results in termination or suspension of provider’s status and is reportable to the NPDB or limits the provider’s ability to perform certain procedures.

Question 3

When is a provider action generally not reviewable?

Answer 3

1) Loss of licensure; or
2) Federal or state sanction, exclusion, or disbarment when one’s ability to practice is denied.

Question 4

Name 5 important points regarding discipline

Answer 4

1) Discipline must be consistent
2) Mechanisms for discipline must exist
3) Plan of discipline for those who fail to detect an offense committed by someone else must exist
4) Plan of discipline for those who commit offense must exist
5) Punishment must be based on the severity of the infraction

Question 5

True/False

Written standards of conduct should include procedures for handling disciplinary problems and those who are responsible for taking appropriate action

Answer 5

TRUE

Question 6

True/False

The OIG dictates specific punishments organizations should take for identified infractions

Answer 6

FALSE

OIG provides a framework for reference that states that punishment “could range from oral warnings to suspension, termination or financial penalties, as appropriate.”

Question 7

True/False

The OIG strongly suggests that the promotion of and adherence to compliance should be taken into account during performance reviews

Answer 7

TRUE

Question 8

True/False

Managers and supervisors should be sanctioned for failure to investigate or detect non-compliance

Answer 8

TRUE

Question 9

How should an organization discipline agents and independent contractors for compliance violations?

Answer 9

Terminate the relationship, stop doing business with the agent

Question 10

Before contracting with an agent, an organization should verify what?

Answer 10

That the agent has adopted a compliance plan that meets the minimum standards in the Federal Sentencing Guidelines

Question 11

What does the Whistle Blower Act prevent?

Answer 11

Punishment or wrongful discharge of an employee who reports suspected wrongdoing.

Question 12

True/False

Organizations should have written standards outlining typical violations and matching those to expected consequences.

Answer 12

TRUE

Question 13

Discuss an internal investigation and corrective actions policy

Answer 13

Each healthcare organization should have in place an internal investigation and corrective actions policy. The policy should explain that all employees are responsible for reporting known or potential violations and the reporting mechanism (such as a hotline) described.

• Investigations: The procedure for investigations should be outlined, including who will conduct the investigation, circumstances under which outside counsel will be retained, timeframe for beginning the investigation, and procedures (interviews, board notification, preventive methods against the destruction of documents/evidence, circumstances under which employees may be relieved of duty, information about disciplinary action, and contents of the summary report (complaint, investigation results, reports issues, and recommendations regarding corrective and disciplinary actions.
• Corrective actions: Actions are based on the investigation and should be individualized to prevent the recurrence of the violation. In some cases, a report must be sent to appropriate federal, state, or local authorities if civil or criminal laws have been violated. The report is made to the appropriate authority by the compliance professional in consultation with legal counsel.

Question 14

Discuss monitoring of management’s implementation of corrective actions plans

Answer 14

While the compliance professional may be responsible for identifying the need for corrective action plans and may help to design those plans, explain implementing those plans is ultimately the responsibility of management. Regardless, the compliance professional should monitor the implementation of corrective action plans and maintain close contact with management during implementation. Without ongoing monitoring and input, a corrective action plan may exist only on paper. During the planning phase, measures of outcomes and monitoring should be built into the process and specific timelines established. The compliance professional should meet regularly with those responsible for implementation and determine if deadlines are being met for corrective actions and if the corrective actions are demonstrating effectiveness. In some cases, corrective action plans need to be modified or reconsidered. Once implementation is completed, all stakeholders should be updated regarding progress made and a post-implementation assessment completed and follow-up data obtained.

Question 15

Discuss responding to a compliance audit or compliance concerns

Answer 15

The response to a compliance audit or compliance concerns should be provided in writing and should be distributed to the board of directors, administration, and any other appropriate entities.

The response should include:

• A direct response to the findings, highlighting areas of concern and providing an easily understandable assessment of the problems.
• Explanation as to whether the discovery resulted from internal or external audits and/or regulatory inspection.
• Outline of corrective actions that are needed to remedy the problems, including responsible parties.
• Provide examples to help make clear the problems and plans.
• Explain expected outcomes in clear terms.
• Establish a timeline for action.
• Explain the monitoring procedure that will be utilized to ensure corrective actions are carried out.

Question 16

Discuss the steps to take regarding disciplinary action associated with noncompliance to standards

Answer 16

Each healthcare organization should have a policy in place for dealing with non-compliance to standards, whether intentional or unintentional. Steps should be clearly outlined and followed consistently. All staff members should be aware of the policy and procedures. The policy should clearly state that all members of the organization are expected to understand the policy and report non-compliance immediately. The steps to take regarding disciplinary action associated with noncompliance to standards include:

• Accepting an internal report of non-compliance and ensuring non-retaliation.
• Developing a plan of corrective actions, including halting any inappropriate actions and notifying appropriate authorities, including Human Resources.
• Conducting an investigation to determine the accuracy of the report.
• Determining appropriate disciplinary action based on the facts and with the guidance of Human Resources. Disciplinary actions may vary but may include termination.
• Maintaining all pertinent documentation.

Question 17

Discuss a disciplinary/sanctions plan:

Levels of violations

Answer 17

A disciplinary/sanctions plan must be in place to deal with violations of compliance and privacy. This plan is usually developed in cooperation with Human Resources. In an organization with many departments, discipline is often handled in different ways, but it is imperative that discipline be consistent across the organization so that similar violations are treated the same. The first step is to outline different levels of violations, for example:

• *Level 1**: Unintentional violations: Verbal coaching, supervision, training, written warning.
• *Level 2**: Intentional violations despite knowledge but standards ignored: Suspension, reassignment, termination.
• *Level 3**: Intentional violations for malice/personal gain/retribution or other reason: Termination.

Regardless of the number of levels an organization decides upon, each level should include examples from different departments and appropriate disciplinary action. If mitigating (such as self-reporting) or exacerbating (such as individuals were harmed) circumstances are to be considered when applying disciplinary action, these should be outlined in the plan to ensure that they are consistently applied. If employees are unionized, some issues of discipline may be contractual, and legal advice may be necessary.
Disciplinary actions should be recorded and monitored for consistency and reported to regulatory agencies as required.

Question 18

Discuss disciplinary/sanctions plan:

Just culture

Answer 18

While it is common practice to blame the individual responsible for committing an error, in a just culture, the practice is to look at the bigger picture and to try to determine what characteristics of the system are at fault, leading to the error. For example, there may be inadequate staffing, excessive overtime, unclear orders, mislabeling, or other problems that contribute.

A just culture considers the need to change the system rather than the individual and differentiates among the following:

• Human error: Inadvertent actions, mistakes, or lapses in proper procedure: Management includes considering processes, procedures, training, and/or design to determine the cause of the error and consoling the person.
• At-risk behavior: Unjustified risk, choice. Management includes providing incentives for correct behavior and disincentives for incorrect, and coaching the person.
• Reckless behavior: Conscious disregard for proper procedures. Management includes remedial action and/or punitive action.

Question 19

Discuss ensuring that disciplinary actions are enforced consistently

Answer 19

Depending on personal philosophies and relationships, managers often approach discipline differently and may report problems to Human Resources or deal with issues individually. Therefore, if disciplinary actions are to be enforced consistently, then managers, as well as Human Resources, need to be involved in developing a Code of Conduct and a sanctions plan and need a clear understanding of the regulatory and legal (civil, criminal) implications of enforcing disciplinary actions inconsistently or failing to report violations. When developing levels of violations and examples, each department should provide examples so that these can be discussed to determine if the violation matches the appropriate level and then included in the plan if appropriate.
Additionally, all disciplinary actions should be reported to Human Resources and records maintained so that these actions can be
monitored on a regular basis and any compliance violations reported to the appropriate authorities. Sanctions should also be in place for failing to follow the procedures for disciplinary actions.

Question 20

Discuss employee misconduct:

Digital and social media

Answer 20

Employee misconduct involving digital and social media (Facebook, Twitter, blogs, web pages) is an increasing problem. For example, employees may vent about working conditions (overworked, underpaid, unsafe conditions), discuss patient care, disclose private information, or engage in bullying behavior without considering the implications in terms of compliance issues. Any evidence or reports of employee misconduct involving digital and social media must be immediately investigated, the behavior documented, and appropriate disciplinary action (including suspension or termination) taken. Any staff members victimized (such as through online bullying) should be supported and provided counseling. As prevention, an organization should have clear policies regarding digital and social media conduct. Some organizations prohibit any mention of the workplace on social media, and all organizations should have strong anti-bullying policies that cover digital bullying. These policies should describe violations and disciplinary action for those violations but should also include an explanation of their rights.

Question 21

Discuss penalties for HIPAA violations:

Category 1 to category 4

Answer 21

In order to remain in compliance with HIPAA regulations, an organization must carry out 6 annual audits: security risk, privacy, HITECH Subtitle D, security standards, asset and device, and physical sit. All Staff members must have annual training regarding HIPAA and security awareness training. Identity management and control of access must be in place and access to electronic PHI monitored. Patients must receive a Notice of Privacy Practices.

Category Circumstances Fine

1 The entity was not, and could not reasonably have been expected $100 to $50,000 per violation
to be aware of the violation
2 The entity knew, or should reasonably have known, about the violation, $1,000 to $50,000 per violation
but did not “act with willful neglect.”
3 The entity “acted with willful neglect,” but corrected it swiftly $10,000 to $50,000 per violation
(within 30 days) once they became aware of the violation
4 The entity “acted with willful neglect” and failed to correct the violation $50,000 per violation
in a timely manner.

An organization may be fined up to $1.5M per calendar year for all identical violations of a given HIPAA provision. Violations of multiple provisions increase the annual cap linearly.

Question 22

Discuss penalties for HIPAA violations:

Criminal penalties/Employee Sanctions

Answer 22

In order to remain in compliance with HIPAA regulations, an organization’s HIPAA violations may result in not only civil penalties but also jail or prison terms, depending on the type of violation and mitigating factors.
Lack of knowledge of HIPAA rules and regulations is not considered justification for violations:

Criminal penalties:

• Tier 1: Reasonable cause or the entity had no knowledge of the violation—up to one year of incarceration.
• Tier 2: Protected health information obtained under false pretenses—up to 5 years of incarceration.
• Tier 3: Protected health information obtained and used for personal profit or for malicious purpose—up to 10 years of incarceration.

Employee sanction: May result from action on the part of the employee or even for failing to report a HIPAA violation by another employee (such as unauthorized access of a patient’s medical records). Sanctions may vary according to the organization and the type of violation but may include suspension, termination of employment, or loss of licensure.

Question 23

Discuss HIPAA violations:

Data breaches

Answer 23

HIPAA data breaches are often associated with loss of unencrypted data and lost or stolen unencrypted portable devices (phones, laptops, iPads), such as when a laptop is left in a motor vehicle. If a mobile device must be left in a motor vehicle, it must be secured in the trunk and out of sight.

Another common data breach occurs when a patient’s medical record is viewed by unauthorized personnel, such as by using another person’s password or by reading “over the shoulder” of an authorized person. Those who break the rules may be dealt with internally by the employer, be terminated from employment, face professional board sanctions, or face criminal charges, depending on the nature and extent of the violation. HHS and OCR investigate violations and may refer some cases to the Department of Justice for criminal prosecution, which may range from misdemeanor offenses to felonies.

Question 24

Discuss OIG disciplinary action: Program exclusion

Answer 24

The OIG with the power of the Civil Monetary Penalties Act may impose program exclusions, meaning that the entities/individual may not receive any payments from federal health care programs, such as Medicare and Medicaid. Further, the exclusion applies to any entity/individual that may hire or contract with the excluded person.

Exclusions include:

• Mandatory: A minimum of 5 years exclusion is required for some offenses (patient abuse, program-related crimes, felony healthcare fraud, controlled-substance felony convictions).
• Permissive: OIG may, if it chooses, exclude individuals/entities for other types of violations (failure to repay student loans, losing state practice license, failure to provide quality care, and conviction of some types of misdemeanor offenses).

Exclusion may be for a specific period of time or maybe indefinite and, reinstatement is not automatic as the entity/individual must apply for reinstatement. Excluded entities/individuals are listed on the List of Excluded Individuals and Entities (LEIE) on the OIG website.