The U.S. Department of Justice (DOJ) recently updated its Evaluation of Corporate Compliance Program (ECCP) guidance with a focus on ensuring effective measures are in place to prevent and detect potential misconduct. The ECCP guidance outlines different aspects that prosecutors will consider when evaluating the effectiveness of a corporate compliance program. Understanding what prosecutors will look for helps providers evaluate their own compliance programs to ensure that they are compliant with the standards set by the ECCP. Below is a brief summary of the key updates that were made along with tips providers can take to properly evaluate their compliance policies and procedures.
- Compensation Structure and Consequence Management. The DOJ advised prosecutors to assess policies and procedures to determine if there are established incentives implemented for compliance and consequences for noncompliance within an organization. Additionally, the guidance advised prosecutors to determine if the policies and procedures are enforced consistently throughout the organization. The purpose of this guidance is to shift the burden from uninvolved members onto those more directly responsible.
- Pilot Program. The DOJ created a Pilot Program to shift the burden of fines from general members to the culpable parties. The Pilot Program requires any organization that enters corporate resolutions with the DOJ to implement compliance-promoting criteria in its compensation and bonus systems. Additionally, the Pilot Program will reward organizations that "claw back" compensation from the culpable parties by reducing fines in connection with DOJ resolutions. The Pilot Program became effective March 15, 2023, and will be in effect for three years.
- Communication Guidance. The DOJ revised its guidance for evaluating a compliance program to include whether a provider has implemented effective policies and procedures regarding the use of personal devices and communications platforms. Prosecutors are directed to consider communication channels, the policy environment, and the risk management within an organization. The purpose of this update is to ensure the preservation of electronic data and communication within the context of business-related communications.
Key Takeaways and Steps for Healthcare Compliance Programs:
- Providers must implement tailored policies and procedures that are specific to their industry, size, and risk profile that reward compliance and discipline noncompliance.
- Providers must conduct a risk assessment concerning business communications and implement a personal device and communication policies that are aligned with provider's assessment.
- Providers must instill a "culture of compliance" within their organizations by promoting ethical behavior and encouraging employees to report any potential misconduct without fear of consequence.
- Providers must have a system to investigate any reports of misconduct.
- Providers should make sure that their employees are receiving regular training on the policies and procedures specific to their job functions and the organization as a whole.
- Providers should conduct annual assessments to identify and evaluate internal and external risks associated with their operations.
The DOJ's updates on corporate compliance should highlight to providers the importance of having a comprehensive, tailored, and effective compliance program within an organization.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.