Health Care Law

Compliance training is a vital component of an effective compliance program, and should be specifically tailored to the organization and its risk profile. A health care organization’s risk profile is different depending on provider type, patient population, state law, and myriad other factors. Delivering on-point training specific to the organization helps to build a culture of compliance throughout the organization, ensuring that all employees have been educated on red flags and how to report concerns through the compliance program.

Three layers. Effective programs run onboarding training, an annual refresher for everyone, and role-targeted sessions as needed. The third layer is the one most frequently missing. Coders and billing staff need different instruction than the clinical workforce. Physicians need training that respects their time and addresses documentation and medical necessity in terms that connect to how they actually chart. Human resources needs to understand exclusion screening, because HR runs it. Front desk staff need to understand copayment collection and waiver rules, because they decide in the moment whether to collect.

Two subjects carry most of the weight. The first is HIPAA, specifically the parts that govern daily behavior: minimum necessary, need-to-know access, including an understanding that access to a record is not permission to open it. Frequent questions include how to handle a patient's request for access to records, or requests to amend a record. These types of issues have historically resulted in the most complaints to OCR.

The second is coding and documentation. Nearly every claims-based enforcement theory, whether upcoding, services not rendered, failure to meet coverage criteria, or incident-to billing that did not satisfy supervision requirements, traces back to a gap between what was documented and what was billed. Training that addresses the specific codes your organization bills most, using your own examples, does more than any generic compliance training.

OIG also expects boards to understand enough to meaningfully exercise oversight. Directors do not need technical instruction, but they do need a working grasp of the organization’s principal regulatory risks and enough vocabulary to carefully study a compliance report and ask appropriate questions.

Documentation is the deliverable. Training that occurred but cannot be proven has limited value in an investigation. Keep attendance records tied to named individuals, retain the materials actually presented on each date, and obtain signed acknowledgments, both of the code of conduct at hire and of key policies when they change materially. When a disciplinary decision is later challenged, or when the government asks whether an employee knew the rule, the signed acknowledgment and the dated attendance record are crucial evidence.  Compliance training records should be kept for a minimum of six years.

The most useful training material a compliance officer has is the organization’s own audit findings and hotline reports, anonymized. A session built around actual compliance reports made last quarter will always capture more attention from staff than an off-the-shelf compliance training module.

Closing Thoughts

• Build the third layer. Role-targeted training for coders, billers, providers, HR, and front desk staff is where meaningful risk lives.
• Anchor the curriculum in HIPAA’s daily-behavior rules and in your own coding and documentation patterns, using your own examples.
• Keep named attendance records, the materials as presented, and signed acknowledgments, and retain them long enough to cover any period a future audit might reach.

Kaufman & Canoles' Health Care Practice Group represents health care providers in compliance, regulatory, and transactional matters, with experience working with all types of healthcare organizations. Please reach out to Colin McCarthy or any member of the Health Care Practice Group with any questions.