Compliance Outsourcing: What, Why, When, Where, Who, and How
One of the most significant business trends over the last decade has been to outsource functions that are not core business activities. Cutting costs and gaining expertise are the two most prevalent motivations for outsourcing. This trend has long since reached corporate compliance programs. Many questions surround this practice in the compliance arena.
Why Outsource Compliance?
The first question is: why should an organization engage an outside expert to assist in running the compliance program? The reality is that many compliance office tasks are routinely outsourced to vendors to enable the compliance office to focus on the program’s core elements. Hotlines, sanction screening services, and training programs are commonly outsourced functions.
In some cases, a compliance officer’s departure creates the need for assistance until the organization can hire a replacement. In others, an existing compliance program needs assistance to handle added responsibilities, such as compliance management or HIPAA privacy/security officer support.
When Should You Outsource Compliance?
Organizations decide to hire compliance experts after identifying weaknesses or gaps in their operations, such as vacancies in compliance, privacy or security officer roles. Many times, government investigation drives the decision to bring in experts. Corporate Integrity Agreements mandate that an organization attests to having a fully functioning and effective compliance program.
Managed Care statutes require maintaining an effective compliance program and notifying CMS when a compliance officer vacancy occurs. And under the Affordable Care Act, CMS is required to develop mandated compliance program requirements. Once these requirements are in effect, many will seek expert assistance to meet them.
Where Can You Find Compliance Outsourcing Services?
Where can organizations find necessary compliance expertise? The easiest starting point is checking the internet to find professional journal articles on the subject. This can provide additional insight and identify experts on the subject. A search can also identify firms that may provide the needed services.
Who Should You Outsource Compliance To?
Who are some experts that can fill gaps or supplement compliance programs, and have also built, assessed, and managed effective compliance programs? They are individuals with hands-on experience in multiple circumstances and settings that make them experts.
The following are examples of experts with extensive compliance program consulting experience, who have served as compliance officers in multiple roles:
- Cornelia Dorfschmid, PhD, who has over 20 years of health care consulting experience and has served as designated/interim compliance officer for hospital systems and physician practices on multiple occasions.
- Steve Forman, CPA, with 12 years as a health care consultant, 10 years as VP for Audit/Compliance at a hospital system, and has served as interim/designated compliance officer multiple times.
- Suzanne Castaldo, JD, CHC, an experienced consultant who has served as interim/designated compliance officer several times.
How Can You Best Outsource Compliance?
How can organizations use compliance experts to its best advantage? Using qualified experts has many benefits, but the key in hiring them is to bring an optimum return of benefit for the cost by ensuring added value. In addition to day-to-day management, consider including some of the following:
- Examine the program to confirm strengths and identify opportunities for improvement;
- Conduct an independent evaluation of the program for senior management and board;
- Review the Code of Conduct and other written guidance;
- Evaluate the quality and effectiveness of compliance training;
- Assess high-risk areas that warrant attention;
- Assess resources needed to effectively operate the compliance program;
- Use experts to identify and build metrics evidencing compliance program effectiveness;
- Use experts to assist in identifying and evaluating candidates for the permanent compliance officer position; and
- Provide a “road map” for incoming compliance officers to follow.
What Level of Effort Should You Put Into Outsourcing Compliance?
What level of effort do organizations need to use compliance experts in compliance programs? Even for fairly large organizations, a true compliance expert can hold the program together for several months without having to be on-site full time. Most organizations can run compliance programs efficiently through using an expert for 50-80 hours per month for up to 6 months until having a permanent compliance officer in place becomes critical.
Smaller organizations and most physician practices will need experts for only half the time. Due to advances in technology, not all hours need to be on-site. However, the key is to have the expert on-call to address any emergent issues. Notably, the OIG has accepted that for smaller organizations, engaging a qualified expert as the Designated Compliance Officer may make more sense. The OIG cites many reasons for an organization to consider using an outside expert instead of a W-2 full time employee.
