Your Records Management Compliance Audit Checklist: Developing A Solid Compliance Records Management Program

What type of compliance records management system is utilized by your organization? According to the U.S. Department of Health and Human Services Office of Inspector General (OIG), all effective healthcare compliance programs should implement some type of compliance records management system. The primary purpose is to ensure that all documents, including healthcare compliance policies and procedures, necessary to protect the integrity of the organization are current with applicable laws, regulations and requirements and are properly maintained. A well-managed compliance records management system also evidences the effectiveness of the compliance program.

For example, compliance records management system should include:

• Documentation that employees were adequately trained
• Reports from the compliance hotline
• Documentation that shows modifications to the compliance program
• Self-disclosures to government agencies
• Compliance audit checklist
• Results of auditing and monitoring efforts
• Healthcare compliance policies and procedures
• Records management compliance checklist

Additionally, the Compliance Officer should also ensure proper healthcare records management.  For example, patient medical records, billing information and cost reports are areas that should be guided by clear healthcare records management policies and procedures.  These policy documents are often controlled by specific laws and regulations and, therefore, would probably be developed in consultation with legal counsel.  However, once established the Compliance Office may be involved in auditing and monitoring these policy documents as they relate to compliance in many ways.  For example, upon proper request the organization should be able provide patients’ medical records and physicians’ orders, to support the medical necessity of services that the organization has provided.  The Compliance Officer should ensure that a clear, comprehensive summary of the “medical necessity” definitions and rules of the various government and private plans is prepared and disseminated appropriately.

The OIG recommends as a key compliance program element, that employees participate in annual healthcare compliance training programs as condition of continued employment and that failure to comply with training requirements should result in disciplinary action. Therefore, documentation related to employee training, including the training material, who attended, completed quizzes, employee attestations and the training policy and procedures, be maintained in the compliance records management system.

Here are some suggestions that Compliance Officers may wish to consider as part of a compliance records management system.

• Develop and implement policies and procedures for the creation, distribution, retention, storage, retrieval and destruction of compliance related documents and healthcare compliance policies and procedures.
• Develop a compliance records management and healthcare records management system to track, administer and store compliance related documents and healthcare compliance policies and procedures.
• Ensure adequate records of healthcare compliance training programs of employees are maintained, including attendance logs and material distributed at training sessions.
• Maintain a hotline log of calls that evidence how the information was handled and controlled.
• Review requirements established by the Centers for Medicare & Medicaid Services and state health agencies for maintaining various categories of records, and then implement controls and document management to address these requirements.
• Ensure that the compliance records management system addresses protection of patients’ protected health information.
• Extend document and records management to contracts and agreements with referral sources and maintain a database of all such agreements.
• Ensure compliance with compliance records management and healthcare records management systems are included as part of ongoing monitoring and auditing.

About the Author

Richard P. Kusserow established Strategic Management Services, LLC, after retiring from being the DHHS Inspector General, and has assisted over 2,000 health care organizations and entities in developing, implementing and assessing compliance programs.