Governance & Total Compliance

1. Governance & Total Compliance Regulators Expectations & Best Practices to Meet Them Presented by: David M. Rottkamp, CPA– Partner, Not-for-Profit Practice Leader Alfonso P. Conti, MPA – Manager, Healthcare Management Consulting

2. The year ahead will be a pivotal one for Boards and audit committees Many of the larger companies that failed: Were sabotaged by Board negligence; Were too optimistic; Had ill-informed Boards; Had Boards that spent too much time looking backwards than towards the road ahead. Opening Remarks

3. Ex-CEO admits stealing from prominent NYC charity The politically connected former CEO of a prominent city charity admitted Wednesday he helped steal more than $9 million from the organization in an insurance scheme that authorities linked to campaign contributions. William Rapfogel pleaded guilty to grand larceny, money laundering and other charges in a case that had rattled city and state political circles. Source: The Associated Press, April 23, 2014

5. Effective leaders are straight shooters who know that if performance or the ability to fulfill obligations is lacking, they must work to educate, demonstrate expectations, and critique behavior that is below the norm. Opening Remarks

6. Audit Committees from both the For Profit and Not-For-Profit world agree that the Board: Cannot sit back and conduct business a usual! Must engage management to understand current and future challenges of the business. Must reduce the reactive nature to an issue and be more proactive and Ensure that the right people and skill sets are on the Board to enable the growth and protection of the organization. Recent Surveys

7. 60% of Boards surveyed replaced or added a director in the last 12 months. 52% of Boards do not oversee organizations social media strategy and can improve on their technical knowledge 14% of the Boards surveyed have removed a director due to poor performance/ evaluation Boards are focusing on age limits and term limits for Board members Trends in Governance

8. Does your Board consider or have in place: A Board Succession Process Constantly assess and challenge the members Optimizing the Board seat and rotate with term limits Board member recruitment Board Mentoring Board Questions

9. Governor Cuomo emphasis on Ethics reform in government, it does not stop with the politicians! Passage Not For Profit Revitalization Act implementation July 1, 2014 Appointment of James Sheehan to head the Charities Bureau -you remember the mantra educate / prosecute Recent Media articles on CEO Kickbacks in NFP and Healthcare organizations! OIG published 52 month average Jail time for Fraud and Abuse conviction. Corporate Integrity Agreements are getting tougher! Why all the Concern?

10. Fiduciary Duty: This means that the board member will act for the financial benefit of the organization. Duty of Care: The board member will use a level of care that an ordinarily prudent person would exercise in a similar position when faced with similar circumstances. Duty of Loyalty: This is an expectation that the governing board member will act in a manner he/she reasonably believes to be in the best interests of the organization. Responsibility of the Governing Board

11. Boards are being targeted for their focus on: Compliance and their direction of the Compliance Officer and Compliance Committee. Boards in general need to know what the annual compliance efforts Involves. Boards are ultimately responsible for the ethical conduct of the management. Boards are Targets of the OMIG / OIG

12. So how does a Board avoid this embarrassment? The answer is culture, education, and continuous focus A structure where the Compliance Officer reports to the Board Getting harder and harder to oversee the challenges Boards are Targets of the OMIG / OIG

13. A continuous stream of communication Sharing of Compliance efforts The Board assistance of the Compliance Officer Potential Board Solution

14. Passed December 18, 2013 effective date July 1, 2014! Addresses the growing concerns in the NFP industry! (Target) Main Components of the Act: Mandatory Audit Committee or Board Audit Function Kickbacks. Mandatory Whistleblower and Conflict of Interest policies Other areas in the Act involve Document everything Not For Profit Revitalization Act

15. Does the board of directors need to approve ALL policies and procedures? If not, what type of policies MUST have board approval? Is annual compliance training required for the board of directors or is it best practice? What training MUST board receive on an annual basis? Is annual defined as “within 365 days” or is there some leeway, such as 13 months? In the compliance audits conducted by the OMIG or other regulatory agencies, of which the OMIG is aware, what are some practical tools used by compliance officers /organizations to get board engagement? OMIG FAQ’s Targets Boards

16. In successful businesses Boards need to set the Tone from the Top! What does that mean? Communicate to Management Insure Ethical behavior Provide Support How Can Boards Help Management?

17. Where is your Compliance Officer in the Food Chain? Compliance Officer position is more critical in 2014! The Board should know the Compliance Officer! The Board should know the Compliance Committee! A Board members should sit on the Committee! Boards and Their Compliance Officer

18. Charities Bureau: Effective February 1, 2014 the new head of the Charities Bureau (CB) is James Sheehan former head of the Office of the Medicaid Inspector General. One of his many charges will be the implementation of the NFP Revitalization Act. How does that affect the Board and Compliance Officer relationship? The Compliance Officer New _ _ _ _ _

19. Facilitate Candid conversation at the Board and C-Suite Develop ethical leaders Build ethical leadership incentives Train everyone in the organization starting with the Board Form a Compliance Committee that will assist the CCO Assess the organization risk areas CCO has an independent voice Chief Compliance Officer Responsibility

20. Governance Involvement Compliance Committee Meetings Continuous Compliance Education of Staff Annual Risk Assessment by Departments Work Plan Update Auditing and Monitoring Program Internally and Externally Reporting to Governance Current Practices

21. The function of the Bureau of Compliance is to insure providers of Medicaid services have an effective Compliance program in place. They enforce the year-end certification of compliance programs. “The goal of these reviews is to assess if providers have compliance programs that meet the requirements of applicable laws, regulations, rules and policies of the Medicaid program” per their introduction letter. OMIG Bureau of Compliance

22. Contact information of the Compliance Officer Contact Information Senior Administrative Official Document Request Compliance Officer information Copy of the Organization Chart Bureau of Compliance Request

23. The turn around time is usually 1 week. They want to see: Minutes of the Compliance Committee Training conducted with staff A work plan that identifies the risks identified A summary of reviews performed Reporting to Governance Bureau of Compliance Reporting

24. Schedule a site-visit Purpose: Meet with a member of Governance Speak with Management Discuss with the Compliance Officer what their role is Perform a walk around Bureau of Compliance Follow-Up

25. Year-end Certification is backed up The Bureau in their review always finds something A Discussion Draft is issued No submission, a final letter is issued The Bureau suspects lax and non-adherence to compliance What Happens If …?

26. Review existing Compliance Plan Documentation Conduct a review of all supporting policies and procedures Conduct a comprehensive self-assessment of the program Prepare an updated work plan on the risk areas identified Report on a quarterly basis on reviews performed Compliance Summary

27. The Final HITECH Regulations went into effect on March 26, 2013. DHHS is allowing Covered Entities (“CEs”) and Business Associates 180 days to come into compliance. This means, unless otherwise noted, CEs and Business Associates must be compliant by September 23, 2013. The Date has Passed! Other Piece of Compliance HIPAA

28. So now you see the Circle of Life as seen by the OMIG! Governance Management Compliance Officers You know we are there for You… Nervous Yet or Relieved?

29. The Breach Notification Requirements Business Associates Privacy Notice Changes Marketing / Fundraising / Sale of Protected Health Information (PHI) Various Miscellaneous Privacy Provisions Enforcement and Penalties MEGA Rule - Impact

30. 46% loss is of laptops with PHI 42% loss due to employee mistakes or unintentional action. Effectiveness training is questionable OCR Study on Breaches

31. Do you have a Social Media Policy? Limit access from devices to critical systems Require the user to read/sign an acceptable use policy Limit or restrict the download of PHI Scan devices for viruses/malware software Require anti-virus/anti malware prior to connection Scan devices removing apps that present a security threat Mobil Devices

32. Steps to prepare for it: Conduct a security risk assessment and privacy review Identify PHI locations throughout the organization Create a work plan to mitigate top risks identified Ensure Business Associate agreements up to date Update policies and procedures for HITECH rule Appropriately assign an Officer to oversee Compliance with HIPAA Standards

33. Recently Skagit County signed off on the CAP after paying $215,000 settlement: A three year program HHS must approve policies and procedures Breach Notification policy Accounting for Disclosures Hybrid Entity Business Associate Documentation Security Management Process Update all policies for Federal compliance Provide Training for all workforce and certify performance Reportable events if any workforce member does not comply with these requirements OCR Corrective Action Plan

34. Annually a Report is submitted NLT 60 days after signing date of CAP containing summary of security mgt., reportable events and attestation by an officer of the County Institute a document retention requirement for 6yrs. OCR Corrective Action Plan

35. What are your HIPAA goals? Meet compliance Mitigate risk Improve your security posture Evaluate your team’s response capabilities, all good responses. HIPAA Goals / Questions

36. However, pretend for a moment you have completed an assessment what are some questionsto ask yourself: What do you hope to show management when reporting results? Is there something you are trying to prove? Do you need to test your external network devices? Are you looking for a thorough review of your web applications? Do you want to test the security culture of your organization? Do you have a specific technical area of your environment you need to evaluate that you don’t have the right skillset in-house for? HIPAA Goals / Questions

37. Forward looking Boards must remain: Vigilant Energetic, Wary of bad habits. Objective Built on Ethics and Culture Successful boards will be those that work in the spirit of continuous improvement at every meeting, while always keeping the long range goals in mind. By creating forward thinking Boards, organizations can avoid the failures and potholes discussed today. Summary

38. Building a real, substantive compliance and ethics program will demonstrate to the government, shareholders, employees, rating agencies, and others that your company is indeed, committed to integrity. Summary

39. VACCINE

40. For more information… David M. Rottkamp Partner, Not-for-Profit Practice Leader 516-918-5942 drottkamp@grassicpas.com Alfonso P. Conti Healthcare Management Consulting Manager Grassi & Co. 516-336-2471 aconti@grassicpas.com