The Department of Justice (DOJ) Criminal Division issued, April 30, a 19-page document entitled Evaluation of Corporate Compliance Programs. This document applies broadly to all industries where compliance is integral to operations and is not targeted specifically to healthcare. Know what prosecutors are measuring should your organization be charged with noncompliance.

Three Overarching Questions

In a press release, the DOJ states, “The guidance document sets forth topics that the Criminal Division has frequently found relevant in evaluating a corporate compliance program, organizing them around three overarching questions that prosecutors ask in evaluating compliance programs.”

The three main questions prosecutors try to answer when evaluating a compliance plan are:

1. Is the corporation’s compliance program well designed?
2. Is the program being implemented effectively?
3. Does the program actually work in practice?

The “Principles of Federal Prosecution of Business Organizations” in the Justice Manual gives very specific factors, which prosecutors are supposed to take into consideration when conducting an investigation of an organization, where they determine whether to bring charges or negotiate a plea or other agreements. One of the factors that goes into this decision is “the adequacy and effectiveness of the corporation’s compliance program at the time of the offence, as well as at the time of the charging decision” and the organization’s remedial actions “to implement an adequate and effective corporate compliance program or to improve an existing one.” (Justice Manual 9-28.300, 9-28.1000)

This new guidance updates a prior version that was issued in February 2017 and was issued to clarify for the prosecutors what makes a well-designed, effective, and operating compliance plan.

Factors to Consider

Is the organization’s compliance program well designed?

Factors that prosecutors consider for this element include:

• Risk assessments – Were quality and effective risk assessments performed such that the compliance plan is able to identify the areas in need of improvement?
• Policies and procedures – At a minimum, prosecutors want to see the organization has a written code of conduct that sets out their commitment to full compliance with federal laws and that this is applicable to all employees. Prosecutors also look at the design, comprehensiveness, and accessibility of policies and procedures meant to prevent misconduct and encourage compliance.
• Training and communication – Policies and procedures are insufficient if there is not follow-up with training and communications. Prosecutors look how the policies and procedures are integrated into the organization via training and communications.
• Third-party management – Prosecutors should assess the organizations full understanding of the qualifications and associations with third-party partners, including third-party partners’ reputations and compliance within their operations.

Is the organization’s compliance program being implemented effectively?

This is where prosecutors make sure the compliance program is not on paper only, or electronically stored only but not used. Prosecutors check if the elements outlined in the compliance program are actually in practice by talking to members of the organization and asking them what is done under different circumstances. Prosecutors look for:

• Commitment by senior and middle management – Prosecutors determine to what extent both senior and middle management in the organization have articulated the organization’s ethical standards and have demonstrated it by example and adherence to the standards.
• Autonomy and resources – Prosecutors evaluate how the compliance is structured. They should also determine whether the organization has the appropriate personnel and resources to effectively complete audits, documentation, and analysis of the compliance program. Personnel should have sufficient autonomy from management, including direct access to the physicians in order to provide feedback.
• Incentives and disciplinary measures – Prosecutors should be able to see that the organization has clear disciplinary procedures in place that are consistently practiced, which ensures procedures match the violations.

Does the organization’s compliance program work in practice?

This is the hardest component for the prosecutor to measure. The presence of misconduct does not mean that a compliance program did not work or was ineffective at the time of the offense, by itself. The prosecutor considers:

• whether and how the misconduct was detected;
• what investigation resources were in place to investigate suspected conduct; and
• the nature and thoroughness of the organization’s remedial efforts.

Some of the things that prosecutors consider when they attempt to determine if the compliance program is working in practice include:

• whether the program evolved over time to address existing and changing compliance risks; and
• whether the company undertook an adequate and honest root-cause analysis to understand both what contributed to the misconduct and the degree of remediation needed to prevent similar events in the future.

Healthcare practices must be vigilant in the design, implementation, and testing of our compliance programs, keeping these three key test questions in mind along the way.