5 compliance tales of terror

The compliance landscape is like a haunted burial ground where millions of dollars go to die every year at the hands of organizations that fail to abide by regulations. And like the apparitions that float through those desolate grounds, compliance specters keep hospital CFOs up at night, feeding fears that the U.S. Department of Health & Human Services will visit them.

Sheridan Johnson, who has taken the reins as chief compliance and security officer for revenue cycle solutions provider Navicure, has heard all the horror stories and witnessed the gore of health organizations losing millions because of compliance violations.

She shared with Healthcare Finance News some of the compliance horror stories that send shivers down the spines of CFOs everywhere.

1. Night of the Third-party Vendors. Johnson said third-party vendors can cause tremors of fear in CFOs. “When you see the statistics behind safety and privacy breaches, a lot of it is going on with third-party vendors,” Johnson said. She points to a case in 2012 when an employee of a Tricare contractor left unencrypted backup tapes in the trunk of a car. The car – and the tapes – was stolen, putting the protected health information of 4.9 million patients at risk and resulting in multiple class action and other lawsuits being filed. “That will certainly keep you up at night,” she said.

2. Attack of the Killer Rules.  Even though compliance procedures and rules sound like they’d be simple to follow, more times than organizations would like to admit, employees aren’t following them, leading to hellish situations, such as when a scheduler from an AIDS clinic taking a subway train home from work left a folder that included patient information on the train. “That’s everybody’s biggest nightmare,” Johnson said. “Obviously, a list of names at an AIDS clinic is very sensitive.” Johnson said the clinic paid a hefty fine based on that “simple” mistake.

3. A Nightmare on Facebook Street. Managing compliance for social media is like trying to cross a moor on a moonless night. It is fraught with dangers, such as employees posting information that isn’t for public consumption or behaving inappropriately, like criticizing other employees. “There are things that shouldn’t be put on social media.” Organizations need to have policies in place that prevent the disclosure of medical data or private company data, such as revenue.

4. The Curse of the Budget. “Everyone has a limited compliance budget,” Johnson said. With compliance penalties always increasing, putting enough resources into compliance policies and procedures could mean preventing ghastly events.

5. The Thing from Another Policymaker. The prospect of new compliance regulations is enough to make the guts of even the most stalwart of CFOs quiver. New rules mean a lot of toil and trouble.