3/14/2019
1
Internal Audit’s &Corporate Compliance’s
Role in AddressingEnterprise Risk –
Behavioral Health ServicesLorrie Oelkers Ghose, CPA Kimberly Jordan, CHCChief Audit Executive Chief Compliance Officer
HCCA Compliance InstituteApril 7-10, 2019Boston, MA
Agenda
2
• Fairview Health Services
• Risks / Challenges in Behavioral Health
• Enterprise Risk Identification• Risk Assessment• Enterprise Risk Management
• Role of Internal Audit and Corporate Compliance in Risk Mitigation Activities• Executive Oversight Committee• Areas of Focus• Other Audit Activity• Risk Dashboard• Ongoing Monitoring – Sustaining Change
• Governance – Audit and Compliance Committee of the Board of Directors
• Tools
• Questions/Answers
3/14/2019
2
Our Health System
About Fairview Health Services3
Fairview Health Services• University of MN Academic Affiliation• 33,000 Employees• 5,000+ System Providers• 12 hospitals and medical centers• 2,140 staffed beds• 56+ primary care clinics• 100+ specialties• 70+ senior housing facilities• 40+ retail pharmacies• 327,000+ health plan members
Behavioral Health Services• 370 beds• 12,448 Inpatient Cases Annually• 42,500 Outpatient Encounters Annually• 15,528 Outpatient Chemical Dependency Cases
Annually
Behavioral Health Services Programs
About Fairview Health Services4
• Behavioral Health Home Services
• Adult Mental Health• Inpatient Care• Outpatient Care• Senior Treatment
Programs• Young Adult
Mental Health Services
• Adolescent Substance Use Disorder / Dual Diagnosis Program
• Compulsive Gambling Program
• Adult Substance Use Programs
• Outpatient Treatment Program
• Inpatient Treatment Program
• Lodging Plus Residential Program
• Prenatal Substance Use Disorder Program
• Child Adolescent Mental Health
• Children’s Day Therapy Program
• Inpatient Care
3/14/2019
3
5
Behavioral Health Services – Risks & Challenges
• Increasing need (depression, opioid epidemic)
• Decreasing availability / Inadequate capacity
• Difficult population
• Inadequate funding and insurance coverage / Financial risk to providers
• Quality of care / Variation of practice
• Staffing shortages
• Research challenges
• Billing compliance
• Violence / Harm to patients, staff and visitors
• Increased regulatory oversight
Behavioral Health Services: National Crisis
3/14/2019
4
Behavioral Health Services: National Crisis
8
Mental Health Patient Rights Violations
Sexual Assault of Patient by Another Patient
Patient Elopements
Improper Research Consenting of Mental Health Patient
Use of Ketamine without Patient Consent
Staff Injured by Patient
Overuse of Restraints/Seclusions
Behavioral Health Services – Local News
3/14/2019
5
9
Risk Assessment – Identifying & Assessing Risks
Internal Audit & Corporate Compliance Annual Risk Assessment Process
• Conduct interviews with executive leadership, management and other stakeholders across the enterprise.
• Survey all members of the management team as well as 20% of non-management staff across the Fairview enterprise.
• Evaluate results of prior audit and compliance projects.
• Evaluate the impact of the current financial, operational and regulatory environment related to Fairview’s key initiatives.
• Consider top healthcare risks identified by industry experts (e.g. Crowe Horwath, CHAN Healthcare, Deloitte) and government and other regulators (e.g. CMS, Department of Health and Human Services, Joint Commission, Office of Inspector General).
Drives Annual Work Plan / Identified Risks Considered in ERM Exercise
10
Tool – Risk Assessment Survey
Management Employee
Response Rate2019 2018 2019 2018
41% 46% 25% 23%
In your opinion, does the organization demonstrate a commitment to its core values: Dignity, Integrity, Service, Compassion, and Innovation? Yes…
96% 95% 90% 90%
In your opinion, does leadership demonstrate integrity and ethical behavior? Yes…
Are you aware that the organization has an anonymous reporting tool (hotline) available for all employees, vendors, patients and others to report ethical or regulatory infractions and other concerns (Compliance Reporting Hotline)? Yes…
Do you believe you can report a concern without fearing retaliation? Yes…
Do you know where to find policies and procedures to guide your work? Yes…
Are you confident that the data you utilize to perform your work are accurate and reliable? Yes…
How would you rate the organization’s culture of accountability on a scale of 1-5 (with 5 stars being highly accountable)?
3/14/2019
6
11
Enterprise Risk Management –Identifying Strategic & Enterprise Risks
• Highest risks and concerns / risk statements are requested from executive leadership.• Internal Audit and Compliance facilitate exercise with executive leadership and board
members to pare down risks by determining impact, likelihood and velocity. Risks are then categorized as strategic or enterprise risks.
• Strategic risks – risks which, if realized, would prevent the organization from achieving its strategic initiatives and goals.
• Enterprise risks – risks for which redundant oversight and leadership is appropriate for some period of time until risk is mitigated to a point where it can be managed locally.
• Accountable executive owners are assigned to Strategic and Enterprise risks.• Accountable executive owners and their designees are responsible for developing
interventions to mitigate risks.• Status of mitigation activities is reported bi-weekly at Strategic Management Team
meetings.• Results of mitigation efforts are reported to the Audit and Compliance Committee of the
Board of Directors in June and December.
12
Tool – Enterprise Risk ManagementImpact: The financial or business impact if the adverse event were to occur.
5: Catastrophic • Event with a financial impact greater than $100 Million.• Significant downgrade in debt. Major enforcement action.• Disqualification from participation in government reimbursement program.
4: Major • Event with a financial impact between $50 and $100 Million.• Major adverse events with negative publicity (e.g. infant abduction)
3: Significant • Event with a financial impact between $25 and $50 Million.• Adverse events with high reputational impact (e.g. workplace violence)
2: Minor • Event with a financial impact between $2 and $25 Million.• Published malpractice claim.
1: Insignificant • Event with a financial impact less than $2 Million.
Likelihood: The probability of occurrence given controls in place.
5: Almost Certain • Event will occur in most circumstances; 90% or more of the time (e.g. snow in MN in January)
4: Likely • Event should occur; more than 50% probability and up to 90% certainty (e.g. snow in MN in December)
3: Moderate • Event will probably occur; more than 25% and up to 50% probability (e.g. snow in MN in November)
2: Unlikely • Event could occur; more than 5% up to 25% probability (e.g. snow in MN in October)
1: Rare • Event would occur only in exceptional circumstances; <5% probability (e.g. snow in MN in September)
Velocity: The speed of onset of the event, should it occur.
5: Immediate • Very Rapid onset; little or no warning, instantaneous
4: Fast • Quick onset; several weeks or months to occur
3: Moderate • Moderate onset; between 6-12 months to occur
2: Slow • Slow onset; between 13 and 18 months to occur
1: Prolonged • Very slow; >18 months to occur
3/14/2019
7
Tool – Enterprise Risk Management
Enterprise Risk
Risk Indicators
Risk Definition
ScoreImpact
XLikelihood+ Velocity
CommentsRisk Tolerance
Risk Level
Risk Trend
Status of Risk
Mitigation Plan
Behavioral Health
ServicesLow
Failure to ensure safety of behavioral patients and
staff leads to unacceptable reputational and financial
risk.
16National risk trend increasing with regard to substance use/abuse and dual diagnoses
Oversight of Behavioral Health Enterprise Risk –Executive Oversight Committee
14
• Purpose – identify and address areas of risk in the Behavioral Health service line; demonstrate appropriate redundant oversight until risk is sufficiently mitigated.
• Committee Membership• Chief Operating Officer, Chair• Chief Audit Executive• Chief Compliance Officer• Chief Nursing Executive• Chief Medical Officer• Chief Legal Officer• Service Line Executives• Clinical and Administrative Behavioral Health Leadership• Regulatory Response Director• Facilities / Security Executive• Human Resources Leadership
• Meeting Cadence• Initially every two weeks, changed to monthly
3/14/2019
8
Oversight of Behavioral Health Enterprise Risk –Executive Oversight Committee
15
Meeting Expectations / Ideal Behaviors
• Honest and constructive discussion is necessary to resolve issues.
• Have the courage to speak up and challenge things that need to be challenged.
• No “meetings after the meeting.”
• Challenge hypotheses.
• Support resolution with data.
• Seek to understand.
• Be prepared.
• Be transparent, honest and forthcoming.
• Be willing to discuss the difficult issues.
• Be open to change.
• Acknowledge an recognize the value of dissension; work towards agreement.
Oversight of Behavioral Health Enterprise Risk –Executive Oversight Committee
16
• Assessment History• Multiple Internal Audit Reviews• Compliance Coding and Provider Documentation Review• Issues Reported to Compliance Office
• Focus / Priorities• Address Open Internal Audit and Compliance Findings• Incorporate Auditing / Monitoring Activities in Other Audits• Report on Areas of High Risk – Monitoring and Auditing Activities
3/14/2019
9
Oversight of Behavioral Health Enterprise Risk –Areas of Focus
17
• Restraints/seclusion• Staffing, including Physician Coverage• Leadership Communication• Healing Milieu / Care Model• EMR Documentation• Scope of Practice – Face to Face Assessments• Use of Occupational Therapists• Physical Environment
• Ligature Risks• Safety• Patient Elopement
Incorporate Risks in “Other” Audits
18
3/14/2019
10
Risk Dashboard
Definition:
Process/risk owner: BHS Service Line Executive
Board governance: Audit Committee
Management governance: BHS Executive Oversight CommitteeExecutive Compliance Risk and Control Committee
Risk Category
Root Causes / Risk Drivers Mitigation action plansTarget Date
Project Status
% Complete
Key accomplishments/ challenges
Behavioral
Ligature Risk
Ligature Risk Assessment • Completed Assessment of Adult Unit
• Completed Assessment of Pediatric UnitLigature Risk Remediation
(Pediatrics)
Patient Suicide
Nurse Staffing Ratios• Created Standard Roles• Obtained Budget approval for
additional FTEs1:1
Patient elopement Egress Point Control• Trained all staff in elopement
risk
Patient/Staff Violence Nurse Call System
• Completed System Risk Assessment
• Identified areas of focused training
Tool – Risk Dashboard
Sample Ongoing Monitoring Activity –Restraints / Seclusion
About Fairview Health Services20
3/14/2019
11
Governance – Audit & Compliance Committeeof the Board of Directors
About Fairview Health Services21
Updates on Behavioral Health Services• Internal Audit Activity• Compliance Audit Activity• Compliance Hotline Reports• Areas of Particular Concern
Enterprise Risk Management Updates• Bi-Annual• End of Year Close-out of ERM Risk or Carry Forward for Consideration for Next
Year Risk Inventory
Tools
22
• Heat Map
• Risk Tolerance Guiding Principles
• Operational Action Plan
• Ligature Risk Requirements Checklist
Please note that additional tools are embedded in the presentation:• Risk Assessment Survey – slide 10
• Enterprise Risk Management – slides 12, 13
• Risk Dashboard – slide 19
3/14/2019
12
0
1
2
3
4
5
6
7
8
9
0 1 2 3 4 5 6 7 8 9
Lik
elih
oo
d P
roba
bilit
y of
Occ
urre
nce
Impact Level of Severity
Behavioral Health RisksNumber Risk - Condensed
1 Patient Suicide
2 Clinical Documentation
3 Healing Milieu
4 Employee Harm
5 Emergency Department (ED) Boarding
6 Ligature Risk
7 Patient Elopement
8 Inadequate Staffing
9 Behavioral Health Research Consent
10 Use of Videography
11 Restraint/Seclusion/Other
12 Patient/Patient Violence
Tool – Heat Map
16
3 7
12 945
2 810
11
24
Tool - Risk Tolerance Guiding Principles
Principle Examples Tolerance
Risks in the pursuit of innovative, breakthrough research that improves the health of our patients
High/Moderate/Low/Zero
Risk taking that enhances our health care delivery High/Moderate/Low/Zero
Risks for rewarded financial gain High/Moderate/Low/Zero
Risks arising from discharge of management responsibilities and accountability
High/Moderate/Low/Zero
Risks that undermine actual safety (patient and employee) or the perception of safety, at our hospitals, clinics and other facilities
High/Moderate/Low/Zero
Risks for behavior that puts our patients at harm High/Moderate/Low/Zero
Risks resulting from variation in process High/Moderate/Low/Zero
Risks that inhibit care system integration High/Moderate/Low/Zero
Risk resulting from non-compliance with laws or regulations High/Moderate/Low/Zero
Risk resulting from HR related actions or processes High/Moderate/Low/Zero
3/14/2019
13
Tool – Operational Action Plan
25
AreaArea of Focus
Detail RecommendationRemediation / Action Plan
Responsible Person(s)
Due Date
Behavioral Health Units
Signage / process
Inventory of ligature risk across all service and patient care areas.
Assessment of ligature risk, replacement of equipment based on
risk rating criteria
Behavioral Health Leadership
7/1/2018Behavioral
Health UnitsSignage / process
Elopement Prevention- physical work, including the installation of sally ports or "man-traps" at each
BH unit. Many elopements are due to the inattention or carelessness of
staff entering or leaving.
Signage, ("Own this door"), awareness, limiting staff access authority and related technology
Signage creationBehavioral Health
Leadership7/1/2018
Behavioral Health Units
Safety / spaceStaff Protection- indications that
some staff felt unsafeUse of the charting rooms as
shelters
Gemba walks with staff- identify
egress / shelter areas
Behavioral Health Leadership
7/1/2018
Behavioral Health Units
Safety Training
Staff Protection- indications that some staff felt unsafe in Security
Alert level Code 21
Video, training and awareness. Additional Code 21 and/or Clinical
Education designated training.
Tools in the LMS program and unit
specific pilots
Behavioral Health Leadership / Education
7/1/2018
Behavioral Health Units
Access Control / Visitor
management
Alignment with campus access control practices; consistent visitor
management
Develop consistent standard for visitor screening and access control
to all behavioral health units, UMMC and system
UMMC West lobby project; align with
SJH project
Behavioral Health Leadership /
Security6/1/2018
26
Air Exchange Vent Small Perforations that are Secured in Place with Tamper Resistant FastenersAlcohol-Based Hand Rub Not Mounted or Located in Patient Access AreasAppliances Ligature-Resistant; Securely AnchoredBadge Reader Tight to the Wall; Sloped Bed - Medical No Open Side Rails; If Open Side Rails Needed, 1:1 ObservationBed - Platform Securely Anchored, No Storage DrawersBed - Stretcher 1:1 ObservationBlinds Mounted Between Layers of Safety Glass & Pull Cord / Opener UnattainableCeiling Type Hard Lid; If Not Hard Lid, Clips Required for Dropped CeilingsChair Armless Chairs, HeavyClock In Protective EnclosureCloset / Storage Unit Rod None on UnitCloset / Storage Unit Shelves Built-In or Securely Anchored with Tamper Resistant ScrewsCords (appliances, lamps, call lights, TV, telephones)
Wired into Wall or Table; Shortest Exposure Possible; Cord Less than 6 to 8 Inches
Decorative Picture(s) Polycarbonate or Acrylic Glazing Over Picture; Screwed to the Walls with a Minimum of One Tamper-Resistant Screw Per Side; Pick-Resistant Sealant on Top
Door Closure Mounted on the Corridor Side of the Door, Away from Rooms Where Patients will be Alone or in Groups
Door Handles Ligature-ResistantDoor Hinges Closed Sloped Top and Continuous GearsDoor Material Impact Resistant or Soft- Foam BreakawayDoor View Windows to Corridors
No Ligature-Resistant on Opener
Doors Barricade Resistant Refer to FGI GuidelinesDrapes Breakaway with Minimum Force if GatheredElectrical Device Cover Plates Attached With Tamper Resistant Screws
Exit Signs Tight to the Ceiling with a Full-Length Mounting BracketExposed Piping (sink, toilet, & shower)
All Must be Enclosed / Sloped, Ligature-Resistant
Faucets (sink & shower) All Must be EnclosedFire Enunciator Tight to the Wall; Sloped
Tool – Ligature Risk Requirements Checklist
3/14/2019
14
27
Fire Extinguisher Cabinet Continuous Hinges, Recessed Pulls (if any), and Polycarbonate GlazingFire Extinguisher Signs Tight to the Ceiling
Floor Pads / Mats No Zippers, Seams SealedFloors Non-PatternedFlush Mechanism on Toilet Push ButtonGas Valves, Flow Meters Covered with Lockable Panels or Panels Attached with Tamper-Resistant Screws
Grab Bars Filled Gap Solid Grasp Only Bar, Flush to WallHandles / Pulls Recessed, with No Protruding Openings, or of a Closed Ligature-Resistant Type
Hooks Collapsible
HVAC Grilles / Registers Small Perforations that are Secured in Place with Tamper-Resistant FastenersIV Pole / Tubing If Medical Need, 1:1 Observation
Lamps None on Unit
Light Switches Tamper-ResistantLighting Tamper-Resistant Securely Fixed in the Frame with Covers that are Firmly Secured w Tamper Resistant
ScrewsMattress / Pillow No springs, No Zippers, Seams Sealed
Mirror Non-Glass Mirror; Firmly Secured with Tamper-Resistant Screws; If Flat Surface, Tapered Strip Present
Night Lights Tamper Resistant- Not Removable
Outlets Hospital-Grade, Tamper-Resistant TypePaper Towel Dispensers Recessed ShelfPlastic Bags None on UnitPrivacy Curtain Breakaway with Minimum Force if GatheredPull Cords Push Button; No Longer than 4” and as Light Weight as Possible Screws Tamper-Resistant, Flush Mounted Set ScrewsSharps Container Securely Mounted; Ligature-ResistantSheets / Covers No Additional Supplies in Room; No Fitted Sheets
Shower Curtain & Rod Breakaway with Minimum Force if Gathered
Shower Stools Ligature-Resistant
Shower Wands Ligature-Resistant, Quick-Disconnect Fitting that Allows Removal of the Head and Attached Hose
Soap Dispensers Ligature-Resistant
Sprinkler Head Institutional Heads
Tool – Ligature Risk Requirements Checklist
28
Questions / Answers
Thank you!
Lorrie Oelkers [email protected]
Kimberly [email protected]