Healthcare organizations are under growing pressure to meet compliance obligations, maintain profit margins, optimize the revenue cycle functions and reduce risk. Most risks in the healthcare industry are exacerbated by provider organizations performing a variety of services and having decentralized operations across multiple states — risks audit and compliance functions must address. Some organizations try to build a robust internal audit department to address the inherent complexity of their operations; others look outside to form long-lasting relationships with experienced partners they can trust.
One healthcare organization, with multiple locations across the United States, chose the latter path. The healthcare system had experienced significant growth and changes in recent years; however, its internal audit function was having a hard time addressing all aspects of the ever-expanding enterprise effectively. The organization recognized that the internal audit function had a lot of capacity but chose not to audit certain areas because it did not have the right expertise internally.
To address these challenges, the organization sought to revitalize its internal audit function through a co-sourced partnership with a respected firm with deep healthcare expertise. The CEO was familiar with Protiviti’s extensive knowledge of the industry and proven internal audit expertise through his work as the chair of the audit and compliance committee of another healthcare provider organization where Protiviti served as the outsourced internal audit function.
“The organization needed a firm with a broad reach and knowledge of the healthcare industry, and also possessed tried and true internal audit methodologies and next-gen auditing capabilities to help build a road map for where the internal audit function needed to be.”
-Richard Williams, Global Healthcare Industry Leader
The CEO invited a Protiviti team to conduct a comprehensive, top-to-bottom assessment of the internal audit program to assist in understanding where the current program differed from leading practices, to identify opportunities for improvement and to provide a detailed road map to attain world-class status. The objectives were clear: Determine if the current internal audit function had the following attributes:
Clearly defined purpose and role
Established governance and reporting structure
Qualified and skilled resources
Robust risk assessment and audit plan development process
Comprehensive and consistent audit approach
Robust audit and findings follow-up process
The assessment culminated in a final report delivered to the board of directors. The report identified several areas of opportunity which, when addressed, would meet the objective of achieving industry leader status for the internal audit function.
During the course of the assessment, the organization’s internal audit team developed a close and productive working relationship with Protiviti, and the trust between the two organizations grew. Through the assessment, the organization recognized Protiviti’s expertise in a range of healthcare risk management domains and invited other Protiviti specialty practice teams to address other risk areas across the enterprise, including compliance, IT audit and technical operations. Some of the key areas that Protiviti assisted with included:
Protiviti helped the organization identify potential revenue opportunities within the billing function. Protiviti used data analytics to quantify outliers and select high-risk targeted accounts and performed sample-based testing to confirm instances where the billed amount was less than the contracted rate.
In addition, Protiviti performed an assessment of select billing and collection practices with a primary focus on compliance. An operational and analytical review was also performed of the denials management program inclusive of identification, tracking, classification, root causation and resolution of denials incurred. Specific areas of review included collection follow-up protocols, timeframes and correspondence; medical necessity, clinical and coding denials, and appeals processes; and credit balance resolution and government overpayments.
Protiviti performed a compliance review of drug diversion prevention and detection processes, billing for drug waste with the JW modifier, and controlled substance prescribing practices at three select facilities within the organization’s system.
The organization also asked Protiviti’s compliance practice to review select Centers for Medicare & Medicaid Services’ (CMS) conditions of participation (CoPs). Protiviti reviewed the organization’s policies, procedures and practices for adherence to select, targeted components of the current CMS CoPs for hospitals and provided feedback on opportunities to align with CMS’ CoP stipulations more optimally.
Protiviti assisted with several projects, including a payment card industry (PCI) program review, which included an assessment of the reasonableness of oversight programs and associated processes in place for complying with the PCI Data Security Standard (DSS). Protiviti also performed external penetration testing to assess vulnerabilities within the organization’s cybersecurity environment. The scope of the penetration testing included the identification, analysis and exploitation of select vulnerabilities to demonstrate potential impacts, along with the use of web application testing, password attacks and social engineering techniques to determine areas that may be exploited by an attacker.
Protiviti supported the organization with a review of its current processes for compliance with regulations under section 501(r) for tax-exempt hospitals, including the system’s community health needs assessment, financial assistance policy, determination of amounts generally billed and uninsured collection efforts.
The organization continues to rely on Protiviti as its trusted risk management partner to tackle several projects every year, including:
Starting with an initial internal audit program assessment, this healthcare provider is now characterized by a risk-based approach for audit and compliance, better corporate governance, and enhanced subject-matter expertise. The organization partners with Protiviti on a recurring basis not only for internal audit assistance but also for compliance audit assistance, an area of opportunity uncovered in the initial comprehensive internal audit program assessment. Through this collaboration, the organization has completed several high-priority risk management projects and significantly raised the maturity of its compliance function.
More importantly, the organization has gained a trusted adviser in Protiviti — an invaluable relationship in an industry characterized by constant regulatory pressure and change. Together, the two organizations are working hand-in- hand to deliver the world-class internal audit and compliance services that the CEO envisioned.