510 Internal Audit, Risk In Behavioral Health

3/14/2019HCCA Compliance InstituteApril 7-10, 2019Boston, MAInternal Audit’s &Corporate Compliance’sRole in AddressingEnterprise Risk –Behavioral Health ServicesLorrie Oelkers Ghose, CPAChief Audit ExecutiveKimberly Jordan, CHCChief Compliance OfficerAgenda Fairview Health Services Risks / Challenges in Behavioral Health Enterprise Risk Identification Risk Assessment Enterprise Risk Management Role of Internal Audit and Corporate Compliance in Risk Mitigation Activities Executive Oversight Committee Areas of Focus Other Audit Activity Risk Dashboard Ongoing Monitoring – Sustaining Change Governance – Audit and Compliance Committee of the Board of Directors Tools Questions/Answers21

3/14/2019Our Health SystemFairview Health Services University of MN Academic Affiliation33,000 Employees5,000 System Providers12 hospitals and medical centers2,140 staffed beds56 primary care clinics100 specialties70 senior housing facilities40 retail pharmacies327,000 health plan membersBehavioral Health Services 3370 beds12,448 Inpatient Cases Annually42,500 Outpatient Encounters Annually15,528 Outpatient Chemical Dependency CasesAnnuallyAbout Fairview Health ServicesBehavioral Health Services Programs Behavioral HealthHome Services Adult Mental Health Inpatient Care Outpatient Care Senior TreatmentPrograms Young AdultMental HealthServices Adolescent SubstanceUse Disorder / DualDiagnosis Program Compulsive GamblingProgram4 Adult Substance UsePrograms OutpatientTreatment Program Inpatient TreatmentProgram Lodging PlusResidentialProgram Prenatal SubstanceUse DisorderProgram Child Adolescent MentalHealth Children’s DayTherapy Program Inpatient CareAbout Fairview Health Services2

3/14/2019Behavioral Health Services – Risks & Challenges Increasing need (depression, opioid epidemic) Decreasing availability / Inadequate capacity Difficult population Inadequate funding and insurance coverage / Financial risk to providers Quality of care / Variation of practice Staffing shortages Research challenges Billing compliance Violence / Harm to patients, staff and visitors Increased regulatory oversight5Behavioral Health Services: National Crisis3

3/14/2019Behavioral Health Services: National CrisisBehavioral Health Services – Local NewsSexual Assault of Patient byAnother PatientMental Health Patient Rights ViolationsStaff Injured by PatientPatient ElopementsOveruse of Restraints/SeclusionsUse of Ketamine without Patient ConsentImproper Research Consenting of Mental Health Patient84

3/14/2019Risk Assessment – Identifying & Assessing RisksDrives Annual Work Plan / Identified Risks Considered in ERM ExerciseInternal Audit & Corporate Compliance Annual Risk Assessment Process Conduct interviews with executive leadership, management and other stakeholdersacross the enterprise. Survey all members of the management team as well as 20% of non-management staffacross the Fairview enterprise. Evaluate results of prior audit and compliance projects. Evaluate the impact of the current financial, operational and regulatory environmentrelated to Fairview’s key initiatives. Consider top healthcare risks identified by industry experts (e.g. Crowe Horwath, CHANHealthcare, Deloitte) and government and other regulators (e.g. CMS, Department ofHealth and Human Services, Joint Commission, Office of Inspector General).9Tool – Risk Assessment SurveyManagementResponse RateIn your opinion, does the organization demonstrate a commitment toits core values: Dignity, Integrity, Service, Compassion, andInnovation? Yes Employee201920182019201841%46%25%23%96%95%90%90%In your opinion, does leadership demonstrate integrity and ethicalbehavior? Yes Are you aware that the organization has an anonymous reportingtool (hotline) available for all employees, vendors, patients andothers to report ethical or regulatory infractions and other concerns(Compliance Reporting Hotline)? Yes Do you believe you can report a concern without fearing retaliation?Yes Do you know where to find policies and procedures to guide yourwork? Yes Are you confident that the data you utilize to perform your work areaccurate and reliable? Yes How would you rate the organization’s culture of accountability on ascale of 1-5 (with 5 stars being highly accountable)?105

3/14/2019Enterprise Risk Management –Identifying Strategic & Enterprise Risks Highest risks and concerns / risk statements are requested from executive leadership. Internal Audit and Compliance facilitate exercise with executive leadership and boardmembers to pare down risks by determining impact, likelihood and velocity. Risks arethen categorized as strategic or enterprise risks. Strategic risks – risks which, if realized, would prevent the organization fromachieving its strategic initiatives and goals. Enterprise risks – risks for which redundant oversight and leadership is appropriatefor some period of time until risk is mitigated to a point where it can be managedlocally. Accountable executive owners are assigned to Strategic and Enterprise risks. Accountable executive owners and their designees are responsible for developinginterventions to mitigate risks. Status of mitigation activities is reported bi-weekly at Strategic Management Teammeetings. Results of mitigation efforts are reported to the Audit and Compliance Committee of theBoard of Directors in June and December.11Tool – Enterprise Risk ManagementImpact: The financial or business impact if the adverse event were to occur.5: Catastrophic Event with a financial impact greater than 100 Million. Significant downgrade in debt. Major enforcement action. Disqualification from participation in government reimbursement program.4: Major Event with a financial impact between 50 and 100 Million. Major adverse events with negative publicity (e.g. infant abduction)3: Significant Event with a financial impact between 25 and 50 Million. Adverse events with high reputational impact (e.g. workplace violence)2: Minor Event with a financial impact between 2 and 25 Million. Published malpractice claim.1: Insignificant Event with a financial impact less than 2 Million.Likelihood: The probability of occurrence given controls in place.5: Almost Certain Event will occur in most circumstances; 90% or more of the time (e.g. snow in MN in January)4: Likely Event should occur; more than 50% probability and up to 90% certainty (e.g. snow in MN in December)3: Moderate Event will probably occur; more than 25% and up to 50% probability (e.g. snow in MN in November)2: Unlikely Event could occur; more than 5% up to 25% probability (e.g. snow in MN in October)1: Rare Event would occur only in exceptional circumstances; 5% probability (e.g. snow in MN in September)Velocity: The speed of onset of the event, should it occur.5: Immediate Very Rapid onset; little or no warning, instantaneous4: Fast Quick onset; several weeks or months to occur3: Moderate Moderate onset; between 6-12 months to occur2: Slow Slow onset; between 13 and 18 months to occur1: Prolonged Very slow; 18 months to occur126

3/14/2019Tool – Enterprise Risk sk IndicatorsStatus ofRiskRiskTrend MitigationPlanRiskRiskTolerance LevelLowRisk DefinitionScoreImpactXLikelihood VelocityCommentsFailure to ensure safety ofbehavioral patients andstaff leads to unacceptablereputational and financialrisk.16National risk trend increasing with regard tosubstance use/abuse and dual diagnosesOversight of Behavioral Health Enterprise Risk –Executive Oversight Committee Purpose – identify and address areas of risk in the Behavioral Health service line;demonstrate appropriate redundant oversight until risk is sufficiently mitigated. Committee Membership Chief Operating Officer, Chair Chief Audit Executive Chief Compliance Officer Chief Nursing Executive Chief Medical Officer Chief Legal Officer Service Line Executives Clinical and Administrative Behavioral Health Leadership Regulatory Response Director Facilities / Security Executive Human Resources Leadership Meeting Cadence Initially every two weeks, changed to monthly147

3/14/2019Oversight of Behavioral Health Enterprise Risk –Executive Oversight CommitteeMeeting Expectations / Ideal Behaviors Honest and constructive discussion is necessary to resolve issues. Have the courage to speak up and challenge things that need to be challenged. No “meetings after the meeting.” Challenge hypotheses. Support resolution with data. Seek to understand. Be prepared. Be transparent, honest and forthcoming. Be willing to discuss the difficult issues. Be open to change. Acknowledge an recognize the value of dissension; work towards agreement.15Oversight of Behavioral Health Enterprise Risk –Executive Oversight Committee Assessment History Multiple Internal Audit Reviews Compliance Coding and Provider Documentation Review Issues Reported to Compliance Office Focus / Priorities Address Open Internal Audit and Compliance Findings Incorporate Auditing / Monitoring Activities in Other Audits Report on Areas of High Risk – Monitoring and Auditing Activities168

3/14/2019Oversight of Behavioral Health Enterprise Risk –Areas of Focus Restraints/seclusionStaffing, including Physician CoverageLeadership CommunicationHealing Milieu / Care ModelEMR DocumentationScope of Practice – Face to Face AssessmentsUse of Occupational TherapistsPhysical Environment Ligature Risks Safety Patient Elopement17Incorporate Risks in “Other” Audits189

3/14/2019Tool – Risk DashboardRisk DashboardDefinition:Process/risk owner:BHS Service Line ExecutiveRiskCategoryRoot Causes / Risk DriversBoard governance:Audit CommitteeMitigation action plansLigature Risk AssessmentLigature RiskLigature Risk Remediation(Pediatrics)Nurse Staffing RatiosPatient SuicideBehavioral1:1Management governance:BHS Executive Oversight CommitteeExecutive Compliance Risk and Control CommitteeTargetDateProject%Status CompleteKey accomplishments/challenges Completed Assessment of AdultUnit Completed Assessment ofPediatric Unit Created Standard Roles Obtained Budget approval foradditional FTEsPatient elopementEgress Point Control Trained all staff in elopementriskPatient/Staff ViolenceNurse Call System Completed System RiskAssessment Identified areas of focusedtrainingSample Ongoing Monitoring Activity –Restraints / Seclusion20About Fairview Health Services10

3/14/2019Governance – Audit & Compliance Committeeof the Board of DirectorsUpdates on Behavioral Health Services Internal Audit Activity Compliance Audit Activity Compliance Hotline Reports Areas of Particular ConcernEnterprise Risk Management Updates Bi-Annual End of Year Close-out of ERM Risk or Carry Forward for Consideration for NextYear Risk Inventory21About Fairview Health ServicesTools Heat Map Risk Tolerance Guiding Principles Operational Action Plan Ligature Risk Requirements ChecklistPlease note that additional tools are embedded in the presentation: Risk Assessment Survey – slide 10 Enterprise Risk Management – slides 12, 13 Risk Dashboard – slide 192211