GAO-07-79, HOSPITAL ACCREDITATION: Joint Commission On Accreditation Of .

organizations to prevent conflicts of interest and sharing of facilityspecific information.7 For example, the firewall is intended to prevent JCRfrom sharing the names of its hospital clients with the Joint Commission.You asked us to provide information on the relationship between the JointCommission and JCR as it relates to the hospital accreditation process. Inthis report, we describe (1) how the Joint Commission and JCR are relatedto one another through their governance structure and operations, and(2) the significant steps both organizations have taken to prevent theimproper sharing of facility-specific information, obtained through theirhospital accreditation and consulting activities, since the creation of JCR.To describe the relationship between the Joint Commission and JCR,specifically as it pertains to their governance structure and operations, weinterviewed senior staff at both organizations, including the President ofthe Joint Commission and the individual who serves as both President andChief Executive Officer (CEO) of JCR. We also interviewed boardmembers from the Joint Commission and JCR and reviewed documentsfrom both organizations, including documents related to the organizations’financial relationship.8 Further, we interviewed staff at CMS to obtaininformation on their oversight of the Joint Commission and otheraccreditation organizations, and reviewed reports CMS provides toCongress related to its validation surveys of Joint Commission accreditedhospitals. To further our understanding of issues related to organizationalgovernance, conflicts of interest, and independence standards, weinterviewed officials from both the private and public sector9 and reviewedpertinent documents.To provide information on the significant steps taken by the JointCommission and JCR since JCR’s creation to prevent the improper sharing7For the purposes of this report, when we refer to facility-specific information, we arereferring to information on hospital facilities only. The Joint Commission’s status in statuteas an approved accreditation organization for Medicare purposes extends only to hospitals.Therefore we excluded other types of facilities accredited by the Joint Commission fromour work.8We excluded Joint Commission International, a division of JCR that provides consultingand accreditation services to foreign health care facilities, from the scope of our workbecause these facilities are not eligible to participate in the Medicare program.9Among others, we spoke with officials at the United States Department of Education, theCouncil on Higher Education Accreditation, Independent Sector, and the National Centerfor Nonprofit Enterprise.Page 3GAO-07-79 Joint Commission and Its Affiliate

of facility-specific information, we reviewed relevant policies developedby the two organizations. We reviewed versions of the firewall and relatedpolicies issued between 1987 and 2006 and interviewed senior staff withresponsibility for this area, including the person who serves as theCorporate Compliance and Privacy Officer (Compliance Officer) for bothorganizations. We also conducted interviews with staff members at eachorganization to obtain information on their understanding of the firewalland related policies and guidelines, their training on these policies andguidelines, and their awareness of possible firewall violations. In addition,to learn about JCR’s clients’ understanding of the relationship betweenJCR and the Joint Commission, we conducted interviews with statehospital associations that, as of May 2006, used JCR’s consulting services,and hospitals that used these services during calendar year 2005. We alsoconducted interviews with state hospital associations that had not usedJCR’s consulting services as of May 2006 to learn more about their reasonsfor not doing so. The information provided from our interviews with staff,state hospital associations, and hospitals reflects the comments of thosewe interviewed and cannot be generalized to all Joint Commission andJCR staff or all state hospital associations and hospitals using JCRconsulting services. (For additional information on our methodology, seeapp. I.)We conducted our work from October 2005 to December 2006, inaccordance with generally accepted government auditing standards.Results in BriefAlthough the Joint Commission and JCR provide different types ofservices to health care organizations, they remain closely related to oneanother in their efforts to achieve their similarly stated missions. Theirclose relationship is demonstrated through both their governancestructure and operations. The Joint Commission has substantial controlover JCR through powers provided in JCR’s bylaws as well as throughJoint Commission commissioners that also serve on JCR’s board. Inaddition, the two organizations provide various operational services to oneanother.The Joint Commission and JCR have taken steps designed to prevent theimproper sharing of facility-specific information obtained from theiraccreditation or consulting activities. In 1987, shortly after the creation ofJCR, the organizations developed initial firewall guidance. Beginning in2003, both organizations began taking additional steps designed toenhance the firewall guidance. They have also implemented additionalpolicies and guidance designed to further strengthen the firewall betweenPage 4GAO-07-79 Joint Commission and Its Affiliate

the two organizations. Both the Joint Commission and JCR reportproviding training to staff on these policies, and have developedmechanisms to allow staff to report possible firewall violations. They bothhave also taken steps, primarily since 2003, to strengthen the oversight ofthe implementation of, and compliance with, the firewall and relatedpolicies.Ensuring the independence of the Joint Commission’s accreditationprocess is vitally important. To ensure that the firewall and othermechanisms instituted are sufficient to prevent the improper sharing offacility-specific information, it would be prudent for the Joint Commissionand JCR to continue to assess these mechanisms and monitor theirimplementation.The Joint Commission agreed with our concluding observations andemphasized that its highest priority is to preserve the integrity of itsaccreditation process. CMS did not comment on our findings orconcluding observations.BackgroundThe Joint Commission, a nonprofit organization founded in 1951, wascreated to provide voluntary health care accreditation for hospitals. All butone of the Joint Commission’s founding members continued to serve on itsBoard of Commissioners as of October 2006, including the AmericanHospital Association and the American College of Surgeons.10 Thestandards established by the Joint Commission address a facility’s level ofperformance in areas such as patient rights, patient treatment, andinfection control. To determine whether a facility is in compliance withthose standards, the Joint Commission conducts on-site evaluations offacilities, called accreditation surveys. The Joint Commission recognizes afacility’s compliance with its standards by issuing a certificate ofaccreditation, which is valid for a 3-year period. In 2004, the JointCommission implemented a new accreditation process in an effort toencourage hospitals to focus on continuous quality improvement, ratherthan survey preparation. Previously, facilities were told in advance whenJoint Commission surveyors would conduct their evaluations. As a part of10The other founding members of the Joint Commission were the American College ofPhysicians, the American Medical Association, and the Canadian Medical Association. In1959, the Canadian Medical Association withdrew to form its own accreditation body inCanada. The American Dental Association joined the Joint Commission as a member in1979.Page 5GAO-07-79 Joint Commission and Its Affiliate

the new process, the Joint Commission began conducting unannouncedsurveys.11 The Joint Commission employs over 900 staff members,including approximately 200 hospital surveyors from a range ofdisciplines—such as physicians, nurses, and hospital administrators—whoconduct the accreditation surveys. In 2005, the Joint Commissionaccredited approximately 4,300 hospitals.The Joint Commission established JCR to provide consultative technicalassistance to health care organizations seeking Joint Commissionaccreditation. (See fig. 1.) JCR is governed by a Board of Directors andemploys approximately 180 staff members, including consultants locatedthroughout the country. In 2000, the Joint Commission expanded JCR’srole beyond consulting to include all educational services, such asseminars and audio conferences, which the Joint Commission previouslyprovided. (See app. II for a timeline of key developments in the JointCommission and JCR relationship.) JCR also became the official publisherof the Joint Commission’s accreditation manuals and support materials.JCR offers consulting services either independently to health care facilitiesor through a subscription-based service called the Continuous ServiceReadiness (CSR) program, which is typically offered in partnership withstate hospital associations.12 The CSR program provides ongoing technicalassistance and education to subscribers through a variety of means,including meetings, e-mails, telephone calls, and conferences.11Organizations volunteered for unannounced surveys in 2004 and 2005, and all surveys(with certain exceptions, such as prison hospitals) became unannounced effectiveJanuary 1, 2006.12Previously housed at the Joint Commission, the CSR program was also transferred to JCRin 2000. JCR also expanded its services to include international accreditation activitiesthrough Joint Commission International, which is a division of JCR that providesconsulting and accreditation services to foreign health care facilities. The activities of JointCommission International are beyond the scope of this work.Page 6GAO-07-79 Joint Commission and Its Affiliate

Figure 1: Relationship between the Joint Commission, JCR, and Hospitals4,365 hospitals (2005)JCRll PolicFirewaThe Joint Commission is anonprofit corporation responsible forsetting standards that hospitals mustmeet to receive their accreditation,conducting surveys to determinecompliance with those standards,and issuing certificates ofaccreditation, which arevalid for a 3-yearperiod.iesJoint CommissionJCR is a nonprofit,controlled affiliate of theJoint Commission thatprovides health care facilitieswith consultative andeducational assistance.903 hospital clients (2005)Joint Commission accreditation decisionJCR consultation and educationSource: GAO analysis of Joint Commission and JCR documents and interviews.In 2004, we reported that CMS’s oversight of the Joint Commissionhospital accreditation process is limited. Although it conducts on-sitevalidation surveys of a sample of Joint Commission-accredited hospitals,the agency cannot restrict or remove the Joint Commission’s accreditationauthority if it detects problems.13 CMS reported that the agency and the13In our 2004 report, we suggested that Congress consider giving CMS the authority overthe Joint Commission’s hospital accreditation program that it has over other accreditationprograms. We also recommended that CMS modify its methods for assessing the JointCommission’s performance. For more information, see GAO, Medicare: CMS NeedsAdditional Authority to Adequately Oversee Patient Safety in Hospitals, GAO-04-850(Washington, D.C.: July 20, 2004).Page 7GAO-07-79 Joint Commission and Its Affiliate

Joint Commission engage in ongoing dialogue to identify potential hospitalaccreditation performance issues. In addition, CMS provides an annualreport of its findings to Congress. Unlike the Joint Commission, JCR is notsubject to any oversight by CMS.When developing policies regarding its relationship with JCR, the JointCommission has been affected by the increased focus in both the publicand private sectors on governance issues. The Sarbanes-Oxley Act of2002,14 passed in response to corporate and accounting scandals, requiredpublicly traded companies to follow new governance standards, includingthose designed to ensure auditors’ independence from their clients. Eventhough most provisions of the Sarbanes-Oxley Act are not applicable tononprofit organizations, activities that have occurred in the wake of theact have affected nonprofits. For example, several state legislatures areconsidering legislation that applies standards similar to the SarbanesOxley requirements to nonprofit organizations. In addition, some nonprofitorganizations, such as the Joint Commission, have voluntarily adoptedpolicies and altered governance practices based upon the act.Organizations in the public and private sectors have also begun to institutecompliance programs15 and those that provide accreditation orcertification services have developed standards to ensure theindependence of these services. Compliance programs for health careorganizations—such as hospitals, home health agencies, and medicalsupply companies—have used provisions of the federal SentencingGuidelines,16 developed in 1991, as a program model. These guidelines layout two common principles of adequate compliance programs—to preventand detect criminal conduct, and to promote an organizational culture ofethics and compliance with the law. In 1998, the HHS Office of Inspector14Pub. L. No. 107-204, 116 Stat. 745.15Compliance programs are designed to encourage the development and use of internalcontrols to monitor adherence to applicable statutes, regulations, and programrequirements.16Federal Sentencing Guidelines have been developed both for individuals and fororganizations. The Sentencing Guidelines for organizations provide for reduced sentencesfor federal crimes if the organization demonstrates adherence to certain elements thatdemonstrate an effective compliance program.Page 8GAO-07-79 Joint Commission and Its Affiliate

General developed a model compliance program for hospitals.17 Regardingindependence standards, organizations that provide accreditation orcertification, or recognize accreditation bodies, have begun to imposecertain criteria to demonstrate independence. For example, theDepartment of Education developed criteria for educational accreditingbodies that are designed to ensure that those organizations grantingaccreditation are not improperly influenced by related trade ormembership associations.The Joint CommissionHas a CloseRelationship with JCRthrough TheirGovernance Structureand OperationsThe mission statements of the Joint Commission and JCR both share thesame phrase of seeking “to continuously improve the safety and quality ofcare.” While each organization differs in the activities it engages in toachieve that mission, they maintain a close relationship through both theirgovernance structure and operations. The Joint Commission hassubstantial control over the governance of JCR through the powersretained by the Joint Commission in JCR’s bylaws as well as through theJoint Commission’s representation on JCR’s Board of Directors. Inaddition, JCR manages all Joint Commission publications and educationalactivities, while the Joint Commission provides various support servicesand some management oversight to JCR.The Joint Commission HasSubstantial Control overJCR through ItsGovernance AuthorityThe Joint Commission has substantial control over the governance of itsaffiliate, JCR. In 2003, the Joint Commission undertook a major review ofthe structural, operational, and legal aspects of its relationship with JCR inan effort to address any real or perceived conflict-of-interest issues. Thisreview led to the restructuring of JCR through revisions to JCR’s bylaws,which govern the internal affairs of the organization, and resulted inchanges to the composition of JCR’s board and the appointment of boardofficers. In particular, after the restructuring the Joint Commission nolonger retained a majority on the JCR board through board members whoserved on the boards of both organizations. However, through changes to17The HHS Office of Inspector General Compliance Program Guidance for Hospitals isintended to help health care facilities promote adherence with laws and regulations, as wellas with ethical and business policies. This guidance recommends the inclusion of severalelements in a compliance program, such as the development of written policies andprocedures, a compliance officer and compliance council, a hotline for staff to reportviolations, and ongoing staff training. While these guidelines were not developed foraccreditation bodies, the Joint Commission used this framework when developing itscompliance program.Page 9GAO-07-79 Joint Commission and Its Affiliate

JCR’s bylaws, the Joint Commission maintained control over JCR byreserving powers that would otherwise have been exercised by JCR.The 2003 restructuring of JCR allowed the Joint Commission to effectivelymaintain control over JCR by implementing a change in the “corporatemembership” of JCR. Similar to for-profit entities that may havestockholders, nonprofit corporations may have corporate members who,in general, are responsible for major organizational decisions, such aselecting the corporation’s board.18 If a nonprofit corporation does not haveany members, the corporation’s board of directors holds decision-makingauthority.19 With the restructuring of JCR, the Joint Commission becamethe “sole member” of JCR.The sole member has the ability to exercise substantial control over theaffiliate through its “reserved powers”—powers that would otherwise beexercised by the affiliate board, if the sole member did not reserve themfor itself. When the Joint Commission became the sole member of JCR, itsreserved powers included those previously held and a number ofadditional powers, as shown in table 1.20 A practicing attorney withexpertise in transactions involving nonprofit health care organizations andwho has served as external counsel for the Joint Commission considersthis structure necessary to enable the parent to protect itself from thepossibility of the affiliate acting against the parent’s interests. However, anarticle published in a law journal cautions that this structure allows theparent to make decisions solely in its own interest without considering theimpact on the affiliate.2118See, e.g., 12A Fletcher Cyclopedia Corporations § 5687 (Perm. Ed.).19The laws related to the organization of nonprofit corporations may vary by state. Both theJoint Commission and JCR were organized under the laws of the State of Illinois and aresubject to its laws. See 805 ILCS 105/107.03 (f)(2004).20The bylaws of JCR indicate that the sole member shall have the reserve powers listed inthe bylaws in lieu of reserve powers that would be otherwise provided by applicablestatute.21See Dana Brakman Reiser, “Decision-Makers Without Duties: Defining the Duties ofParent Corporations Acting as Sole Corporate Members in Nonprofit Health Care Systems,”Rutgers L. Rev. 53 (2001): 991.Page 10GAO-07-79 Joint Commission and Its Affiliate

Table 1: Joint Commission’s Powers Over JCR Enumerated in JCR BylawsJoint Commission’s powers in JCRJoint Commission’s powers added to JCRbylaws before 2003 restructuringbylaws as a result of 2003 restructuring Appoint JCR directors Appoint JCR board vice chairman andPresident/CEO Remove JCR directors, with or without Remove JCR board chairman, vicecause, by a two-thirds votechairman, and President/CEO, with or Appoint the JCR board chairmanwithout cause Approve amendments to JCR articles Amend JCR articles of incorporation andof incorporation and bylawsbylaws Approve JCR’s mission s

Joint Commission on Accreditation of Healthcare Organizations' Relationship with Its Affiliate December 2006 GAO-07-79 . . to help facilities comply with the Joint Commission's accreditation standards. While JCR is a separate entity legally from the Joint Commission, the organizations are related corporate entities. .