Report: 25 top management risks for healthcare in 2023

Clinical risks

Behavioral health

Interest in behavioral healthcare has grown tremendously over the past three years with the onset of the COVID-19 pandemic and its devastating impact on the mental health of adults and children alike. Providers also are expanding their behavioral health services as they expand their whole-person approach to patient care in recognition of the inextricable link between mental health and physical health. As part of that whole-person approach, providers are conducting more screenings for behavioral health issues as part of physical health assessments. Behavioral health issues are more nebulous and abstract than physical illnesses or injuries and, therefore, are harder to detect and diagnose until an acute episode flares up.

Behavioral health risks include:

• Inaccurate or unperformed suicide risk and mental health screenings on all patients served resulting in missed diagnoses and/or harm to the patient
• Staff untrained or improperly trained on de-escalation and workplace violence prevention techniques when dealing with aggressive or violent patients resulting in serious harm to staff, harm to patients, and an unsafe work environment
• Improper use of restraints and documentation of the use of restraints and seclusion in an inpatient behavioral health setting resulting in harm to patients, staff, and the organization’s reputation and accreditation
• Inadequate ligature risk identification and routine assessments of ligature risks in an emergency department (ED) or inpatient behavioral health setting resulting in patient self-harm
• Limited behavioral health treatment facilities resulting in patients unnecessarily remaining in the ED for extended periods of time going untreated

Audits for consideration to mitigate behavioral health risks

• Patient suicide and mental health screening processes
• Workplace violence prevention and de-escalation education processes
• Restraints and seclusion compliance assessment
• Ligature risk assessment of the inpatient behavior health settings and ED

How audit and compliance professionals can use technology to expand behavioral health risk coverage

• Analyze electronic medical records (EMRs) for populated suicide scale flow sheets and documentation.

Patient safety

An eye-opening study published earlier this year in the New England Journal of Medicine suggests that nearly one in four patients suffers an adverse event after being admitted to the hospital.¹  Previously, in a ground-breaking study, patient safety experts from Johns Hopkins Medicine estimated that medical errors are the third leading cause of death in the U.S., following only heart disease and cancer.²

These stark figures exist despite many years of increased regulatory scrutiny, automation, and focus on preventable errors. Medical errors run contrary to the primary objective of hospitals and health systems to improve the patient experience, including quality, safety, and satisfaction. Despite the universality of healing as a health system goal, many hospital and health system internal auditors do not discuss clinical risks during their risk assessment discussions. Therefore, many internal audit functions do not include any clinical audits on their annual audit plans.

Errors that result in patient harm can occur in almost any area of a hospital or health system, from an emergency department visit to discharge and transition to post-acute care.

Some of the most common patient safety risks are:

• Clinicians causing adverse drug effects by administering the wrong medication to the right patient, the wrong dose of medication to the right patient, or the right medication to the wrong patient, all of which can cause patient injury or death
• Missing or incomplete medication histories and reconciliations causing a clinician to administer a drug that’s contraindicated
• Clinicians performing the right surgical or other procedure on the wrong patient or the wrong procedure on the right patient, again resulting in patient injury or death
• Not identifying and mitigating the three main components of the fire triangle (fuel source, oxidizer, and ignition source) causing surgical fires in or around the patient
• Caregivers failing to perform a standardized assessment of fall risk factors, so that appropriate precautions are missed, resulting in preventable patient injury from a fall event
• Caregivers failing to implement other risk-reduction strategies such as skin monitoring, improving patient mobility, repositioning patients in bed, and optimizing nutrition, resulting in avoidable hospital-acquired pressure injuries
• Caregivers overlooking or omitting infection prevention precautions, exposing patients or caregivers to a variety of infections, including methicillin‐resistant Staphylococcus aureus, catheter-associated urinary tract infections, surgical site infections, ventilator-associated pneumonia, clostridium difficile infections, or sepsis

Audits for consideration to mitigate patient safety risks

• Medication reconciliation/medication administration
• Surgical safety, including retained surgical Instruments and surgical fires
• Device sterilization, device disinfection, sterile processing department, surgical suite disinfection
• Personal protective equipment (PPE) utilization
• Falls, hospital-acquired pressure ulcers
• Healthcare-associated infection

How audit and compliance professionals can use technology to expand patient safety risk coverage

• Perform ongoing analysis of claims data to identify patient safety events for testing.
• Test full populations of established monitoring or control points in medical records to identify gaps.
• Use control assessment tools to quickly identify and summarize the presence or absence of desired clinical interventions across multiple locations.

Pharmaceuticals: Opioids

The ongoing opioid crisis continues to reshape hospitals’ opioid stewardship programs. Although opioid prescribing continues a downward trend, opioid overdosing and deaths continue to increase, according to government and industry research. As a result, hospitals must redesign opioid stewardship programs into more multifaceted community collaboration efforts to fight the current opioid crisis. The crisis spans opioid use disorders (OUD), substance abuse disorders (SUD) with or without comorbid mental health illness or disorders, illegal and illicit drug use, and overdoses.

With approximately $50 billion of manufacturer, distributor, and retailer opioid settlement funds already flowing into states, hospitals will see even more focus on opioid abatement remediation strategies. Many of these strategies target prevention, treatment, and services for OUD/SUD patients.

Risks include:

• Noncompliance with regulatory, industry, and evidence-based practices for proper opioid prescribing and OUD/SUD treatment and services resulting in patient harm and patient addiction

Audits for consideration to mitigate opioid prevention, prescribing, and treatment risks

• Assessment of the hospital’s opioid stewardship program

How audit and compliance professionals can use technology to expand opioid stewardship risk coverage

• Use data analytics to compare 100% of opioid prescriptions with evidence-based prescribing practices and guidelines.
• Use data analytics to evaluate OUD/SUD patients to determine the extent of early intervention protocols used.

Supply chain

A May 2022 Forbes article, “Supply-Chain Snags Create Shortages of Lifesaving Medical Supplies in U.S.,” noted, “The U.S. healthcare system is facing supply shortages that dwarf the problems experienced in the early days of the COVID-19 pandemic . . .” due to “component scarcities, backlogged ports, transportation glitches, and lockdowns in China.” The article went on to say that while current supply chain shortages might not be as urgent as they were during the pandemic, they include a much wider array of equipment that ranges from latex and vinyl examination gloves to dialysis-related products and pharmaceuticals.

Further, a February 2023 Becker’s Hospital Review article, “Shot-Down Chinese Balloon May Affect US Medical Supply Chain,” said after the downing of a “high-altitude object” and confirmation that the object was a Chinese spy balloon, “it’s unclear what these actions mean for the U.S.-China medical supply chain.”

And a brief in the American Journal of Managed Care cited a report from the Scrip Pharma Intelligence website that said, “FDA inspections of Chinese manufacturing plants were suspended during COVID lockdowns and the political fallout from the balloon incident may delay their resumption, even though China has ended its zero-COVID policy. The United States relies on overseas drug manufacturing, with 18 of 21 vital antibiotics and 72% of its active drug ingredients coming from abroad.”

These dynamics are pulling apart the healthcare supply chain and creating specific risks for hospitals and health systems, including:

• Insufficient critical equipment and supplies resulting in potential negative impact to operations and patient care
• Inadequate emergency preparedness or supply chain instability resulting in negative patient outcomes and increased reputational risk
• Bypassing existing procurement processes and controls to obtain critical equipment or materials in short supply resulting in increased risk of overpayment or vendor fraud

Audits for consideration to mitigate supply chain risks

• Supply chain resiliency
• Supplier procurement and diversification program effectiveness
• Supply chain emergency preparedness
• Critical equipment and supplies inventory management

How audit and compliance professionals can use technology to expand supply chain risk coverage

• Analyze critical equipment and supply inventory levels to identify potential high-risk shortages and outages.
• Analyze procurement transactions to identify potential supplier diversification or geographic/geopolitical vulnerability issues.
• Analyze supplier selection data and procurement transactions for indications of potential overpayment or fraud.

Telemetry monitoring

Telemetry monitoring is the use of remote cardiac monitoring devices to detect arrhythmias in patients outside of critical care units. Telemetry monitoring gives providers real-time measurements of monitored physiologic parameters from a distance. Breakdowns in technology and clinical response time increase the risk of patient harm by disrupting or interrupting identification of critical and abnormal changes in a patient’s cardiac health. Also, the use of telemetry can lead to alarm fatigue and nonaction, both of which distract from care and jeopardize patient safety.

In 2017, the American Heart Association revised its evidence-based standards to guide providers on appropriate telemetry use based on patient diagnosis. Primary interventions to decrease telemetry use include staff education, developing discontinuation criteria, integrating telemetry orders into daily communications, and hardwiring standards into the organization’s ordering practices. Internal audit and compliance professionals can be a valuable resource to provide an independent assessment of the organization’s risk mitigation efforts and alignment with industry standards.

Specific risks in this area include:

• Monitoring equipment not connected to patients as ordered by the provider resulting in the wrong patient being connected to a specific telemetry box or a delay in connecting a patient to telemetry
• Communication breakdown between monitor watchers and frontline staff resulting in improper escalation notification
• Lack of vendor support or lack of adequate transmission bandwidth within all areas of facilities resulting in infrastructure breakdowns, equipment malfunctions, and failures of end-of-life systems
• Lack of daily re-assessment of the need for telemetry leading to overuse

• Telemetry monitoring – patient safety (clinical- and IT-focused)
• Telemetry utilization assessment

• Use data analytics to analyze trends in telemetry initiation and daily usage by specialty of ordering physician and average duration of telemetry monitoring.

Financial and operational risks

Accounts payable processing fraud

Key business processes such as accounts payable (AP) are critical to every healthcare organization. While these processes are highly visible and typically well-managed, when significant changes occur within the AP process (for example, leadership or employee turnover or cutbacks) or within the overall organization (for example, changes in operating procedures due to a pandemic, implementation of a new enterprise resource planning system, or organizational consolidation or centralization post-merger), fraud risks might increase due to changes in people, processes, or technology, or suspension or elimination of key internal controls.

Specific risks include:

• Fraudulent or unauthorized payments to existing vendors or employees
• Creation of, and payment to, fictitious vendors
• Inappropriate or unauthorized updates to vendor master data, causing payments to be diverted from the correct vendor

Audits for consideration to mitigate AP processing fraud risks

• Procure-to-pay process audit
• AP and vendor master file system access and general IT controls audit
• Vendor master file change process
• Corporate purchase card audit

How audit and compliance professionals can use technology to expand AP processing fraud risk coverage

• Analyze AP transactions to identify fraudulent payments to employees.
• Analyze payments made to the same bank account for multiple vendors.
• Analyze vendor payments that lack an associated purchase order.
• Analyze vendor payments issued for amounts just under standard approval levels.
• Analyze instances in which vendors were added and removed from the vendor master file immediately before and after payments were made.
• Analyze corporate purchase card transactions for nonbusiness uses.

Community benefit

Due to increased scrutiny of not-for-profit healthcare organizations, proving that hospitals are deserving of their tax-exempt status is more important than ever. Not-for-profit hospitals are required to demonstrate community benefit in many ways, including meeting the “community benefit standard” under IRS Revenue Ruling 69-545 and meeting certain requirements under Section 501(r) of the Affordable Care Act. But those are simply baseline requirements for not-for-profit hospitals. The real focus is how much they are doing in addition to those baseline requirements.

Unflattering media reports and congressional inquiries of how much community benefit and charity care hospitals provide in exchange for their preferential tax treatment are putting pressure on not-for-profit hospitals to differentiate themselves from their for-profit counterparts.

Risks associated with incomplete and inaccurate community benefit reporting include:

• Public scrutiny
• Inquiries from state charity officials and other local officials
• Challenges to property tax exemption, sales tax exemption, and possibly income tax exemption

Audits for consideration to mitigate community benefit reporting risks

• Community benefit calculation accuracy
• Community benefit reporting with a focus on unreported or underreported community benefit activities
• Community benefit policy and procedures review
• Review of environmental, social, and governance reporting that might incorporate community benefit

Inflationary economy

“Everything Everywhere All at Once” won the 2022 Oscar for best picture. The movie wasn’t about myriad challenges facing hospitals and health systems, but it could have been. Challenges such as labor shortages, wage pressures, declining operating margins, new COVID-19 surges, runaway expenses, rising interest rates, bank failures, investment losses, and more continually buffeted hospitals and health systems from all sides in 2022 and during the first quarter of 2023.

As patient volume slowly returns to pre-COVID rates and state and federal COVID relief funds end, rising inflation presents an additional hurdle to providers’ financial health. Entering 2023, hospital and health system management and governance need a full range of resources to counter the ongoing barrage of operating and financial headwinds.

An inflationary economy presents healthcare organizations with specific financial risks, including:

• Deteriorating liquidity metrics leading to credit downgrades
• Uncertain investment returns contributing to deteriorating liquidity
• Slow and unpredictable patient volume recovery
• Intractable labor issues and wage pressures
• Rising supply, pharmaceutical, and equipment costs

To combat the inflationary economy and strengthen operations, healthcare leaders are using some of the following resources and tactics with a focus on performance and margin enhancement:

• Increasing clinical operation efficiencies
• Clinical excellence and value-based payments
• Clinical efficiencies and outcomes
• Improving revenue cycle management performance
• Billing and collections
• Charge capture and clinical documentation improvement
• Increased digital transformation and creating value
• Labor efficiencies
• Increased risk coverage at lower cost
• Identifying cost saving opportunities

Audits for consideration to mitigate inflationary economy risks

• Denials management
• Revenue charge capture
• Procurement (with focus on spend)
• Timekeeping and payroll (with focus on overtime and premium pay)

How audit and compliance professionals can use technology to expand inflationary economy risk coverage

• Use data from organizations’ enterprise resource planning, EMRs, payroll, and other systems to design and roll out automated digital transformation to provide continuous auditing of accounts payable, payroll, general ledger, and supply chain risk areas, which can help reduce risk and identify revenue enhancement and cost saving opportunities.

Pharmaceuticals: Drug diversion and 340B

Drug Enforcement Agency (DEA) regulations can be complex and difficult to understand, and citations involving these regulations can lead to multimillion-dollar settlements for organizations. A DEA audit or inspection also can lead to criminal prosecution and administrative action against a DEA registrant if the agency finds violations of the Controlled Substances Act.

The dispute between safety net hospitals and drug manufacturers over new price limitations by manufacturers on hospitals’ use of the federal 340B Drug Pricing Program is heading into a new phase of legal battles that ensures this fight will remain a dominant issue in the 340B arena for months to come. Furthermore, hospitals’ lack of compliance with 340B Program regulations might result in repayment to drug manufacturers or removal from the program. Also, rapidly rising costs along the pharmaceutical supply chain combined with the complexities of accurately capturing medication charges can contribute to a reduction in revenue and additional compliance risks.

Specific risks for hospitals and health systems include:

• Removal from the 340B Program due to lack of compliance
• DEA monetary penalties and/or criminal prosecution
• Loss of pharmacy revenue
• Patient harm/addiction

Audits for consideration to mitigate drug diversion and 340B Program risks

• 340B Program compliance assessment
• Drug diversion monitoring controls assessment
• Medication billing assessment

How audit and compliance professionals can use technology to expand drug diversion and 340 B Program risk coverage

• Test 100% of critical data elements related to 340B Program compliance.
• Test 100% of critical data elements related to drug diversion monitoring controls.
• Test 100% of medication charges to confirm drugs administered and wasted are accurately billed.

Physician practices

Physician practices provide continuing care in the community and are the primary entry and exit points for many health systems. Although acute care facilities are highly regulated and frequently audited, ambulatory care settings, where processes are often manual, face less regulatory oversight of the operations and processes. In acquired physician practices, medical groups, and ambulatory clinics, lack of staff training, staff turnover, temporary staff, staff shortages, and time pressures can easily derail high-touch processes and can introduce additional unknown risks to a hospital or health system acquirer. Hospitals and health systems must establish “closed loop” processes and workflows to prevent patient harm, avoid liability, and improve quality.

Risks related to physician practices include:

• Missed referrals (for example, to cardiology), resulting in avoidable patient injury or death
• Lost screening results leading to a failure to diagnose or a misdiagnosis of a disease like cancer in time to initiate optimal treatment
• Missing or poorly performed medication reconciliation leading to clinicians concurrently prescribing contraindicated medications
• Unidentified temperature variations within a refrigerator resulting in the need to revaccinate patients and increased risk of reputational damage and legal liability
• Failure by hospitals or health systems to notify primary care physicians of patient admissions, discharges, or transfers resulting in gaps in care

Audits for consideration to mitigate physician practice risks

• New acquisition or pre-acquisition clinical practice assessment
• Diagnostic test and referral management
• Medication management (physical controls and reconciliation)
• Device disinfection (sterilization and/or high-level disinfection)

How audit and compliance professionals can use technology to expand physician practice risk coverage

• Identify diagnostic tests or specialist referrals ordered but not completed.
• Analyze medication reconciliation frequency and completion.

Vendors and business associates

Hospitals and health systems increasingly rely on third-party vendors in a variety of clinical, financial, and operational areas to augment staffing levels and achieve cost savings and increased efficiency. As technology has become increasingly critical to healthcare operations, vendors often require access to key information technology systems and networks. Sophisticated cybercriminal attacks are becoming more frequent, with many ransomware and cyberattacks targeting vendors and vendor systems as an entry point into a provider organization’s IT systems.

Strong contracting and oversight processes for these significant vendor relationships are critical for provider organizations to achieve their business goals and objectives. When an essential vendor fails to perform as expected, operational, financial, compliance, and reputational risks can ripple across the entire enterprise.

Common risks associated with vendor relationships include:

• Inadequate vendor screening and selection procedures
• Overcharging or billing for services not provided
• Failure to meet service, performance, or financial terms in accordance with contract requirements
• Failure to comply with facility policies and standards, resulting in compliance and reputational risks
• Weak privacy and IT security controls for vendors that have access to hospitals’ IT systems and data

Audits to consider for mitigating vendor and business associate risks

• Vendor selection and contracting
• Vendor onboarding, management, and monitoring
• Vendor HIPAA privacy and IT risk assessment
• Business continuity planning with focus on critical vendor services

How audit and compliance professionals can use technology to expand vendor and business associate risk coverage

• Analyze the vendor master file to identify duplicate and incorrect entries.
• Analyze accounts payable transactions to identify duplicate and inaccurate payments to vendors as well as vendor payments that could represent conflicts of interest, particularly for physicians (for example, lack of compliance with the Sunshine Act).
• Analyze vendors’ access to systems to identify excess or inappropriate access.

Workforce

Hospital CEOs’ top concern in 2022 was workforce challenges, according to the 2022 survey of hospital CEO challenges conducted by the American College of Healthcare Executives (ACHE).³  It was the second consecutive year that workforce challenges ranked No. 1 on ACHE’s annual list of hospital CEO worries.

“Hospitals need to take both long- and short-term measures to address critical workforce issues so they can continue to provide safe, high-quality care now and in the future,” said Deborah Bowen, ACHE president and CEO, in a statement accompanying the ranking.

The workforce challenges that healthcare organizations face include recruiting, hiring, and retaining qualified employees as demand for healthcare services increases due to the aging U.S. population and the competition for healthcare workers intensifies. Workers leaving the healthcare sector due to pandemic-related burnout and accelerated retirements have only exacerbated the challenge over the past three years.

One way healthcare organizations have responded is through increased reliance on travel nurses. Some formed their own travel nurse programs in an attempt to limit related costs. Others offered increased benefits or incentives to retain workers. Some of those that couldn’t respond with creative solutions reduced or eliminated services or service lines at select sites of care.

The situation has created a number of specific risks that hospitals and health systems historically have not had to deal with before at such scale.

Those risks include:

• Decreased quality and safety of patient care and clinical outcomes, leading to higher readmission rates, higher hospital-acquired infection rates, and higher mortality rates
• Lower quality scores leading to lower reimbursement rates
• Higher labor costs attributable to higher salary and benefit expenses and travel nurse program expenses resulting in impaired financial performance
• Increased difficulty in filling openings in the executive ranks, especially in organizations where the approach to succession planning (that is, identifying and mentoring successors) has not been formalized or well-established

Audits for consideration to mitigate workforce risks

• Travel nurse management and contract compliance
• Critical department staffing levels
• Recruiting and retention processes
• Succession planning
• Premium employee pay levels

How audit and compliance professionals can use technology to expand workforce risk coverage

• Analyze travel nurse timekeeping and billing data to assess propriety of agency billings.
• Use data analytics to identify patient readmissions and assess for staffing-related root cause(s).
• Analyze employee retention expenses and turnover data to assess effectiveness of retention programs.

Workplace violence

Seventy-three percent of healthcare workers in critical care settings around the world said they experienced workplace violence over the past year, according to the Violence Study of Healthcare Workers and Systems survey conducted by researchers with Global Remote Research Scholars Program.⁴  The researchers conducted the survey in 2022 and released the results in January 2023.

The Joint Commission’s new workplace violence prevention accreditation standards for hospitals took effect in January 2022.⁵  The standards require hospitals to manage worker safety and security risks, collect information to monitor security incidents, participate in workplace violence prevention education and training, and develop and enforce workplace violence prevention programs.

More recently, ECRI named “physical and verbal violence against healthcare staff” as one of its top 10 patient safety concerns for 2023.⁶

Specific workplace violence risks include:

• Failure to comply with standards of The Joint Commission and other regulatory agencies related to prevention of workplace violence
• Failure to monitor security personnel and outsourced security vendors
• Adverse financial impact and lower quality resulting from employee turnover
• Harm to patients and healthcare provider team members

Audits for consideration to mitigate healthcare workplace violence risks

• Regulatory readiness, including compliance with Joint Commission standards
• Prevention of patient/visitor/family violence to staff audit
• Security event response assessment

How audit and compliance professionals can use technology to expand healthcare workplace violence risk coverage

• Evaluate reporting of violence resulting in staff harm.
• Analyze response time to events based on policy or service agreements with security vendors.
• Evaluate most frequent types of violent events and sources of violence threats.

New regulation risks

Cybersecurity

As evidenced by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which directly affects the healthcare and public health sectors, federal legislators and regulators as well as healthcare leaders are continually addressing cybersecurity and privacy challenges. Because of the collective high interest by these stakeholders, it’s likely that the cybersecurity requirements for HIPAA-covered entities will be strengthened in the next few years. The primary change likely will come in the form of updated attestation methods from a check-the-box model currently in place to a provide-proof-and-be-graded model much like the model introduced by the Department of Defense, the Cybersecurity Maturity Model Certification (CMMC).

Risks faced by healthcare organizations in this space include:

• Inability to react quickly to the accelerating change in government cybersecurity policies and regulations

Audits for consideration to mitigate cybersecurity policy and regulatory compliance risks

• HIPAA security and privacy assessments
• National Institute of Standards and Technology (NIST) cybersecurity assessment
• CMMC precertification readiness assessment

How audit and compliance professionals can use technology to expand cybersecurity risk coverage

• Use a cyber tool stress test (for example, Department of Defense-class IT tool testing) to identify gaps in the use of cyber and IT risk management tools.

No Surprises Act

A year into the enactment of the federal No Surprises Act (NSA), which generally prohibits the practice of balance billing patients, CMS extended the period of enforcement discretion for billing challenges in which good faith estimates (GFEs) don’t include expected charges from co-providers or co-facilities. Also, due to concerns about the burden of implementing advanced explanations of benefits (EOBs) for patients with commercial insurance, facilities and providers must share a GFE with the payor, and the payor must include the GFE in an advanced EOB sent to the patient. CMS temporarily deferred enforcement of this portion of the NSA as well. CMS has begun to audit providers and payors for noncompliance with all other requirements that went into effect on Jan. 1, 2022.

Risks associated with the NSA include:

• Civil monetary penalties for each violation in which a patient receives a surprise medical bill
• Negative reputational risks resulting in lost revenue for facilities and providers

Audits for consideration to mitigate NSA risks

• NSA process effectiveness
• NSA compliance

How audit and compliance professionals can use technology to expand NSA risk coverage

• Use data analytics to analyze whether actual billed charges are within $400 of the GFE.
• Analyze compliance with GFE timing requirements.
• Use data analytics to identify potential balance billing exceptions.

State-regulated data privacy

Five states – California, Colorado, Connecticut, Utah, and Virginia – passed new privacy laws that go into effect in 2023 to increase protection of consumers’ personal data. In addition, eight other states are either holding hearings on privacy bills or planning to introduce privacy bills this year. The objective of the new state laws is to regulate the collection, use, and sharing of personal information. Though healthcare organizations as covered entities or business associates already are required to comply with HIPAA, the new state privacy law requirements might apply as well. In states that have passed new privacy laws, the statutes typically give enforcement authority to a state agency like the state attorney general.

Risks associated with new state privacy laws include:

• Financial penalties and negative reputational risk stemming from how healthcare organizations use consumers’ personal data
• Failure by healthcare organizations to fully de-identify consumers’ personal information

Audits for consideration to mitigate the risks associated with new state privacy laws

• Data governance assessment
• Data privacy compliance

Next steps for achieving return on risk

Today more than ever, healthcare organizations’ resources are limited even as the number and significance of potential risks grow. Taking these steps can help organizations make sure internal audit and compliance functions are aligned with the most significant risks they face, are achieving greater risk coverage, and are using data analytics to enhance efficiencies and achieve a better return on risk:

• Review the top risks as part of preparing for annual risk assessment interviews and the work plan development process.
• For those that are not currently using data analytics, ensure teams are using data and technology for each project in the annual work plan to enhance the risk assessment process, increase efficiencies, and expand risk coverage. Consider how technology and analytics can be used, including the implementation of monitoring technology that enables continuous controls.
• Once the annual work plan is developed, compare it to the top risks and the most common audit projects conducted by those within the Crowe Audivate user community. Determine whether variances are justified for the organization or if there is a gap in the work plan.
• Continually align and reallocate limited resources to the healthcare organization’s top management risks as well as the industry’s top and emerging risks to deliver the greatest return on risk.

¹ David Bates, David Levine, Hojjat Salmasian, et al., “The Safety of Inpatient Health Care,” New England Journal of Medicine, Jan. 12, 2023, https://www.nejm.org/doi/full/10.1056/NEJMsa2206117
² Martin Makary and Michael Daniel, “Medical Error – the Third Leading Cause of Death in the US,” BMJ, May 3, 2016, https://www.bmj.com/content/353/bmj.i2139
³ “Survey: Workforce Challenges Cited by CEOs as Top Issue Confronting Hospitals in 2022,” American College of Healthcare Executives news release, Feb. 13, 2023, https://www.ache.org/about-ache/news-and-awards/news-releases/survey-workforce-challenges-cited-by-ceos-as-top-issue-confronting-hospitals-in-2022
⁴ “Most Critical Care Workers Experience On-the-Job Violence,” Society of Critical Care Medicine news release, Jan. 21, 2023, https://sccm.org/sccm/media/PDFs/Global-Survey-Impact-Violence-Against-Healthcare-Workers-CC-News-Release-Final.pdf
⁵ “Workplace Violence Prevention Standards,” R3 Report, The Joint Commission, June 18, 2021, https://www.jointcommission.org/standards/r3-report/r3-report-issue-30-workplace-violence-prevention-standards
⁶ “Top 10 Patient Safety Concerns 2023,” ECRI, https://www.ecri.org/top-10-patient-safety-concerns-2023-special-report
⁷ “Rising Cyberthreats Increase Cyber Insurance Premiums While Reducing Availability,” U.S. Government Accountability Office, July 19, 2022, https://www.gao.gov/blog/rising-cyberthreats-increase-cyber-insurance-premiums-while-reducing-availability
⁸ Tina Reed, “As Cyber Attacks on Healthcare Soar, so Does the Cost of Cyber Insurance,” Axios, March 6, 2023, https://www.axios.com/2023/03/06/cyber-attacks-cost-of-cyber-insurance
⁹ Donald Berwick, Thomas Nolan, and John Whittington, “The Triple Aim: Care, Health, and Cost,” Health Affairs, May-June 2008, https://pubmed.ncbi.nlm.nih.gov/18474969/