In 2016, the U.S. Department of Justice collected more than $4.7 billion in settlements and judgments from fraud and false claims cases.1 Of the total amount recovered, $2.5 billion came from the healthcare industry – the seventh consecutive year the department’s civil healthcare fraud recoveries have exceeded $2 billion.2 This continued uptick in investigations and enforcement does not seem to be slowing down. Whether responding to a whistleblower concern, a government subpoena, a civil contract dispute, or accusations of theft or fraud, healthcare providers, executives, and organizations need to be ready to answer.
Typically, when a healthcare provider becomes aware of potential fraud, it conducts an internal investigation. In today’s climate of increased oversight and scrutiny, especially for individuals and providers, an organization might expose itself to significant financial and reputational risk if it waits until an internal investigation is required before it develops a plan for how to manage and conduct that investigation. Here are five basic steps to take to prepare for an internal investigation.
1. Establish a Culture of Integrity
An organization with an established culture of integrity will be best prepared for and able to navigate an investigative situation. Such a culture helps set the stage for leadership to be able to honestly assess a situation, determine whether it poses a threat to the organization, and, if so, decide on an appropriate response.
To help promote such a culture within an organization, leadership should create an internal structure that is prepared to manage an investigation in an appropriate and honest way. One example an organization can consider is assembling a proactive triage team available specifically to address investigations. This team would include the organization’s compliance and ethics officers as well as internal counsel and/or external counsel as circumstances indicate. Members of the senior leadership team, such as the CEO, CFO, chief operating officer, director of internal audit, or chief information officer, also may join the team depending on the circumstances and the investigation’s focus.
2. Identify Outside Resources
If an organization’s internal investigation triage team determines an investigation is warranted, the organization needs to gauge whether outside assistance is necessary. Often it is. Less complicated investigations, such as employee disputes, may be resolved internally with the assistance of the organization’s existing compliance, human resource, and legal departments. For complicated investigations, leadership should not wait until a situation arises to seek outside resources that are competent and familiar with the issues facing the organization.
Ideally, an organization should have established relationships with outside firms familiar with the organization and its management. That way, when counsel is needed, the organization can be confident it is working with resources that understand the organization and can address its particular needs. Having pre-established relationships with such professionals can save valuable time during an investigation, especially when it comes to identifying relevant custodians and issuing notices or preservation or litigation holds. This, more than ever, is critical given the breadth and scope of electronically stored information.
3. Know the Location of Data
Prior to an investigation, it is imperative that an organization establishes criteria and guidelines for data retention and that the IT team educates leadership and department management on these guidelines and existing data systems, including where and how data is stored. Should an organization suspect or become aware it is under investigation, the need to preserve data is not a luxury but a mandate. Failure to prevent data loss through normal business processes has potentially dire civil and criminal implications.
Organizations under an investigation frequently are asked to provide data from several months or even years in the past. Without knowledge of how long data is stored and how and when the data is to be retrieved, organizations often are caught off guard or, worse, unable to provide necessary data to investigating agencies. Having and demonstrating an information retention policy and compliance with the policy could be deciding factors in whether sanctions are issued for retention failures.
4. Prepare to Execute an Investigation
In addition to being prepared to access and preserve data and records, organizational leadership must be prepared and able to conduct an internal investigation. Staff should be trained and ready to handle less-complicated investigations. Training should include how to document employee interviews and collect and analyze business records. A properly documented investigation provides credibility to its results. For more challenging investigations in which the independence of those conducting the investigation is important, enlist the help of external consultants who can assist with gathering and analyzing data and with the complicated process of conducting interviews.
Leadership should expect to participate actively in investigations, to dedicate adequate resources, and to allow the necessary degree of independence. It also must accept the results of an internal investigation even if it determines someone in the organization has committed regulatory violations, fraud, theft, or any other violation of laws and regulations.
5. Be Ready to Follow Up
If an internal investigation does result in adverse findings for the organization, it must be prepared to remediate. This means repaying improperly paid funds, implementing corrective action, and following progressive disciplinary policies. Leadership also must have a formal strategy in place to manage internal and external communications during an investigation, during the litigation phase if needed, and upon completion of an investigation.
Leaders also should think about and prepare for how they will adjust policies and procedures, internal controls, and employee culture and behavior to prevent fraudulent activity from recurring. These efforts are necessary to demonstrate a culture of compliance and could result in lesser consequences. Every investigation will identify areas where an organization could “do better.” Verifying that lessons are learned and the mistakes identified are minimized in the future helps establish an organization’s reputation for doing what is right.
Conclusion: Have a Strategy in Place
Today’s environment of increased oversight and scrutiny of the healthcare industry has made preparing in advance for an internal investigation paramount. Waiting until the investigation has commenced likely could result in increased costs and a less efficient and complete investigation. Having an efficient and effective strategy in place and knowing when to call on internal and external specialists who are skilled in handling investigations can help close the risk gap and ready an organization for whatever path an investigation may take.
1 “Justice Department Recovers Over $4.7 Billion From False Claims Act Cases in Fiscal Year 2016,” The United States Department of Justice, Dec. 14, 2016, https://www.justice.gov/opa/pr/justice-department-recovers-over-47-billion-false-claims-act-cases-fiscal-year-2016
2 Ibid.
