Staff

Structure

Support

HCCA Special Interest Group

1-28-03

New Regulations: A Strategy for

Implementation

Sharon SchmidVice President, Compliance and

PrivacyMedica

Multiple Levels of Obligations Multiple States’ Regulations Overlapping State and Federal Regulation

DOL ERISA Regulations Privacy (GLB, HIPAA, Federal Privacy Act, State Law,

NCQA) Accreditation Requirements

Type of Regulation Governs the Core of What We Do

Volume and Complexity of Obligations

Governing Standards Framework:

Challenges for Implementation

– Develop Method to Help Ensure Obligations Come to Life in the Business

– Risk Based Approach to Implementation and Ongoing Compliance• Assess• Prioritize• Resource

– Compliance Project Management (“CPM”)• Manage the Complexity• Builds it into the Core of What We Do

Implementation Process

– Builds on Traditional Project Management Practices - Adapted to Manage and Minimize Compliance Risk

– Defined Analytical and Implementation Processes that Support: Identify Implement

Assess Monitoring

Plan Audit

What is Project Management For

Compliance?

Document

– Central Oversight With Identified Compliance Staff in All Business Units - Departments

• Shared Accountability for Compliance and Business Ensures Compliance Expertise and Strong Understanding of Business

– Process and Structure to Support Consistent, Documented, Completed Implementation

– Tools and Training

– Ongoing Support and Training

What Makes CPM Successful

What are the Elements of Compliance Project

Management?• Understand the Legal/Regulatory/Governance Requirements

• Identify and Assess Current Business Practices

• Identify Operational Gaps

• Develop a Documented Action Plan

• Implement the Plan and Document the Implementation Activities

• Monitor the Results of the Implementation

• Document “How We Know” We Are in Compliance

How Will Compliance Project Management Help Us Reach

Our Goal?• Compliance Project Management Helps to

Identify and Minimize Legal Risk

• Develops Consistency In Approach and Implementation

• Documents Work To Support Compliance

• Builds on Expertise of All Staff from all business areas

• Enhances Communication

• Creates Institutional Memory

The Higher the Level of Risk, As Determined by the “As-is” Assessment, the Greater the Need for

Compliance Project Management

Greater need for CPM

Why Might You Want to Use The Project Management

Approach?

Compliance Operations Project Management Phases

Intake

Assessment

Implementation Planning

Implementation

Post Implementation Management

How Does Compliance Project Management Help

Manage Risk?

Intake

Assessment

Planning

Implementation

PostImplementationManagement

RiskProject Phases

A Key Step in Any Compliance Effort - Whether It Is a

Relatively Simple or Complex Obligation - Is

Understanding, Defining, and Documenting the

Issue.

Key Tasks for Intake Identify the “Obligation”

Initial Legal Analysis

Intake Information Completed - Including Obligation Summary

Intake Phase

Compliance Project Life Cycle - Compliance Project Life Cycle - Intake in DetailIntake in Detail

Com

pete

ncy

Com

pete

ncy E

xit

Exit

C

rite

ria

Cri

teri

aT

ask

sT

ask

s

IntakeIntake

Identify obligation Conduct initial legal analysis Notify compliance operations of new obligation Review legal analysis, enter obligation information in CPM, link relevant documentation Conduct initial triage assessment and notify CO leads to conduct operational assessment

Required information completed in CPM and Compliance Operations notified CO staff complete Archive Summary, if applicable

Compliance OperationsCompliance Operations

LegLegalal

Business Business OperationsOperationsSteering CouncilSteering Council

Deli

vera

ble

sD

eli

vera

ble

s

Documented legal analysis Completed Intake information in CPM including Obligation Summary Linked documentation in System An Archive Report, if no further action is necessary

Ph

ase

Ph

ase

The Operational Assessment Is a Review of Business Operations Against the Requirements of the Obligation

Compliance Ops Leads Conduct Operational Assessment online:

Products Processes Departments Vendors Background/History Connections Current Business Practices Recommendations

Assessment Phase

Assessment Summary Report

The Assessment Summary Report Is a Compilation of All of the Information Entered As Part of the Operational Assessment

•This Report Can Be Invaluable for Focusing Resources and Expertise

•Helps to Identify Specific Action Steps or Tasks for Implementation.

•In Some Instances, the Assessment Summary Report Will Reflect That the Organization Is Already in Compliance With the Obligation’s Requirements and Will Provide the Necessary Information for Documenting Our Compliance.

Planning

In the Planning Phase, the Project Manager Develops a Detailed Action Plan To:

•Create the Right Solution for Compliance and Business

•Establish Communication About Implementation

•Foster Involvement of Team and Key Stakeholders

Review the Assessment Summary Report

Develop the Action Plan

Identify Team Members and Key Stakeholders

Schedule and Hold the Kickoff Meeting With the Project Team

Document Additional Tasks Based on Team Members Participation

Obtain Stakeholder Input for Plan

Define the Communication Protocols

Planning Phase Key Tasks

The Purpose of the Implementation Phase Is to Perform, Monitor, and Control Project Work So That You Can Complete the Project on Schedule and Within Defined Quality Standards.

In This Phase, Staff Implement and Manage Against the Action Plan, Making Enhancements and Changes to the Action Plan As Necessary to Accomplish the Project Goal(s).

Implementation Phase

Implement Project Plan

Communicate Status to Team Members and

Stakeholders

Status Updates in Application

Training As Needed

Manage Project Changes as Needed

Escalate Barriers for Resolution

Summarize Compliance

Implementation Phase Key Tasks

The Purpose of the Post Implementation Management Phase Is to Complete Commitments, Check the Success of the Implementation, Plan for Transitions, Conduct Evaluations, and Identify Lessons Learned That Can Be Carried Forward to Future Projects

Post Implementation Management Phase

Project Manager Ensures Project Documentation is

Completed and Linked to Obligation in Application

-Action Plan and Supporting Documentation

-Policies and Procedures, training, process

documentation, etc.

Post Implementation Evaluation

Monitoring Activities Completed According to

Action Plan and Ongoing As Necessary

Post Implementation Management Key Tasks

Compliance Project Management Supports Effective Compliance

Identify and Minimize Legal Risk

Develops Consistency In Effective Approach For Implementation

Documents Work To Support Compliance

Builds on Expertise of All Staff

Enhances Communication

Creates Institutional Memory