2.2 Compliance Committee Oversight, Charter & Board Reporting

Compliance Committee Oversight, Charter & Board Reporting

Executive Summary: Operationalizing compliance across a complex healthcare institution requires structured executive governance and active board oversight. The executive Compliance Committee provides interdisciplinary oversight, helping the Chief Compliance Officer operationalize compliance standards across clinical, billing, legal, and administrative departments. Concurrently, the Board of Directors bears a legal fiduciary duty under the Caremark doctrine to maintain active oversight of the compliance program, supported by quantitative executive compliance dashboards.

---

Role and Interdisciplinary Composition of the Executive Compliance Committee

While the Chief Compliance Officer (CCO) leads the compliance function, an effective compliance program cannot operate in institutional isolation. The executive Compliance Committee serves as the interdisciplinary operational steering body that advises, supports, and assists the CCO in executing compliance initiatives across all operational divisions.

Interdisciplinary Leadership Representation

To ensure comprehensive institutional coverage, the Compliance Committee must comprise senior leadership representing all core operational and clinical risk areas:

• Chief Medical Officer (CMO) / Medical Staff Leadership: Provides oversight on clinical medical necessity, physician documentation, quality standards, and clinical trial compliance.
• Chief Nursing Officer (CNO) / Patient Care Services: Ensures operational compliance with patient care protocols, nursing documentation, and EMTALA regulations.
• Chief Financial Officer (CFO) / Health Information Management (HIM) / Revenue Cycle: Oversees billing integrity, coding compliance, charge master maintenance, and financial overpayment identification.
• General Counsel / Risk Management: Offers legal perspectives, risk assessment analysis, and coordination on regulatory investigations.
• Chief Information Officer (CIO) / Chief Information Security Officer (CISO): Oversees HIPAA Security Rule compliance, electronic health record (EHR) audit logs, and data security.
• Vice President of Human Resources: Coordinates monthly sanction screening (OIG LEIE / SAM.gov), employee onboarding attestations, and consistent disciplinary enforcement.
• Internal Audit Director: Coordinates monitoring and auditing activities to eliminate redundant reviews and maximize audit coverage.

                          +-----------------------------------+
                          |    Chief Compliance Officer       |
                          |        (Committee Chair)          |
                          +-----------------+-----------------+
                                            |
        +------------------+----------------+------------------+------------------+
        |                  |                                   |                  |
        v                  v                                   v                  v
+---------------+  +---------------+                   +---------------+  +---------------+
| Clinical &    |  | Finance &     |                   | HR, IT &      |  | Legal & Internal|
| Medical Staff |  | Revenue Cycle |                   | Security      |  | Audit        |
| (CMO, CNO)    |  | (CFO, HIM)    |                   | (CISO, HR VP) |  | (GC, Audit)   |
+---------------+  +---------------+                   +---------------+  +---------------+

---

The Compliance Committee Charter & Operational Cadence

The Compliance Committee operates under a formal, written Compliance Committee Charter approved by the Chief Executive Officer and the Board of Directors. The charter establishes the committee's scope, authority, structure, and operational protocols.

Key Components of a Compliance Committee Charter

1. Statement of Purpose: Explicit mandate to advise the CCO and assist executive management in identifying compliance risks, formulating corrective action plans, and maintaining operational compliance.
2. Membership & Voting Rights: Formally designated committee roles, voting mechanisms, designation of alternates, and attendance mandates (e.g., minimum 80% mandatory annual attendance).
3. Operational Responsibilities:
   • Reviewing and approving the annual Compliance Auditing & Monitoring Work Plan.
   • Assessing high-risk operational areas based on internal audits and external OIG Work Plan releases.
   • Evaluating hotline reporting trends and monitoring significant internal investigations.
   • Reviewing, approving, and tracking Corrective Action Plans (CAPs) resulting from billing errors or regulatory non-compliance.
   • Reviewing proposed organizational compliance policies and procedures prior to adoption.
4. Meeting Cadence and Minutes: Mandating regular committee meetings (typically monthly, but no less than quarterly). Formal written minutes must be maintained, recording all discussion topics, risk evaluations, voting actions, and assigned follow-up items.

---

Governance Oversight & Board Fiduciary Responsibilities

Governing boards of healthcare organizations carry a legal fiduciary obligation to oversee institutional compliance. This duty is rooted in landmark legal precedents and joint guidance issued by federal regulators and legal associations.

The Caremark Doctrine and Legal Standards

The legal benchmark for board compliance oversight stems from the landmark Delaware Chancery Court ruling In re Caremark International Inc. Derivative Litigation (1996), as affirmed and expanded by Stone v. Ritter (2006).

• The Caremark Standard: Board members face personal fiduciary liability for corporate losses resulting from compliance failures if they fail to implement an adequate compliance reporting system, or consciously fail to monitor and oversee the compliance system once established.
• Conscious Failure of Oversight: Directors cannot insulate themselves by remaining passive. Ignoring explicit "red flags" (e.g., severe audit error rates, whistleblower allegations, OIG subpoenas) constitutes a breach of the fiduciary duty of loyalty.

OIG/AHLA Joint Educational Guidance for Governing Boards

The HHS-OIG, in collaboration with the American Health Law Association (AHLA), published seminal guidance documents—including Corporate Responsibility and Health Care Compliance (2003) and Practical Guidance for Health Care Governing Boards (2015)—defining board oversight expectations:

• Duty of Inquiry: Board members must ask probing questions regarding high-risk operational areas (e.g., physician referral arrangements, billing practices, medical necessity).
• Independent Information: The Board must receive unbiased compliance reports directly from the CCO, independent of executive management's operational summaries.
• Executive Sessions: The Board's Audit & Compliance Committee must conduct regular executive sessions with the CCO.
• Resource Allocation: The Board is responsible for ensuring the compliance department receives adequate funding, staffing, and technological infrastructure.

---

Key Compliance Dashboard Metrics & Board Reporting Structure

To fulfill their oversight mandate effectively, board members require clear, quantitative compliance metrics rather than vague narrative assurances. The CCO presents a consolidated Compliance Dashboard to the Board on a quarterly basis.

Core Compliance Dashboard Indicators

---

Real-World Healthcare Compliance Scenario

The Passive Board Failure and Caremark Exposure

Background: A multi-facility health system operated a network of outpatient diagnostic imaging centers. Over a 3-year period, internal billing audits revealed that several centers were routinely billing Medicare for complex MRI procedures without required physician supervision. The internal audit team flagged these findings to the executive Compliance Committee.

Board Conduct: The board's Audit & Compliance Committee received oral summaries from the CEO stating generally that "compliance monitoring is ongoing," but the committee never requested audit detail, never reviewed error rate metrics, and never held executive sessions with the CCO.

Enforcement Action: Following a whistleblower qui tam action, the U.S. Department of Justice intervened, filing a False Claims Act lawsuit that resulted in a $38 million civil settlement. Shareholders subsequently filed a derivative suit against individual board members under the Caremark doctrine. The court permitted the suit to proceed, holding that the board's conscious failure to inquire into explicit billing red flags and lack of formal dashboard reviews constituted a potential breach of their fiduciary duty of loyalty.