Federal grand jury investigations and Centers for Medicare & Medicaid Services probes have been in the news in recent months. Investigators are responding to complaints against entities caring for patients particularly susceptible to COVID-19, including allegations that facilities “failed to follow proper COVID-19 safety and infection control procedures.” These investigations, including the federal probe of Brighton Rehab and Wellness Center in Western Pennsylvania, are often being conducted in conjunction with state and local prosecutors and agencies and include the issuance of grand jury subpoenas and the execution of search warrants.

Alternatively, Residential Care Facilities are also being targeted in cases brought pursuant to the False Claims Act. For example, SavaSeniorCare LLC and related entities, based in Georgia, recently agreed to pay $11.2 million — and maybe more. The settlement was intended to resolve allegations that Sava violated the False Claims Act by causing its skilled nursing facilities to bill the Medicare program for rehabilitation therapy services that were not reasonable, necessary or skilled, and to resolve allegations that Sava billed the Medicare and Medicaid programs for grossly substandard skilled nursing services.

As a result, now more than ever, Residential Care Facilities must make sure to have robust, updated Corporate Compliance Programs that are being properly enforced in order to avoid being the subject of such a criminal investigation or at least mitigate the consequences of one. A well-designed and diligently enforced Corporate Compliance Program will also help an organization avoid being the defendant in a False Claims Act case.

A robust Corporate Compliance Program is intended to prevent misconduct. Additionally, when misconduct does occur, a Corporate Compliance Program can facilitate the reporting and the correction of such misconduct. Finally, an effective Corporate Compliance Program can help secure leniency from the government when misconduct occurs.

Residential Care Facilities who already have Corporate Compliance Programs in place should ask themselves certain questions to ensure they are sufficient:

1. Is the compliance program being applied earnestly and in good faith? In other words, is the program adequately resourced and empowered to function effectively?

• A “paper” compliance program, devoid of the staff and resources needed to implement it, is not sufficient, and such a program will not be viewed by the government as functioning effectively. In fact, having a compliance program that is not followed can do more harm than good.
• The federal government has made it clear that an organization must foster a culture of compliance at all levels, which must be implemented by middle management as well as upper management.
• The amount of resources and staff that an organization must devote to compliance depends on its size. A larger organization needs to dedicate more resources to compliance than a smaller one.
• Another hallmark of a compliance program that is working effectively is the existence of a well-functioning and appropriately funded mechanism for the timely and thorough investigation of any allegations or suspicions of misconduct by the organization, its employees or agents. 
• In assessing whether an organization’s compliance program was effective at the time of misconduct, the government considers whether and how the misconduct was detected, what resources were in place to investigate suspected misconduct and the nature and thoroughness of the organization’s remedial efforts.

2. Is the organization’s compliance program updated on a regular basis as well as when the organization’s business changes and when applicable laws and regulations change?

• To determine whether an organization’s compliance program is working effectively at the time of a charging decision or resolution, the government considers whether the program evolved over time to address existing and changing compliance risks.
• For instance, during the pandemic, has the organization been using telemedicine rather than having physicians visit with patients in person? If so, the compliance program should be updated to reflect this change in practices and to ensure that all applicable laws and regulations are being followed.
• Similarly, the compliance program should be updated to implement COVID-19 safety and infection control procedures.
• Additionally, an organization should review and adapt its compliance program based upon lessons learned from its own misconduct and/or that of other organizations facing similar risks.

3. Does the organization’s staff receive regular training regarding what is required of them pursuant to the compliance program?

• New staff members should receive training, but so should all affected staff when changes and updates to the compliance program are adopted.

4. Is disciplinary action taken when a staff member fails to follow the policies and procedures in the compliance program?

• An organization should strive for consistency in its investigations and in any resulting disciplinary actions.
• There must be consequences for violations. An organization should not ignore violations of its compliance program.