Internal investigations are an important component of an effective legal and compliance program within health care organizations. These investigations may arise from many varied situations ranging from patient complaints, compliance hotline reports, and internal auditing and monitoring activity to whistleblower complaints, government audits and investigations, and litigation. Regardless of the impetus, a coordinated and disciplined approach to investigations will ensure the health care organization can uncover the facts while protecting the organization.
The following practices help ensure internal investigations can be thorough and impartial while maintaining the integrity of the investigation and mitigating legal, financial and reputational risk for the organization.
1. Identify key legal and regulatory guardrails. Each internal investigation may present unique facts and considerations, which typically evolve over the course of the investigation. However, at the outset, it is important to identify appropriate legal and regulatory guardrails that should be built into the plan. For example, if patient information is involved, the investigation plan should ensure that information will be appropriately safeguarded in compliance with HIPAA and state privacy laws. If the internal investigation will be conducted under attorney-client privilege, the investigation plan should ensure appropriate documentation and communication channels to maintain that privilege. Establishing thoughtful and appropriate legal and regulatory guardrails early on, and acting in compliance with those guardrails throughout the process, can avoid inadvertently creating additional exposure for the health care organization.
2. Follow established internal policies. Health care organizations may have policies that relate to the process and/or substance of the internal investigation. This may include, for example, policies on investigation of potential billing irregularities, patient abuse, medical errors, or employment discrimination. Consistent application of these policies ensures alignment with applicable law, accreditation standards, medical staff bylaws, and compliance program expectations.
3. Define the scope. In the complex and highly regulated health care environment, the scope of internal investigations may expand as the investigation evolves. However, at times that expansion is unintentional and unnecessary. A well‑defined scope at the outset and intentional planning can keep the investigation focused.
4. Ensure Coordinated Direction and Oversight. Because internal investigations typically rely on input and coordination among numerous business units and stakeholders, a single point person to provide oversight is essential to ensure efficiency, confidentiality, and alignment. A strategic decision should be made at the outset as to whether the investigation will be conducted under attorney-client privilege. Privileged investigations must be conducted at the direction of internal or external legal counsel. If an investigation is conducted through internal legal counsel, the responsible attorney typically is best suited to provide this direction and oversight. If the investigation is conducted by outside counsel, it can greatly benefit overall cost and efficiency to assign an internal point person within the organization who is familiar with the organization’s processes and people. For non-privileged investigations, internal or external counsel may still serve as this single point person, or it may be an individual from another business unit – for example, compliance or HR – with more selective input from legal counsel as appropriate.
Regardless of the selected point person, a project manager or designated administrative coordinator to assist with tracking, coordination and documentation can be instrumental to a successful and efficient investigation, particularly for larger investigations. If project management and/or administrative coordination resources are not available internally, they may be available through outside counsel or a consultant, and it is worthwhile to at least consider whether external resources to assist with project management would be a necessary or meaningful investment in any given investigation.
5. Protect impartiality and objectivity. To maintain the integrity of an investigation, the investigation should be managed by an investigator who has no personal or professional stake in the outcome. Investigators should be aware of and manage to any potential conflicts of interest on the part of participants, including reporting relationships. Particularly for high-stakes investigations, many organizations prefer to rely on outside counsel to ensure impartiality and objectivity. Relying on outside counsel routinely addresses this issue. All participants should disclose potential conflicts of interest, including clinical reporting relationships.
6. Preserve evidence. In any investigation, but most especially if there is a potential for litigation, preservation of evidence is critical. To avoid loss of evidence that can thwart the investigation and potentially result in spoliation claims, one of the first steps in any investigation should be identification of potential evidence, identification of potential custodians who might have potential evidence, and implementation of an effective system to collect and/or preserve that evidence. Effective coordination and oversight is of critical importance related to evidence since it may reside in disparate systems and locations including, for example, individual email and smartphone accounts.
7. Conduct interviews strategically. Interviews to gather facts should be private, well-planned, and thoroughly documented. Strategic thought should be given to who conducts the interview and whether individuals other than the interviewer and interviewee are present. When possible, in-person interviews often are more productive. When employees are interviewed by internal or external counsel, it is important to give an “Upjohn warning” to ensure the interviewee understands the role of counsel.
9. Prepare a comprehensive report, but only when appropriate. When appropriate, a well‑structured formal written report can help key stakeholders and decision-makers understand the findings and potential implications. Reports should avoid assumptions or irrelevant details and instead rely on specific evidence collected in the investigation. Although it may be appropriate to include conclusions in the report that can be drawn from the investigation, this should be done only with great consideration. Further, it is not a given that a formal written report should be prepared and shared with stakeholders and decision-makers in every investigation. Because written reports can be time-intensive and costly to prepare and have the potential to create additional exposure for an organization, even if prepared under privilege, a strategic decision should be made as to whether a formal report will be prepared. Regardless of whether a written report is prepared and shared, it is important that the person overseeing the investigation maintain clear documentation of the investigation and findings.
10. Don’t forget the corrective actions. Once findings are complete, timely action to remediate any identified issues is essential. Corrective actions may include, for example, changes to policies or processes, staff discipline and/or retraining, implementation of new audit and monitoring initiatives, and refunding overpayments. In some cases, self‑disclosure to a government agency or payer may be required. Coordinated oversight and tracking can help ensure follow-through.
11. Protect against retaliation. A culture of compliance and safety depends on employees feeling secure when raising concerns. Individuals who report issues or participate in interviews must be shielded from retaliation in any form.
12. Manage reputational risk. Patient trust, employee relationships and community perception are central to the success of any health care organization. Organizations should coordinate with communications teams early, develop internal and external messaging strategies, and protect confidentiality to avoid premature or inadvertent disclosures.
When health care organizations approach investigations with coordination, clarity, and discipline, they not only mitigate legal, financial, and reputational risk to the organization, they also can strengthen their culture, reinforce compliance, and protect the patients and communities they serve.
[View source.]
