Preamble
Healthcare compliance programs are ultimately judged by how they affect, directly or indirectly, the delivery of health care to the patients, residents, and clients served by the healthcare industry and, thus, by how they contribute to the well-being of the communities we serve. Those served by the health care industry are particularly vulnerable, and therefore, healthcare compliance professionals (HCCPs) understand that the services we provide require the highest standards of professionalism, integrity, and competence. The following Code of Ethics expresses the profession’s recognition of its responsibilities to the general public, to employers and clients, and to the legacy of the profession. The Code of Ethics consists of two kinds of standards: Principles and Rules of Conduct. The Principles are broad standards of an aspirational and inspirational nature, and as such, express ideals of exemplary professional conduct. The Rules of Conduct are specific standards that prescribe the minimum level of conduct expected of each HCCP. Compliance with the Code is a function both of the individual professional and of the professional community. It depends primarily on the HCCP’s own understanding and voluntary actions, and secondarily, on reinforcement by peers and the general public.
A commentary is provided for some rules of conduct, which is intended to clarify or elaborate on the meaning and application of the rule. The following conventions are used throughout the Code: “Employing organization” includes the employing organization and clients; “Law” or “laws” includes all federal, state, and local laws and regulations, court orders and consent agreements, and all foreign laws and regulations that are consistent with those of the United States; “Misconduct” includes both illegal acts and unethical conduct; and “Highest governing body” of the employing organization refers to the highest policy and decision-making authority in an organization, such as the board of directors or trustees of an organization.
Principle I. Obligations to the Public
Healthcare compliance professionals should embrace the spirit and the letter of the law governing their employing organization’s conduct and exemplify the highest ethical standards in their conduct in order to contribute to the public good.
R1.1 HCCPs shall not aid, abet, or participate in misconduct.
R1.2 HCCPs shall take such steps as are necessary to prevent misconduct by their employing organizations.
R1.3 HCCPs shall exercise sound judgment in cooperating with all official and legitimate government investigations of or inquiries concerning their employing organization. Commentary: While the role of the HCCP in a government investigation may vary, the HCCP shall never obstruct or lie in an investigation.
R1.4 If, in the course of their work, HCCPs become aware of any decision by their employing organization which, if implemented, would constitute misconduct; adversely affect the health of patients, residents, or clients; or defraud the system, the professional shall: (a) refuse to consent to the decision; (b) escalate to the highest governing authority, as appropriate; (c) if serious issues remain unresolved after exercising “a” and “b,” consider resignation; and (d) report the decision to public officials when required by law. Commentary: The duty of a compliance professional goes beyond other professionals in an organizational context, inasmuch as his/her duty to the public includes prevention of organizational misconduct. The compliance professional should exhaust all internal means available to deter his/her employing organization, its employees, and its agents from engaging in misconduct. HCCPs should consider resignation only as a last resort, because compliance professionals may be the only remaining barrier to misconduct. In the event that resignation becomes necessary, however, the duty to the public takes priority over any duty of confidentiality to the employing organization. A letter of resignation should set forth to senior management and the highest governing body of the employing organization the precise conditions that necessitate his/her action. In complex organizations, the highest governing body may be the highest governing body of a parent corporation.
Principle II. Obligations to the Employing Organization
Healthcare compliance professionals should serve their employing organizations with the highest sense of integrity, exercise unprejudiced and unbiased judgment on their behalf, and promote effective compliance programs.
R2.1 HCCPs shall serve their employing organizations in a timely, competent, and professional manner.
R2.2 HCCPs shall ensure to the best of their abilities that employing organizations comply with all relevant laws.
Commentary: While HCCPs should exercise a leadership role in compliance assurance, all employees have the responsibility to ensure compliance.
R2.3 HCCPs shall investigate with appropriate due diligence all issues, information, reports, and/or conduct that relate to actual or suspected misconduct, whether past, current, or prospective.
R2.4 HCCPs shall keep senior management and the highest governing body informed of the status of the compliance program, both as to the implementation of the program and about areas of compliance risk.
Commentary: The HCCP’s ethical duty under this rule complements the duty of senior management and the highest governing body to assure themselves “that information and reporting systems exist in the organization that are reasonably designed to provide to senior management and to the board itself timely, accurate information sufficient to allow management and the board, each within its scope, to reach informed judgments concerning both the corporation’s compliance with law and its business performance.”[1]
R2.5 HCCPs shall not aid or abet retaliation against any employee who reports actual, potential, or suspected misconduct, and they shall strive to implement procedures that ensure the protection from retaliation of any employee who reports actual, potential, or suspected misconduct.
Commentary: HCCPs should preserve to the best of their ability, consistent with other duties imposed on them by this code of ethics, the anonymity of reporting employees, if such employees request anonymity. Further, they shall conduct the investigation of any actual, potential, or suspected misconduct with utmost discretion, being careful to protect the reputations and identities of those being investigated.
R2.6 HCCPs shall not reveal confidential information obtained in the course of their professional activities, recognizing that under certain circumstances, confidentiality must yield to other values or concerns (e.g., to stop an act which creates appreciable risk to health and safety, or to reveal a confidence when necessary to comply with a subpoena or other legal process).
Commentary: It is not necessary to reveal confidential information to comply with a subpoena or legal process if the communications are protected by a legally recognized privilege (e.g., attorney-client privilege).
R2.7 HCCPs shall take care to avoid any actual, potential, or perceived conflict of interest, to disclose them when they cannot be avoided, and to remove them where possible. Conflicts of interest can also create divided loyalties. HCCPs shall not permit loyalty to individuals in the employing organization with whom they have developed a professional or a personal relationship to interfere with or supersede the duty of loyalty to the employing organization and/or the superior responsibility of upholding the law, ethical business conduct, and this code of ethics.
Commentary: If HCCPs have any business association, direct or indirect financial interest, or other interest which could be substantial enough to influence their judgment in connection with their performance as a professional, the HCCPs shall fully disclose to their employing organizations the nature of the business association, financial interest, or other interest. If a report, investigation, or inquiry into misconduct relates directly or indirectly to activity in which the HCCP was involved in any manner, the HCCP must disclose in writing the precise nature of that involvement to the senior management of the employing organization before responding to a report or beginning an investigation or inquiry into such matter. Despite this requirement, such involvement in a matter subject to a report, investigation, or inquiry will not necessarily prejudice the HCCP’s ability to fulfill his/her responsibilities in that regard.
R2.8 HCCPs shall not mislead employing organizations about the results that can be achieved through the use of their services.
Principle III. Obligations to the Profession
Compliance professionals should strive, through their actions, to uphold the integrity and dignity of the profession, to advance the effectiveness of compliance programs, and to promote professionalism in healthcare compliance.
R3.1 HCCPs shall pursue their professional activities, including investigations of misconduct, with honesty, fairness, and diligence.
Commentary: HCCPs shall not agree to unreasonable limits that would interfere with their professional ethical and legal responsibilities. Reasonable limits include those that are imposed by the employing organization’s resources. If management of the employing organization requests an investigation but limits access to relevant information, HCCPs shall decline the assignment and provide an explanation to the highest governing authority of the employing organization. The compliance professional should with diligence strive to promote the most effective means to achieve compliance.
R3.2 Consistent with paragraph R2.6, HCCPs shall not disclose without consent confidential information about the business affairs or technical processes of any present or former employing organization that would erode trust in the profession or impair the ability of compliance professionals to obtain such information from others in the future.
Commentary: Compliance professionals need free access to information to function effectively, as well as the ability to communicate openly with any employee or agent of an employing organization. Open communication depends upon trust. Misuse and abuse of the work product of compliance professionals poses the greatest threat to compliance programs. When adversaries in litigation use an organization’s own self-policing work against it, this can undermine the credibility of compliance professionals. HCCPs are encouraged to work with legal counsel to protect confidentiality and to minimize litigation risks.
R3.3 HCCPs shall not make misleading, deceptive, or false statements or claims about their professional qualifications, experience, or performance.
R3.4 HCCPs shall not attempt to damage, maliciously or falsely, directly or indirectly, the professional reputation, prospects, practice, or employment opportunities of other compliance professionals.
R3.5 HCCPs shall maintain their competence with respect to developments within the profession, including knowledge of and familiarity with current theories, industry practices, and laws.
Commentary: HCCPs shall pursue a reasonable and appropriate course of continuing education, including, but not limited to, review of relevant professional and healthcare industry journals and publications, communication with professional colleagues, and participation in open professional dialogues and exchanges through attendance at conferences and membership in professional associations.