Complete Healthcare Compliance Manual 2024

Development and Management Process

Companies may take different approaches to policy and procedure development and management. Whether your process is centralized or decentralized, it is important to establish ownership and a clear and consistent process so people understand their roles and responsibilities.

In a centralized approach, policy and procedure development typically begins at the organization’s headquarters and follows this process:

1. The compliance team or a cross-functional committee identifies the need for a policy or procedure.

2. A draft is prepared and may be circulated to designated people with subject matter expertise in the business units for review.

3. The business units may submit feedback, including possible revisions to address differences in local law or practice.

4. A central team or committee generally has final approval responsibility and authority to adopt policies for the organization.

A centralized approach to policy development and management has the advantages of avoiding duplicate or conflicting policies and procedures, promoting consistency of practice across an organization, and ensuring that the organization’s overall values and culture are represented. A disadvantage may be that achieving a common approach may make it more difficult to provide specific local guidance on the application of policy requirements.

Some organizations utilize a more decentralized approach, in which policy and procedure development begin at the local or business unit level and follows a process that may include:

1. Local subject matter experts (SMEs) identify a need for a policy or procedure.

2. SMEs draft policy content that interprets and adapts the organization policy to local laws and practices.

3. A central team or committee may review the policies and procedures before final approval.

In some organizations, a centralized approach may be utilized for core compliance issues, and a more decentralized approach may be utilized to develop application guidelines for corporate policy requirements or to develop policies to address more localized issues of compliance. Whatever the approach, a clear process should be developed, and process owner identified. The process owner may be the compliance department, legal department, or a cross-functional committee. The responsibility of the process owner is to ensure that a formal process is developed and is consistently followed. The process should include steps such as:

• Establishing criteria to determine what should be a policy, procedure, guidance, or other form

• Maintaining a consistent naming convention for all policies in the policy library

• Identifying the subject matter expert or content owner for each policy

• Defining the process for development, review, and approval

• Formatting policies into a standard template and posting updates to the centralized policy library

• Planning for communication, training, and education

• Identifying and maintaining a central document storage location that is easily accessible to employees and that ensures one “source of truth”

• Establishing compliance criteria

• Defining a process for ongoing maintenance, such as periodic review and revision

• Encouraging cross-functional involvement in the policy-management program

This process may be manual or can be automated using a platform such as SharePoint or a commercial policy management system. These systems often include document tracking, workflow, and storage capabilities, along with automated alerts for revision and ongoing maintenance.

Centralized Repository

In addition to having a policy team, another important step is to find ways to streamline and centralize documentation of policy development, approval, and even acknowledgment and review of policy documents. For some organizations this can be as simple as creating an intranet page or an internal server folder where responsible personnel can easily access, review, and complete all necessary review and approval steps (and where documentation of completion can be maintained.)

The best practice for policy management is to house an organization’s policies and procedures in a common online repository, with organization-wide and department-specific policies all stored and managed according to the same policy management protocols. A centralized process for all policy and procedure documents makes the policy and procedure process easier to manage—from initiation of a new policy, to the policy development and approval process, to review and acknowledgment of policies by affected workforce members when the policy has been finalized and is effective.

Drafting Policy and Procedure Content

When drafting policy and procedure content, keep in mind the organization’s culture and work to ensure that the tone of policies and procedures is consistent with the tone and approach of other organizational communications. Policies and procedures should be comprehensive, consistent, and easily accessible and applicable to the target audience. Consider the following tips:

• Use plain language; avoid legalese.

• Be clear and concise.

• Write in active voice.

• Explain expectations for employees and workforce members.

• Avoid gender-specific language.

• Fully define acronyms and unfamiliar terms.

• Use graphics or tables to organize content and to make it easier to read and locate important details.

• Avoid overly long policy and procedure documents.

• Use attachments for examples.

• Consider creating separate policy and procedures documents.

Use a consistent format for your organization’s policies and procedures. A typical policy format includes the following elements:

• Title: Give a short (10 words or less), descriptive name that will be meaningful to readers. Readers (and searchers) should be able to quickly identify the policy they are looking for by the title.

• Scope: Describe who or what the policy covers—all employees or a subset, an enterprise-wide policy or applicable to only a specific business unit? Is the policy applicable to all physician compensation relationships or to all gifts from vendors?

• Owner: State who is responsible for the policy content and administration.

• Approver: State the individual or group who approved the policy; for example, the Compliance Committee, Chief Compliance Officer, or the Board of Directors.

• Effective Date: State the date the policy becomes effective. Use an actual date and not a month, for example, use “01/01/2021” and not “01/21.”

• Purpose: Provide a short statement explaining the policy’s objective. For example, the purpose of a policy on intellectual property may be “this policy safeguards the intellectual property assets of ABC Company and its subsidiaries.”

• Policy Statement: Describe the company’s position and the standard of behavior it expects of its employees. In the policy statement or another section, include a statement as to the consequences for noncompliance.

• Definitions: Explain the meaning of special terms and acronyms used in the policy.

• References: Include references or links to other related documents or policies.

• Amendments: Include the dates and purpose of any revisions.

• Headers: Use a header with multipage numbering (Page # of ## Pages) format to help the reader keep track of common content elements.

A typical procedure format includes some, but not all, of the same elements as a policy format. Organizations should create consistent templates for other written standards documents such as frequently asked questions (FAQs), guidelines, and guidance memos. Templates help drafters provide consistent content. See the Resource:Sample Policy Template after this article.

Feedback, Review, and Approval Process

For most policies and procedures, it is crucial to gather feedback on the content during the drafting stage. Gathering feedback helps confirm that proposed processes will work, content is understood, and potential issues are identified before a document is approved and launched, thus enhancing the drafting process credibility. Imagine launching a policy without gathering feedback, only to find significant operational obstacles make the policy inoperable. Asking for feedback during the drafting process helps avoid these situations.

Don’t be afraid to gather feedback. Use the feedback process to strengthen your content and establish support for the subject matter. You could use a number of methods to gather feedback, including these ideas:

• Identify a “review group” within the subject matter area who will review and comment on all content (policies, procedures, guidelines). This review group would represent a larger group and could be chosen via vote, self-selection (for example, the first five to respond), nomination, or some other method.

• Send the draft content to employees with selected job titles or in positions in which they work with the topic.

• Post the draft content on the company’s internal web page and ask for comments.

Regardless of the method you choose, include questions to help drafters identify issues. Ask reviewers questions such as:

• Does the [policy, procedure] make sense?

• Do you understand your role?

• Does the [policy, procedure] conflict with your operational responsibilities?

• Are there any operational barriers to your duties with the [policy, procedure]?

Give the reviewers a specific time period for providing the feedback. Ten days to two weeks is generally a reasonable time. Thank reviewers for their responses.

Once you have reviewed the feedback and updated the draft, move the draft through all required approval channels. Approval channels will vary based on the organization type and content subject matter. For example, the policies of a small, privately-owned home health agency will have a different approval process than the policies of a large, state-owned health system with hospitals that have achieved Magnet designation from the American Nurses Association. Generally, an organization should have a high-level group authorized by the organization’s governing body or executives to approve routine policies, with certain policies needing the governing body’s approval. The group should be multidisciplinary, with representatives from the organization’s business units. This approach allows greater support and ownership of policies. Unless the organization is very small, policy approval should not rest with one person. A single person is less likely to understand all the nuances of how the policy will affect the entire organization than a multidisciplinary group.

Carefully review the regulations and accreditation standards driving each policy to confirm that you request all pertinent approvals. Patient-care policies require medical staff approval, for example. Shared-governance models have their own approval requirements for policies. Create an approval plan for each policy.

The approval for other types of content—procedures, job aides, frequently asked questions, guidelines—may differ from the process for policies. By having a standardized approval matrix for all content as part of an organization-wide policy on how written standards are developed, you can identify the common approval requirements for routine content.

Policy Distribution and Implementation

There are many considerations when preparing for distribution. It is important to define the appropriate target audience to understand the scope of the distribution and any challenges that may exist.

• Will you be rolling out the new policy to all employees or to a subset that will be affected by it?

• Do you need to communicate the policy to any group outside the company?

• Are there any local requirements, such as vetting with unions or works councils prior to implementation?

• Will the delivery process be online or printed (or a combination)?

• What languages do the people in the target audience speak and how do they best receive communication?

• How will you track receipt and acknowledgment of the policy by workforce members?

• Will there be required affirmation or training that accompanies rollout of the policy?

• Are there systems or procedures in place to monitor compliance with the policy?

The answers to these questions and more will help you to define your implementation and communication plan. A policy implementation tracker document can be used to document your plan. See the Resource: Sample Policy Implementation Master Tracker after this article.

Communicate policy implementation using a launch plan. Customize the plan for each policy; don’t merely recycle the process from policy to policy. Ensure that unique characteristics of each policy are addressed in each policy launch plan. The plan should include:

• The objective of the communication that will accompany the policy distribution

• The various vehicles used to communicate the message to employees (e.g., email, intranet story, newsletters, FAQs)

• The different audience groups and all required languages

• Key messages for leaders, supervisors, and any others supporting the launch effort

• Persons responsible for either creating or delivering messages

• A timeline for planned communication

• Appropriate training and education tools and complete expectations for those tools

In a multinational organization, it is critical to translate the policy and all related communications, training, and education into the local languages of the target audience. As with any translation, have a local person review the translation to ensure its accuracy and appropriateness prior to the rollout of any policy.

In your launch plan, consider using an automated distribution process. Automation allows organizations to streamline document distribution by automatically delivering the proper documentation to the appropriate workforce members. This reduces the email and information fatigue of blast email distributions. As different departments are required to acknowledge/comply with policies and procedures specific to their roles, an automated system ensures that each department receives its relevant and required documentation.

This process is crucial for organizational change management. As policies and procedures are updated, having an automated distribution system allows teams to efficiently distribute the updates. In many cases, these systems can be configured to automatically send out any updates as they are added to the centralized policy library. The result is real-time distribution of pertinent information to all relevant parties.

Many automated systems have the capability to create records of the distribution and acknowledgment of organizational policies. By creating a centralized system of record with this information, team leaders can quickly identify what information has been sent out as well as who has and/or has not seen it. Such information allows team leaders to conduct personalized follow-ups on policy acknowledgments, where needed, as well as provides quick access to all records should a compliance audit occur. Two other helpful data points are how frequently documents are accessed and then downloaded by unique users. These data points identify topics of interest to your users, and by extension, could indicate potential risk areas.

In the context of a potential review of your compliance processes by the DOJ or another regulatory or enforcement agency, or even in context of a third-party review of effectiveness, a process that results in documentation of the receipt and acknowledgment of receipt of new policy requirements by all affected workforce members will help to persuade evaluators that your organization is operating an effective compliance program. Regardless of whether a structured policy management system is utilized – the distribution process should be designed to document both distribution and acknowledgment of the policy by all affected workforce members.

Educating and Training Employees on Policies and Procedures

A key element for successful policies and procedures is to provide employees with education and training as you launch each document and periodically thereafter. “Training” and “education” are often used interchangeably in the compliance program context – but there are important distinctions you should understand as you create an appropriate policy rollout plan. Education explains why you have the policy or procedure. Education gives employees the theory or context and the larger picture—the goal, the purpose, etc. Are you safeguarding protected personal information? Or trying to improve safety? Education tells your employees why compliance is important. Training, meanwhile, explains how to accomplish the policy’s objectives. Training tells employees this is how we execute the safeguard and this is how we improve safety.

The launch of every policy and procedure should include some education and/or training to ensure employees are able to perform their duties. Details will vary by topic. Changes to policies on high-risk topics may require lengthy in-person sessions, while routine updates to long-standing procedures might be adequately addressed by a short video update. Here are some considerations for selecting delivery methods:

• Is this a new policy or procedure or a change to an existing policy or procedure?

• Is the subject matter of the policy on the annual compliance work plan?

• Who needs to better understand the policy requirements?

• Does the education/training need to happen as a stand-alone program or could it be combined with another program? Could it be a staff/team meeting or shift-change topic?

• How much time does the topic need? Could the training be presented in an existing/already structured meeting or program? Should nonproductive work hours be considered?

• Could the program be accessible for repeat use? Could a podcast, a video, an online education program be created?

• Are collateral materials such as slides, job aids, posters needed?

Key policies and procedures, such as those addressing high-risk areas, should be included in annual employee education and training requirements.

Encourage Employee Engagement

Compliance programs rely upon an employee’s receipt and acknowledgment of new and updated policies, but finding ways to get employees to take the time to review the materials is often difficult. For larger, mandated initiatives, such as workplace safety programs or sexual harassment training, this is likely not an issue, because an employee’s job status is often contingent upon completion of this training. In these cases, employees know that they have to review and complete accompanying materials for these policies within a certain time frame to ensure their ongoing employment. But what about the “less important” policies that many employees may overlook—social or technology policies, short- and long-term disability policies, or even policy updates—that may occur at any time and thus require employee input outside of regular training programs?

In these situations, many have found success in gamification. From offering up prizes or perks to, say, the first 50 employees to review and acknowledge a policy change to organizing full departmental outings, identifying ways to bring a spirit of fun to these processes can alter an employee’s perception and willingness to review, acknowledge, and complete necessary documentation. In some instances, it may be as simple as providing points or badges to employees upon completion of policy review, attestation, and/or demonstration of understanding (e.g., quizzes).

If considering this approach, take the time to speak to your employees to determine what would make the process more entertaining. Knowing what motivates and drives your employees—and what they consider to be fun—can strengthen your relationship with them while also boosting their engagement.

Keeping Policies Current and Ensuring Effectiveness

Once policies and procedures have been created and distributed, you need to ensure they remain current and effective. Establish a process for ongoing maintenance of company policies and procedures and identify ways to indicate a need to add, modify, or retire policy requirements. Events such as new or amended legislation or regulatory requirements, a change in business strategy, or a merger or acquisition may result in the need to add or revise a policy or procedure. Risk assessments and regular periodic reviews of existing policy and procedure content by owners or subject matter experts may help identify necessary additions or revisions.

Policies and procedures may require revisions if compliance failures indicate that a policy may be ineffective in driving the right behavior. Internal audits or other methods of monitoring compliance (such as helpline calls) may indicate that employees are inconsistently following the policy or procedure. When trying to understand why noncompliance is happening, you may find that the policy or procedure is unclear in a certain area, employees do not understand it, or employees didn’t know it existed. To improve the policy or procedure document, gather feedback from employees in the target audience. Feedback may also reveal that a process or practice has changed and the policy or procedure document no longer achieves the originally intended objective. When a revision is needed, the revision and the reason for its revision should be documented as part of the amendment history.