sustainable risk management for an evolving healthcare arena

The healthcare reform environment requires organizations to undertake sustainable risk management, which involves continually re-evaluating the risks posed by changes and implementing strategies to mitigate their impact.

Healthcare reform has introduced tremendous change for payers and providers as well as for third parties that provide services to the healthcare industry-and the rate of change is expected to accelerate in the near term. The bumpy rollout of certain provisions of the Affordable Care Act (ACA) has created uncertainty around issues that can affect revenue, including new regulatory requirements, the number of insured, and shifting payment models.

Forward-thinking healthcare organizations began some time ago to factor the coming monumental changes into their strategic plans and to establish critical goals for maintaining their financial viability. To truly thrive, however, organizations must consider the risks that threaten such objectives. Today's evolving reform environment requires that organizations take a sustainable risk management approach, which involves continually re-evaluating the risks posed by the changes and developing and implementing mitigation strategies. Perhaps most important, sustainable risk management necessitates monitoring and making adjustments as needed. An ongoing process is essential for organizations to remain nimble enough to respond quickly to continuing changes and avoid repercussions, such as falling short of revenue goals, incurring fines and penalties for noncompliance, and suffering a damaged reputation in an era of increased data transparency and media scrutiny.

Several areas in particular pose risks for healthcare organizations. Through sustainable risk management, organizations can implement a proactive approach to addressing the risks that will enable them to come out on top.

Unpredictable Revenues

Amid the turmoil of reform, one trend is certain: Significant changes in the payer mix, coupled with declining volumes, are exacerbating financial pressures on healthcare organizations-and even more change is on the horizon. Payers' adoption of alternative payment models (including, but not limited to, accountable care organizations [ACOs], bundled payments, and value-based purchasing or pay for performance), increased patient responsibility for payment, and narrow networks are likely to have a negative effect on payment rates and utilization patterns. Incentives specifically intended to reduce the use of inpatient services, such as those provided for by the Centers for Medicare & Medicaid Services (CMS) through the Hospital Réadmissions Reduction Program and the recently delayed "two midnight" rule, could decrease the reimbursable volume of patients and services.* It remains to be seen whether newly insured patients will make up for those declines.

To mitigate the risk of reduced revenues due to changes in payment and volume, healthcare organizations should conduct extensive scenario analyses to prepare for various situations and build in the flexibility necessaiy to react promptly to change. As much as possible, organizations should move from a fixed-cost to a variable -cost structure, particularly with labor costs. Although this shift could adversely affect an organizations reputation in its local community, labor nimbleness and flexibility to react to market changes are imperative for maintaining a positive bottom line and future viability. To formulate plans and respond accordingly, organizations should closely study the market and engage physicians and payers.

Ongoing and real-time monitoring is critical, as well. It is important to be vigilant because financial pressures are expected to keep increasing in the near future, although the specifics remain unknown. Even as more answers are revealed over time, changes to laws, regulations, and payment will continue. Thus, healthcare organizations should implement processes for timely and frequent monitoring to identify trends in payment rates, volumes, and payer and service mixes and to make the necessaiy adjustments on the cost side to achieve revenue goals.

Organizational Realignments

The need to reduce costs might result in significant organizational changes, including mergers, acquisitions, and joint ventures, to obtain greater economies of scale. Healthcare organizations already are pursuing horizontal integration (hospitals merging to create efficiencies in acute care) and vertical integration (hospitals acquiring physician practices and ancillary service providers to increase market share and form ACOs). Some organizations are stopping short of actual mergers and acquisitions but using joint ventures, with members that can collaborate on administrative components-for example, IT and supply chain.

Not surprisingly, dramatic organizational alterations come with substantial risks. Simply combining with another organization will not produce long-term success. Again, ongoing and frequent monitoring is required. In this case, the tracking should determine whether anticipated results were realized and, if not, what type of response might be required.

For example, a healthcare organization might acquire several hospitals in a state to increase its buying power with vendors. The organization should then monitor its contracts and actual costs to determine whether they achieved the significant savings projected in the ROI studies performed before the acquisition and actually improve the bottom line. If the buying power has not been fully utilized-whether through lack of compliance with new purchasing requirements or through inappropriate application of contract terms-or, worse, if it has deteriorated, immediate, in-depth analysis is required to uncover and resolve the root cause.

Some healthcare organizations also are undergoing major business redesigns to improve administrative efficiency through increased centralization and standardization. A large organization with multiple hospitals might, for example, attempt to centralize accounts payable. But as many organizations have learned the hard way, such centralization is difficult to realize. Successful transitions must verify that no payments are slipping through the cracks. Identifying the appropriate controls for conversion readiness requires much planning and data analysis before the conversion. In addition, proper monitoring recognizes post-conversion hiccups in a timely manner, which allows not only quick corrections to inaccurate payments, but also implementation of controls to prevent reoccurrences.

Financial analysis can bring issues to light early, but the root cause of an issue often is not directly related to finances. Perhaps the CFO of the acquiring healthcare organization believed that its acquisitions would reduce its costs for artificial joints. Although a lower price from a vendor is possible, the CFO also could discover that the organization's newly acquired physicians are loyal to a more costly manufacturer and resistant to change. Someone has to relent, which requires good relations between the CFO and chief medical officer.

Physician Integration

A primary impetus for many of the organizational changes underway is the need to assemble the right complement of primary and specialty physicians to attract payers. This type of physician integration is usually attempted by employing physicians, which entails many risks.

Hospitals frequently find that when a physician becomes a salaried employee, productivity falls, which cuts into expected revenues. It is estimated that hospitals typically lose $150,000 to $250,000 per year for each employed physician during their first three years of employment.b This cost quickly accumulates when an organization employs hundreds or even thousands of physicians. The challenge for hospitals and health systems is in determining how to prevent the losses without alienating physicians.

Physicians' involvement in this strategy is vital. They must be part of the decision-making process and buy into often-challenging strategies and tactics. Such buy-in is particularly important when plans go awry, requiring tough decisions. It is therefore important to include physicians throughout the sustainable risk management cycle.

Emphasis on Quality of Care

Administrative processes are not the only targets of standardization. ACOs are expected to lead the push for more standardized use of evidencebased practices and clinical pathways, which will reduce the role of physician judgment and, in turn, physician autonomy. Without physicians' buy-in to such approaches, organizations face a heightened likelihood that payers will withhold not only bonuses but also payment for provided services that were not part of the prescribed pathway. The public availability of providers' performances on quality indicators can dramatically shift reputations in individual markets and lead to further volume declines.

An inability to provide payers with the requisite supporting data to qualify for outcome-based payment, regardless of whether the quality standards were followed, also puts revenue at risk. It is the provider's burden to demonstrate compliance.

To combat these revenue risks, healthcare organizations should establish an organizationwide understanding of the importance of the quality initiative. A prescriptive approach to providing care will prove difficult for some providers to adopt. However, sustainable risk management will enable an organization to monitor whether physicians and staff perform processes as designed and to react appropriately if physicians and staff do not do so.

IT That Informs and Protects Patients

Patients are increasingly seeking physician interactions that do not require an office visit. Cost and efficiency considerations for providers add to the appeal of consults with patients via telephone, video chats, or email. But the move to digital communications-as well as the electronic storage of patient information-carries risks related to data security, privacy, and IT system integrity.

Unfortunately, the healthcare industry traditionally has fallen behind other industries in IT investment. The lack of investment is partly because many healthcare organizations are not-for-profit businesses and use decades-old technology for records and back-office activities, such as capturing charges and generating claims, to reserve significant technology investments for functions that directly affect patient care. However, consumer demand, new incentives related to electronic health records (EHRs), and the emphasis on quality of care require increased provider IT efforts.

Providers also face an increased risk of expensive fines, damaged reputations, and loss of revenue from noncompliance with HIPAA privacy, security, and breach notification rules and HITECH requirements. Other risks include the possibility of fines and imprisonment if providers are found to have fraudulently testified to the meaningful use of EHRs. Beginning in 2015, failing to switch to electronic records can lead to decreased remuneration of physician fee schedules of 1 percent per year.

The average fine imposed by the Office for Civil Rights (OCR) amounts to more than $900,000.c With a patient privacy or security breach or rights violation, multiple government agencies, including the Federal Trade Commission, can impose fines. These agency fines do not include other costs associated with a breach of protected health information-costs that can involve patienl notification, ongoing litigation, settlements, credit monitoring, and patients' reputation loss. Healthcare organizations' average cost per record breached is $233, according to one survey.'1 Meanwhile, another survey determined that the average total cost for a security breach is $810,189.''

In addition, due to concerns about meaningful use fraudulent attestation, CMS recently increased its meaningful use audits to check for EHR systems that did not meet stage-one funding requirements. After performing a self-audit, one health system returned $3i million in incentive funds to avoid potential fines from a meaningful use audit.'And one former healthcare CFO faces potential prison time and fines for allegedly committing identity theft and attesting for fraudulent meaningful use funds/

Complying with HIPAA security and privacy and HITECH regulations requires active risk management. Ongoing audits and reviews are needed to confirm that patient records are protected and that organizations are compliant with regulations. Security and compliance cannot be considered just an annual exercise. Forming a HIPAA steering committee and performing a gap analysis and risk assessments should be the start of all organizations' HIPAA compliance programs.

Continually increasing controls and mitigating risks can help to build an effective security and compliance program. Performing self-audits can improve the accuracy of meaningful use attestation and help avoid fines. In addition, continuing to testify to meaningful use requirements can safeguard full remuneration for physician fee schedules and ensure that organizations receive the government's incentive money to pay for EHR programs.

Call to Action

A sustainable risk management program can increase the likelihood that a healthcare organization will achieve its business objectives by:

> Proactively identifying the threats that present the greatest risks

> Raising awareness of those risks

> Developing and implementing risk-treatment plans to manage those risks

A successful risk management program helps the organization prioritize strategies focused on risks that are likely to have the biggest impact on the business. The exhibit on page n3 shows a sample risk dashboard with elements, such as:

> Classification of the risk, which defines the organizational function or functions affected and/ or responsible for managing the risk

> Description of the risk, in summary form (with more details included in the remediation plan)

> Residual risk score, which is an indicator of the severity of the risk and is produced by a simple scoring algorithm that captures all stakeholders' scoring of risk and the effectiveness of the controls in place

> Residual risk ranking, which is based on the organization's risk appetite (color-coding of the residual risk score indicates the importance and priority for risk treatment purposes)

Survive and Thrive

Although 2014 is a milestone year for ACA reforms, the amount and pace of change will not end soon. The healthcare environment will evolve in comingyears. Organizations that invest in and maintain a sustainable risk management program will be better positioned to navigate the seemingly endless threats to the industry and to achieve their strategic objectives. *

AT A GLANCE

* A sustainable risk management approach includes the use of extensive scenario analyses to mitigate the risk of reduced revenues from changes in payment and volume.

* A successful risk management program helps organizations prioritize strategies for risks that are likely to have the biggest impact on their business.

* Continually strengthening controls and mitigating risks through a risk management program can help to build an effective security and compliance program.

a. Hall, C., and Sanderfon, B., "Minimizing the IPPS Final Rule's Impact on the Hospital Revenue Cycle," Healthcare Insights, February 2014.

b. Burnett, S., end Hawkins, C., 'Strategic Physician Onboarding: Seven Tactics (or Minimizing Losses on Employed Medical Practices,' Becker's Hospital Review, Jan. 7,2013.

c. "HIPAA Omnibus Final Rule Changes Breach Notification 8. Enforcement Plus an Audit Update," OCR/Workgroup for Electronic Data Interchange webinar series, July 17,2013.

d. '2013 Cost of Data Breach: Global Analysis," Ponemon Institute research report, May 2013.

e. "Eighty-Two Percent of Health IT Executives Report Their Organizations Are Not Prepared for the Unexpected," Business Wire news release, Feb. 23,2014.

I. "HMA to Repay $31M in Improper Meaningful Use Payments," iHealthBeat, Nov. 6,2013.

g. 'Texas Medical Center CFO Indicted on Meaningful Use Fraud Charges," iHealthBeat, Feb. 10,2014.

About the authors

Sarah A. Cole, CPA, is senior vice president, CHAN HEALTHCARE LLC, and partner, Crowe Horwath LLP, St. Louis, and a member of HFMA's Greater St. Louis Chapter ([email protected]).

Raj Chaudhary, CGEIT, CRISC, is principal, Crowe Horwath LLP, Chicago, and a member of HFMA's First Illinois Chapter (raj.chaudhary@ crowehorwath.com).

Derek A. Bang, CPA, CGMA, is partner and healthcare advisory services leader, Crowe Horwath LLP, Indianapolis, and a member of HFMA's Indiana Pressler Memorial Chapter ([email protected]).