Managing risk in the hospital setting is a difficult but vital practice. On any given day, the risks are enormous: situations ranging from data breaches to medical errors and hazardous conditions can arise, jeopardizing human safety, compliance and finances, reputations, and more.
While quality and risk managers are ultimately responsible for continually assessing and minimizing an untold number of risks to patients, staff, and the public, every healthcare participant has a role to play. Understanding the risks and learning how effective risk assessment is conducted is a great place for everyone to start.
Why is healthcare risk assessment important?
As a healthcare administrative professional, you understand the importance of mitigating risk to foster patient safety and shore up revenue that can be lost due to noncompliance. You’ve read the health industry articles on it, and perhaps even attended hot topic sessions about risk mitigation provided by a professional organization.
Increasingly, quality and risk managers or hospital administration may be offering education and training about how the facility performs and mitigates risk. But who exactly requires risk assessments, why are they necessary, and how can your organization better manage an effective program of risk assessment?
Every healthcare organization employee, administrator, and governing board member should know that risk assessment is mandated through the laws and guidelines of regulatory bodies. The U.S. Department of Health and Human Services (HHS) is perhaps the most widely known entity that requires and monitors risk compliance. Its Health Insurance Portability and Accountability Act (HIPAA) outlines breach and security rules that surround protected health information (PHI).
The HIPAA Security rule requires a covered entity or business associate to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.” The Security Rule also requires the maintenance of a written record of the action, activity, or assessment, which may be electronic.
To comply with these HIPAA requirements, a hospital must perform a risk assessment of any potential breach to determine the probability of compromise of PHI, and it must perform a written risk assessment as to the vulnerabilities of electronic PHI.
Also, the Office of Inspector General (OIG), in their November 2023 General Compliance Program Guidance, formally included risk assessment as an element for an effective compliance program. OIG recognizes the importance of a formal compliance risk assessment process as part of the compliance program. Specifically, OIG states in this guidance that a compliance risk assessment is important in that it focuses on risks stemming from violations of government health care program requirements and other actions or failures to act that may adversely affect the entity’s ability to comply with those requirements.
In addition to these requirements, other government programs and regulations address the need for risk assessment. Among them are:
- The Department of Justice (DOJ)
- The Centers for Medicare & Medicaid Services (CMS)
- The Environmental Protection Agency
- The Occupational Safety and Health Administration (OSHA)
Healthcare compliance is serious business with significant fiscal consequences. Penalties for regulatory noncompliance are steep in terms of monetary fines, exclusion from participation in federal healthcare programs, prison time, and reputational damage. Consider that:
- In 2023, OIG reported 707 criminal actions against individuals or entities that engaged in crimes impacting HHS programs and 746 civil actions (e.g., false claims lawsuits and civil monetary penalty settlements).
- Also, in 2023, OIG excluded 2,112 individuals and entities from participating in federal healthcare programs, including Medicare and Medicaid.
Avoiding or mitigating legal breaches and monetary penalties is a huge incentive for including risk assessment in your healthcare compliance program. Besides the legal requirements and economics fueling its importance, there are other reasons to undertake the process. When issues are identified proactively through risk assessment and amended through the corrective action plan (CAP) process, patient safety and the provision of quality care are positively impacted.
Finally, regular risk assessment increases your healthcare organization’s ability to defend against allegations of noncompliance or wrongdoing and potentially reduces the number and severity of malpractice lawsuits filed. All of this leads to positive public perception and a more favorable reputation, which is crucial in today’s competitive healthcare market: Patients have a great deal of choice in where they obtain their healthcare.
Leading practices in healthcare risk assessment
Information is power. Understanding and being able to communicate the underlying reasons your organization conducts risk assessment is often half the battle.
The following are leading practices when conducting effective risk assessment. No matter your role, do your homework: Tap into resources such as CMS and OIG to understand risk. If your role requires participation in risk assessment, identify the risk areas most crucial to your compliance program.
- Provide ongoing education for everyone from senior leaders and the governing board to front-line clinicians and support staff on the “why” of risk assessment to get their buy-in and support.
- Define a manageable scope for any risk assessment program and involve the necessary department managers and staff as stakeholders in the process.
- Identify a useful process for conducting risk assessment and use a rating system for the risks encountered.
- Develop a meaningful CAP process with specific measures such as education, policy and procedure review, and additional auditing and monitoring.
- Report risk assessment results back to senior leaders, the governing board, and other stakeholders to promote education about risks and to create a culture of compliance.
- Use compliance and risk management software to continually assess your regulatory compliance stance and uncover areas of risk and better manage the remediation process enterprise wide.
- House risk data in one location and move beyond the manual import of risk management and claims data to eliminate errors and to ensure information is current and accurate.
- Provide the tools for any employee to do their part in mitigating risks, including the ability to report (near) incidents; answer investigations, surveys, or audits; and obtain on-the-spot education or reference.
- Allow process managers and executives to access real-time data by role to support strategic decision making along the entire governance, risk, and compliance continuum.
With everyone working together on mitigating risk, your organization will be better positioned to support a complete culture of compliance and safety.
