Enforcing Your Vendor Credentialing Policy Checklist  

Overview  

Vendors play an essential role in healthcare. From providing supplies, equipment, and repair services to sharing knowledge, expertise, and so much more, they are critical partners in the healthcare ecosystem. Yet, for hospitals and health systems, maintaining stringent health and safety standards for compliant vendor access can be daunting. In a recent survey of supply chain leaders, only 29% said they were very confident the vendor representatives who access their facility are properly credentialed, and only 10% said they were very confident their staff is educated to identify and remediate vendor non-compliance.   

Many organizations are looking for ways to improve their vendor compliance and:   

• Gain more visibility into their vendor activity
• Gain more insight into why a vendor is onsite      
• Make checking in the standard rather than the exception
• Quickly identify vendor non-compliance
• Stay ready for audits
• Alleviate burden from teams
• Instill the importance of compliance in their vendor partners
• Engage and empower their own staff to be partners in compliance and serve as the f irst line of defense

Your policies, the credentials you require, and your engagement processes, both internally and externally, should directly address these key areas and align with your overall strategy for vendor management and compliance goals.  

This checklist is designed to help you work through the primary elements of access management so that you and your vendors can successfully navigate how to interact in the future as partners, while ensuring compliance, health, and safety for everyone. 

1. Review your vendor policy

• The first step in driving vendor compliance is to ensure your vendor policy reflects your compliance standards, is up to date, and includes your expectations for both onsite and virtual interactions.
  • This includes being current on vaccinations, immunizations, background checks, bloodborne pathogen training, HIPAA compliance, and that they have all the necessary licenses or trainings to support your organization’s diverse needs.
• As technology evolves, so do the ways health systems and supplier representatives meet, communicate, and interact. With these changes come new vendor credentialing questions. For example: when a representative virtually remotes into an operating room (OR), do they need to be credentialed? When introducing a new product to a facility via virtual value analysis, do you expect your vendors to remain compliant through that process as well? Whether they are conducting business in person or virtually, it is a leading practice to require vendors to be credentialed to ensure a united front for compliance and consistent business practices across your organization.
• When considering your vendor policy, a good standard is to set up reminders to review your policy. Determine a frequency for reviewing your policy in both normal and emergency situations. At a minimum, policies should be reviewed annually and be reviewed by the compliance department.
• To extend policy impact and enforcement, consider including specific contract language surrounding vendor credentialing compliance in your contracts.Review your vendor policy   

2. Check your communication methods with vendors

• Make sure you have a streamlined way to communicate with your entire vendor/supplier population so that they can be kept aware of how your policy changes may affect them. For example, utilizing templates in your vendor credentialing software is an effective way to communicate with your vendors and ensure they receive important information through a consistent channel.
• If you implement new requirements, such as an acknowledgment or providing their reason for entry, outline your communication plan to ensure vendors are compliant with your policies.
• Compliance is something that typically must be communicated in multiple ways and with different channels. In addition to strong, standardized email communication with vendors, ensure there is clear signage at your organization that provides directives on what the vendor should do, such as how to check in and gain compliance. Adding this information to your public website is another good way to ensure your policies and processes are visible to your vendors

3. Make it as easy as possible on vendors

• Signage is one important way to clearly direct vendors and reduce confusion, but another critical element is ensuring check-in stations are in highly visible areas to capture the most foot traffic. For most facilities, multiple check-in stations at different entrance points will help promote compliance by providing a convenient way for vendors to check in rather than bypassing this critical step.
• Another important way to reduce confusion among vendors is ensuring everything they need to acknowledge, reference, and accomplish is in one place with the ability to manage everything directly from the mobile app. For instance, in your vendor credentialing software, make sure your policy is easily accessible for vendors with automatic reminders to electronically acknowledge it before coming onsite. Also, ensure vendors have full transparency to quickly check their compliance status and receive timely alerts notifying them if a credential is about to expire.
• Facilitating swift and secure vendor access is essential to curbing non-compliance. If getting compliant or checking in takes more than a few minutes, organizations can expect to see vendors bypassing compliant behavior. Ensure your vendors can quickly scan their badge at check-in to streamline the entry process.
• To support compliant access, ensure your vendors are receiving timely alerts when a credential is about to expire so they can easily update their credentials before entering your facility.
• Ensure background checks and exclusion screenings are built into their credentialing requirements. By being automatically part of the credentialing process, organizations don’t carry the risk of having to guess if their vendors have passed their background check. Rather, when it is part of the standard credentialing process, neither the vendor nor the facility has the burden of managing background checks as a separate process.
• Finally, make sure vendors know who to go to for questions. If you’re using symplr Access, all vendor inquiries are handled by our live support team via phone, email, or chat to centralize questions and alleviate burden from hospital staff.

4. Make compliance personal

• For both your staff and vendors, fostering the “why” behind compliance is critical. Telling vendors they must be compliant due to hospital policies alone tends to only go so far and likely will yield disappointing results. Instead, try leaning into the human connection that healthcare is deeply personal and relational. We all have loved ones who engage with the healthcare system, which can be a vulnerable experience. Ask your vendors, “If it was their grandmother undergoing a procedure, would they want an unknown person there with her?” Likely not – they would want to ensure that each person in the room with her was supposed to be there and was credentialed to be there for her safety. With every opportunity, ensure the “why” is communicated, including in your policies, trainings, email communications, verbal communications, and on your website.
• This is true for your own staff as well to help increase buy-in to serve as compliance partners. However, the risk doesn’t stop with patient safety. Non-compliance also leads to organizational risk. If accrediting bodies flag non-compliance at your organization, this can lead to financial and reputational risk, detrimentally impacting the health system, and ultimately, its staff. Each team member has a responsibility to be compliance partners to help protect the organization from this risk. After all, your staff is the first line of defense when it comes to stopping non-compliance in its tracks. See step 5, Educate your teams, and step 7, Stay prepared, for more information.

5. Educate your teams

• Protecting compliance should be part of everyone’s job. Developing a culture of compliance requires strong and consistent staff education, where support is led from the top.
• Consider educating with a video format for engagement. A good f irst step in communicating background on your vendor compliance program is sharing this educational video on the importance of compliance.
• Education shouldn’t be limited to the front desk. Ensure you educate cross-functionally, from supply chain and key departments, such as the OR, to the security team to ensure the loop is closed. Consider going on a departmental roadshow to educate on the importance of vendor compliance and how to be the f irst line of defense along the way.
• Ultimately, your staff need to know why it’s important, how to be a compliance partner, and how to communicate with vendors if they spot non-compliance.

Training Should Include:

• Who to go to internally for questions
• What protocols your organization has in place
• Highlights from your policy
• What vendor passes are available
• Where the check-in stations are
• How to identify non-compliant behavior, such as not having a badge visible, and how to contact security if needed
• Where to direct vendors to gain compliance or ask specific credentialing questions
• How to use your vendor credentialing software to quickly access check-in dashboards and pull reports to identify who is onsite and why if surveyors ask questions
• How to explain the “why” behind compliance to vendors
• Information surrounding the risk of non-compliance, especially if a patient interaction occurs. If a compliance violation occurs due to a non-credentialed vendor interacting with a patient, the liability and fines can be significant.

6. Lean into the data

• When steering your ship towards vendor compliance, let data be your guide. At a minimum, we recommend your organization reviews your check-in and compliance data quarterly to identify trends. Monthly data reviews allow organizations flexibility to pivot and address issues if they arise.
• When reviewing data, identifying repeat offenders is a critical part of improving compliance. Do a quick internal audit to determine if your organization has a process for identifying repeat offenders and note the data used to determine non-compliance. Even more specifically, do a self-audit of how many times your team performs overrides (allows vendor entry even if they are not in full compliance). If you don’t see any overrides, that is likely an indicator that compliance numbers are too good to be true and should be a red flag that vendors are accessing your facility without first checking in. This should, in turn, open an investigation into repeat offenders and inform your processes and policies.
• When looking into your vendor compliance data, incorporate benchmarking into your review. For example, how does your check-in and compliance data compare year-over-year or quarter-toquarter? Or, how do the individual levels of compliance between vendor companies compare to one another? If you identify that one of your vendor companies is demonstrating a high level of noncompliance, you may want to consider scheduling a business review to enforce your policies and ways of doing business.
• When key data is collected and trends are identified, ensure these key metrics are shared back with your departments and teams and reported to leadership to continue garnering support for your vendor compliance program.
• Finally, allow data to inform your policies and business practices. For example, if your organization has an issue with non-compliance in the OR, you could consider focusing efforts on OR education. Or, if you have a particular rep who visits one of your physicians and repeatedly tries to introduce new products without an appointment, then you can investigate that relationship to ensure your physician’s billable time is protected.

7. Stay prepared

• Joint Commission surveyors visit accredited healthcare organizations every 18 to 36 months (every two years for laboratories) to evaluate compliance with standards. One of The Joint Commission standards requires that hospitals are aware of who is entering their facility, why they are there, and what they are doing (EC.02.01.01).
• When The Joint Commission pays a visit, it can leave teams scrambling. Ensure you’re prepared to meet auditing body requirements by taking proactive measures. Some considerations could be to introduce a mock survey to test preparedness, hold a mock audit, and schedule annual or semiannual meetings to review audit preparedness and ensure teams know what to do when auditors arrive at your front door. For example, ensure teams know where to go on your vendor credentialing platform to bring up vendor check-in dashboards to satisfy questions regarding location, compliance status, and reason why vendors are onsite.
• For more information, reference the eBook, The Joint Commission is Onsite.

Assess any other populations— like students, volunteers, and visitors—who may need access

• Vendors aren’t the only outside populations who may need to access your facility. Students learning in clinical rotations, volunteers, contractors, visitors, and several other populations all have reason to be on-site and should be addressed as part of a holistic access management strategy.
• Implementing a strategy for everyone who accesses your facility helps ensure compliance and patient safety. General credentials and requirements should be tailored to the different types of populations accessing your facility and the subsequent levels of patient access they’ll require. Your vendor credentialing software should be able to provide best practices to help ensure safety while not overburdening your visiting populations.
• Additionally, your visitor management program should enable your organization to set visitor limits if conditions require it and assist in local contact tracing efforts. Using an integrated visitor management system is also an excellent way to help prevent non-compliance by flagging vendors attempting to access your organization falsely as a visitor.