Top Risks for 2021 and 2030 - Healthcare Industry Perspectives

Healthcare organisations are facing unprecedented challenges because of the COVID-19 pandemic. In order to align organisational emergency management practices with public health emergency guidelines, most healthcare providers will need to create or revise policies for visitors, staff attestation, social distancing and so on; develop risk mitigation processes to address shortages in personal protective equipment (PPE); and bifurcate clinical areas to accommodate both COVID-19 positive and COVID-19 negative patients, to name a few. Organisations should also incorporate COVID-19 infectious disease protocols into their existing emergency preparedness plans to accommodate simultaneous events, in an all-hazards approach. Each organisation will need to ensure its business continuity plans (including department-specific plans) include a focus on public health safety and be prepared to provide adequate staffing to account for labor shortages, the increase in documentation requirements, new Occupational Safety and Health Administration (OSHA) provisions, and the significant reporting obligations for COVID-19 testing and vaccine distribution.

Among the most pressing priorities are vaccine distribution policies and protocols and the associated state and federal reporting requirements. For example, vaccine-related internal documentation must include all adverse drug reporting as well as secondary dosage scheduling, reminders and so on. This area is especially important if the healthcare organisation is distributing vaccine responsibilities to their clinics and pharmacies.

The development of a comprehensive organisational vaccine protocol is critical to meeting the associated regulatory requirements and mitigating legal and regulatory compliance risk in the likely event of future scrutiny by government agencies.

A key risk mitigation strategy is to develop a supply chain resiliency plan. A critical component of the healthcare supply chain is the flow of numerous product types from manufacturer to patient. This requires the participation of various stakeholders who work in concert to achieve the goal of meeting patient care needs. The supply chain implications of simultaneous events such as a hurricane during a pandemic can play a significant role in supply chain operations. These types of simultaneous events can be mitigated through activation of programmes, determination of the language to be included in emergency declarations, public messaging, and more. Vendors for commonly needed products during these events, such as vaccines and PPE, are often limited. In public health emergencies, demand for these products can far exceed production capacity.

Each healthcare organisation should verify that a supply chain resiliency plan that focuses on considerations for providers and patients is in place. The plan should also address manufacturer and distributor roles and key vulnerabilities and include pre-event, response and recovery considerations for the necessary components of the healthcare supply chain.

The prospect of regulatory change and heightened enforcement has been a key consideration in the identification and mitigation of organisational risk in the healthcare industry for decades. However, this year, perhaps more than ever, regulatory change will drive a shift in the way healthcare is delivered. Additionally, a new presidential administration brings with it a new perspective on healthcare reform, which will almost assuredly result in further policy and regulatory change, with unknown implications.

The fraud opportunities associated with COVID-19 are expected to be a key focus of federal enforcement officials in 2021. Compliance with rules and regulations issued in response to the pandemic, such as those regarding the sale of PPE and federal healthcare payments relating to federal recovery programmes, will remain critically important. While the pandemic may have caused a temporary enforcement slowdown in 2020, we are already seeing an escalation in enforcement actions and recent regulatory changes will likely amplify enforcement trends throughout the year. For example, the Office for Civil Rights (OCR) ramped up privacy and security enforcement actions toward the end of 2020 for both small- and large-scale healthcare organisations. We expect this activity to remain steady with a continued focus on OCR’s new Patient Right of Access Initiative as the industry heads toward the goal of coordinated care and the comment period comes to a close on newly proposed HIPAA Privacy Rules. Further, recent regulatory changes such as those to the Stark Law and the Anti-Kickback Statute, as well as new regulatory initiatives such as the Office of the National Coordinator for Health Information Technology (ONC) Cures Act Final Rule, will bring about additional scrutiny. Moreover, healthcare fraud investigation and prosecution will continue to be a top priority for the Department of Health and Human Services (HHS) Office of Inspector General (OIG) and the Department of Justice (DOJ), especially with the newly created False Claims Act Working Group. Based on recent regulatory changes and OIG, OCR and DOJ enforcement actions, compliance will remain a top concern, especially in the areas of telemedicine, opioid prescribing, substance abuse treatment facilities, genetic testing, Medicare Advantage Plans, electronic medical record certification, kickbacks and privacy.

Furthermore, President Biden plans to focus his attention on the protection and expansion of the Affordable Care Act (ACA), value-based care, racial health disparities, surprise billing, drug price transparency, and expanding Medicare and Medicaid. These plans for healthcare reform will hopefully reduce costs and create a healthcare system that is less complex for patients to navigate. However, new areas of healthcare compliance risk areas will emerge, and industry participants will need to identify and mitigate these risks.

Many compliance leaders are being asked to do more with less, even as legal and regulatory compliance risks increase. With the significant changes brought about by the pandemic, the changes to come with the new administration, and the OIG, OCR, and DOJ focus on enforcement activities, maintaining effective compliance programmes, and performing timely and thorough risk assessments will continue to gain importance. Compliance programmes should be continually evolving to identify new compliance risks from insights gathered from disparate sources, both internal and external. All efforts mounted to mitigate newly identified risks, including implementation of effective controls, new auditing and monitoring initiatives, and training, should be utilised in order to enable a compliance programme to truly be effective. Because demonstrably effective compliance programmes can identify, detect and correct instances of regulatory noncompliance and because they reduce fines and penalties should things go wrong, their existence has likely never been more important than it is now.

The pandemic has had significant impacts on many in-person service businesses that typically employ large numbers of young to middle-aged persons. These impacts include layoffs, unpaid furloughs, bankruptcies and even closures. Increases in unemployment are typically accompanied by a reduction of commercially insured patients and an increase in Medicaid and uninsured patients. Many healthcare organisations are financially stressed both because of fewer encounters in profitable service areas and increased costs — due to staffing shortages (requiring the use of expensive temporary patient care labor), acquisition of PPE and other COVID-19-related supplies, and the reconfiguration of existing treatment space. The financial impact has been compounded by the relatively low payments for COVID-19-related care that, in many cases, includes extended lengths of stay and the use of intensive care unit (ICU) resources. In 2020, the federal government provided significant funding through the Coronavirus Aid, Relief, and Economic Security (CARES) Act and other initiatives. However, there is a high degree of concern that 2021 may see a marked decline in pandemic relief funding.

Many healthcare organisations may find themselves in a position of needing to simultaneously fund purchases of new technology, replenish critical supply inventories, deal with continued labor shortages and pivot to delivering remote/virtual care, all while experiencing the operating margin pressures highlighted above. In addition, this could be compounded by continued delays in patients seeking elective medical procedures due to pandemic concerns or uncertainty of employment and/or insurance coverage. Although many organisations have recently improved liquidity with debt issuances, concerns have been raised around the ability for some organisations to access sufficient additional capital if a prolonged or severe recession develops in 2021.

As healthcare organisations continue to leverage data to provide advanced and predictive healthcare in an attempt to paint a more complete picture of an individual’s health, more data will be collected not only from the patient, but also from outside data resources, much like today’s data-driven leaders (e.g., Amazon, Microsoft, Apple) do. These activities, coupled with a new administration and new and proposed regulatory changes (e.g., the ONC Cures Act, proposed HIPAA Privacy Rule changes), will create many privacy- and security-related challenges for healthcare organisations. When contemplating the collection of new data sets, many determinations should be made:

• Is this data protected health information (PHI) and therefore governed by HIPAA and other regulations?
• Is this data necessary to provide better care to patients?
• Who should have access to this data and in what manner may it be provided?
• With whom can this data be shared?
• Who owns this data?
• Who is responsible for amending data if discrepancies are noted?
• How does the healthcare organisation ethically use this data to help its financial position?
• What are the correct mechanisms to engage with the patient when the data is pointing to potential health needs or trends that need to be encouraged or changed?

Critical to compliance with the many privacy and security requirements associated with PHI is the accurate identification of patients and all of the additional data related to an individual (e.g., geographic location, estimated income level, credit score, shopping trends). A historical problem in healthcare information management has been the lack of a primary and universal identifier for patients. As a result, many healthcare organisations still deal with duplicate patient records that have to be assessed and cleaned. Bringing in additional data elements can continue to help ensure the integrity of the patient identity, but it can also introduce additional risk and privacy concerns, if not done accurately and securely. While data can drive better care, it is also important to understand that as more data is collected on these patients, the value of the information being created is going to make these data repositories even more enticing for attack, snooping or other misuse. The ability to monitor a user’s activity may need to be improved to identify potential snooping or abuse of access to new data in potentially new environments. Many healthcare organisations have not yet considered the many privacy and information security implications that accompany these more pervasive data repositories, including the operational challenges and overall risk they present. However, keeping patient data safe and secure should continue to remain a priority, and investments may be required to do so.

Successfully managing labor costs is not a new concept, especially in the healthcare industry. Healthcare is fundamentally a service industry, one requiring a large complement of highly skilled personnel. The general reimbursement model does not allow for the easy pass-through of increased labor costs, which, absent efficiency gains, leads to compressed operating margins. Healthcare labor shortages have been predicted for the past decade, as the rate of healthcare professionals retiring exceeds the rate of those entering the workforce. Additionally, the need for healthcare workers is growing, as the average life expectancy of the general population has increased by nearly 10 years over the last half century. The impacts of these demographic trends have been compounded during the last year due to the effect COVID-19 has had on the healthcare industry. The historically high censuses at many hospitals, generally, and within their ICUs, specifically, have had and will continue to have both short- and long-term consequences for labor costs.

In the short term, many organisations have offered shift premiums or COVID-19-related enhanced pay, hired contract nurses and physicians, and leveraged high levels of overtime to meet the care demands of the pandemic. These necessary labor solutions result in increased cost over normal/planned operating levels, with reimbursement levels for services often not adjusting to adequately compensate for the increased cost. In addition, a soft cost is being incurred, as the effects of the strain put on front-line workers in the battle against the pandemic (e.g., burnout, turnover, career changes) will likely continue to be felt long after the COVID-19 pandemic is over. The risk of a clinical labor supply shortage is very real, in both the short and long terms. Without adequate planning and action, providers will likely see significant drops in key metrics across the board, from quality to patient and employee satisfaction to operating margins and beyond.

Actions to consider for addressing decreased margins due to labor costs should include increasing telehealth and virtual care options, leveraging technology (including artificial intelligence) to find better clinical pathways and outcomes, optimising scope of practice for clinical providers, analytical analysis to identify under capacity and negative margin service lines, clinical process improvement and re-engineering initiatives, and strengthening relations with medical schools and clinical practice programme.