A Compliance Hotline is a telephonic or web-based hotline designed to receive reports from employees on compliance and ethical concerns. Compliance hotlines typically allow for anonymous and confidential reporting and are open 24-hours a day, 365 days per year to receive reports.  

A Compliance Hotline permits employees and other groups of individuals engaged to work at the organization to report potential wrongdoing. Internal reporting enables the Compliance Department to investigate reports and substantiate wrongdoing. Information obtained through Compliance Hotline reports helps the Compliance Department better understand risk and the internal culture of the organization.

A Compliance hHotline is a critical communication channel whereby an organization may be alerted by those in the workforce to potential violations of laws, rules, regulations, Code of Conduct, policies, and/or procedures.  

A variety of laws, regulations, and guidance from federal and state authorities mandate and encourage the creation of a communication line that allows anonymous reporting of possible regulatory compliance problems and concerns, including the .  

U.S. Sentencing Commission’s “Guidelines for Organizations,” HHS OIG’s “General Compliance Program Guidance,” and its industry specific Compliance Program Guidance documents, the DOJ’s “Compliance Program Effectiveness Guideline,” the Sarbanes Oxley Act and the Affordable Care Act. 

In general, workforce members should report known or suspected violations of Federal or state laws, health care program rules, regulations, and the organization’s Code of Conduct, policies or procedures. Examples include matters relating to financial misconduct, questionable arrangements with a referral source, improper claims processing, falsification of records, embezzlement, theft, and accounting malfeasance, as these areas would involve direct action by the Compliance Officer and/or Legal Counsel. Many employees report HR-related issues to the Compliance Hotline, such as unlawful harassment, discrimination and difficulties in the workplace. Regardless of the topical issue, it is in the best interest for organizations to learn of them and take appropriate action to prevent or mitigate unwanted consequences or liability. Any reports of actual or imminent violence or violation of criminal law should be turned over to appropriate law enforcement agencies

Contact your organization’s Compliance Hotline when you observe or know of an actual or suspected violation of Federal or state law, health care program rule, regulation, and the organization’s Code of Conduct, policy or procedure. Many organizations also maintain an open-door policy and encourage reporting to a manager and/or the Compliance Officer.

Regardless of your business industry or the nature of your operations, having a Compliance Hotline available to employees is a best practice. Establishing a Compliance Hotline provides employees, contractors and other workforce members with a confidential and secure channel to report concerns. Making internal reporting channels available to the workforce can help reduce instances of violations that could lead to costly fines and remedies.

Promotion and awareness of the Compliance Hotline is critical to its success. The steps for contacting the Compliance Hotline should be included in new employee orientation, the Employee Handbook and Code of Conduct, the annual Compliance Program training, internal intranet, company newsletter, and posted in employee break-areas.

Organizations should establish a record retention policy that governs the length of retention for all documents produced, received or maintained by the organization, including Compliance Hotline Reports. The Compliance Department then would adhere to the established policy. Retention and deletion of Compliance Hotline reports should never be an ad hoc process. As a general rule, the Compliance Hotline log should be part of the permanent records. Individual case files should be retained as long as the information is current or useful but should not be expunged without an affirmative decision by the Compliance Officer or Legal Counsel.

The Compliance Department should always maintain a report log that captures key facts, such as the date and time of receipt; location of where the incident or concern occurred; reporting channel (i.e., web, phone, in-person); nature of the report; who is/was involved in the investigation and resolution; is the reporter anonymous. A copy of the initial report, investigation notes, interview notes, and summary of the resolution and corrective action should all be retained in compliance with the organization’s document retention policy.

Who would investigate a Compliance Hotline report depends on the nature of the information reported. The Compliance Officer or their designee typically investigates reports of non-compliance with laws, program rules, regulations, the Code of Conduct and company policies. The Compliance Officer may consult with Legal Counsel before investigating reports of non-compliance. Matters of a clinical nature, IT, security or human resources, should be assigned to the appropriate department to investigate and reported back to the Compliance Officer.