One of the critical elements of an effective compliance program is establishing and maintaining communication channels that permit employees to report sensitive matters outside the normal supervisory channels. The U.S. Sentencing Commission Guidelines and Department of Health and Human Services (HHS) Office of Inspector General Compliance Guidance (OIG) call for a hotline. Results from the 2024 Healthcare Compliance Benchmark Survey, conducted by SAI Global and Strategic Management Services, found that most organizations outsource their hotline function. There are many reasons for this, in that the benefits of outsourcing it to a vendor far outweigh those of an internally managed one. The cost of staffing qualified people in-house is prohibitive. There is the problem of ensuring that the systems are blocked and “backstopped” to prevent anonymous caller identification. There is also the problem, especially in smaller organizations, that those answering the call may recognize those reporting problems, and any calls being received need to be in an area where they can be overheard by others. Other factors are that those answering calls should have training and experience to properly debrief those reporting problems. Internal staff, especially those answering calls part-time most often lack proper training and experience to manage the process well, whereas vendors have trained people who have this as their sole duty. There is further the problem that callers feel more secure speaking without an outside party than one that is internal to the organization. There is also the issue of enforcement agencies that question the effectiveness and credibility of internal hotlines. With all these factors at play, the big question for healthcare organizations is how to make the right choice in vendors. The following are some tips to consider:

Tips on Evaluation Hotline Vendors

• Cost. For budgetary and control purposes, ensure the vendor’s service fee is set and not variable. A set fee is usually under $2 per employee per year, depending on the size of the service population.
• Contract Termination. Avoid contracts that do not permit cancellation by 30 days written notice. Clients should be held by good service, not by contracts.
• Industry Expertise. Seek vendors that are knowledgeable about and specialize in the healthcare sector. Those vendors generalized to all sectors will have operators who may not understand how to fully debrief and develop necessary details.
• Operator Answered vs. Web-based Reporting. Ensure the vendor being considered provides both live operator and web-based reporting. With changing demographics, either approach alone has deficiencies that undercut its value.
• Related Policies & Procedures. Vendors should assist with developing operating protocols for following up on allegations and complaints received through the hotline.
• Timeliness. Insist on the provision of a full written report within one business day of receiving the call. For urgent matters, it should be immediate.
• Reports Delivery. Written reports must be clear, concise, and logically presented to permit proper action.
• Report Delivery. How the report is delivered is important. There are security issue reports sent by facsimile or email. Insist on secure web-based reporting, with notification of a report being provided via email.HIPAA Compliance. In the healthcare sector, there is always the potential for protected health information (PHI) to be included in calls made to the hotline. As such, the vendor should execute a Business Associate Agreement (BAA) to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA).

Interested in learning more about hotlines? Contact Shelby Cole at [email protected].