Ahead of the Curve: How Comprehensive Vendor Monitoring Mitigates Risk

So welcome everyone to Ahead of the Curve, a webinar discussing how comprehensive vendor monitoring mitigates risk. Our speakers today are ProviderTrust co founder and managing partner Chris Redditch, as well as Katie Harvey who serves as our vice president of the provider segment. Today, we’re going to be discussing a little bit about vendor monitoring. We’ll end with our final thoughts. It’s going to be a q and a session with Katie and Chris, and we’ll also take some questions from the audience if we have time. And with that, I’m going to turn it over to Katie to get started. Thank you. Hi, everyone. Thanks for joining, and hello, Chris. I am excited to have this conversation with you today. Really focusing on the responsibility health care organizations have to monitor vendors and vendor owners to meet the federal and state exclusion monitoring regulations. And we are really here to learn from your experience in this space. So as we get started, I think it’s best to begin with who and what we are going to be talking about. My first question is, what criteria or factors define a business as a vendor in the health care space? Katie, while we’re while we’re waiting for, people to answer the question, I could, give a little bit of, my history. One one of the reasons I actually started ProviderTrust was because I was, working in a business, and an individual actually embezzled a bunch of money. And I saw kind of how that impacted me, not only on a personal standpoint, but my family. And that was one of the kind of the main reasons why, I started, provider trust, really to to to try to pull or eliminate, fraud, out of health care. So, in interested in, the the the results of these, of of these questions. You see the the results that just popped up, Chris. I think, most of the crew is right along with what you would say, wouldn’t you? Yeah. So, when when when you’re looking at a vendor, one of the common misconceptions is that, it’s just, in terms of health care, it’s just someone who’s working with the patients. Typically, those are described as FDR vendors or first tier downstream related entities. But, actually, based upon the law, it’s any, vendor. Basically, anyone who’s providing goods or services that you’re paying directly or indirectly within health care. So that could be anyone from a lawn care person, to a window washer, to Cardinal Health or someone who’s actually providing instruments, in the surgery. So it really is everyone kind of on within your AP system, that that you’re paying both directly or indirectly. Now there are situations, where, you could work with an excluded vendor. If everything is completely segmented off and there’s no intermingle of, Medicare or Medicaid funds, so any type of government funds. But, typically, the easiest way to to do this is you need to monitor, all your owner ours, all your vendors. And then the other next step is the owners. And this is actually where where the problem is and we see with with our clients is, how do you actually collect that information, Katie? That’s the hardest thing, to do. So being able to not only collect and have accurate vendor information, but then to go that next level, and collect owners. And and people might be asking why owners. The federal government OIG says anyone who owns over five percent of an entity, you need to monitor. And the reason for that is we we see a lot of fraud where individuals will will get excluded, and then they’ll hide behind what we call the corporate veil. So, you really need to not only be monitoring the the the entity, but also the owners as well. And we’ll talk a little bit more about that as the conversation goes on. To confirm, Chris, vendors, this includes janitorial services, food, catering. I mean, you think about the span of entities that will do business within your health care organization. They are all defined as a vendor. Correct? They they are. Yeah. And and, again, as I as I said earlier, that’s a common misconception where it’s just anyone who’s working in the in the medical space. But it is really, anyone, that you’re paying directly or indirectly with Medicare or Medicaid funds. An interesting, situation, we have a client, prior to, working with them. They had a a laundry service, that came in and actually was collecting, patient’s laundry, and and and and washing them. The entity and the owner were wasn’t excluded, but actually the employee was. And that kinda gets to that we’ll talk about, a little bit later in, the discussion around not only monitoring the entity, the owners, but also ensuring that those vendors are monitoring their owner or their employees as well. So, Chris, help us kinda understand how does vendor exclusion monitoring contribute to overall compliance with federal and state regulations? Yeah. So, this is really good. So we we we started provider trust and really were monitoring for licenses and exclusions. And I would say that was in two thousand eleven through two thousand fifteen. That was, really where the OIG was focused. But, really, over the last five to seven years, OIG has kinda began to, start and say, hey. We we think there’s a lot of fraud over here in the vendor, area. And when you look at health care organizations, the amount of, money that flows through their vendors is pretty staggering. You know? We’re we’re looking at eighteen to twenty percent of our GDP that is involved in health care, which is which is massive. And so if anyone’s looking to commit fraud, they’re probably gonna go to a large, area and then try to hide really in the in in in the tail. And so that’s one of the reasons why, as you could see in this poll, one out of five, organizations site vendor or suppliers source as their most disruptive external fraud, focus. Yeah. And, you know, it’s challenging to keep up with vendors and and exclusions as a whole. And just looking at the total number of excluded entities in the United States, there’s over two hundred and ten thousand entities that are excluded. Only twelve thousand of those have an organization name attached to them at the source that that we’re monitoring. And then, you know, diving down a little bit more into the detail, only twenty seven hundred have both a name and an organization. So it is really challenging to keep up with this and to determine that your vendor and that the people that are running this organization are compliant. So, you know, Chris, talk a little bit about the key challenges health care organizations face when it comes to monitoring vendors and vendor business owners for exclusions. Yeah, Katie. I think with an interesting, point there is where where you talked about how, you know, there’s over two hundred thousand, entities that are excluded, but only a certain percentage have owners attached to it. The reason for that is because when you get excluded, you’re gonna set up a new entity. Right? And that’s what makes this so hard to to for for an health care organization and for for our clients is because the these organization or these these fraudsters, as we would say, are gonna get excluded, but they’re gonna continue to go back and operate in their network of influence. Right? And not everyone knows that that business was excluded or that individual is excluded. So they’re just gonna go ahead and and and set up. The other hard thing is we typically see across our clients, twenty percent of their vendor data changes every year. Right? So if you’re not updating your, business information, if you’re not updating, your, ownership information on an annual basis, very quickly, you’re gonna get out of compliance. And that’s really what, what the fraudsters are looking for is they’re looking for organizations that don’t have that annual program where you’re constantly updating the vendor information and monitoring those vendors and owners on a monthly basis. Absolutely. And and, really, let’s let’s talk about some of the not fun stuff, which is what are the potential consequences for health care organizations if they fail to effectively monitor these vendors and vendor business owners for exclusions? Yeah. Typically, you see, civil and monetary fines. So, and a lot of these go undisclosed. The the situation, that I shared a little bit earlier where they had the employee, that was actually self disclosed by, by the organization. It wasn’t published, at the OIG, so they didn’t publish that, that fine. But that’s typically what you’re looking at. The average fine, I think this year, Katie, you can correct me if I’m wrong, but I think it’s a hundred and forty ish thousand dollars, for for, NOIG, exclusion. And so you’re typically looking, you know, anywhere between fifty to a hundred and forty thousand dollars depending on, the the incidents, for that. The biggest issue, though, is the reputational. Right? Yeah. You might be able to you have insurance that’s gonna cover those spines or you have some back payments. But now all of a sudden you’re branded as a noncompliant organization. You’re not keeping things up to date. So we we say, yeah, there’s the the monetary fine that that you get, but the reputational harm, will patients come? Do they consider it to be a safe place? That’s really what where where you’re looking at it from from from that standpoint. Absolutely. And you already shared kind of a a unique example of a, of an organization where the employee was excluded. But let’s talk a little bit more about, you know, some examples of vendor owner exclusions that either have impacted an organization, or I know you’ve talked a little bit about sanctions in the past and how, that can impact the organization. So let’s just talk and and give some examples so for the folks that are attending. Yeah. You know, this is a really good example on the screen of where an owner, was actually, excluded. This is an example back in two thousand eighteen where, it was a community mental health, facility. And what’s what’s interesting about this is, there there were two owners. One was the the wife. The other one was was the husband. The husband was, was excluded. But, what what they did here and how they committed fraud was the husband actually owned the real estate. Right? And so, by the direct or indirect payments, they were able to track this back to the the husband who is the individual who actually owned it. And so payments directly and indirectly were were being funneled through this organization back to this real estate, company. And so that’s the type of fraud that you begin to see. It’s it’s a pretty complicated fraud. They’re pretty smart about how they do it. And, again, it’s it’s kind of in the the long tail. So you necessarily, if you looked at this community health facility, you wouldn’t see that they were excluded. However, if you started looking at the ownership, and collected that that ownership information, you’d be able to track that. So that’s just a good example. Another example, actually, the very first exclusion that we ever found from owner exclusion, was for one of our clients. This is probably five or six years ago. It was actually a cleaning service. And, again, the the the wife was the the majority owner. The husband was the, minority owner. We collected the ownership information, through our product, and we are able to find that that exclusion. So those are just some of the examples of, you know, how fraud is hard to find, but it is out there. And I believe, this is actually one of the biggest one or two sources of fraud in health care. It’s just really hard to collect the data, and and and and focus on it. Yeah. And before we talk about, you know, how technology can help, just, you know, a lot of times we hear organizations talk about physician ownership. And while that’s very important, it’s not just about physician ownership. It’s every owner with a greater than five percent stake in a vendor that is an organization’s responsibility to monitor. Anything you wanna add to to that piece, Chris? Yeah. A lot of times this, gets placed into the Stark law, right, where you’re looking for physician ownership or back payments, or are they paying the appropriate amount for rent? This is literally every vendor. Right? So you need to, be monitoring your your your vendors, your owners, and then ensure that those, entities are also monitoring their employees as well. Katie, just one example of that is, you know, a lot of times, health care organizations will have contracts that push that requirement off to the vendor to monitor, their their employees. While that’s important and you should have have a contract for that, The challenge is is if that, vendor has an employee who’s coming into your organization and is excluded, the fines are still being assessed to you as the organization. Right? And so you might have a contract that then covers you could go back and be reimbursed. You have insurance that covers it. But then, again, you have the reputational harm around that. And then and then the challenge is is how do you ensure that they’re being monitored, and that they’re monitored on an ongoing basis? So when you start looking at this fraud, it’s, I would say, you know, physician and employees, like, we’ve got that. Right? Because most organizations have their employee information, have their Social Security number. We can monitor that. This is the hard area that that there’s still lots of innovation to be had around it, and one of the areas that we’re really focused on because I think this is the long tail. We’ll as we begin to, focus our our our light, on on this area, we’ll be able to kind of, get a lot of the bad actors out of health care. Yeah. And I and I think kinda it’s it’s timely, and it’s an important conversation, you know, based on the poll result poll results, we’re seeing over fifty percent of attendees either do not monitor vendor owners or are unsure. And I think unsure is is really, where we’d find a lot of the space. They may do some, you know, attestations at the beginning of a contract with a vendor, but then that ongoing monitoring that you touched on earlier is is so important. So, Chris, as we talk about there’s some great questions coming in in the q and a. So I’m gonna shift to those for a moment and then come back to talking about how technology can, help us as streamlining this process. But so one of the questions is when it comes to vendors, how do we know which ones to monitor? Is it the person who we bought balloons for for an employee’s birthday? You know, obviously, you’ve referenced Cardinal Health. There’s just the gamut of vendors. So what how do we know which vendors to monitor? And then on top of that, how do we know which vendor owners we should really focus on? Yeah. So, when when you’re looking at vendors, the the simple answer is all of them. Right? Anyone that you’re paying directly or indirectly. The the challenge there is how do you collect the information. Right? So we have a lot of clients that will pay for those balloons with a credit card or something like that. It’s really hard to collect that information, from from a credit card because that doesn’t show up on your AP, payments. But, really, any, vendor that you’re collecting their w nine from, getting all their information, to be able to pay them, you need to be collecting their their business information, their tax ID or TIN, number along with their ownership information. Typically, what we do is we set a threshold with our clients. We can say anyone that you’re spending annually over a thousand dollars, annually with, you’re wanting to go through your your procurement, process and just at least collect their information, which is their business, their ten, and then their ownership information as well. And, again, this is all your vendors. So anyone who you’re doing lawn services with all the way up to surgical equipment, you’re gonna wanna collect their information. The in interesting thing about this, Katie, is that the small to medium sized businesses is actually where your fraud is at. Right? That’s your biggest risk. The Cardinal Health, they have got a massive compliance department. They’re monitoring their employees and their their owners, their public company. You know, that’s not where your fraud is gonna be. Your fraud is gonna be kind of in the the trickle down effect. A little fun little tidbit. We’re in Nashville, Tennessee, and a lot of you all have probably heard of music and music theft and Spotify and the whole, like, the whole gamut around music. I have a friend who literally focuses on music, playlist fraud. Right? And that type of fraud doesn’t happen with the with the massive artists. It happens with the smaller artists that are sitting there and spending their music. Right? And so that’s what we have to do realize is that the fraud is actually on the long tail. It’s not in the middle, and that’s what makes this hard. I think that’s great information. I think we’re able to to answer another question, which is, you know, what information of a vendor is needed to actually have them run, in an exclusion check. So, you know, the answer always is the more information, the better. And sometimes that information is really hard for an organization to gather and and potentially worth looking into a vendor to help assist with that process. I think, you know, in my experience, the most difficult information to gather is ownership information because it’s it’s another step. But it can be a step in your new vendor onboarding process. And that’s really where one of the ways technology can can play a role. So one more question, Chris. As far as owners, you mentioned one with five percent or more invested. What about the owners linked that have no investment percentage, just ownership status? Should we run those as well correct no matter what since they are linked to the company? What’s the risk there? Yeah. Great great question. I’ll share a little bit of a story. During, during twenty twenty when, COVID and and, all the Russian, stuff was going on. There there was a lot of sanctions that were put on Russia. And we had some clients that were monitoring their their their owners, or their vendors and their owners, and we were able to help them identify. Do any of these Russian oligarchs own, any of, their their health care vendors? And the only way to do that is collect the information. So I share that story because, the answer to that is yes. Anyone over five percent, that’s kind of the threshold. It would be interesting if someone has ownership, status but is not an owner. I’ll I’ll be asking, are they making administrative decisions? Right? Do they have some type of stock grant or things like that? So if they’re making administrative decisions within that organization, the simple answer to that is yes. And then another great, question that we’ve received a couple times, which is, do you have to run grants, Or do you have to run checks on grant recipients? So individual patients receiving grant funds, like housing assistance, you know, that runs the gamut of what grants can be used within a health care organization. Yeah. So we lean towards we work with a lot of the academic institutions that are that are getting grants from the federal government, to do research. And so I would say if you’re doing any type of, of research, and those those grants are going coming from the federal government, Anyone who is receiving those funds and being, dispersed to those funds for work, the simple answer to that would be yes. There are some caveats that you could kind of, look through, you know, from a patient standpoint or if they’re see receiving treat treatments, that would be excluded, from from a a patient, standpoint. But if there are researchers and they are receiving federal, grant dollars for that, you’ll want to, monitor those. Yeah. My guess is that that’s probably included in the grant information, in in the research grant. So if you kinda look into the the fine print, the the federal government is pretty good on on including those in those really long grants. Yeah. Really, really long. So let’s talk a little bit about how technology can play a role in streamlining this process. And then I think, you know, we got another question that that I’d love to touch on as you share some best practices. So we’ll start with, just, you know, overall, how can technology help, those that are in attendance today and and out in the health care ecosystem? Yeah. So the the biggest thing and, again, this is we’re not trying to, sell here. We’re just trying to, share how we have gone and solved this problem. So, on the left hand side, a lot of the questions that had been asked is, what type of information do you need to collect? So you could see business name, TIN number, phone, email. The other things that that, we’re able to verify is the legal business name and the DBAs. And that’s through collecting that ownership that ownership information. So, typically, when we’re working with a client, they give us a business name, the TIN, phone number, email, and email then goes out. They go through the sign up process, and we collect the legal name, the DBAs. We validate the TIN and address. This is where we actually collect the ownership information, and then we actually allow the vendor to upload their employees as well. We don’t ever share that information with with our with our clients. That’s the the vendor’s information, but we can ensure that, it is being being monitored. And so that’s, really kind of the process. The other thing that’s really important is that, you’re doing it on an annual basis. Right? So you’re collecting this information on an annual basis so that then, you could, make sure that you’re monitoring them, make sure the data is accurate. And as Katie mentioned before, the same frequency that you’re monitoring your employees, you need to be monitoring your vendors and owners and their employees as well. And so the federal government, if they come in and they’re looking at it, they’re gonna look across the board and say, are you using the same criteria for your internal employees that you are with your vendors and owners? So then, you know, we talked a little bit about what information is is helpful. But, what can be used as proof of ownership, Chris? What, you know, what information would we want to to see from, from a vendor to ensure that, you know, we’re capturing that greater than five percent ownership stake? Yeah. So, what’s great about technology is it continues to keep improving. Right? So the answer today is, this information is self reported. They’re gonna report, any of the ownership information of the vendor, self reported. They typically tell the truth, on that, but I’m sure there are are, fraudsters have that have wise wisened up. What’s interesting about this is the federal government actually just passed a a law, which is, kinda tied to, COVID and the COVID, where it it’s basically saying, there’s no way to have businesses that are are, where you’re not disclosing your owners. And so as that begins to roll out at all the states, we’ll actually be able to validate ownership information with the business businesses. Today, that’s a little bit hard, but, it is self reported data. And then you just monitor, the the owner, along with their Social Security number to ensure that they’re not excluded. And I think as a whole, as we kinda come up at, on the end of our time, just, you know, general best practices, number one takeaway that you want to share with those in attendance today. You know, how can they continue to implement an efficient and comprehensive vendor exclusion monitoring program? Yeah. I think, Katie, the the the the answer to that is is pretty simple. Right? But also complicated because it’s it’s across an organization. Simplest simple. You need to monitor the owner. You need to monitor, or so the vendor. There are ten. You need to monitor the owner. Right? And if they are an FDR vendor, you could even, force them to to monitor, their their employees as well. What’s the complicated thing is over here on the right hand side is this vendor data touches a lot of parts within your organization. So compliance, risk, AP, procurement, finance, legal audit. Right? And so one of the great things about this is if you get this process right, you could eliminate risk and improve efficiencies across all these departments, which is really fun. So when we have, clients that are really bought into, to the process and what we do, we’re we’re able to, eliminate the risk, drive down their costs, and make them, ensure that they’re they’re really efficient around that. And I think, my best practice definitely is to start early in your relationship with a vendor collecting this information, set the stage that this is going to be an ongoing request, and then actually continue with the ongoing monitoring and updating of this information. We had a couple of questions for follow-up information. That poll question is up now. If you’d like any of the information we shared today or additional kind of guidance on where, we get this these topics from. I know the OIG, can put out very lengthy documents as well. Something about the federal government. So we’d be happy to share and support some resources and, and provide the slides as well for for those in attendance. We really, really appreciate everyone that joined today. Thank you for such a thoughtful q and a. It made the conversation fly by. And, you know, this is an important topic. It’s not one that’s going away. And and we’re going to be looking to expand upon, the different topics of vendor exclusion monitoring as the year goes on. So keep an eye out for some new topics and new ways that you can continue to, to monitor your vendors and maintain a really healthy compliance program. If you need anything, please reach out to us, and, we really appreciate your time today. Thank you so much for all the information, Chris. It was awesome talking to you. Thanks, Katie.