Good question. The Affordable Care Act required the Department of Health and Human Services to promulgate regulations implementing the compliance program mandate by March 23, 2012. The Department has not yet issued these regulations–but could do so any day.
Some people have heard CMS verbally advise that it will not enforce the mandate until the regulations are issued. The reasoning behind this is likely that, because the regulations will guide providers in implementing compliance, it is not fair to penalize providers until the regulations are available. However, providers should be cautious: a verbal statement from CMS is not binding. No formal guidance delaying enforcement of the mandate has been issued by CMS, the Office of Inspector General, or any other federal agency.
Providers without compliance programs are in violation of the law.
We don’t recommend it. Because we don’t know when enforcement will happen or what it will look like, it is better to be safe than sorry. Plus, we don’t know if the regulations will – or won’t – include a grace period before enforcement begins. Because it can take at least a year to implement an effective compliance program, once enforcement begins, it’s too late to start. Remember the first HIPAA penalty issued in 2011, for $4.3 Million? That came as quite a shock to all who were used to a non-enforcement era for HIPAA. By implementing compliance now, you can avoid being the first example of enforcement.
Even if the compliance program mandate didn’t exist, a compliance program is still essential to avoid penalties under the heavily enforced health care laws. The government may mitigate penalties if you have an effective compliance program in place, and you are much more likely to prevent violations of health care laws if you have a robust compliance program.
The Affordable Care Act also requires all providers to have compliance programs as a condition of enrollment in Medicare or Medicaid. The Act does not say when this requirement will become effective, or how it will be enforced–but we know that providers without compliance programs will not be able to participate in (bill) Medicare or Medicaid.