Resource Allocation and Health Care Enforcement
The OIG recently released a report that was critical of the oversight and enforcement by CMS with respect to the HIPAA Security Rule. The report included the following remarks: “CMS had taken limited actions to ensure that covered entities adequately implement the HIPAA Security Rule. These actions had not provided effective oversight or encouraged enforcement of the HIPAA Security Rule by covered entities.” The report notes that CMS primarily relied on complaints to identify non-compliant covered entities that it might investigate and recommends that CMS establish policies and procedures for conducting HIPAA Security Rule compliance reviews of covered entities.
The report raises an interesting topic that should receive more scrutiny in upcoming years: Resource allocation for enforcement of Federal health care laws and regulations. OIG indicates that CMS could be more effective in its oversight and enforcement of the HIPAA Security Rule by conducting compliance reviews. But, this begs the question: Why did CMS not conduct compliance reviews during the period under review?
If the answer is that CMS allocated significant resources to compliance reviews and simply failed to execute, then a critique on this failure may be justified. But, if CMS chose not to engage in compliance reviews during the period under review, relying on other (perhaps, less expensive) methods of enforcement and allocating resources to achieve other objectives on its agenda, than the assessment should focus on the decision not to allocate significant resources to compliance reviews.
And, if this latter statement is true, that CMS chose not to allocate significant resources to compliance reviews during the period in question, to analyze this decision, one should look at the opportunity cost of compliance reviews, i.e., the CMS projects that could have been given less attention in order to direct more resources to compliance reviews.
CMS’s response to the report is marked by its disagreement with OIG’s conclusions on the complaint-driven enforcement process. Is CMS saying, with the hand we are dealt, we believe our complaint-driven enforcement model is appropriate?
In reviewing performance, the reviewer should consider the resources available to the performer. Allocation of Federal government resources, already a topic of mainstream discussion, will continue to be dissected heavily in upcoming years given the capital that has been infused into the economy and the likelihood for increased dedication of resources to regulation of the financial industries. Of course, how this resource allocation will affect enforcement in the health care industry remains to be determined.
