Compliance Hotlines: How to Build, Evaluate, and Ensure Effectiveness

Jan 12, 2024

In today’s complex regulatory landscape, organizations are faced with pressing questions about the efficacy and management of compliance hotlines.

For example: How does one ensure 24/7 accessibility without compromising on quality? What are the cost implications of in-house versus outsourced operations? How do evolving technological preferences influence the way reports are received? And amid all this, how does one maintain the crucial element of anonymity?

Compliance Hotline Management Strategies

These questions, and more, reflect the many ongoing challenges and considerations that come with building and evaluating an effective compliance hotline program.

Key Insights on Compliance Hotlines: A Deep Dive with Richard Kusserow

In the following Q&A, Richard Kusserow, CEO of Strategic Management Services, shares insights from a recent webinar he co-presented on –Building and Evaluating Effective Hotline Programs–about the significance of confidential compliance hotlines. This webinar also explored the impact of guidelines from both the Department of Health and Human Services Office of Inspector General (DHHS OIG) and the Department of Justice (DOJ).

Below, Kusserow delves into the intricacies of compliance hotlines, emphasizing the need for 24/7 accessibility, cost-efficiency, evolving reporting preferences, and the paramount importance of maintaining caller anonymity. Responses have been lightly edited for clarity.

Q: Why isn’t an internal phone line with a voicemail feature “good enough” for 24-hour/365-day access?
Richard: Not “good enough.” For example, a caller may have an important issue but not leave enough information to act, because there was no debriefing opportunity. Also, there is no way to re-contact that person for additional information unless the person provides contact information.

Another problem is you would be recording the caller’s voice which theoretically could lead to their identity and compromise the commitment to ensure anonymity.

Also, a call may be “urgent,” relating to potential and imminent danger to a person or property. Imagine the consequence if something did happen and you find out later that a warning had been provided in advance but was not reviewed until after the incident.

Q: Why does it make more sense cost-wise to outsource the hotline?

Richard: The hotline should be operational 24/7 to capture all the callers. Many employees do not feel comfortable calling from the job site during work hours. Many healthcare providers, such as hospitals and skilled nursing facilities, work around the clock and may make calls at any time. If a serious incident takes place at night or on a weekend, it may not wait until the next workday to act appropriately on it.

Even staffing an internal hotline for only core business hours would be prohibitive with a single full-time employee costing at least $60,000 per year.

The cost per call would be prohibitive:

1,000 employees = 12-15 calls/year = over $1,000/call
10,000 employees = 120 calls/year = about $300/call
Vendor charges should only be about $1/employee/year

Q: What percentage of hotline reports are likely to be received via web-based reporting versus live operator reporting?

Richard: This varies according to the size and complexity of the organization and the level of maturity of the Compliance Program. However, trending data suggests a growing trend towards web-based reporting.

Our data indicates currently about 40 percent of reports are filed in a web-based manner. A few years ago, very few were comfortable using this method, but the new generation of employees is increasingly more comfortable using technology to report than live operator discussions. At this point, new employees are more comfortable with online reporting, whereas older employees tend to prefer speaking with someone in person.

Q: Why is anonymity such a big issue?

Richard: First, both the Sentencing Commission Guidelines and the OIG Compliance Guidance underscore the importance of anonymous reporting. The underlying reasons for this are the evidence that many knowledgeable parties do not want to identify themselves for fear of retribution, retaliation, or reprisals, notwithstanding any assurance of protection.

Not offering anonymity may cut the organization off from critical information. Also, it is in the best interest of the organization to offer anonymity, because if it offers only confidentiality, it creates the added burden of actively protecting more people.

Q: Can you explain the concept of being on guard versus being trapped by a vendor contract?

Richard: A vendor should hold clients by good service, not by contract provisions that block their ending the contract. Some vendors have provisions in their contract that permit canceling the contract only during a specific period in advance of an anniversary of the agreement; otherwise, the contract remains in place with the client unable to do anything until the end of the next period.

A best practice is to have a contract that permits canceling the service at any time by simple 30-day written notice. Another technique to trap the client is to control their hotline number, so if a client does cancel, they cannot use the same number. This creates difficulties by forcing the announcement of a new number and including it in the Code of Conduct, posters, and policy documents.

A best practice is to own your number with a call forwarding to the vendor.

Best Practice Tip: If you have a contract with a vendor, check the terms and conditions. If it does not permit cancellation without cause within thirty days, then review the terms for cancellation and develop a plan to cancel at the first opportunity.

Q: What metric is better to evidence an effective hotline, a lot of calls or few calls?

Richard: Too many calls raise questions about the reason so many feel the need to report perceived problems. Too few calls raise questions about why employees are so reluctant to use the hotline.

Data maintained for the last twenty years indicate that on average an organization could expect one call per thousand employees per month, or one to two percent of employees calling a year.

Therefore, it is reasonable to look at your call volume to see how it matches up with that.

Q: What defines urgent calls and how should these be handled?

Richard: An urgent matter may require immediate action. As such, a call is made to alert the compliance officer or designated party, in addition to the normal reporting channel.

An urgent call would be something (a) occurring in real time that may need intervention, (b) that could result in loss of property or injury to a person, or (c) that could result in liability if not acted upon in a timely fashion.

The real problem is making sure that you have someone available to take a call and act upon the information. This also means there should be a backup person to call in case the primary party is not available.

Q: Should you leave the results of your investigation on the hotline for the caller?

Richard: No, the best method for communicating with the caller/reporter was included in the presentation. Generally, this involves using a PIN.

Q: For organizations with multiple state locations, how do you recommend communication between locations for hotline complaints if e-mail is not a good method?

Richard: The key to secure transmission of hotline information is web-based. Email can be used to alert the local facility that they have mail in their folder.

Also, fax is considered more secure than email, if the person receiving the information is on the fax machine. And there is always verbal communication via phone.

Q: One last question. In terms of how the hotline should provide ground rules to reporters, what should these ground rules be?

Richard: Generally, ground rules should include such things as: the call is not recorded, callers may report anonymously and no attempt would be to identify them or trace the call origin, and callers who identify themselves will have their identity kept confidential to the limit possible.