Read the hypothetical case study below carefully.

Congratulations. You have been hired as the first chief compliance officer (CCO) for Mystic Health Systems, a tax-exempt charitable organization located in the Midwest, which operates a 250-bed hospital with $400 million in annual revenue (Mystic Hospital), a 200-member multispecialty physician group (Mystic Medical Group), and a 100-bed skilled nursing facility (Mystic Nursing Home), each of which is separately incorporated. Mystic Hospital is located in an urban (city) setting approximately 5 minutes from the state's capital; Mystic Nursing Home is located in a developing, previously rural area approximately 45 minutes from the state's capital; and Mystic Medical Group has multiple offices throughout the five counties that surround and include the state's capital (mostly in suburban areas).

WEEK 3: You receive several notes in the comment box outside your door:

"Check the EMR access log. You'll see that Dr. Paynewhose wife is finally divorcing him (what took her so long?)accessed his wife's mental health records last week."

"A homeless man came into the ER with a blood clot in his leg and after the vascular surgeon on call learned that the man was homeless, he refused to come and treat the patient."

"Last week, I saw Mystic Hospital transfer some non-English-speaking ER patients to Mythic Hospital prior to being stabilized even though the medical chart says otherwise."

"I watched a 60 Minutes segment about how little oversight there is of SMD labs, and I know that the CMO in particular uses almost nothing but SMD devices here at Mystic. Are we sure these are safe for patients??"

"Our patient restraints badly need to be replacedwe're using them on every floor and there just aren't enough! I swear I've been putting these on our patients since I first started working here 15 years ago!"

"My mom received a free sample of some new blood pressure medication from Okay Pharma 6 months agonot sure how they knew she had high blood pressure, but she can't really afford her current prescription, so that was a real blessing. She's out of it now though and Dr. Ego in cardiology isn't returning any callscan't he just have Okay send her some more?"

After reading this case study answer the following questions below:

1. What are the legal and/or compliance issues raised by the hypothetical?

2. What law, regulation, or governance requirement/policy MAY have been violated? Consider among the following and explain why a potential violation may have occurred.

• Federal False Claims Act
• Physician Self-Referral "Stark" Law
• Federal Anti-Kickback Statute
• Federal Tax-Exempt Law
• Emergency Medical Treatment and Labor Act (EMTALA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Antitrust Law
• Organizational bylaws
• Scope of practice laws, licensure, certification
• Employment law, corporate liability

3. Which issues merit highest priority? Why?

4. Which issues would you recommend for further investigation? Why?

5. What, if any, further steps would you suggest (e.g., referral to inside/outside counsel, involvement of additional departments or individuals, revision of policies/procedures, termination of employment or contractual relationships, self-reporting to the government, internal audit, etc.)?

6. To the extent you believe there to be a legal or compliance-related issue, please recommend alternatives to the problematic program, policy, programmatic element/component, departmental or corporate structure, and/or relationship that you believe would not violate any laws. These alternative proposals do not require detail; however, and particularly where the offending program/policy is designed to increase access, improve quality, or reduce costs, the CEO and board will want to know that these ultimate goals can still be achieved if you are recommending elimination or modification of existing activities.