Corporate Compliance Policy

1.0 SCOPE

This policy applies to all Empassion Health employees, contractors, temporary employees, volunteers, Board members, network providers, and third-party vendors involved in the delivery of serious illness care services through our managed services organization. This includes all activities related to value-based contracts with Medicare Advantage, Medicaid, and Duals plans, home-based and telephonic care coordination, and provider network management across all states of operation.

2.0 PURPOSE

To establish a comprehensive compliance framework that ensures Empassion Health operates in accordance with all applicable federal, state, and local laws and regulations while delivering high-quality serious illness care. This policy promotes ethical business practices, prevents fraud and abuse, and maintains the integrity of our value-based care delivery model.

3.0 DEFINITIONS

Chief Compliance Officer (CCO): The designated individual responsible for overseeing and managing Empassion Health’s compliance program, who reports directly to the Board of Directors.

Compliance: Adhering to the requirements of laws, industry and organizational standards and codes, principles of good governance and accepted community and ethical standards.

Personnel: For purposes of this Policy, Personnel shall refer to all full-time and part-time employees, volunteers, temporary employees, Board of Directors and any subcontractors.

Network Provider: Healthcare providers contracted with Empassion Health to deliver palliative and hospice care services to beneficiaries under our value-based contracts.

Serious Illness Care: Palliative care, hospice care, and related supportive services for individuals with life-limiting conditions.

Value-Based Contract: Risk-sharing arrangements with health plans that tie payments to quality outcomes and cost management rather than fee-for-service.

Managed Services Organization (MSO): Empassion Health’s business model of providing administrative and care coordination services to support serious illness care delivery.

4.0 REQUIREMENTS

4.1 Compliance Program Structure

4.1.1 Chief Compliance Officer

Empassion Health designates a Chief Compliance Officer (“CCO”) who:

Does not serve as legal counsel to the organization
Reports directly to the Board of Directors
Has sufficient authority and resources to implement the compliance program
Provides quarterly reports to the Board of Directors covering audits, regulatory matters, investigations, and compliance metrics

CCO Responsibilities:

Develop, implement, and maintain compliance policies and procedures (“P&P”)
Overseeing and monitoring adherence to the compliance program.
Ensure adherence to federal, state, and local healthcare laws and regulations
Conduct compliance training for all Personnel.
Investigate compliance concerns and implement corrective actions
Coordinate with external legal counsel and external regulators as needed
Perform regular risk assessments and internal audits
Provide guidance to management, medical/clinical program personnel and individual departments regarding P&P and governmental laws, rules and regulations.

4.1.2 Compliance Committee

A multidisciplinary compliance committee supports the CCO and includes representatives from:

Clinical operations
Network management
Legal affairs
Information technology
Human resources
Finance

The roles of the Compliance Committee include:

Analyzing the environment where Empassion conducts business, including legal requirements with which it must comply.
Reviewing and assessing existing P&P that address these risk areas for possible incorporation into the Corporate Policy.
Working with departments to develop standards and P&P that address specific risk areas and encourage compliance according to legal and ethical requirements.
Advising and monitoring appropriate departments relative to compliance matters.
Developing internal systems and controls to carry out compliance standards and policies.
Monitoring internal and external audits to identify potential non-compliant issues.
Implementing corrective and preventive action plans.
Developing a process to solicit, evaluate and respond to complaints and problems.

At least annually, the Corporate Compliance Committee shall report to the Company’s Board of Directors concerning: (1) the Company’s adherence to the standards of legal and ethical conduct contained in the Employee Handbook; and (2) the Compliance Program, generally.

4.2 Identification and Resolution of Compliance Issues

4.2.1 Proactive Monitoring

Empassion Health implements systematic monitoring through:

Regular internal audits of operations and provider networks
Annual compliance risk assessments
Ongoing review of regulatory changes and guidance
Data analytics to identify compliance risks and patterns

4.2.2 Issue Resolution Process

All compliance concerns are:

Documented and reported to the CCO within 24 hours of identification
Investigated thoroughly with appropriate resources and expertise
Escalated to the Board of Directors for significant matters
Resolved through corrective action plans with defined timelines
Tracked for effectiveness and prevention of recurrence
Any potential or actual non-compliance issues will be promptly reported to the impacted Health Plan.

4.2.3 Non-Retaliation Policy

Empassion Health prohibits retaliation against any individual who reports compliance concerns in good faith or participates in compliance investigations.

4.3 Reporting Mechanisms

4.3.1 Compliance Hotline

A confidential compliance hotline is available 24/7 for personnel, network providers, members, and other stakeholders to report:

Suspected fraud or abuse
Quality of care concerns
Conflicts of interest
Violations of laws or policies

Hotline number: 1-888-565-3292

Secure web form: https://empassion.com/noncompliance/. This form can be completed anonymously or named.

Any compliance concern can also be reported directly via email as well, compliance@empassion.com.

Anonymous Whistleblower Form (internal staff): Whistleblower Form

All complaints are imported into an auditable worksheet for tracking and stored on a secure drive. All complaints are promptly investigated in a confidential manner by the acting Compliance Officer and any resolution/findings are documented on the tracking worksheet and reported to the appropriate Agency, Plan, or impacted organization.

Individuals assisting in compliance investigations are expected to cooperate fully, honestly, and promptly with investigators. The integrity of the process depends on the cooperation of all relevant parties, and a failure to assist can result in disciplinary action.

4.3.2 Reporting Obligations and Expectations

All personnel have a duty to report suspected compliance violations. Failure to report known violations may result in disciplinary action up to termination.

Expectations for employees

Prompt and truthful disclosure: Provide complete and accurate information during interviews and when submitting documents. You should not withhold or conceal information, intentionally provide false or misleading information, or alter any records.
Confidentiality: Do not discuss the investigation or your participation with anyone who does not have a legitimate need to know. Maintaining confidentiality protects the integrity of the investigation and all parties involved.
Protection against retaliation: It is forbidden to retaliate against anyone who participates in an investigation or reports a compliance concern. Any employee who experiences or witnesses retaliation should report it immediately.
Documentation and evidence: Preserve and provide any requested documents, electronic communications, or other evidence, such as financial records or training logs, to the investigator.
Good faith participation: Approach the investigation with an open mind and provide honest accounts, even if you believe your information is not valuable.
Seeking guidance: Ask questions and seek guidance from the compliance officer or designated investigator if you are unsure about a company policy or the law.

Expectations for management

Set the tone: Managers are expected to demonstrate and encourage a culture of compliance by setting the “tone at the top”.
Lead by example: All managers, including senior leadership, must set a positive example by fully cooperating with all investigations.
Protect employees: Ensure that any employee who raises a compliance concern or participates in an investigation is not subjected to retaliation.
Communicate expectations: Clearly communicate the company’s compliance policies and the importance of full cooperation to their teams.
Report misconduct: Report suspected violations promptly and through the proper channels.
Support the process: Facilitate the investigation by ensuring their staff can cooperate. This may include coordinating interviews and assisting with the collection of relevant information.

Consequences for non-cooperation

An individual’s failure to assist or cooperate with an internal investigation may result in disciplinary action. Non-cooperation can also compromise an organization’s defense against potential civil or criminal exposure.

4.4 Education and Training

4.4.1 Initial Training

All new employees, contractors, and network providers must complete compliance training within 30 days of engagement, covering:

Healthcare fraud and abuse laws
Privacy and security requirements
Quality and safety standards
Empassion Health policies and procedures
Reporting mechanisms and obligations

4.4.2 Ongoing Training

Annual compliance training is required for all personnel, with specialized training provided based on role and risk areas. Training completion is tracked and documented.

4.5 Enforcement and Corrective Action

4.5.1 Disciplinary Measures

Violations of compliance policies may result in:

Corrective action plans
Additional training
Suspension of privileges
Contract termination
Termination of employment
Referral to appropriate authorities

4.5.2 Reporting to Authorities

Empassion Health will promptly report probable violations of law to appropriate enforcement agencies, including but not limited to:

Centers for Medicare & Medicaid Services (CMS)
Office of Inspector General (OIG)
State insurance commissioners
Law enforcement agencies

4.6 Key Compliance Areas

4.6.1 Healthcare Fraud and Abuse Prevention

Compliance with:

Anti-Kickback Statute
Stark Law (Physician Self-Referral)
False Claims Act
Civil Monetary Penalties Law
State anti-fraud laws

4.6.2 Privacy and Security

Adherence to:

Health Insurance Portability and Accountability Act (HIPAA)
Health Information Technology for Economic and Clinical Health Act (HITECH)
State privacy laws
Data security standards

4.6.3 Quality and Safety

Commitment to:

Clinical quality standards
Patient safety protocols
Credentialing and licensing requirements
Performance monitoring and improvement

4.6.4 Network Management

Oversight of:

Provider credentialing and re-credentialing
Contract compliance monitoring
Performance standards enforcement
Quality assurance programs

4.6.5 Multi-State Operations

Compliance with:

State licensure requirements for risk-bearing entities
Insurance regulations
Professional licensing standards
Local healthcare laws and regulations

4.7 Business Ethics and Conduct

4.7.1 Conflicts of Interest

All board members, employees, and contractors must:

Disclose potential conflicts of interest annually
Recuse themselves from decisions where conflicts exist
Follow established procedures for conflict resolution

4.7.2 Anti-Discrimination

Empassion Health prohibits discrimination in:

Service delivery
Employment practices
Network participation
Beneficiary access to care

4.7.3 Beneficiary Rights

Commitment to:

Freedom of provider choice
Access to medically necessary services
Transparent communication about benefits and limitations
Privacy and confidentiality protection

4.8 Recordkeeping Requirements

The Chief Compliance Officer will document efforts to comply with applicable statutes, regulations and federal health care program requirements. Reports shall be maintained by the Chief Compliance Officer for a period of ten (10) years. At the end of ten (10) years, all pertinent documentation relating to reporting of compliance activities may be destroyed in accordance with procedures established by Empassion for destruction of confidential records. Compliance documents to be destroyed will include, but are not limited to:

Helpline Reports
Helpline Logs
Reports to the Chief Compliance Officer, Compliance Committee or Board of Directors
Audit Reports
Audit Worksheets
Corporate Compliance training records

4.9 Monitoring and Auditing

The Chief Compliance Officer, in consultation with the Compliance Committee, will construct a corporate annual audit plan, determine who shall comprise the internal audit teams based upon the particular expertise requirements and the situation, and determine the priority and frequency of audits. Audits may be performed by the Corporate Compliance Officer or by internal audit teams consisting of Empassion employees or external auditors, depending upon the specific area being audited and the situation. Audits will establish a baseline for future monitoring and benchmarking analyses to determine the progress in reducing or eliminating the risks. The Chief Compliance Officer will review audit findings and provide recommendations for corrective action to the Compliance Committee. If it is determined that an audit revealed improper procedures, misinterpretation of rules, including fraud and systemic problems, the Chief Compliance Officer in consultation with the appropriate Senior Leadership will take prompt steps to correct the problem.

Validation

Any time a corrective or improvement plan is a result of an audit, it is vital to monitor that change to validate its success. To accomplish this, the Chief Compliance Officer will perform a status review audit within eight (8) months after implementation of the action plan. This audit will serve as a “spot check” to determine if the changes made are resulting in the desired outcomes. Validations and audits will be monitored and scheduled by the Compliance Committee.

4.10 Continuous Improvement

The compliance program is regularly evaluated and updated to address:

Changes in laws and regulations
Business expansion and evolution
Identified risks and vulnerabilities
Industry best practices

5.0 Disclaimer

Empassion follows all applicable federal and state laws and regulations. This document is intended as a best practice guideline. Situations may arise in which professional judgment may necessitate actions that differ from the guideline. Circumstances that justify the variation from the guideline should be noted and submitted to the appropriate business area for review and documentation, including legal review as appropriate. This policy is subject to change or termination by Empassion at any time. Empassion has full and final discretionary authority for its interpretation and application.

6.0 Noncompliance

Failure to comply with any part of Empassion’s policies, procedures, and guidelines may result in disciplinary actions up to and including termination of employment, services or relationship with Empassion. In addition, state and/or federal agencies may take action in accordance with applicable laws, rules and regulations.

Any unlawful act involving Empassion’s systems or information may result in Empassion turning over all evidence of unlawful activity to appropriate authorities.