The Sarbanes-Oxley Act of 2022 was initially passed with large public corporations in mind, but private organizations of all types and sizes have also chosen to use the Act’s requirements as a way of ensuring best-practice financial procedures and building community trust. In this blog post, we review what the Sarbanes-Oxley Act (SOX) is and explore how it has impacted the way hospitals and health systems in America approach financial reporting.
Sarbanes-Oxley: What Is it and Who Does it Apply To?
SOX is a federal act passed in 2002 to crack down on messy financial practices and promote ethical, honest business operations. It was introduced directly following Enron and other accounting scandals—and passed quickly with bipartisan congressional support.
SOX Isn’t Very Forgiving of Mistakes… |
Though SOX was a powerful driver toward a renewed focus on accountability, its requirements only extended to businesses that had gone public. As with most rules related to publicly traded and owned entities, SOX is enforced by the Securities and Exchange Commission (SEC) of the United States. SOX is far from perfect and can be costly to comply with, but it did provide a framework for safe internal controls and auditing procedures that appealed even to private organizations working to bolster their operations and reputations.
SOX Healthcare
This interest in adopting SOX extended into the healthcare industry, particularly once executives realized the continuity between SOX compliance and similar regulations that not-for-profit hospitals and physician groups already work under. Of course, for-profit healthcare businesses in the public space would have been required to comply.
While SOX does deal with data security and integrity, it should not be confused with HIPAA or other legislative actions specifically related to protected health data and keeping medical records. That said, process flows that have already been established to ensure compliance with HIPAA and other requirements can be adapted to work for SOX compliance healthcare as well.
Get the Latest in Healthcare Technology
|
Healthcare SOX: Here’s What it Means for You
SOX does not require any company to explicitly establish a compliance program, but a robust program can help provider organizations meet SOX’s objectives. The impact of a SOX compliance rollout on healthcare organizations typically falls into three principal areas:
#1 Governance
Revising formal corporate governance is critical. Fortifying a documented internal control structure proves useful beyond healthcare SOX by reducing risk and bias throughout the organization. For instance, signing officers (usually CEOs and CFOs) should have a regular cadence for certifying that financial statements are complete, accurate, and true. Additionally, decision-making should include checks and balances to ensure that donors don’t have an unethical influence on business processes, board members do not have a conflict of interest, etc.
#2 Internal Management
Data encryption and access controls are important parts of complying with SOX. Beyond protecting sensitive financial information via encryption, healthcare provider organizations should also establish or tighten security best practice measures to guard against inappropriate access, malicious attacks, and fraudulent accounting.
#3 External Auditing
Having internal processes set up to regulate behavior and guard against frauds or deficiencies is a great first step toward risk management, but organizations should also open themselves up to evaluation from third-party auditors and independent professionals. For Sarbanes-Oxley health care compliance to be successful, there must be an elevated level of transparency and openness to ensure effective internal controls.
Challenges of Complying with SOX in Health Care
While there are many positive effects related to SOX healthcare alignment, making the changes necessary for compliance can be resource-intensive and time-consuming. Challenges can include:
Ineffective management
Without strong leadership, operational frameworks, and management systems in place, any initiative to improve security and compliance will fall short. Organizations must have a clear plan for introducing and implementing new processes that engage staff of all levels. Financial information is woven into many parts of the healthcare experience and must be handled securely and correctly along the entire journey.
Intimidating costs
Particularly after enduring over two years of a resource-draining pandemic, healthcare providers and organizations may not be in good financial condition. Building up data security and auditing methods may not seem like a wise financial choice when clinicians are short-staffed, burnout is rising, and the virus is still mutating. The good news is that in most cases, SOX compliance can be achieved gradually and may not require huge overhauls of technology to make significant progress. It’s better to start with something small than not to start at all.
Competing priorities
Healthcare is an industry already swamped with red-tape, regulations, and requirements. Securing and verifying financial data is not the only initiative that leaders are concerned with. They also want to improve clinician productivity, streamline the revenue cycle, deliver value-based care, appropriately audit medical records, and comprehensively address public health issues.
Consequences if Your Organization Isn’t Sarbanes-Oxley Health Care Compliant
Though moving your organization toward SOX compliance can be a difficult process, it is guaranteed to be a better option than dealing with the far-reaching consequences of a scandal. Even if companies are not required to report on their financial proceedings under SOX, they can still incur the penalties of missteps, including:
- Prosecution
- Hefty penalties
- Imprisonment
- Marred reputation
- Lost loyalty and trust
- Disruption to patient care
So, how can you avoid these negative outcomes while also tackling the challenges of Sarbanes-Oxley health care compliance? Find a reliable, collaborative partner to guide your organization through SOX. True North uses top-of-the-line security technology alongside innovative backup solutions to make SOX compliance simple and affordable.
