Key Takeaways | 2024 Enforcement Outlook | DOJ and OIG Corporate Compliance Updates: Healthcare and Life Sciences Company Lessons

Recent updates to the US Department of Justice’s (DOJ) Evaluation of Corporate Compliance Programs (ECCP) and the Office of the Inspector General’s (OIG) compliance guidance – including the Nursing Facility Industry-Specific Compliance Program Guidance (ICPG) released on November 20, 2024 – underscore the growing need for tailored, proactive compliance strategies in the healthcare and life sciences industries. These updates focus on managing emerging risks, such as artificial intelligence (AI), fraud prevention, and data privacy, while strengthening quality programs and addressing evolving regulatory expectations.

Members of McDermott’s white-collar and healthcare teams provided an overview of these critical developments and actionable strategies to ensure your compliance program aligns with the latest standards.

Top takeaways included:

1. The OIG’s General Compliance Program Guidance Places Greater Emphasis on Executive Governance. As part of its updates, the OIG continues to track the seven elements of compliance, but it also stresses the importance of compliance oversight and involvement from the highest levels of corporate governance. Compliance should be led by members of senior leadership, separate from and not subordinate to legal or finance teams. A well-functioning compliance committee should include leaders from across the organization as well as corporate investors.
2. The DOJ’s Updated ECCP Includes Questions Corporations Need to Ask When Evaluating Their Policies. When evaluating a corporation’s compliance program, the DOJ focuses on whether a program is well-designed, applied in good faith, and effective in practice. In its update, the agency provides new areas to consider when answering these questions. This includes the evolving risks associated with technology, compliance empowerment, whistleblowers and antiretaliation, and lessons learned from other industries and geographical risks.
3. Corporations Face Risks Associated With Evolving Technology, Including AI. When necessary, prosecutors consider the technology used by companies and their employees. To avoid enforcement actions, it is recommended that compliance committees assess and mitigate the risks associated with the use of any new or emerging technologies, especially AI. Suggestions include developing and implementing a governance strategy for new technologies and deploying controls to monitor the purposes for which AI is being used. Additionally, there should be a focus on training employees on the proper use of technology and recognizing misconduct.
4. The DOJ Emphasizes the Importance of Whistleblowers Protection and Antiretaliation. A corporation should ask itself: Does the company encourage and incentivize the reporting of potential misconduct or policy violations? Is there an antiretaliation policy in place? Corporations need to review the effectiveness of their reporting avenues and ensure that the data being collected is used to update policies.
5. Compliance Policies and Procedures Should Reflect Lessons Learned From a Company’s Own Prior Issues. The DOJ asks not just whether a company has a compliance program but whether the program is continuously evolving to address emerging risks. Companies should consider who is tracking and elevating risks in real time, and how the information learned is being incorporated into compliance policies and procedures.

McDermott’s Enforcement Outlook webinar series is designed to keep you up to date on the enforcement trends that might impact your organization’s compliance strategy. For more materials related to past episodes, visit our Enforcement Outlook Series hub.