Hospital Accreditation: Joint Commission on Accreditation of Healthcare Organizations' Relationship with Its Affiliate
Published: 2006-12-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Hospitals must meet certain conditions of participation established by the Centers for Medicare & Medicaid Services (CMS) in order to receive Medicare payments. In 2003, most hospitals--over 80 percent--demonstrated compliance with most of these conditions through accreditation from the Joint Commission on Accreditation of Healthcare Organizations (Joint Commission). Established in 1986, Joint Commission Resources, Inc. (JCR), a nonprofit affiliate of the Joint Commission, provides consultative technical assistance services to hospitals. Both organizations acknowledge the need to ensure that JCR's services do not--and are not perceived to--affect the independence of the Joint Commission's accreditation process. GAO was asked to provide information on the relationship between the Joint Commission and JCR. This report describes (1) their organizational relationship, and (2) the significant steps they have taken to prevent the improper sharing of information, obtained through their accreditation and consulting activities, respectively, since JCR was established. GAO reviewed pertinent documents, including conflict-of-interest policies and information about the organizations' financial relationship, and interviewed staff and board members from both organizations, JCR clients, and CMS officials.
section_title: What GAO Found
paragraphs: The Joint Commission and JCR have a close relationship as demonstrated through their governance structure and operations. The Joint Commission has substantial control over JCR and the two organizations provide operational services to one another. For example, JCR manages all Joint Commission publications, while the Joint Commission provides support services to JCR. Despite the Joint Commission's control over JCR, the two organizations have taken steps designed to protect facility-specific information. In 1987, the organizations created a firewall--policies designed to establish a barrier between the organizations to prevent improper sharing of this information. For example, the firewall is intended to prevent JCR from sharing the names of hospital clients with the Joint Commission. Beginning in 2003, both organizations began taking steps intended to strengthen this firewall, such as enhancing monitoring of compliance. Ensuring the independence of the Joint Commission's accreditation process is vitally important. To prevent the improper sharing of facility-specific information, it would be prudent for the Joint Commission and JCR to continue to assess the firewall and other related mechanisms. The Joint Commission agreed with GAO's concluding observations. CMS did not comment on GAO's findings or concluding observations. Both provided technical comments, which we incorporated as appropriate.

section_title: Letter
paragraphs: In order to be eligible to receive payments from Medicare—the federal  program that provides health care benefits to over 42 million elderly and  disabled beneficiaries—hospitals must meet certain criteria established by  federal law. The Centers for Medicare & Medicaid Services (CMS), the  federal agency within the Department of Health and Human Services  (HHS) that administers Medicare, has established conditions of  participation that hospitals must meet to be eligible to participate in the  Medicare program. The Joint Commission on Accreditation of Healthcare  Organizations (Joint Commission), a nonprofit corporation, has developed  its own accreditation standards that are intended to meet or exceed  Medicare’s conditions of participation. Hospitals accredited by the Joint  Commission are, in general, deemed to meet most of the conditions to be  eligible for Medicare payment. In 2003, most hospitals—over   80 percent—demonstrated that they met the applicable conditions of  participation through accreditation from the Joint Commission.
The Joint Commission’s status as a hospital accrediting body was  established by statute in 1965, and consequently, can only be changed by  Congress. Although CMS has approved other organizations’ hospital  accreditation programs, the Joint Commission is the only organization  whose approval is expressly provided for in statute. As such, the Joint  Commission is not required to periodically reapply to CMS for this  approval.
In 1986, the Joint Commission created Joint Commission Resources, Inc.  (JCR), a nonprofit, controlled affiliate. JCR’s stated purpose is to assist  health care organizations in improving the quality of their care through  educational and research activities. Of particular interest, JCR provides  consultative technical assistance services—referred to as “consulting  services” throughout the remainder of this report—to health care facilities,  including individual hospitals and members of state hospital associations,  to help facilities comply with the Joint Commission’s accreditation  standards. While JCR is a separate entity legally from the Joint  Commission, the organizations are related corporate entities. As a result,  the two organizations have acknowledged the need to ensure that JCR’s  consultative services do not affect, and are perceived not to affect, the  independence of the Joint Commission’s accreditation process, either  through the improper sharing of information about facilities using JCR’s  services with Joint Commission accreditation staff or through any  implication that using JCR’s services will provide an undue advantage in  the Joint Commission accreditation process. Both of the organizations  attempted to address these concerns through the development of a  “firewall”—policies designed to establish a barrier between the  organizations to prevent conflicts of interest and sharing of facility- specific information. For example, the firewall is intended to prevent JCR  from sharing the names of its hospital clients with the Joint Commission.
You asked us to provide information on the relationship between the Joint  Commission and JCR as it relates to the hospital accreditation process. In  this report, we describe (1) how the Joint Commission and JCR are related  to one another through their governance structure and operations, and   (2) the significant steps both organizations have taken to prevent the  improper sharing of facility-specific information, obtained through their  hospital accreditation and consulting activities, since the creation of JCR.
To describe the relationship between the Joint Commission and JCR,  specifically as it pertains to their governance structure and operations, we  interviewed senior staff at both organizations, including the President of  the Joint Commission and the individual who serves as both President and  Chief Executive Officer (CEO) of JCR. We also interviewed board  members from the Joint Commission and JCR and reviewed documents  from both organizations, including documents related to the organizations’  financial relationship. Further, we interviewed staff at CMS to obtain  information on their oversight of the Joint Commission and other  accreditation organizations, and reviewed reports CMS provides to  Congress related to its validation surveys of Joint Commission accredited  hospitals. To further our understanding of issues related to organizational  governance, conflicts of interest, and independence standards, we  interviewed officials from both the private and public sector and reviewed  pertinent documents.
To provide information on the significant steps taken by the Joint  Commission and JCR since JCR’s creation to prevent the improper sharing  of facility-specific information, we reviewed relevant policies developed  by the two organizations. We reviewed versions of the firewall and related  policies issued between 1987 and 2006 and interviewed senior staff with  responsibility for this area, including the person who serves as the  Corporate Compliance and Privacy Officer (Compliance Officer) for both  organizations. We also conducted interviews with staff members at each  organization to obtain information on their understanding of the firewall  and related policies and guidelines, their training on these policies and  guidelines, and their awareness of possible firewall violations. In addition,  to learn about JCR’s clients’ understanding of the relationship between  JCR and the Joint Commission, we conducted interviews with state  hospital associations that, as of May 2006, used JCR’s consulting services,  and hospitals that used these services during calendar year 2005. We also  conducted interviews with state hospital associations that had not used  JCR’s consulting services as of May 2006 to learn more about their reasons  for not doing so. The information provided from our interviews with staff,  state hospital associations, and hospitals reflects the comments of those  we interviewed and cannot be generalized to all Joint Commission and  JCR staff or all state hospital associations and hospitals using JCR  consulting services. (For additional information on our methodology, see  app. I.)
We conducted our work from October 2005 to December 2006, in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: The Joint Commission, a nonprofit organization founded in 1951, was  created to provide voluntary health care accreditation for hospitals. All but  one of the Joint Commission’s founding members continued to serve on its  Board of Commissioners as of October 2006, including the American  Hospital Association and the American College of Surgeons. The  standards established by the Joint Commission address a facility’s level of  performance in areas such as patient rights, patient treatment, and  infection control. To determine whether a facility is in compliance with  those standards, the Joint Commission conducts on-site evaluations of  facilities, called accreditation surveys. The Joint Commission recognizes a  facility’s compliance with its standards by issuing a certificate of  accreditation, which is valid for a 3-year period. In 2004, the Joint  Commission implemented a new accreditation process in an effort to  encourage hospitals to focus on continuous quality improvement, rather  than survey preparation. Previously, facilities were told in advance when  Joint Commission surveyors would conduct their evaluations. As a part of  the new process, the Joint Commission began conducting unannounced  surveys. The Joint Commission employs over 900 staff members,  including approximately 200 hospital surveyors from a range of  disciplines—such as physicians, nurses, and hospital administrators—who  conduct the accreditation surveys. In 2005, the Joint Commission  accredited approximately 4,300 hospitals.
The Joint Commission established JCR to provide consultative technical  assistance to health care organizations seeking Joint Commission  accreditation. (See fig. 1.) JCR is governed by a Board of Directors and  employs approximately 180 staff members, including consultants located  throughout the country. In 2000, the Joint Commission expanded JCR’s  role beyond consulting to include all educational services, such as  seminars and audio conferences, which the Joint Commission previously  provided. (See app. II for a timeline of key developments in the Joint  Commission and JCR relationship.) JCR also became the official publisher  of the Joint Commission’s accreditation manuals and support materials.  JCR offers consulting services either independently to health care facilities  or through a subscription-based service called the Continuous Service  Readiness (CSR) program, which is typically offered in partnership with  state hospital associations. The CSR program provides ongoing technical  assistance and education to subscribers through a variety of means,  including meetings, e-mails, telephone calls, and conferences.
In 2004, we reported that CMS’s oversight of the Joint Commission  hospital accreditation process is limited. Although it conducts on-site  validation surveys of a sample of Joint Commission-accredited hospitals,  the agency cannot restrict or remove the Joint Commission’s accreditation  authority if it detects problems. CMS reported that the agency and the  Joint Commission engage in ongoing dialogue to identify potential hospital  accreditation performance issues. In addition, CMS provides an annual  report of its findings to Congress. Unlike the Joint Commission, JCR is not  subject to any oversight by CMS.
When developing policies regarding its relationship with JCR, the Joint  Commission has been affected by the increased focus in both the public  and private sectors on governance issues. The Sarbanes-Oxley Act of  2002, passed in response to corporate and accounting scandals, required  publicly traded companies to follow new governance standards, including  those designed to ensure auditors’ independence from their clients. Even  though most provisions of the Sarbanes-Oxley Act are not applicable to  nonprofit organizations, activities that have occurred in the wake of the  act have affected nonprofits. For example, several state legislatures are  considering legislation that applies standards similar to the Sarbanes- Oxley requirements to nonprofit organizations. In addition, some nonprofit  organizations, such as the Joint Commission, have voluntarily adopted  policies and altered governance practices based upon the act.
Organizations in the public and private sectors have also begun to institute  compliance programs and those that provide accreditation or  certification services have developed standards to ensure the  independence of these services. Compliance programs for health care  organizations—such as hospitals, home health agencies, and medical  supply companies—have used provisions of the federal Sentencing  Guidelines, developed in 1991, as a program model. These guidelines lay  out two common principles of adequate compliance programs—to prevent  and detect criminal conduct, and to promote an organizational culture of  ethics and compliance with the law. In 1998, the HHS Office of Inspector  General developed a model compliance program for hospitals. Regarding  independence standards, organizations that provide accreditation or  certification, or recognize accreditation bodies, have begun to impose  certain criteria to demonstrate independence. For example, the  Department of Education developed criteria for educational accrediting  bodies that are designed to ensure that those organizations granting  accreditation are not improperly influenced by related trade or  membership associations.
section_title: The Joint Commission Has a Close Relationship with JCR through Their Governance Structure and Operations
paragraphs: The mission statements of the Joint Commission and JCR both share the  same phrase of seeking “to continuously improve the safety and quality of  care.” While each organization differs in the activities it engages in to  achieve that mission, they maintain a close relationship through both their  governance structure and operations. The Joint Commission has  substantial control over the governance of JCR through the powers  retained by the Joint Commission in JCR’s bylaws as well as through the  Joint Commission’s representation on JCR’s Board of Directors. In  addition, JCR manages all Joint Commission publications and educational  activities, while the Joint Commission provides various support services  and some management oversight to JCR.
subsections: section_title: The Joint Commission Has Substantial Control over JCR through Its Governance Authority
paragraphs: The Joint Commission has substantial control over the governance of its  affiliate, JCR. In 2003, the Joint Commission undertook a major review of  the structural, operational, and legal aspects of its relationship with JCR in  an effort to address any real or perceived conflict-of-interest issues. This  review led to the restructuring of JCR through revisions to JCR’s bylaws,  which govern the internal affairs of the organization, and resulted in  changes to the composition of JCR’s board and the appointment of board  officers. In particular, after the restructuring the Joint Commission no  longer retained a majority on the JCR board through board members who  served on the boards of both organizations. However, through changes to  JCR’s bylaws, the Joint Commission maintained control over JCR by  reserving powers that would otherwise have been exercised by JCR.
The 2003 restructuring of JCR allowed the Joint Commission to effectively  maintain control over JCR by implementing a change in the “corporate  membership” of JCR. Similar to for-profit entities that may have  stockholders, nonprofit corporations may have corporate members who,  in general, are responsible for major organizational decisions, such as  electing the corporation’s board. If a nonprofit corporation does not have  any members, the corporation’s board of directors holds decision-making  authority. With the restructuring of JCR, the Joint Commission became  the “sole member” of JCR.
The sole member has the ability to exercise substantial control over the  affiliate through its “reserved powers”—powers that would otherwise be  exercised by the affiliate board, if the sole member did not reserve them  for itself. When the Joint Commission became the sole member of JCR, its  reserved powers included those previously held and a number of  additional powers, as shown in table 1. A practicing attorney with  expertise in transactions involving nonprofit health care organizations and  who has served as external counsel for the Joint Commission considers  this structure necessary to enable the parent to protect itself from the  possibility of the affiliate acting against the parent’s interests. However, an  article published in a law journal cautions that this structure allows the  parent to make decisions solely in its own interest without considering the  impact on the affiliate.
As part of the 2003 restructuring, the Joint Commission took steps to  reduce the proportion of persons serving on the JCR board who also  served as board members on the Joint Commission board. Prior to the  2003 restructuring, JCR’s board had 13 directors with a majority—7  directors—from the Joint Commission, including the President of the Joint  Commission as an ex officio director with voting rights. The other 6  directors were from outside the Joint Commission, and included the CEO  of JCR as an ex officio director with voting rights. After the 2003  restructuring, directors from the Joint Commission no longer comprised  the majority of members on JCR’s board. There are 17 directors on JCR’s  board, consisting of 7 Joint Commission directors—including the  President of the Joint Commission as an ex officio director with voting  rights—and 9 external directors who cannot be, either concurrently or  within the prior 3 years, Joint Commission commissioners or employees.  The President/CEO of JCR also serves on the JCR board, serving as a  voting ex officio director. (See fig. 2.)
Directors we interviewed who serve on both the Joint Commission and  JCR boards said that serving on the two boards has not been problematic  because both organizations share the same mission. However, they also  recognized the potential for overlapping board members to be faced with  competing organizational interests if differences between the Joint  Commission and JCR arise. These directors noted that, if competing  organizational interests were to occur, the Joint Commission’s reserve  powers would dictate the final decision.
The restructuring also affected the appointment of JCR officers. Prior to  the restructuring, the President and the Chief Financial Officer (CFO) of  the Joint Commission also served in those same positions for JCR. The  CEO of JCR was appointed by, and reported to, the President of the Joint  Commission, and could only appoint other JCR officers after consulting  with the Joint Commission’s President. Changes to JCR’s bylaws through  the 2003 restructuring removed the requirement that the Joint  Commission’s President and CFO serve in those positions for JCR. Rather,  the Joint Commission appoints and has the power to remove the  President/CEO of JCR. The President/CEO of JCR also now has the  authority to appoint officers, such as the CFO, without consulting with the  Joint Commission’s President. In addition, the Joint Commission, rather  than JCR’s board, now appoints the vice chairman of JCR’s board.
One other noteworthy change as a result of the 2003 restructuring dealt  with the role of two Joint Commission board committees in relation to  JCR and the creation of a new JCR board committee. The Joint  Commission created a Governance Committee, which has a number of  responsibilities involving JCR, such as nominating JCR board directors  and certain officers. This committee also has oversight responsibility for  JCR governance issues and JCR conflict-of-interest policies, and reviews  the bylaws and other documents of JCR. Further, the Joint Commission  expanded the responsibilities of an existing committee—the Finance and  Audit Committee—to include reviews of annual financial audits and other  matters related to oversight of the firewall between the Joint Commission  and JCR. Within the JCR board, a Firewall Oversight Committee was  created as a result of the restructuring. This committee is charged with  monitoring compliance with the firewall and related policies.
section_title: The Joint Commission and JCR Provide Operational Assistance to One Another
paragraphs: The structure of the Joint Commission and JCR allows the two  organizations to provide certain operational assistance to one another.  The Joint Commission provides support and management services to JCR.  Through a January 2001 service agreement, the Joint Commission provides  JCR with financial, legal, marketing and public relations, human resources,  accounting (bookkeeping and payroll), information technology, and other  support services such as office management and mail. JCR pays for these  services through a management fee. The methodology used to determine  the appropriate allocation of expenses varies by department. For some  departments, the allocation is based upon JCR’s percentage of total  revenues, whereas in other departments, the estimate is made using the  amount of time spent doing work on behalf of JCR. Departments also vary  in whether they include overhead costs in the allocation.
Along with support services, the Joint Commission also provides  management services to JCR through its General Counsel and Compliance  Officer. For example, all JCR materials, including the publications it  produces on behalf of the Joint Commission and materials produced for its  own purposes, must be reviewed and approved by the Joint Commission’s  General Counsel prior to issuance. The Compliance Officer, a position  created by the Joint Commission in 2005, oversees compliance duties for  both the Joint Commission and JCR. Among other duties, the Compliance  Officer is responsible for implementing, providing training on, and  monitoring compliance with the firewall policies. The Compliance Officer  reports directly to the President of the Joint Commission and  President/CEO of JCR, the Joint Commission’s Governance Committee,  JCR’s Firewall Oversight Committee, and may also report to the full  boards of both organizations. The Compliance Officer is aided by a  Compliance Council, which was created in late 2005 and consists of  members who represent multiple departments from both the Joint  Commission and JCR. The Council works with the Compliance Officer to  develop an annual work plan that focuses on areas of greatest risk,  recommended training, auditing, and measures of the compliance  program’s effectiveness.
JCR also provides assistance to the Joint Commission, including  publication and educational services. The Joint Commission transferred its  publications and educational product lines to JCR in 2000 in order to  combine support services within JCR and to allow for organizational  separation between the Joint Commission’s evaluation and accreditation  function and the consultation and educational services provided by JCR.  JCR currently offers a variety of educational programs regarding Joint  Commission accreditation, including seminars, e-learning opportunities,  and audio, satellite, and video conferences. These programs cover a range  of topics and include information on the Joint Commission standards and  changes to those standards. JCR also publishes its own books on health  care issues and periodicals on patient safety and quality improvement.
The operational services the Joint Commission and JCR provide to one  another result in a flow of funds between the two organizations. In  exchange for the license to publish Joint Commission materials, JCR pays  the Joint Commission a royalty fee that ranges from 4.75 to 9.5 percent on  gross sales. JCR also annually transmits assets to the Joint Commission in  excess of the amount needed to operate JCR’s business. The amount of the  transfer is based on a formula that considers JCR’s cash, investments, and  average operating expense.
section_title: The Joint Commission and JCR Have Taken Steps to Prevent the Improper Exchange of Facility-Specific Information
paragraphs: The Joint Commission and JCR have taken steps, primarily since 2003,  designed to strengthen the firewall guidance initially developed in 1987,  shortly after the creation of JCR. They have also further developed  guidance addressing the relationship between the two organizations. In  addition, they have made an effort to educate staff at both organizations  on these matters and have enhanced monitoring of compliance with the  firewall and related policies.
subsections: section_title: The Joint Commission and JCR Have Policies Designed to Prevent the Sharing of Facility-specific Information
paragraphs: The Joint Commission and JCR firewall polices were initially developed as  guidelines in 1987. Relatively few changes were made to these guidelines  until 2003, when they were extensively modified. In addition, since 2003,  the Joint Commission and JCR have developed other policies and  guidance designed to further strengthen the firewall between the two  organizations.
subsections: section_title: Firewall Policies
paragraphs: Since 1987, shortly after the creation of JCR, both the Joint Commission  and JCR have operated under a set of firewall guidelines designed to  prevent conflicts of interest between the Joint Commission’s accreditation  activities and JCR’s consultative services. Between 1987 and 2003, the  firewall guidelines were modified twice—once in 1992 and again in 1999— to reflect JCR’s name change and other issues related to JCR services. In  2003, the Joint Commission and JCR made extensive modifications to the  guidelines, which were released to staff in the form of policies in 2004.  (See app. III for a list of key policies, guidelines, and protocols.) These  modifications stemmed from the Joint Commission’s review of its  relationship with JCR following the passage of the Sarbanes-Oxley Act in  2002. According to senior staff from the Joint Commission and JCR, the  revised firewall policies are not based on any specific model. However,  they are a component of the two organizations’ joint compliance  program, which was developed in part using the hospital compliance  program guidelines issued by HHS’s Office of Inspector General.
The stated purpose of both organizations’ firewall policies is “to eliminate  any real or perceived conflict of interest” between the Joint Commission’s  accreditation activities and JCR’s consulting services. Certain  requirements in the firewall policies of the two organizations are very  similar, such as a prohibition on accessing confidential facility-specific  information from, or sharing any facility-specific information with, staff  from the other organization. (See app. IV for more information on the  contents of each organization’s firewall policies.) Joint Commission and  JCR staff are also prohibited from suggesting that the use of JCR  consulting services is necessary for, or will influence, Joint Commission  accreditation decisions. In addition, staff and board members of both  organizations are required to sign an annual statement signifying that they  have read, and agree to comply with, the firewall policies. Of the 25 staff  members we spoke with from the Joint Commission and JCR, all but 1  reported signing the required annual compliance statement and all but 4— 2 from the Joint Commission and 2 from JCR—were aware that the  firewall policy required them to sign this statement on an annual basis.
While both organizations’ firewall policies share similar requirements,  each has certain provisions that focus specifically on the services offered  by its own organization. For example, the Joint Commission’s firewall  policy stipulates that Joint Commission staff will not seek or solicit  information on whether or not a facility has used JCR consulting services.  The Joint Commission policy also provides guidance on how Joint  Commission staff should respond to requests for consulting services. For  example, if a facility asks Joint Commission surveyors for advice on these  services, they are required to direct the facility to an appropriate senior  staff member in the Joint Commission’s central office. That senior staff  member can provide limited information on JCR, including its services and  the reason for its creation. JCR’s firewall policy limits, among other things,  the language JCR can use to promote its services. It also requires that  JCR’s consulting services staff be housed in separate facilities from Joint  Commission staff and use separate telephone and computer systems.
Most of the state hospital associations and hospitals we interviewed that  use JCR’s consulting services were familiar with the firewall between the  Joint Commission and JCR. Of the five state hospital associations we  interviewed that participate in JCR’s CSR program, four said they were  provided with information on the relationship between the Joint  Commission and JCR or had been told by JCR staff about the firewall  between the two organizations. Further, all five associations stated that  JCR staff have never indicated that participation in the CSR program  would affect the accreditation process, other than through the general  improvements that are expected when using consulting services. Similarly,  staff we interviewed at six hospitals that use JCR’s consulting services  stated that there had been no indication from JCR consultants that the use  of these services would influence their facility’s Joint Commission  accreditation process.
section_title: Additional Firewall- Related Policies and Guidance
paragraphs: In addition to the recent changes to the firewall policies, the Joint  Commission and JCR developed other policies and guidance beginning in  2003 that further address possible areas of risk to the firewall. JCR  formalized protocols for its consultants in the field, which provide specific  guidance related to their interaction with the Joint Commission staff. For  example, if Joint Commission staff members arrive at a facility to conduct  a survey when a JCR consultant is on site, the JCR consultant must leave  the facility immediately. In 2003, JCR also developed a policy—referred to  as the “scope limitations policy”—which is designed to clarify what  services can be provided to Joint Commission-accredited facilities. The  policy specifically prohibits JCR from providing certain consulting  services to facilities after they have undergone a Joint Commission survey,  including helping facilities challenge the Joint Commission’s accreditation  decisions or findings, resolving Joint Commission deficiency findings, or  preparing facilities that have been denied Joint Commission accreditation  for future surveys.
In 2004, the Joint Commission developed an additional policy reiterating  the importance of the firewall for those Joint Commission employees— information technology and planning and financial affairs staff—who,  through the service agreement between the two organizations, need, and  are able, to access JCR financial or operational information. In addition  to the firewall compliance statement all Joint Commission staff are  required to sign, these particular staff members are required to sign a  separate compliance statement associated with this specific policy. Also in  2004, JCR approved a formal firewall policy related to JCR marketing  materials in an effort to ensure that JCR marketing materials contain no  implication that purchasing its products or services will impact the Joint  Commission accreditation process. Because JCR markets some products  that it develops on the Joint Commission’s behalf—publications and  educational services—as well as its consulting services, the marketing  policy clarifies the language and logos that can be used on marketing  materials for these different products. For example, while marketing  materials for the Joint Commission accreditation manuals published by  JCR can only carry the Joint Commission logo, JCR’s marketing materials  promoting its consulting services carry only the JCR logo.
In 2006, the Joint Commission and JCR published posters, which are  displayed in Joint Commission and JCR meeting rooms, to govern  meetings that involve staff from both organizations. These posters  reiterate the organizations’ firewall policy requirements, in place since  1987, that facility-specific information should not be discussed at meetings  that include staff from both organizations and such information cannot be  included in materials prepared for those joint meetings. The posters also  state that, if facility-specific information must be discussed for business  purposes by staff from one organization, the staff from the other  organization must leave the meeting. There are a number of occasions  when Joint Commission and JCR staff interact during which these  guidelines may be applicable. For example, both Joint Commission and  JCR staff participate on internal interdepartmental teams designed to  review Joint Commission programs and ensure they are valuable to health  care organizations. Because these meetings include reviews of the  programs’ publication and education services—services provided by  JCR—JCR staff participate on these teams. Another area of interaction is  through educational programs offered by JCR. These programs may  include training by Joint Commission surveyors and central office staff  and may take place at the Joint Commission’s headquarters.
The Joint Commission and JCR have also developed a joint code of  conduct and organization-specific conflict-of-interest policies that, while  not focused exclusively on firewall issues, address aspects of the  relationship between the two organizations and the independence of the  accreditation process. In particular, the Joint Commission’s conflict-of- interest policy prohibits staff from providing accreditation-related  consulting and prohibits survey staff from surveying facilities to which  they provided consulting services during the previous 3 years. Similarly,  JCR’s conflict-of-interest policy prohibits staff from providing external  accreditation-related consulting services and prohibits JCR consultants  from providing consulting services to any facility they may have surveyed  in the past 3 years.
section_title: The Joint Commission and JCR Have Taken Steps to Train Staff on, and Monitor, the Firewall
paragraphs: The Joint Commission and JCR report providing ongoing training to  ensure that staff understand the firewall and related policies. The  organizations have also developed mechanisms, primarily since 2003, that  allow staff to report possible firewall violations. Both organizations report  monitoring compliance with these policies on an ongoing basis and, in  2005, underwent a joint external review of their implementation.
subsections: section_title: Staff Training on Firewall and Firewall-Related Policies
paragraphs: The Joint Commission and JCR reported that both board and staff  members receive training on the firewall and related policies—board  members are trained when they join the board and staff are trained during  new employee orientation. In addition, Joint Commission and JCR staff  receive annual training on the firewall and related policies and procedures  and are further reminded of these policies through periodic presentations  at departmental staff meetings.
As of June 2006, the organizations’ staff training did not include a testing  component to measure how well staff understand the policies. However,  most staff members and senior staff we spoke with at both organizations  were aware of the firewall policies and were able to accurately describe  their purpose. All but 1 of the 25 staff members we spoke with—13 with  the Joint Commission and 12 with JCR—reported being familiar with these  policies. In addition, all but 1 of the 24 staff members who were familiar  with the firewall policies stated that the training and information they  received made them sufficiently aware of the firewall and its appropriate  implementation. None of the 25 staff members we spoke with were aware  of cases in which staff from either organization had suggested that the use  of JCR consulting services would influence Joint Commission  accreditation.
In addition to training sessions, staff members at the Joint Commission  and JCR have access to information on the compliance program through  an intranet Web site. This site includes copies of the organizations’  respective firewall policies and other compliance-related materials, as well  as information on the role of the organizations’ joint Compliance Officer  and Compliance Council.
section_title: Mechanisms for Reporting Violations
paragraphs: The firewall policies for both organizations require employees to report  violations to their management, the Compliance Officer, or the Joint  Commission General Counsel. In keeping with this requirement, senior  Joint Commission and JCR management stated that they encourage  employees to contact their supervisors or these other management  officers if they are aware of possible violations or have questions on the  firewall. Of the 24 staff members we interviewed at both organizations  who were familiar with the firewall policies, 20 indicated that if they  became aware of a violation, they would contact another staff member,  such as their direct supervisor, division head, or the Compliance Officer.
The Joint Commission and JCR have also developed a compliance hotline  that allows staff to anonymously report any concerns related to  compliance issues. While the firewall policies require employees to report  violations to certain staff, this hotline offers another means of reporting  possible firewall violations. From its inception in March 2005 through  December 2005, the hotline received three calls, none of which involved a  firewall violation. All 24 of the Joint Commission and JCR staff members  we spoke with who were familiar with the firewall policies reported being  aware of the compliance hotline. Of those staff members, 6 stated that  they would contact the hotline if they became aware of a firewall violation.
section_title: Monitoring of Firewall and Related Policies
paragraphs: The Joint Commission and JCR staff report taking multiple steps to  monitor implementation of, and compliance with, the firewall and related  policies. The organizations have created the Compliance Officer position,  the Compliance Council, and the JCR Firewall Oversight Committee, all of  which have a role in monitoring compliance with the firewall and related  policies.
According to Joint Commission and JCR staff, the firewall policies have  been monitored internally on an ongoing basis and are now subject to  external reviews. The Joint Commission conducted an internal review in  2002, which was presented to the Joint Commission and JCR boards in  2003. The 2004 and 2005 firewall policies for both organizations called for  an annual audit of the policy by the Joint Commission’s Office of Legal  Affairs, but these audits were not conducted. According to senior Joint  Commission staff, the Joint Commission determined that its legal  department could not conduct a sufficient audit and that instead, the  audits should be conducted by an external body with experience in this  area. In 2005, the Joint Commission and JCR hired a consulting firm to  conduct the first external review of the organizations’ firewall policies and  related guidance. Following this review, in 2006, the requirement for an  annual audit by the Office of Legal affairs was deleted and was replaced  with a requirement for an annual review, the results of which are  presented to the appropriate committees of each board. According to Joint  Commission staff, the Joint Commission and JCR anticipate continuing to  contract for an external review of the firewall on an annual basis.
The external review conducted in 2005 did not identify any major  violations of either organization’s firewall policy—violations that could  potentially breach the integrity of the accreditation process. In its report,  the consulting firm stated that the implementation of the firewall policies  “represented a reasonable effort to prevent any behavior that could result  in a breach of the integrity of the accreditation process.” However,  because no guidelines or standards exist for this kind of review, the  consulting firm did not certify that the firewall and related policies  protected the integrity of the accreditation process.
The external review did identify some minor violations of the firewall— defined as violations that resulted from the staff’s failure to completely  follow operational procedures required by the policies, but which are not  considered to potentially breach the integrity of the accreditation process.  For example, at the time of the 2005 review, JCR publications and  education staff housed in the Joint Commission offices had access to a  Joint Commission shared network folder on a computer drive. While this  shared folder could not be accessed by JCR consulting staff and Joint  Commission surveyors used a separate network, the consulting firm  recommended eliminating JCR staff access. The Joint Commission and  JCR agreed with this and other recommendations made, and report taking  steps to address the issues, including eliminating JCR’s access to Joint  Commission computer systems.
In addition to this external review, the Joint Commission reported that,  throughout the year, the Compliance Officer monitors concerns and  questions related to the firewall and related policies. Based on this  analysis, the organizations review the policies to determine what, if any,  changes need to be made to improve their clarity. In 2006, the Compliance  Officer developed a list of commonly asked questions and answers, which  was approved by the senior management of both organizations and  released to staff.
According to the Compliance Officer, when minor firewall violations are  identified, each instance is reviewed to determine if it had any impact on  the accreditation decision process and if it was due to a lack of  understanding of the policies or was an intentional violation. She will then  either provide clarification, counseling, or, if necessary, initiate  disciplinary action, including possible dismissal, through the human  resources department. As of July, 2006, no Joint Commission or JCR staff  had been terminated as a result of violating the firewall policies. However,  a senior staff member at the Joint Commission reported that staff have  been terminated for violating the Joint Commission’s conflict-of-interest  policies. This staff member noted that two of the organization’s surveyors  had been fired for providing consulting services, although these services  were not provided to facilities they had previously surveyed.
section_title: Concluding Observations
paragraphs: Accreditation is a key mechanism to ensure the safety and quality of  hospital services provided to Medicare beneficiaries and other members of  the public. The Joint Commission’s role in accrediting the majority of  hospitals participating in Medicare makes the issue of ensuring the  independence of the Joint Commission’s accreditation process vitally  important. Any threat to the independence of the accreditation process  could undermine its ability to ensure the safety and quality of services  provided to Medicare beneficiaries and the general public.
The Joint Commission and JCR have taken steps to protect the Joint  Commission’s accreditation process from influence by JCR’s consulting  services by developing mechanisms to protect against the improper  sharing of facility-specific information. However, the majority of these  mechanisms, including the firewall and firewall-related policies, the  compliance hotline, and the annual external review of the firewall, have  either been developed or significantly revised within the past few years— primarily since 2003. The next step is for management of both  organizations to assure that these mechanisms are sufficient to protect the  integrity of the accreditation process. In addition, even with appropriate  policies and procedures in place, it will take ongoing monitoring and a  concerted effort on the part of the leadership of both organizations to  ensure that these policies and procedures are appropriately implemented  by both their board and staff members.
section_title: Agency Comments
paragraphs: We provided a draft of this report to the Joint Commission and CMS for  comment. In its response, the Joint Commission agreed with our  concluding observations, specifically that ensuring the independence of  the accreditation process is vitally important. It indicated that the report  accurately reflects its relationship with JCR, and emphasized that its  highest priority is to preserve the integrity of the Joint Commission’s  accreditation process. (The Joint Commission’s written comments are  reprinted in app. V.) CMS did not comment on our findings or concluding  observations. Both the Joint Commission and CMS provided us with  technical comments, which we incorporated as appropriate.
As we agreed with your offices, unless you publicly announce the contents  of this report earlier, we plan no further distribution of this letter until 30  days after the date of this letter. At that time, we will send copies to the  Administrator of CMS, appropriate congressional committees, and other  interested parties. In addition, the report will be available at no charge on  the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (312) 220-7600 or aronovitzl@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix VI.
section_title: Appendix I: Scope and Methodology
paragraphs: We examined the relationship between the Joint Commission on  Accreditation of Healthcare Organizations (Joint Commission) and Joint  Commission Resources, Inc. (JCR) as it relates to the independence of the  Joint Commissions’ hospital accreditation process from JCR’s hospital  consulting services. To provide information on the governance structure  and operations of the two organizations, we reviewed multiple documents,  including organizational charts reflecting the organizations’ structure as of  2006, a service agreement signed in 2001 and still in effect as of 2006,  Internal Revenue Service tax documents from calendar years 2001 through  2004, and agendas and minutes from board meetings of both organizations  from 2003 through September 2006. We also interviewed the President of  the Joint Commission and the President/Chief Executive Officer of JCR, as  well as officers from the Joint Commission Board of Commissioners and  the JCR Board of Directors. In addition, we interviewed senior staff at  both organizations, including the organizations’ General Counsel, each  organization’s Chief Financial Officer, and the Joint Commission’s Vice  President for Human Resources.
To describe the policies the Joint Commission and JCR have developed to  prevent the improper sharing of facility-specific information, we reviewed  Joint Commission and JCR documents, including current and past policies  and guidance related, either directly or indirectly, to the firewall. We also  examined training materials and reports from the compliance hotline  contractor. We conducted interviews with senior staff from the Joint  Commission and JCR. These senior staff included the shared Corporate  Compliance and Privacy Officer, the Joint Commission’s Vice President of  Accreditation Services, and the Executive Directors of JCR’s consulting  services.
In addition to interviews with senior staff, we selected a sample of 15 staff  members at each organization to interview. These semistructured  interviews were designed to collect information on Joint Commission and  JCR staff members’ understanding of the firewall and related guidance,  their training on this guidance, and their awareness of possible firewall  violations. Our selection of staff members concentrated on those who  were JCR consultants and Joint Commission staff conducting surveys or  working in the areas of information technology, planning and financial  affairs, and marketing. We considered these particular staff members more  likely to be in a position to breach the firewall than other employees. We  selected staff using random lists of JCR consultants, Joint Commission  hospital surveyors, and employees from the information technology,  planning and financial affairs, and marketing departments, as well as a  random list of employees from all other areas at each organization.  Selected staff were contacted by phone and e-mail. If, after three  attempted phone calls and one e-mail, staff did not respond to our request  for an interview we moved to the next staff member identified in our  random selection. We were able to conduct a total of 25 interviews with  Joint Commission and JCR staff. We were unable to arrange interviews  with 2 Joint Commission surveyors and 3 JCR consultants. We excluded  any Joint Commission survey staff who were not hospital surveyors, JCR  staff who provided only international services, senior staff at both  organizations who we had already interviewed, and Joint Commission  staff acting as liaisons to our work. The information gathered from these  interviews reflects the experience of these staff members and cannot be  generalized to all Joint Commission or JCR staff. While the interviews  provide information on staff awareness of the firewall policies and related  guidance, as well as their awareness of possible firewall violations, they  are not sufficient to determine if there have or have not been any firewall  violations.
We also conducted interviews with officials from a random sample of 5 of  the 14 state hospital associations that participated in JCR’s Continuous  Service Readiness (CSR) program as of May 2006, and with officials from 5  state hospital associations that do not participate in the CSR program.  These interviews were designed to obtain information on the associations’  understanding of the relationship between the Joint Commission and JCR  and how they perceived that their participation in the CSR program might  impact their members’ Joint Commission accreditation. To select the  sample for these interviews, we sorted the associations by census regions.  We then selected a random sample of associations that participate in the  CSR program and a random sample of those that do not from within each  census region. We conducted semistructured interviews with each of the  selected associations. One state hospital association did not respond to  our request for an interview. In this case, we replaced that association  with the next association in the same census region identified in our  random selection.
We also conducted interviews with officials from 6 hospitals that use  JCR’s consulting services to learn more about their understanding of the  relationship between JCR and the Joint Commission. To conduct these  interviews, we determined the number of hospitals that had contracted  with JCR for these services in calendar year 2005. JCR compiled a  spreadsheet that contained e-mail addresses for JCR’s 2005 domestic  hospital clients. We identified a random sample of JCR’s hospital clients  and JCR sent these hospitals an e-mail asking them to contact us if they  were willing to be interviewed. We selected our sample of approximately  10 percent of that population—80 facilities—using a randomly generated  number list. This selection was done at the JCR offices and the e-mails  were sent to hospital facilities under our supervision. Facilities were given  2 weeks to contact us to schedule interviews if they were interested. The  information gathered from these interviews with JCR hospital clients and  the interviews with state hospital associations reflects the experience of  these particular facilities and state hospital associations and cannot be  generalized to all JCR consulting clients.
As part of our work, we also interviewed staff at the Department of Health  and Human Services’ Centers for Medicare & Medicaid Services to obtain  information on their oversight of the Joint Commission and other  accreditation organizations. In addition, we interviewed officials from  multiple organizations and reviewed documents to obtain background  information on possible criteria or best practices related to the  governance of nonprofit organizations, conflicts of interest, compliance  programs, and independence standards. Those we interviewed included  officials at Independent Sector—a coalition of charities, foundations, and  corporate giving programs which focuses on strengthening these  particular types of organizations—and the Hauser Center for Nonprofit  Organizations—a research center at Harvard University focusing on the  nonprofit sector. We also interviewed officials from federal agencies and  organizations to obtain information on how they separate accreditation or  certification programs from consulting services. Those we interviewed  included representatives from the Department of Education, the Council  on Higher Education Accreditation, and the National Organization for  Competency Assurance.
Because the Joint Commission’s status related to Medicare applies only to  hospitals, our review was limited to information related to its  accreditation of hospitals and services provided by JCR to hospitals. We  did not conduct a review of the Joint Commission’s accreditation decision  process. We also did not review information on other activities conducted  by the Joint Commission or JCR that were not related to the relationship  between the Joint Commission’s hospital accreditation process and JCR’s  hospital consulting services. Further, we excluded Joint Commission  International, a division of JCR that provides consulting and accreditation  services to foreign health care facilities, from the scope of our work  because these facilities are not eligible to participate in the Medicare  program.
We conducted our work from October 2005 to December 2006 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Timeline of Key Developments in the Organizations’ Relationship
paragraphs: Appendix II: T the Organizations’ Relationship imeline of Key Developments in  2000: The Joint Commission trfer it  edtion, publiction, nd continus survey  rediness deprtment to JCR.
The Joint Commission yl re mended to:   Crete the Joint Commission’s Finnce   nd Adit Committee, nd expnd it reponilitie to inclde receiving report from the JCR Firewll Overight Committee.   Crete  Governnce Committee.
2001: The Joint Commission nd JCR ign   ervice greement throgh which the Joint  Commission provide er of support  ervice to JCR for gement fee.
The poition of Corporte Complince nd  Privcy Officer i creted. 2004: Operting gideline relted to the  interction of the Joint Commission nd JCR  re formlized as firewll policie.
1999: Joint Commission operting gideline  relting to ctivitie of Joint Commission  Rerce, Inc. i revied to reflect JCR’sme chnge. : The Joint Commission condct  dy of  the potentil impliction of the Sabane-Oxley  Act of 2002 for the governnce of the Joint  Commission nd JCR. A  result the JCR  yl re mended to:   Expnd the rd from 13 director to 17,   the mjority of whom do not erve on the   Joint Commission rd (i.e., “externl   director”).   Allow the Joint Commission preident to erve   only as  voting director on JCR’s rd   nd not as the preident of JCR.   Form the Firewll Overight Committee of   the JCR rd, compoed only of director  who do not erve on the Joint   Commission rd.   Develop fidciry requirement relted to   confidentility nd conflict of interet for    Joint Commission commissioner nd    JCR director.
Sff ign the firt of the nnual complince  tement.
The Joint Commission develop the firewll  policy for plnning nd finnciffir nd  informtion technology ff nd complince  tement for thi ff.
JCR develop the mrketing firewll policy. 2005: Implementtion of the comined Joint  Commission nd JCR complince hotline.
A consulting firm condct n externl review  of the Joint Commission nd JCR firewll nd  firewll-relted policie. 2006: Joint Commission nd JCR develop  comined meeting gideline for Joint  Commission nd JCR.
Additionl policie nd procedre re  developed, inclding:   The Joint Commission code of condct,    which pplie to JCR ff.   JCR’s cope limittion policy.   Protocol for JCR ff.   Initil mrketing gideline.   Policie nd procedre on fidciry   confidentility greement.
section_title: Appendix III: Policies, Protocols, and Guidelines Related to the Firewall, as of 2006
subsections: section_title: Designed to eliminate any real or perceived conflict of interest between the Joint Commission accreditation activities and JCR’s consulting services. Provides specific direction to Joint Commission staff on their interaction with JCR staff and services. This policy applies to all Joint Commission staff.
paragraphs: Firewall policy for planning and financial affairs and information  Reinforces the Joint Commission Firewall Policies and applies  specifically to Planning and Financial Affairs and Information  Technology Staff who provide support services to JCR.
Prohibits involvement in activities that might constitute or be  perceived to constitute a conflict of interest with the overall  mission of the Joint Commission. Requires staff to abide by the  Joint Commission’s firewall policy and prohibits the disclosure of  confidential or proprietary information. Prohibits Joint  Commission staff from providing accreditation-related consulting  services. Prohibits Joint Commission staff from surveying  facilities to which they provided consulting or related services  during the previous 3 years.
Designed to eliminate any real or perceived conflict of interest  between the Joint Commission accreditation activities and  JCR’s consulting services. Provides specific direction to JCR  staff on their interaction with Joint Commission staff and  services. This policy applies to all JCR staff.
Prohibits involvement in activities that might constitute or be  perceived to constitute a conflict of interest with the mission of  JCR and the Joint Commission. Requires staff to abide by  JCR’s firewall policy and prohibits the disclosure of confidential  or proprietary information. Prohibits JCR staff, in most cases,  from providing outside consulting services. Prohibits JCR  consultants from providing consulting services to facilities they  have surveyed in the past 3 years.
Provides requirements for marketing strategies to protect the  integrity of the Joint Commission accreditation process and  ensure that materials contain no implication that purchasing  products or services from JCR will impact accreditation  decisions.
Provides specific direction to JCR consultants in the field,  including their interaction with the Joint Commission staff.
Delineates certain consulting services that cannot be provided  to Joint Commission-accredited organizations, including  assistance in preparing challenges to accreditation decisions,  resolving Joint Commission deficiency findings, preparing root- cause analysis for sentinel events, and preparing organizations  that have been denied Joint Commission accreditation for future  surveys.
Combined Joint Commission and JCR Policies and Guidelines   Guides conduct in meetings that include both Joint Commission  and JCR staff, reiterating that organization-specific or nonpublic  accreditation or survey process information should not be  discussed and, if business needs dictate that organization- specific information be shared, stating that appropriate staff  must excuse themselves.
Provides guidance on standards for staff conduct and the  confidentiality of information, including mechanisms in place to  help staff report violations of the code of conduct.
section_title: Appendix IV: Elements of the Firewall Policies, as of 2006
subsections: section_title: Elements unique to Joint Commission firewall policy
paragraphs: Staff may not seek or solicit information on  whether or not a facility has used JCR and  is not provided this information by the Joint  Commission or JCR representatives.
Staff may not suggest that the use of  JCR consulting services is necessary  to obtain or influence Joint  Commission accreditation.
Staff may not access confidential  services are informed that the Joint  Commission is not told that the facility  used JCR’s services and a disclaimer to  this effect is included in JCR contracts. participation in JCR’s Continuous Service  Readiness program (CSR) is not  considered in the accreditation process. facility-specific information from, or  share facility-specific information with,  the other organization.
Participants in JCR’s CSR program are  informed that Joint Commission survey  teams are told that CSR participation is  not considered in the accreditation  process.
Commission’s Historical File Room.
Joint Commission surveyors are instructed  that survey report forms may not include  information on whether or not the surveyed  organization has used JCR’s services. information about the application of  the Joint Commission standards or  accreditation procedures that is not  already available, or will be made  available promptly, to outside parties.
JCR staff may not attend Joint  with surveyors about specific facility  accreditation decisions, may not in any  way participate in the accreditation  process as a representative of the  facility, and may not discuss the choice  of surveyors for particular facilities with  the Joint Commission.
Joint Commission Historical File Room staff  to allow them to monitor access.
Commission surveyor training and  may not have access to surveyor  educational tools not generally  available to outside parties.
All JCR promotional materials related to  consulting services are reviewed by the  Joint Commission Office of Legal Affairs. financial and operational information as  part of their role in providing services to  JCR may not disclose JCR organization- specific information to other Joint  Commission staff.
All staff must sign a compliance  statement on an annual basis.
The firewall policy is sent annually to  separate offices, telephone numbers,  and computer systems from the Joint  Commission.
JCR publishes the Joint Commission’s  accreditation materials and supplies their  educational services. These services are  promoted in Joint Commission and JCR  materials. Any reference in Joint  Commission materials to JCR’s consulting  services is generally limited to  acknowledging JCR’s existence, its  services, and the reason for its creation. all staff, and is referenced in each  organization’s conflict-of-interest  policies, which staff are also required  to sign on an annual basis.
The firewall policy is covered during  new employee orientation and  training.
JCR promotional materials are limited to  identifying JCR as a nonprofit affiliate of  the Joint Commission and the  separateness between accreditation  decisions and JCR’s services should be  identified.
Staff must report any violation of their  organization’s firewall policy to the  Compliance Officer, the Joint  Commission General Counsel, or  their organization’s management. consulting services are referred to the Joint  Commission’s central office. Staff at the  central office will refer to the availability of  JCR’s services, and will also emphasize  the separateness of the Joint Commission’s  accreditation process from JCR’s  consulting services.
An annual review is conducted to  ensure appropriate separation  between the Joint Commission  accreditation activities and JCR  consulting services and the results  are presented to the relevant board  committees.
The Historical File Room is a secured space at the Joint Commission offices in Oakbrook Terrace,  Illinois.
Staff are required to sign compliance statements signifying that they have read, and agree to comply  with, both the firewall policy and conflict-of-interest policy that apply to their specific organization.
section_title: Appendix V: Comments from the Joint Commission on Accreditation of Healthcare Organizations
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the person named above, Geraldine Redican-Bigott,  Assistant Director; Emily Gamble Gardiner, Thomas Han, Kevin Milne,  Daniel Ries, Janet Rosenblad, and Jessica Cobert Smith made key  contributions to this report.