The Joint Commission, a nonprofit organization founded in 1951, was created to provide voluntary health care accreditation for hospitals. All but one of the Joint Commission’s founding members continued to serve on its Board of Commissioners as of October 2006, including the American Hospital Association and the American College of Surgeons. The standards established by the Joint Commission address a facility’s level of performance in areas such as patient rights, patient treatment, and infection control. To determine whether a facility is in compliance with those standards, the Joint Commission conducts on-site evaluations of facilities, called accreditation surveys. The Joint Commission recognizes a facility’s compliance with its standards by issuing a certificate of accreditation, which is valid for a 3-year period. In 2004, the Joint Commission implemented a new accreditation process in an effort to encourage hospitals to focus on continuous quality improvement, rather than survey preparation. Previously, facilities were told in advance when Joint Commission surveyors would conduct their evaluations. As a part of the new process, the Joint Commission began conducting unannounced surveys. The Joint Commission employs over 900 staff members, including approximately 200 hospital surveyors from a range of disciplines—such as physicians, nurses, and hospital administrators—who conduct the accreditation surveys. In 2005, the Joint Commission accredited approximately 4,300 hospitals. The Joint Commission established JCR to provide consultative technical assistance to health care organizations seeking Joint Commission accreditation. (See fig. 1.) JCR is governed by a Board of Directors and employs approximately 180 staff members, including consultants located throughout the country. In 2000, the Joint Commission expanded JCR’s role beyond consulting to include all educational services, such as seminars and audio conferences, which the Joint Commission previously provided. (See app. II for a timeline of key developments in the Joint Commission and JCR relationship.) JCR also became the official publisher of the Joint Commission’s accreditation manuals and support materials. JCR offers consulting services either independently to health care facilities or through a subscription-based service called the Continuous Service Readiness (CSR) program, which is typically offered in partnership with state hospital associations. The CSR program provides ongoing technical assistance and education to subscribers through a variety of means, including meetings, e-mails, telephone calls, and conferences. In 2004, we reported that CMS’s oversight of the Joint Commission hospital accreditation process is limited. Although it conducts on-site validation surveys of a sample of Joint Commission-accredited hospitals, the agency cannot restrict or remove the Joint Commission’s accreditation authority if it detects problems. CMS reported that the agency and the Joint Commission engage in ongoing dialogue to identify potential hospital accreditation performance issues. In addition, CMS provides an annual report of its findings to Congress. Unlike the Joint Commission, JCR is not subject to any oversight by CMS. When developing policies regarding its relationship with JCR, the Joint Commission has been affected by the increased focus in both the public and private sectors on governance issues. The Sarbanes-Oxley Act of 2002, passed in response to corporate and accounting scandals, required publicly traded companies to follow new governance standards, including those designed to ensure auditors’ independence from their clients. Even though most provisions of the Sarbanes-Oxley Act are not applicable to nonprofit organizations, activities that have occurred in the wake of the act have affected nonprofits. For example, several state legislatures are considering legislation that applies standards similar to the Sarbanes- Oxley requirements to nonprofit organizations. In addition, some nonprofit organizations, such as the Joint Commission, have voluntarily adopted policies and altered governance practices based upon the act. Organizations in the public and private sectors have also begun to institute compliance programs and those that provide accreditation or certification services have developed standards to ensure the independence of these services. Compliance programs for health care organizations—such as hospitals, home health agencies, and medical supply companies—have used provisions of the federal Sentencing Guidelines, developed in 1991, as a program model. These guidelines lay out two common principles of adequate compliance programs—to prevent and detect criminal conduct, and to promote an organizational culture of ethics and compliance with the law. In 1998, the HHS Office of Inspector General developed a model compliance program for hospitals. Regarding independence standards, organizations that provide accreditation or certification, or recognize accreditation bodies, have begun to impose certain criteria to demonstrate independence. For example, the Department of Education developed criteria for educational accrediting bodies that are designed to ensure that those organizations granting accreditation are not improperly influenced by related trade or membership associations. The mission statements of the Joint Commission and JCR both share the same phrase of seeking “to continuously improve the safety and quality of care.” While each organization differs in the activities it engages in to achieve that mission, they maintain a close relationship through both their governance structure and operations. The Joint Commission has substantial control over the governance of JCR through the powers retained by the Joint Commission in JCR’s bylaws as well as through the Joint Commission’s representation on JCR’s Board of Directors. In addition, JCR manages all Joint Commission publications and educational activities, while the Joint Commission provides various support services and some management oversight to JCR. The Joint Commission has substantial control over the governance of its affiliate, JCR. In 2003, the Joint Commission undertook a major review of the structural, operational, and legal aspects of its relationship with JCR in an effort to address any real or perceived conflict-of-interest issues. This review led to the restructuring of JCR through revisions to JCR’s bylaws, which govern the internal affairs of the organization, and resulted in changes to the composition of JCR’s board and the appointment of board officers. In particular, after the restructuring the Joint Commission no longer retained a majority on the JCR board through board members who served on the boards of both organizations. However, through changes to JCR’s bylaws, the Joint Commission maintained control over JCR by reserving powers that would otherwise have been exercised by JCR. The 2003 restructuring of JCR allowed the Joint Commission to effectively maintain control over JCR by implementing a change in the “corporate membership” of JCR. Similar to for-profit entities that may have stockholders, nonprofit corporations may have corporate members who, in general, are responsible for major organizational decisions, such as electing the corporation’s board. If a nonprofit corporation does not have any members, the corporation’s board of directors holds decision-making authority. With the restructuring of JCR, the Joint Commission became the “sole member” of JCR. The sole member has the ability to exercise substantial control over the affiliate through its “reserved powers”—powers that would otherwise be exercised by the affiliate board, if the sole member did not reserve them for itself. When the Joint Commission became the sole member of JCR, its reserved powers included those previously held and a number of additional powers, as shown in table 1. A practicing attorney with expertise in transactions involving nonprofit health care organizations and who has served as external counsel for the Joint Commission considers this structure necessary to enable the parent to protect itself from the possibility of the affiliate acting against the parent’s interests. However, an article published in a law journal cautions that this structure allows the parent to make decisions solely in its own interest without considering the impact on the affiliate. As part of the 2003 restructuring, the Joint Commission took steps to reduce the proportion of persons serving on the JCR board who also served as board members on the Joint Commission board. Prior to the 2003 restructuring, JCR’s board had 13 directors with a majority—7 directors—from the Joint Commission, including the President of the Joint Commission as an ex officio director with voting rights. The other 6 directors were from outside the Joint Commission, and included the CEO of JCR as an ex officio director with voting rights. After the 2003 restructuring, directors from the Joint Commission no longer comprised the majority of members on JCR’s board. There are 17 directors on JCR’s board, consisting of 7 Joint Commission directors—including the President of the Joint Commission as an ex officio director with voting rights—and 9 external directors who cannot be, either concurrently or within the prior 3 years, Joint Commission commissioners or employees. The President/CEO of JCR also serves on the JCR board, serving as a voting ex officio director. (See fig. 2.) Directors we interviewed who serve on both the Joint Commission and JCR boards said that serving on the two boards has not been problematic because both organizations share the same mission. However, they also recognized the potential for overlapping board members to be faced with competing organizational interests if differences between the Joint Commission and JCR arise. These directors noted that, if competing organizational interests were to occur, the Joint Commission’s reserve powers would dictate the final decision. The restructuring also affected the appointment of JCR officers. Prior to the restructuring, the President and the Chief Financial Officer (CFO) of the Joint Commission also served in those same positions for JCR. The CEO of JCR was appointed by, and reported to, the President of the Joint Commission, and could only appoint other JCR officers after consulting with the Joint Commission’s President. Changes to JCR’s bylaws through the 2003 restructuring removed the requirement that the Joint Commission’s President and CFO serve in those positions for JCR. Rather, the Joint Commission appoints and has the power to remove the President/CEO of JCR. The President/CEO of JCR also now has the authority to appoint officers, such as the CFO, without consulting with the Joint Commission’s President. In addition, the Joint Commission, rather than JCR’s board, now appoints the vice chairman of JCR’s board. One other noteworthy change as a result of the 2003 restructuring dealt with the role of two Joint Commission board committees in relation to JCR and the creation of a new JCR board committee. The Joint Commission created a Governance Committee, which has a number of responsibilities involving JCR, such as nominating JCR board directors and certain officers. This committee also has oversight responsibility for JCR governance issues and JCR conflict-of-interest policies, and reviews the bylaws and other documents of JCR. Further, the Joint Commission expanded the responsibilities of an existing committee—the Finance and Audit Committee—to include reviews of annual financial audits and other matters related to oversight of the firewall between the Joint Commission and JCR. Within the JCR board, a Firewall Oversight Committee was created as a result of the restructuring. This committee is charged with monitoring compliance with the firewall and related policies. The structure of the Joint Commission and JCR allows the two organizations to provide certain operational assistance to one another. The Joint Commission provides support and management services to JCR. Through a January 2001 service agreement, the Joint Commission provides JCR with financial, legal, marketing and public relations, human resources, accounting (bookkeeping and payroll), information technology, and other support services such as office management and mail. JCR pays for these services through a management fee. The methodology used to determine the appropriate allocation of expenses varies by department. For some departments, the allocation is based upon JCR’s percentage of total revenues, whereas in other departments, the estimate is made using the amount of time spent doing work on behalf of JCR. Departments also vary in whether they include overhead costs in the allocation. Along with support services, the Joint Commission also provides management services to JCR through its General Counsel and Compliance Officer. For example, all JCR materials, including the publications it produces on behalf of the Joint Commission and materials produced for its own purposes, must be reviewed and approved by the Joint Commission’s General Counsel prior to issuance. The Compliance Officer, a position created by the Joint Commission in 2005, oversees compliance duties for both the Joint Commission and JCR. Among other duties, the Compliance Officer is responsible for implementing, providing training on, and monitoring compliance with the firewall policies. The Compliance Officer reports directly to the President of the Joint Commission and President/CEO of JCR, the Joint Commission’s Governance Committee, JCR’s Firewall Oversight Committee, and may also report to the full boards of both organizations. The Compliance Officer is aided by a Compliance Council, which was created in late 2005 and consists of members who represent multiple departments from both the Joint Commission and JCR. The Council works with the Compliance Officer to develop an annual work plan that focuses on areas of greatest risk, recommended training, auditing, and measures of the compliance program’s effectiveness. JCR also provides assistance to the Joint Commission, including publication and educational services. The Joint Commission transferred its publications and educational product lines to JCR in 2000 in order to combine support services within JCR and to allow for organizational separation between the Joint Commission’s evaluation and accreditation function and the consultation and educational services provided by JCR. JCR currently offers a variety of educational programs regarding Joint Commission accreditation, including seminars, e-learning opportunities, and audio, satellite, and video conferences. These programs cover a range of topics and include information on the Joint Commission standards and changes to those standards. JCR also publishes its own books on health care issues and periodicals on patient safety and quality improvement. The operational services the Joint Commission and JCR provide to one another result in a flow of funds between the two organizations. In exchange for the license to publish Joint Commission materials, JCR pays the Joint Commission a royalty fee that ranges from 4.75 to 9.5 percent on gross sales. JCR also annually transmits assets to the Joint Commission in excess of the amount needed to operate JCR’s business. The amount of the transfer is based on a formula that considers JCR’s cash, investments, and average operating expense. The Joint Commission and JCR have taken steps, primarily since 2003, designed to strengthen the firewall guidance initially developed in 1987, shortly after the creation of JCR. They have also further developed guidance addressing the relationship between the two organizations. In addition, they have made an effort to educate staff at both organizations on these matters and have enhanced monitoring of compliance with the firewall and related policies. The Joint Commission and JCR firewall polices were initially developed as guidelines in 1987. Relatively few changes were made to these guidelines until 2003, when they were extensively modified. In addition, since 2003, the Joint Commission and JCR have developed other policies and guidance designed to further strengthen the firewall between the two organizations. Since 1987, shortly after the creation of JCR, both the Joint Commission and JCR have operated under a set of firewall guidelines designed to prevent conflicts of interest between the Joint Commission’s accreditation activities and JCR’s consultative services. Between 1987 and 2003, the firewall guidelines were modified twice—once in 1992 and again in 1999— to reflect JCR’s name change and other issues related to JCR services. In 2003, the Joint Commission and JCR made extensive modifications to the guidelines, which were released to staff in the form of policies in 2004. (See app. III for a list of key policies, guidelines, and protocols.) These modifications stemmed from the Joint Commission’s review of its relationship with JCR following the passage of the Sarbanes-Oxley Act in 2002. According to senior staff from the Joint Commission and JCR, the revised firewall policies are not based on any specific model. However, they are a component of the two organizations’ joint compliance program, which was developed in part using the hospital compliance program guidelines issued by HHS’s Office of Inspector General. The stated purpose of both organizations’ firewall policies is “to eliminate any real or perceived conflict of interest” between the Joint Commission’s accreditation activities and JCR’s consulting services. Certain requirements in the firewall policies of the two organizations are very similar, such as a prohibition on accessing confidential facility-specific information from, or sharing any facility-specific information with, staff from the other organization. (See app. IV for more information on the contents of each organization’s firewall policies.) Joint Commission and JCR staff are also prohibited from suggesting that the use of JCR consulting services is necessary for, or will influence, Joint Commission accreditation decisions. In addition, staff and board members of both organizations are required to sign an annual statement signifying that they have read, and agree to comply with, the firewall policies. Of the 25 staff members we spoke with from the Joint Commission and JCR, all but 1 reported signing the required annual compliance statement and all but 4— 2 from the Joint Commission and 2 from JCR—were aware that the firewall policy required them to sign this statement on an annual basis. While both organizations’ firewall policies share similar requirements, each has certain provisions that focus specifically on the services offered by its own organization. For example, the Joint Commission’s firewall policy stipulates that Joint Commission staff will not seek or solicit information on whether or not a facility has used JCR consulting services. The Joint Commission policy also provides guidance on how Joint Commission staff should respond to requests for consulting services. For example, if a facility asks Joint Commission surveyors for advice on these services, they are required to direct the facility to an appropriate senior staff member in the Joint Commission’s central office. That senior staff member can provide limited information on JCR, including its services and the reason for its creation. JCR’s firewall policy limits, among other things, the language JCR can use to promote its services. It also requires that JCR’s consulting services staff be housed in separate facilities from Joint Commission staff and use separate telephone and computer systems. Most of the state hospital associations and hospitals we interviewed that use JCR’s consulting services were familiar with the firewall between the Joint Commission and JCR. Of the five state hospital associations we interviewed that participate in JCR’s CSR program, four said they were provided with information on the relationship between the Joint Commission and JCR or had been told by JCR staff about the firewall between the two organizations. Further, all five associations stated that JCR staff have never indicated that participation in the CSR program would affect the accreditation process, other than through the general improvements that are expected when using consulting services. Similarly, staff we interviewed at six hospitals that use JCR’s consulting services stated that there had been no indication from JCR consultants that the use of these services would influence their facility’s Joint Commission accreditation process. In addition to the recent changes to the firewall policies, the Joint Commission and JCR developed other policies and guidance beginning in 2003 that further address possible areas of risk to the firewall. JCR formalized protocols for its consultants in the field, which provide specific guidance related to their interaction with the Joint Commission staff. For example, if Joint Commission staff members arrive at a facility to conduct a survey when a JCR consultant is on site, the JCR consultant must leave the facility immediately. In 2003, JCR also developed a policy—referred to as the “scope limitations policy”—which is designed to clarify what services can be provided to Joint Commission-accredited facilities. The policy specifically prohibits JCR from providing certain consulting services to facilities after they have undergone a Joint Commission survey, including helping facilities challenge the Joint Commission’s accreditation decisions or findings, resolving Joint Commission deficiency findings, or preparing facilities that have been denied Joint Commission accreditation for future surveys. In 2004, the Joint Commission developed an additional policy reiterating the importance of the firewall for those Joint Commission employees— information technology and planning and financial affairs staff—who, through the service agreement between the two organizations, need, and are able, to access JCR financial or operational information. In addition to the firewall compliance statement all Joint Commission staff are required to sign, these particular staff members are required to sign a separate compliance statement associated with this specific policy. Also in 2004, JCR approved a formal firewall policy related to JCR marketing materials in an effort to ensure that JCR marketing materials contain no implication that purchasing its products or services will impact the Joint Commission accreditation process. Because JCR markets some products that it develops on the Joint Commission’s behalf—publications and educational services—as well as its consulting services, the marketing policy clarifies the language and logos that can be used on marketing materials for these different products. For example, while marketing materials for the Joint Commission accreditation manuals published by JCR can only carry the Joint Commission logo, JCR’s marketing materials promoting its consulting services carry only the JCR logo. In 2006, the Joint Commission and JCR published posters, which are displayed in Joint Commission and JCR meeting rooms, to govern meetings that involve staff from both organizations. These posters reiterate the organizations’ firewall policy requirements, in place since 1987, that facility-specific information should not be discussed at meetings that include staff from both organizations and such information cannot be included in materials prepared for those joint meetings. The posters also state that, if facility-specific information must be discussed for business purposes by staff from one organization, the staff from the other organization must leave the meeting. There are a number of occasions when Joint Commission and JCR staff interact during which these guidelines may be applicable. For example, both Joint Commission and JCR staff participate on internal interdepartmental teams designed to review Joint Commission programs and ensure they are valuable to health care organizations. Because these meetings include reviews of the programs’ publication and education services—services provided by JCR—JCR staff participate on these teams. Another area of interaction is through educational programs offered by JCR. These programs may include training by Joint Commission surveyors and central office staff and may take place at the Joint Commission’s headquarters. The Joint Commission and JCR have also developed a joint code of conduct and organization-specific conflict-of-interest policies that, while not focused exclusively on firewall issues, address aspects of the relationship between the two organizations and the independence of the accreditation process. In particular, the Joint Commission’s conflict-of- interest policy prohibits staff from providing accreditation-related consulting and prohibits survey staff from surveying facilities to which they provided consulting services during the previous 3 years. Similarly, JCR’s conflict-of-interest policy prohibits staff from providing external accreditation-related consulting services and prohibits JCR consultants from providing consulting services to any facility they may have surveyed in the past 3 years. The Joint Commission and JCR report providing ongoing training to ensure that staff understand the firewall and related policies. The organizations have also developed mechanisms, primarily since 2003, that allow staff to report possible firewall violations. Both organizations report monitoring compliance with these policies on an ongoing basis and, in 2005, underwent a joint external review of their implementation. The Joint Commission and JCR reported that both board and staff members receive training on the firewall and related policies—board members are trained when they join the board and staff are trained during new employee orientation. In addition, Joint Commission and JCR staff receive annual training on the firewall and related policies and procedures and are further reminded of these policies through periodic presentations at departmental staff meetings. As of June 2006, the organizations’ staff training did not include a testing component to measure how well staff understand the policies. However, most staff members and senior staff we spoke with at both organizations were aware of the firewall policies and were able to accurately describe their purpose. All but 1 of the 25 staff members we spoke with—13 with the Joint Commission and 12 with JCR—reported being familiar with these policies. In addition, all but 1 of the 24 staff members who were familiar with the firewall policies stated that the training and information they received made them sufficiently aware of the firewall and its appropriate implementation. None of the 25 staff members we spoke with were aware of cases in which staff from either organization had suggested that the use of JCR consulting services would influence Joint Commission accreditation. In addition to training sessions, staff members at the Joint Commission and JCR have access to information on the compliance program through an intranet Web site. This site includes copies of the organizations’ respective firewall policies and other compliance-related materials, as well as information on the role of the organizations’ joint Compliance Officer and Compliance Council. The firewall policies for both organizations require employees to report violations to their management, the Compliance Officer, or the Joint Commission General Counsel. In keeping with this requirement, senior Joint Commission and JCR management stated that they encourage employees to contact their supervisors or these other management officers if they are aware of possible violations or have questions on the firewall. Of the 24 staff members we interviewed at both organizations who were familiar with the firewall policies, 20 indicated that if they became aware of a violation, they would contact another staff member, such as their direct supervisor, division head, or the Compliance Officer. The Joint Commission and JCR have also developed a compliance hotline that allows staff to anonymously report any concerns related to compliance issues. While the firewall policies require employees to report violations to certain staff, this hotline offers another means of reporting possible firewall violations. From its inception in March 2005 through December 2005, the hotline received three calls, none of which involved a firewall violation. All 24 of the Joint Commission and JCR staff members we spoke with who were familiar with the firewall policies reported being aware of the compliance hotline. Of those staff members, 6 stated that they would contact the hotline if they became aware of a firewall violation. The Joint Commission and JCR staff report taking multiple steps to monitor implementation of, and compliance with, the firewall and related policies. The organizations have created the Compliance Officer position, the Compliance Council, and the JCR Firewall Oversight Committee, all of which have a role in monitoring compliance with the firewall and related policies. According to Joint Commission and JCR staff, the firewall policies have been monitored internally on an ongoing basis and are now subject to external reviews. The Joint Commission conducted an internal review in 2002, which was presented to the Joint Commission and JCR boards in 2003. The 2004 and 2005 firewall policies for both organizations called for an annual audit of the policy by the Joint Commission’s Office of Legal Affairs, but these audits were not conducted. According to senior Joint Commission staff, the Joint Commission determined that its legal department could not conduct a sufficient audit and that instead, the audits should be conducted by an external body with experience in this area. In 2005, the Joint Commission and JCR hired a consulting firm to conduct the first external review of the organizations’ firewall policies and related guidance. Following this review, in 2006, the requirement for an annual audit by the Office of Legal affairs was deleted and was replaced with a requirement for an annual review, the results of which are presented to the appropriate committees of each board. According to Joint Commission staff, the Joint Commission and JCR anticipate continuing to contract for an external review of the firewall on an annual basis. The external review conducted in 2005 did not identify any major violations of either organization’s firewall policy—violations that could potentially breach the integrity of the accreditation process. In its report, the consulting firm stated that the implementation of the firewall policies “represented a reasonable effort to prevent any behavior that could result in a breach of the integrity of the accreditation process.” However, because no guidelines or standards exist for this kind of review, the consulting firm did not certify that the firewall and related policies protected the integrity of the accreditation process. The external review did identify some minor violations of the firewall— defined as violations that resulted from the staff’s failure to completely follow operational procedures required by the policies, but which are not considered to potentially breach the integrity of the accreditation process. For example, at the time of the 2005 review, JCR publications and education staff housed in the Joint Commission offices had access to a Joint Commission shared network folder on a computer drive. While this shared folder could not be accessed by JCR consulting staff and Joint Commission surveyors used a separate network, the consulting firm recommended eliminating JCR staff access. The Joint Commission and JCR agreed with this and other recommendations made, and report taking steps to address the issues, including eliminating JCR’s access to Joint Commission computer systems. In addition to this external review, the Joint Commission reported that, throughout the year, the Compliance Officer monitors concerns and questions related to the firewall and related policies. Based on this analysis, the organizations review the policies to determine what, if any, changes need to be made to improve their clarity. In 2006, the Compliance Officer developed a list of commonly asked questions and answers, which was approved by the senior management of both organizations and released to staff. According to the Compliance Officer, when minor firewall violations are identified, each instance is reviewed to determine if it had any impact on the accreditation decision process and if it was due to a lack of understanding of the policies or was an intentional violation. She will then either provide clarification, counseling, or, if necessary, initiate disciplinary action, including possible dismissal, through the human resources department. As of July, 2006, no Joint Commission or JCR staff had been terminated as a result of violating the firewall policies. However, a senior staff member at the Joint Commission reported that staff have been terminated for violating the Joint Commission’s conflict-of-interest policies. This staff member noted that two of the organization’s surveyors had been fired for providing consulting services, although these services were not provided to facilities they had previously surveyed. Accreditation is a key mechanism to ensure the safety and quality of hospital services provided to Medicare beneficiaries and other members of the public. The Joint Commission’s role in accrediting the majority of hospitals participating in Medicare makes the issue of ensuring the independence of the Joint Commission’s accreditation process vitally important. Any threat to the independence of the accreditation process could undermine its ability to ensure the safety and quality of services provided to Medicare beneficiaries and the general public. The Joint Commission and JCR have taken steps to protect the Joint Commission’s accreditation process from influence by JCR’s consulting services by developing mechanisms to protect against the improper sharing of facility-specific information. However, the majority of these mechanisms, including the firewall and firewall-related policies, the compliance hotline, and the annual external review of the firewall, have either been developed or significantly revised within the past few years— primarily since 2003. The next step is for management of both organizations to assure that these mechanisms are sufficient to protect the integrity of the accreditation process. In addition, even with appropriate policies and procedures in place, it will take ongoing monitoring and a concerted effort on the part of the leadership of both organizations to ensure that these policies and procedures are appropriately implemented by both their board and staff members. We provided a draft of this report to the Joint Commission and CMS for comment. In its response, the Joint Commission agreed with our concluding observations, specifically that ensuring the independence of the accreditation process is vitally important. It indicated that the report accurately reflects its relationship with JCR, and emphasized that its highest priority is to preserve the integrity of the Joint Commission’s accreditation process. (The Joint Commission’s written comments are reprinted in app. V.) CMS did not comment on our findings or concluding observations. Both the Joint Commission and CMS provided us with technical comments, which we incorporated as appropriate. As we agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution of this letter until 30 days after the date of this letter. At that time, we will send copies to the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (312) 220-7600 or aronovitzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI. We examined the relationship between the Joint Commission on Accreditation of Healthcare Organizations (Joint Commission) and Joint Commission Resources, Inc. (JCR) as it relates to the independence of the Joint Commissions’ hospital accreditation process from JCR’s hospital consulting services. To provide information on the governance structure and operations of the two organizations, we reviewed multiple documents, including organizational charts reflecting the organizations’ structure as of 2006, a service agreement signed in 2001 and still in effect as of 2006, Internal Revenue Service tax documents from calendar years 2001 through 2004, and agendas and minutes from board meetings of both organizations from 2003 through September 2006. We also interviewed the President of the Joint Commission and the President/Chief Executive Officer of JCR, as well as officers from the Joint Commission Board of Commissioners and the JCR Board of Directors. In addition, we interviewed senior staff at both organizations, including the organizations’ General Counsel, each organization’s Chief Financial Officer, and the Joint Commission’s Vice President for Human Resources. To describe the policies the Joint Commission and JCR have developed to prevent the improper sharing of facility-specific information, we reviewed Joint Commission and JCR documents, including current and past policies and guidance related, either directly or indirectly, to the firewall. We also examined training materials and reports from the compliance hotline contractor. We conducted interviews with senior staff from the Joint Commission and JCR. These senior staff included the shared Corporate Compliance and Privacy Officer, the Joint Commission’s Vice President of Accreditation Services, and the Executive Directors of JCR’s consulting services. In addition to interviews with senior staff, we selected a sample of 15 staff members at each organization to interview. These semistructured interviews were designed to collect information on Joint Commission and JCR staff members’ understanding of the firewall and related guidance, their training on this guidance, and their awareness of possible firewall violations. Our selection of staff members concentrated on those who were JCR consultants and Joint Commission staff conducting surveys or working in the areas of information technology, planning and financial affairs, and marketing. We considered these particular staff members more likely to be in a position to breach the firewall than other employees. We selected staff using random lists of JCR consultants, Joint Commission hospital surveyors, and employees from the information technology, planning and financial affairs, and marketing departments, as well as a random list of employees from all other areas at each organization. Selected staff were contacted by phone and e-mail. If, after three attempted phone calls and one e-mail, staff did not respond to our request for an interview we moved to the next staff member identified in our random selection. We were able to conduct a total of 25 interviews with Joint Commission and JCR staff. We were unable to arrange interviews with 2 Joint Commission surveyors and 3 JCR consultants. We excluded any Joint Commission survey staff who were not hospital surveyors, JCR staff who provided only international services, senior staff at both organizations who we had already interviewed, and Joint Commission staff acting as liaisons to our work. The information gathered from these interviews reflects the experience of these staff members and cannot be generalized to all Joint Commission or JCR staff. While the interviews provide information on staff awareness of the firewall policies and related guidance, as well as their awareness of possible firewall violations, they are not sufficient to determine if there have or have not been any firewall violations. We also conducted interviews with officials from a random sample of 5 of the 14 state hospital associations that participated in JCR’s Continuous Service Readiness (CSR) program as of May 2006, and with officials from 5 state hospital associations that do not participate in the CSR program. These interviews were designed to obtain information on the associations’ understanding of the relationship between the Joint Commission and JCR and how they perceived that their participation in the CSR program might impact their members’ Joint Commission accreditation. To select the sample for these interviews, we sorted the associations by census regions. We then selected a random sample of associations that participate in the CSR program and a random sample of those that do not from within each census region. We conducted semistructured interviews with each of the selected associations. One state hospital association did not respond to our request for an interview. In this case, we replaced that association with the next association in the same census region identified in our random selection. We also conducted interviews with officials from 6 hospitals that use JCR’s consulting services to learn more about their understanding of the relationship between JCR and the Joint Commission. To conduct these interviews, we determined the number of hospitals that had contracted with JCR for these services in calendar year 2005. JCR compiled a spreadsheet that contained e-mail addresses for JCR’s 2005 domestic hospital clients. We identified a random sample of JCR’s hospital clients and JCR sent these hospitals an e-mail asking them to contact us if they were willing to be interviewed. We selected our sample of approximately 10 percent of that population—80 facilities—using a randomly generated number list. This selection was done at the JCR offices and the e-mails were sent to hospital facilities under our supervision. Facilities were given 2 weeks to contact us to schedule interviews if they were interested. The information gathered from these interviews with JCR hospital clients and the interviews with state hospital associations reflects the experience of these particular facilities and state hospital associations and cannot be generalized to all JCR consulting clients. As part of our work, we also interviewed staff at the Department of Health and Human Services’ Centers for Medicare & Medicaid Services to obtain information on their oversight of the Joint Commission and other accreditation organizations. In addition, we interviewed officials from multiple organizations and reviewed documents to obtain background information on possible criteria or best practices related to the governance of nonprofit organizations, conflicts of interest, compliance programs, and independence standards. Those we interviewed included officials at Independent Sector—a coalition of charities, foundations, and corporate giving programs which focuses on strengthening these particular types of organizations—and the Hauser Center for Nonprofit Organizations—a research center at Harvard University focusing on the nonprofit sector. We also interviewed officials from federal agencies and organizations to obtain information on how they separate accreditation or certification programs from consulting services. Those we interviewed included representatives from the Department of Education, the Council on Higher Education Accreditation, and the National Organization for Competency Assurance. Because the Joint Commission’s status related to Medicare applies only to hospitals, our review was limited to information related to its accreditation of hospitals and services provided by JCR to hospitals. We did not conduct a review of the Joint Commission’s accreditation decision process. We also did not review information on other activities conducted by the Joint Commission or JCR that were not related to the relationship between the Joint Commission’s hospital accreditation process and JCR’s hospital consulting services. Further, we excluded Joint Commission International, a division of JCR that provides consulting and accreditation services to foreign health care facilities, from the scope of our work because these facilities are not eligible to participate in the Medicare program. We conducted our work from October 2005 to December 2006 in accordance with generally accepted government auditing standards. Appendix II: T the Organizations’ Relationship imeline of Key Developments in 2000: The Joint Commission trfer it edtion, publiction, nd continus survey rediness deprtment to JCR. The Joint Commission yl re mended to: Crete the Joint Commission’s Finnce nd Adit Committee, nd expnd it reponilitie to inclde receiving report from the JCR Firewll Overight Committee. Crete Governnce Committee. 2001: The Joint Commission nd JCR ign ervice greement throgh which the Joint Commission provide er of support ervice to JCR for gement fee. The poition of Corporte Complince nd Privcy Officer i creted. 2004: Operting gideline relted to the interction of the Joint Commission nd JCR re formlized as firewll policie. 1999: Joint Commission operting gideline relting to ctivitie of Joint Commission Rerce, Inc. i revied to reflect JCR’sme chnge. : The Joint Commission condct dy of the potentil impliction of the Sabane-Oxley Act of 2002 for the governnce of the Joint Commission nd JCR. A result the JCR yl re mended to: Expnd the rd from 13 director to 17, the mjority of whom do not erve on the Joint Commission rd (i.e., “externl director”). Allow the Joint Commission preident to erve only as voting director on JCR’s rd nd not as the preident of JCR. Form the Firewll Overight Committee of the JCR rd, compoed only of director who do not erve on the Joint Commission rd. Develop fidciry requirement relted to confidentility nd conflict of interet for Joint Commission commissioner nd JCR director. Sff ign the firt of the nnual complince tement. The Joint Commission develop the firewll policy for plnning nd finnciffir nd informtion technology ff nd complince tement for thi ff. JCR develop the mrketing firewll policy. 2005: Implementtion of the comined Joint Commission nd JCR complince hotline. A consulting firm condct n externl review of the Joint Commission nd JCR firewll nd firewll-relted policie. 2006: Joint Commission nd JCR develop comined meeting gideline for Joint Commission nd JCR. Additionl policie nd procedre re developed, inclding: The Joint Commission code of condct, which pplie to JCR ff. JCR’s cope limittion policy. Protocol for JCR ff. Initil mrketing gideline. Policie nd procedre on fidciry confidentility greement. Firewall policy for planning and financial affairs and information Reinforces the Joint Commission Firewall Policies and applies specifically to Planning and Financial Affairs and Information Technology Staff who provide support services to JCR. Prohibits involvement in activities that might constitute or be perceived to constitute a conflict of interest with the overall mission of the Joint Commission. Requires staff to abide by the Joint Commission’s firewall policy and prohibits the disclosure of confidential or proprietary information. Prohibits Joint Commission staff from providing accreditation-related consulting services. Prohibits Joint Commission staff from surveying facilities to which they provided consulting or related services during the previous 3 years. Designed to eliminate any real or perceived conflict of interest between the Joint Commission accreditation activities and JCR’s consulting services. Provides specific direction to JCR staff on their interaction with Joint Commission staff and services. This policy applies to all JCR staff. Prohibits involvement in activities that might constitute or be perceived to constitute a conflict of interest with the mission of JCR and the Joint Commission. Requires staff to abide by JCR’s firewall policy and prohibits the disclosure of confidential or proprietary information. Prohibits JCR staff, in most cases, from providing outside consulting services. Prohibits JCR consultants from providing consulting services to facilities they have surveyed in the past 3 years. Provides requirements for marketing strategies to protect the integrity of the Joint Commission accreditation process and ensure that materials contain no implication that purchasing products or services from JCR will impact accreditation decisions. Provides specific direction to JCR consultants in the field, including their interaction with the Joint Commission staff. Delineates certain consulting services that cannot be provided to Joint Commission-accredited organizations, including assistance in preparing challenges to accreditation decisions, resolving Joint Commission deficiency findings, preparing root- cause analysis for sentinel events, and preparing organizations that have been denied Joint Commission accreditation for future surveys. Combined Joint Commission and JCR Policies and Guidelines Guides conduct in meetings that include both Joint Commission and JCR staff, reiterating that organization-specific or nonpublic accreditation or survey process information should not be discussed and, if business needs dictate that organization- specific information be shared, stating that appropriate staff must excuse themselves. Provides guidance on standards for staff conduct and the confidentiality of information, including mechanisms in place to help staff report violations of the code of conduct. Staff may not seek or solicit information on whether or not a facility has used JCR and is not provided this information by the Joint Commission or JCR representatives. Staff may not suggest that the use of JCR consulting services is necessary to obtain or influence Joint Commission accreditation. Staff may not access confidential services are informed that the Joint Commission is not told that the facility used JCR’s services and a disclaimer to this effect is included in JCR contracts. participation in JCR’s Continuous Service Readiness program (CSR) is not considered in the accreditation process. facility-specific information from, or share facility-specific information with, the other organization. Participants in JCR’s CSR program are informed that Joint Commission survey teams are told that CSR participation is not considered in the accreditation process. Commission’s Historical File Room. Joint Commission surveyors are instructed that survey report forms may not include information on whether or not the surveyed organization has used JCR’s services. information about the application of the Joint Commission standards or accreditation procedures that is not already available, or will be made available promptly, to outside parties. JCR staff may not attend Joint with surveyors about specific facility accreditation decisions, may not in any way participate in the accreditation process as a representative of the facility, and may not discuss the choice of surveyors for particular facilities with the Joint Commission. Joint Commission Historical File Room staff to allow them to monitor access. Commission surveyor training and may not have access to surveyor educational tools not generally available to outside parties. All JCR promotional materials related to consulting services are reviewed by the Joint Commission Office of Legal Affairs. financial and operational information as part of their role in providing services to JCR may not disclose JCR organization- specific information to other Joint Commission staff. All staff must sign a compliance statement on an annual basis. The firewall policy is sent annually to separate offices, telephone numbers, and computer systems from the Joint Commission. JCR publishes the Joint Commission’s accreditation materials and supplies their educational services. These services are promoted in Joint Commission and JCR materials. Any reference in Joint Commission materials to JCR’s consulting services is generally limited to acknowledging JCR’s existence, its services, and the reason for its creation. all staff, and is referenced in each organization’s conflict-of-interest policies, which staff are also required to sign on an annual basis. The firewall policy is covered during new employee orientation and training. JCR promotional materials are limited to identifying JCR as a nonprofit affiliate of the Joint Commission and the separateness between accreditation decisions and JCR’s services should be identified. Staff must report any violation of their organization’s firewall policy to the Compliance Officer, the Joint Commission General Counsel, or their organization’s management. consulting services are referred to the Joint Commission’s central office. Staff at the central office will refer to the availability of JCR’s services, and will also emphasize the separateness of the Joint Commission’s accreditation process from JCR’s consulting services. An annual review is conducted to ensure appropriate separation between the Joint Commission accreditation activities and JCR consulting services and the results are presented to the relevant board committees. The Historical File Room is a secured space at the Joint Commission offices in Oakbrook Terrace, Illinois. Staff are required to sign compliance statements signifying that they have read, and agree to comply with, both the firewall policy and conflict-of-interest policy that apply to their specific organization. In addition to the person named above, Geraldine Redican-Bigott, Assistant Director; Emily Gamble Gardiner, Thomas Han, Kevin Milne, Daniel Ries, Janet Rosenblad, and Jessica Cobert Smith made key contributions to this report.

Summary: Hospitals must meet certain conditions of participation established by the Centers for Medicare & Medicaid Services (CMS) in order to receive Medicare payments. In 2003, most hospitals--over 80 percent--demonstrated compliance with most of these conditions through accreditation from the Joint Commission on Accreditation of Healthcare Organizations (Joint Commission). Established in 1986, Joint Commission Resources, Inc. (JCR), a nonprofit affiliate of the Joint Commission, provides consultative technical assistance services to hospitals. Both organizations acknowledge the need to ensure that JCR's services do not--and are not perceived to--affect the independence of the Joint Commission's accreditation process. GAO was asked to provide information on the relationship between the Joint Commission and JCR. This report describes (1) their organizational relationship, and (2) the significant steps they have taken to prevent the improper sharing of information, obtained through their accreditation and consulting activities, respectively, since JCR was established. GAO reviewed pertinent documents, including conflict-of-interest policies and information about the organizations' financial relationship, and interviewed staff and board members from both organizations, JCR clients, and CMS officials. The Joint Commission and JCR have a close relationship as demonstrated through their governance structure and operations. The Joint Commission has substantial control over JCR and the two organizations provide operational services to one another. For example, JCR manages all Joint Commission publications, while the Joint Commission provides support services to JCR. Despite the Joint Commission's control over JCR, the two organizations have taken steps designed to protect facility-specific information. In 1987, the organizations created a firewall--policies designed to establish a barrier between the organizations to prevent improper sharing of this information. For example, the firewall is intended to prevent JCR from sharing the names of hospital clients with the Joint Commission. Beginning in 2003, both organizations began taking steps intended to strengthen this firewall, such as enhancing monitoring of compliance. Ensuring the independence of the Joint Commission's accreditation process is vitally important. To prevent the improper sharing of facility-specific information, it would be prudent for the Joint Commission and JCR to continue to assess the firewall and other related mechanisms. The Joint Commission agreed with GAO's concluding observations. CMS did not comment on GAO's findings or concluding observations. Both provided technical comments, which we incorporated as appropriate.