The International Organization for Standardization defines risk as “the effect of uncertainty on objectives.” If you are a health practice leader, owner or manager, having confidence in your ability to keep your organization out of harm’s way is an admirable leadership quality. Yet risk is insidious and being blind to it or ignoring it can have catastrophic consequences.
In business school we were introduced to the well-worn maxim, “If it ain’t broke, don’t fix it.” I was conflicted when I heard it then, and events since have helped me to understand why. Part of my unease stemmed from observing individuals’ risky behaviours in a variety of situations and their seeming disregard for the inevitable consequences. Why didn’t they recognize the risk, why didn’t they evaluate it when they did recognize it, and most troubling of all, why didn’t they manage it? Fortunately, some professionals make a point of being alert to risk. Early in my career, I took inspiration from an ad that featured sheep closely packed in a corral. The caption read, “That sense of everything going well is nothing more than the body temperature at the centre of the herd.” I framed the ad as a reminder not to be deluded into believing that if something is “going well” it will always remain so.
An “ain’t broke” state can be seen as a blessing of sorts for practice and clinic managers because the complexities and demands of running the business are stressful enough. Astute risk managers, however, are healthy skeptics who anticipate risk factors that have the potential to do harm and take the measures necessary to eliminate the possibility of harm or contain it within acceptable limits. What could be risky about the world of rehabilitation, one might ask? Demand for most services is high, as is employment, and the majority of provider incomes are funded by large creditworthy private and public sector institutions. Let’s look at the risk factors underlying what on the surface might appear to be a well-functioning practice to determine which factors are stable and which are not. In reviewing them and their implications, the management practices of some of our readers will be validated while others will realize the importance of resisting “comfort zoning” for comfort’s sake.
Risks can be firm-specific or systemic, such as a change in the personal injury benefits specified in insurance legislation that have global application. As we review both types of risk, readers are encouraged to assess the implications for their particular area of responsibility.
Service Disruption Risk
This risk category overlaps a number of others.First a true story. Several years ago, the CEO of a company called his sales VP at 6 a.m. one morning to announce, “Jack, the building is dead!” This CEO had a well-developed sense of humour, so Jack thought he was being pranked. Still half asleep, he chuckled reflexively in response. When the CEO didn’t laugh, Jack knew there was trouble.
The building and its entire service operation had “died” as the result of a local hydro blackout that had shorted out the inbound calls from customers, who required 24/7 access to assistance. There was no alternative power supply for the company’s 400 employee, single-facility operation. In direct and indirect financial terms, the impact, such as loss of brand equity, was major. But a split second before the lights, IT systems and phone switches died, everything was going well. It wasn’t broke.Disruption of service in a rehabilitation practice can be caused by a number of events – or risks. It could be a power outage. It could also be a default risk of your client service model. To illustrate, here are two questions of readers who operate multidisciplinary practices: 1. For your most profoundly disabled and needy clients, especially those with major cognitive deficits, have you designated backup professionals in the event the internal case manager can no longer provide service? 2. What would the ramifications be if, as a result, those clients’ current twice-weekly service interactions with your firm suddenly stopped?
Medium to large organizations spend big money and commit significant standby resources to developing, updating and activating elaborate business continuity and disaster recovery plans. Most rehabilitation practices do not have the resources to develop such plans. But here is the good news: depending on your size and complexity, you may not need that level of detail and resourcing. What you do need at a minimum is a plan that addresses such topics as:
- The recovery plan’s owner
- The plan’s executive sponsor
- Evacuation protocols in case your facilities are rendered unsafe by fire, flood or other calamity
- Recovery protocols for each of your business processes, including those you have so far considered to be strictly clinical in nature
- Recovery plan leadership: role description and formal designation of the leader and the leader’s team
- Client communications
- Staff communications
- External partner/supplier communications
- Data/file access, backup, storage and recovery
- Response phasing strategy, i.e. for interruptions expected to last less than one day, one to five days, more than one week
The plan should also identify contingency operating locations in case lack of access to service in the existing facility extends more than a specified number of days. Even without specific risk management strategies designed to prevent it, the probability of an adverse event requiring the activation of a formal disaster recovery plan is extremely low. Yet disasters happen, and the organizations that are prepared for them survive and continue to prosper. Indeed, business continuity planning can be a competitive advantage because it forces an understanding of the interdependencies of complex service operations.
Cascading Risk: The (not so hypothetical) Case of the Compound Systems Failure
Isolation of risk factors is a risk management strategy in its own right. When it comes to such strategies, necessity is the mother of prevention, which is why IT people have made lasting contributions to the classification and management of risk. They coined such terms as fault tolerance, failover and redundant array of independent disks (RAID). In ISO parlance, if one of your objectives in a clinical practice setting is data access, the uncertainty that has to be managed is availability.
Like all systems, IT systems have life expectancies. They also have components that are highly interdependent. A controller failure, a data drive failure or a failed internal power supply can each bring down an entire system. While there are accepted methods of assessing and preventing the impacts of such failures, they are beyond the scope of this article. What will be reviewed instead is systemic risk and how an adverse systemic event can trigger multiple internal failures.First, another real scenario to set the scene.Soon after assuming responsibility for a sixty-person financial services consultancy, the general manager conducted an informal audit of business continuity readiness. Several employees met in his office and they started going down his list. Q: How are we backed up in the computing room? A: We back up our data daily and store tapes off-site. Q: What happens if we have a power outage? A: Our phone switch has a backup that is rated at twenty minutes.
That was it. The only protection this firm had from a generalized power interruption was batch media and a twenty-minute line to the outside world. And these employees were conscientious, capable and dedicated people. When asked why they had not taken more measures to safeguard the operation, they replied that within recent memory, the maximum duration of a power outage had been about fifteen minutes. The manager immediately authorized the expenditure of $6,000 to purchase alternative backup power supplies for all critical data and voice system components – a small sum, given the stakes for this $8-million operation. Unfortunately, two weeks after the backup equipment was ordered, the organization was caught in the August 2003 power blackout. The equipment had been delivered but not installed, with predictable consequences: consultants could not do their work and therefore could not bill their clients, clients reached dead air when they tried to call the office, and there was no means of informing staff who were not in the building at the time about contingency and resumption plans without resorting to individual cell phones.
To briefly illustrate another example of cascading risk, let’s hypothesize the existence of a clinic called Zero Risk Rehab (ZRR), which has just three systems: a local area network, an inbound/outbound wireline PBX phone system and a diagnostic imaging machine. It was also caught in the same August 2003 blackout at the same level of exposure on all three systems.Since ZRR does diagnostic imaging, what would happen to patient and machine if the machine quits mid-scan? What if that has happened numerous times in the past? Will repeated outages cause total system failure? Without a secure power supply, will repeat scan attempts expose patients to excess radiation?
Patient/Client Diversification Risk
Diversifying one’s patient or client base is among the most difficult things to achieve for a manager because it involves strategic and tactical thinking and the application of a number of business disciplines. Yet we can all relate to its necessity. How many practitioners derive more than 50% of their fees from Ontario’s auto insurers for assessments and treatments? What percentage of their clients or patients fit the Minor Injury criteria described in new Regulation 34/10? If it exceeds 50%, the new regulation could just be their perfect storm.
Like all storms, this one starts with a gust or two, picks up in intensity, then hits with full force. If you have a well-developed sense of risk management, you would have felt the first gust last November with Minister Duncan’s announcement. Intensity built dramatically with February’s release of that regulation and five others that govern auto insurance in Ontario. On September 1, 2010 the storm front will be heading directly your way. Don’t be caught in the same position that some highly regarded organizations experienced when the WSIB consolidated its Labour Market Re-entry program several years ago.
Financial Risk
There are many types of financial risk, but there is a particularly insidious type to which just about all practices and clinics are exposed. First, another situation.Your monthly statements indicate that your practice is a picture of financial health. Period-over-period revenues are increasing at a rate exceeding your people costs. Your margin percentage on both micro (per unit of service) and macro (gross contribution after all variable costs are taken into account) bases is also healthy. You are showing a strong bottom line. Then your bank calls to ask how you want to handle this period’s preauthorized withdrawal by your payroll service provider, because your operating line has maxed out and thus you are technically insolvent. “That can’t be!” you sputter incredulously. “I am making money.” Barring outright fraud or misappropriation, you are both right. But in this case, your banker is more right than you are.
Make no mistake, if the first inkling of cash flow trouble occurs when your banker tells you that you have it, you have a serious problem. But there is hope, and there is a way to manage this risk to avoid a recurrence.To fix your immediate problem, first request a temporary extension to your limit. Next, assess the quality of your receivables. Is your services “cash-to-cash” gap (the lag from the time payment is made for your service costs to the time you are paid for those services) caused by people doing unauthorized work but invoicing for it anyway, the poor creditworthiness of your customers, or both? You need to find out, and quickly. Managing this risk requires the establishment of reliable service approval procedures, and account rating and collections management processes.
Most credentialed accounting professionals can help you, but be sure they have experience with your accounting software and can write basic bookkeeping and collections procedures for you and your staff.
Process Performance Risk
Another example will demonstrate process performance risk and support the contention that this risk lurks in the most unexpected places and can contribute to overall financial risk.This hypothetical situation is the same as the one above, but it is compounded by the fact that your revenue line does not correspond to the service activity you see going on around you. You have plenty of patients, and your invoicing controls appear to be working insofar as your service providers are booking their time and fees accurately right after patients are seen. You are at a loss to reconcile your perception of “everything going well” with the flat-lining of your reported revenues.Then you come across a drawer containing a pile of paper invoices. Lesson one: if it isn’t being invoiced, it isn’t revenue. This is a case of process failure because controls did not extend through the entire time/billing cycle. The good news about this risk is that if the average age of your WPUB (work performed but unbilled – distinct from WIP: work in progress) is low, your cash recovery rate for it should be the same as for the invoices that are being sent.
Errors and Omissions Risk
Errors and omissions risk is something that will probably increase for the rehabilitation sector as expectations of quality and objectivity increase on the part of clients, payers and the courts.
Readers who are active in the medico-legal field in Ontario would be well advised to become familiar with changes to the rules of civil procedure that took effect in January of this year. It would also be prudent to review the restrictions, if any, that have been set by your respective regulatory authorities on assessing and treating the same person. If you perform services for a third party, such as an insurer, also review the contract language governing your professional relationship with persons they refer to you.An act of commission or omission can happen as unintentionally as in the following example.A recently hired vocational rehabilitation consultant has been assigned an LTD return-to-work claimant file that was referred by the firm’s biggest life insurance customer. The claimant’s disabled life reserve is $2 million and her two-year “own occupation” period will end next month. So the consultant first performs an employability assessment, but does not have suitable supervision and as a result, the assessment is poorly done. Furthermore, he fails to follow the firm’s quality assurance protocol for peer review of reports.
The report is sent to the insurer by the consultant with a cover letter that states in part, “In my professional opinion, which is supported by the results of Ms. Claimant’s assessment and the lack of availability of any other suitable employment according to our employment market database, Ms. Claimant is unable to perform the duties of any occupation.”When the insurer rejects the findings and asks the claimant to undergo another assessment with another consultant, Ms. Claimant refuses. She supplies a copy of the email that had accompanied her copy of the report, which stated in part, “Acting on behalf of the insurer, I am informing you that based on the definition of disability contained in your group policy, I believe you are entitled to the indefinite continuation of your current benefits.”
Ms. Claimant refuses to undergo the second assessment. The insurer discontinues benefits for failure to comply with a contract provision requiring consent to undergo independent assessments as a condition of benefits continuation. Ms. Claimant engages a lawyer specializing in plaintiff LTD claims, who files a claim for unpaid benefits and interest, plus damages. The insurer then sues the rehabilitation firm that employed the consultant for negligent service performance.
Concluding Thoughts
It is the lot of the practice or clinic manager to be a risk manager at the same time. Risk management – or downside management – is admittedly unglamorous and can be unfulfilling, but it needs to be done to make patient rehabilitation upsides all the more probable.
Comments (0)
Post has no comments.