Public Company Accounting Reform and Investor Protection Act

Compliance Journal

Subscribe to Compliance Journal: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get Compliance Journal: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn

Compliance Journal Authors: Liz McMillan, Elizabeth White, John Katrick, Maria C. Horton, Progress Blog

Related Topics: Compliance Journal, SOA & WOA Magazine, Health 2.0


Health Care Compliance with BPM

Discovering process agility and the significance of regulatory compliance

The health care industry, including hospitals, has the greatest need for sophisticated information systems because of the enormous amount of data it handles and because of its life-and-death responsibilities. Yet the implementation of large-scale and robust-enough IT systems in public healthcare institutions can be challenging as well as ineffective. We know that several large American medical centers have not been successful in attempting to execute major upgrades or overhaul their processes. Without careful preparation and agile execution, some may experience a serious, expensive, and distracting fate. With the pace of today's technological innovation and efficiency demands, health care organizations need enhanced customer service orientation, a multi-channeled marketing strategy, and an effective legal and regulatory compliance model. This article will describe both BPM and the legal aspects that together form a foundation for process discovery, improvement, and optimization, and thus organizational effectiveness. Among the legal aspects, we will discuss SOX and HIPAA, which is more closely affiliated to the healthcare model.

Discovering the Value of Business Process Management (BPM) as an Approach
Leveraging Business Process Management (BPM) as a strategic approach and discipline to enable change will serve as a good catalyst that helps foster increased process awareness, transparency, and agility around the core business processes maintained by these healthcare institutions. Organizations have begun to learn the value in harnessing the potential of the data as well as information they generate and consume on a regular basis, in ways that help their business model perform well and execute even better in the marketplace. It is this ability to integrate content with core business processes that is significant in being able to progressively transform the efficiency states of an organization's business model and the supporting enterprise line-ofbusiness (LOB) applications that strengthen them as well as enable maximizing the value of IT-based solutions.

As an approach BPM enables institutions to do a detailed analysis of their current process, also referred to as "Current-State" or an "AS-IS" model, and having performed a gap analysis, develop an implementation plan for the future, also referred to as the "Future-State" or the "TO-BE model." The whole idea of a BPM discovery and development initiative in the context of process optimization is one that helps one manage and improve complex business processes using sophisticated, yet rapidly deployable and non-intrusive technological capabilities. By promoting the engagement of a problemsolving approach that aligns critical content with core processes and business solution applications, organizations can manage, track, expedite, and interlink information streams throughout the organization. BPM as a concept and powerful catalyst for change is one that instills the core fundamental of first being able to go through an investigative approach by capturing a process and related scientific evidence, thus leading to a detailed examination of all core data, processes, information, and interdependencies, while looking for adaptable process-oriented solutions, some of which may constitute technology-oriented and -enabled solutions, such as the use of business process automation routines through workflow enable engine management systems. Other efficiency enablers may simply involve the optimization of worker and resource engagements and general process efficiency applications. Companies are finding many reasons to capture their business process. Companies that have built alliances via mergers and acquisitions want to be able to expose their enterprise process across their various sub-enterprise lines of business to discover champion best practices as potential solutions to other divisional applications. Engaging in this philosophy allows for healthcare organizations to remain cost-effective, competitive, and productive.

Organizational Goals and BPM
Agile businesses have a need for dynamic Process Change, and whether that's being able to react quickly to the unexpected, working toward a strategic organizational goal, or simply looking for areas in the core processes of the business model where potential inefficiencies may exist and so have a need to be exposed and repaired. As a structured approach that unites software capabilities and business expertise, BPM is not just another methodology, but a discipline that promotes the collaboration of the organization's people, systems, and information to speed up the amount of time between business process improvements and the facilitation of business innovation. Using a simple analogy, the goal of a business, generally speaking, is to conduct an n number of operations that typically start from point A and end at point B. For example:

Process AB = (Starting Point) A -> B (Finishing Point)

The fewer the interruptions, glitches, unnecessary loop-backs, and REGULATORY restarts, the better and more efficiently the process can run, minimizing operational cost while continuing to maximize operational efficiencies. A crucial reality factor is that "change" is an inevitable occurrence. What we tend to see is that typically, while the business processes function well (if well designed), they tend to slow down or develop process lags. This can happen for a variety of reasons including:

  1. Business volume is too high when paired with older technology
  2. Process change is cumbersome
  3. Processes are not well documented
  4. Process bottlenecks inhibit efficiency
  5. Complex integration across multiple processes

Standard Components of a BPM-Based Approach to Problem-Solving
Traditionally this is a phased approach; the overall structure is such that it follows a streamlined set of actionable iterations. Some of these phases may choose to employ traditional process improvement methodologies such as Six Sigma.

  • Develop a shared goal of understanding: Often various customers of a process have different positions on how the process should be improved. It is imperative that before conducting any largescale process-improvement initiatives that an overall "shared goal of understanding" is developed. If this does not happen, we tend to see that customers frequently have to revisit exactly what the goals of the process were to begin with.
  • Conduct a situational analysis: What is the situation today and what are the current or currently perceived factors that impact performance efficiencies. What business and technological platforms are involved? What process interdependencies exist? Are there sensitive areas of the process to be aware of? This part is vital to the investigation as it provides insight into the ecosystem of the process and participants. Having a sense of the current landscape in which the organization is operating the business process is a relevant study to be conducted.
  • Conduct an information analysis: Study data and information as they relate to the process and their significance to the notion of process change.
  • Conduct a solutions analysis: Study possible solutions and ideas that can be looked at to make an effective case for process change and optimization.
  • Conducting a solutions cost-benefit analysis: One of the most important junctures is the ability to build a portfolio of solutions in the solutions analysis phase and present it to upper management with a standard high and low estimate. If upper management approves, the next steps can be initiated. Otherwise, previous phases may have to be revisited for scope limitation or expansion due to needs and/or budgetary concerns.
  • Conducting an implementation analysis: Study how solutions are going to be instantiated and the techniques, best practices, strategies, and contingency plans that are in place to come up with the best form of applicable implementations.
  • Performing the implementation development: One of the later stages in the process is to start the process of change by equipping the process or altering components of the process with elements of the new technology, Key Performance Indicators (KPIs), and automation solutions, for example, workflow.

Common Accessories in the BPM Portfolio and Toolkit
1. Business Process Modeler

These are typically simple-to-use, business user-oriented tools with a GUI to model things that affect performance and help measure the performance of the process.

These tools typically provide comprehensive modeling and simulation capabilities along with reporting and documentation. A business process model can help you understand and transform your business process by validating enhancements prior to committing resources. It provides an interface for complex behavior. IBM's WebSphere Business Modeler 6 is an example of a business modeling tool.

2. Business Process Monitor
These are process productivity and role-based dashboards. Common functions of a business monitor that is also a GUI-based thin or thick client include being able to monitor business events and situations and business performance, manage in-flight business processes, gather business intelligence from assimilated data, catch certain business events, and take any necessary corrective action. IBM's WebSphere Business Monitor 6 is an example of a business monitoring tool.

3. Business Process Publisher
This is typically a product and platform that models can be published into. Once published models are exposed to various entities security can be enforced in various layers of the model. It makes for a powerful and rather "adaptive" mechanism for keeping models up-to-date by giving the business subject matter experts an access through which they may be able to make changes, updates, and suggestions, allowing the model to grow overtime and become closer to reality than before. One reason this is perhaps the most important tool in the industry is that it promotes adaptability and many SMEs find their time better spent than devoting a few hours a week to a meeting where they make suggestions to a bunch of people. Those kinds of sessions tend to be more productive for review and analysis, but we often tend to digress and lose sight of the big picture and get too deeply involved in the sub-processes. If you're part of a workflow or process-based competency center, it's a good idea to make this one of the core competencies to mature. IBM's WebSphere Business Publisher is an example of a business publishing tool.

4. IBM WebSphere Integration Developer
This is a toolset designed to take an organization's business process built earlier in the Business Process Modeler and begin the process of integrating core business processes and functions outlined in the model, with computer applications and systems also referred to as Services, within the context of a SOA. This tool is mostly used by integration developers and process engineers to build necessary workflows, automated error handling routines/procedures, compensation or roll-back features and so on. For example, the business has a requirement whereby they would like their agents out in the field to collect and capture customer data as customers show interest in the agent's products being discussed. Instead of doing this on paper, they would like IT to provide a CRM (Customer Relationship Management) solution that is able to house customer data that the agents could publish to in a remote manner using a URL/webpage that simply transports the same data, but now electronically. Once transported and analyzed, the business would like to send an automated email to the customer acknowledging receipt of their information and request before additional steps in the core business workflow are invoked. A scenario like this is one can be handled in integration suites such as IBM's WebSphere Integration Developer in association with either in-house custom solutions or with proprietary software options like or Siebel Sales Force Automation solutions.

5. IBM WebSphere Process Server
This is a high-performance business engine to help form processes that meet the customer's business goals. It's built on open standards and extends the value of core applications and databases by centralizing business processes and sharing them across the enterprise, enabling maximum operational efficiency and ROI. Provides strong support for human workflow and fosters rapid process change for better business agility. Within the context of an IBM solution, this is the runtime platform upon which business models are executed.

The Four Common Steps in a Given Process Model and Potential Goals
1. Human-to-Machine
These are typically initiation/creation and/or request-oriented tasks performed by the human, and could be asynchronous or synchronous in nature. Goal: Design interfaces that are easy for humans to comprehend and allow for efficient searches, logging, data profiling, etc. The request from a human being to a machine should be carefully planned so it doesn't overburden the human to the point a manual strategy is preferred.

2. Machine-to-Machine
These are usually the kinds of tasks that involve data, information, validity check, or some procedural handshake between two or more machines / systems / programs / applications. Goal: Enable efficient machine-to-machine interaction, promote use of speedy algorithms that enable sufficient response times and appropriate automated error-handling mechanisms and provisions for escalated human error-handling and intervention situations. Predictive models and algorithms are a good way to explore the intelligent communication pattern here.

3. Machine-to-Human
These are steps taken to ensure that a human is notified of a response or an update that he requested earlier. It allows the machine to respond by providing a programmatic answer typically an alert or notification such as e-mails or pager. Goal: Use of proper response mechanisms and capabilities that can work around the human's schedule.

4. Human-to-Human
Obviously this is an organic interaction during the lifecycle of a given process model. Typically it consists of either manual or automated human-to-human interactions to ensure that the proper balances and checks are in place. Goal: As one of the most important tasks, you want to ensure that humans are involved as much as needed. Decisions sometimes demand human intervention instead of pre-built programmatic actions and responses.

Next-Generation BPM for Adaptable Compliance
To enable an effective means of transformation using BPM and advanced IT implementation methodologies, we need a basic understanding of the customer, the business model, the legal implications, and the privacy laws that solutions should comply with. So not only is a proper understanding of the solution needed, but also how the solution being built will co-exist with the privacy laws impacting healthcare, such as HIPAA. Process agility and transparency are key parts of the entire solution, so careful consideration should be given to both during process modeling and/or optimization.

Significance of Government Regulations
One of the keys to business success is the ability to stay competitive in a business sense, but also compliant with government regulations such as Sarbanes-Oxley, HIPAA, and ISO 9000. HIPAA is the legal and compliance model closely aligned to the healthcare industry and for purposes of this article I will talk about HIPAA model in greater detail. For organizations in some parts of the world government regulations require that their core business processes be properly documented. For example, the Sarbanes-Oxley Act of 2002 (Public Law No. 107-204) has introduced far-reaching reforms of American business practices.

The legislation established new or enhanced standards for all U.S. public companies, boards, and public accounting firms. In short, it says certain processes must be well documented. It is one of the drivers making organizations take a closer look at their processes. Another relevant example is native to the healthcare industry. For example, the healthcare industry needs an effective way to adopt electronic storage, security, and transmission of patient care information through privacy-oriented laws such as the Health Insurance and Portability & Accountability Act or (HIPAA). Business Process Management is a good candidate since it subscribes to the basic notions of agility and adaptability. So as new business and technology models come into play, and any new government laws and legal regulations come into effect, BPM will be a catalyst for progressive change and successful regulatory compliance.

What Is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 1104-191, was enacted by the U.S. Congress in 1996. In HIPAA, the Congress directed the Secretary of the Department of Health and Human Services (HHS) to adopt regulations governing the privacy and security of health information, standard transactions and code sets, unique health identifiers, electronic signatures, and the transfer of information among health plans (collectively, the regulations). In sum, the major components of HIPAA Administrative Simplification address four specific areas: i. electronic transactions and code, ii. privacy, iii. security, and iv. identifiers.

The Administrative Simplification subtitle of HIPAA is set forth in sections 261 through 264 of HIPAA. It is relevant to mention that HIPAA required the Secretary of Health and Human Services to issue privacy regulations governing individual identifiable health information, if Congress did not enact privacy legislation within three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a rule and released it for public comment on November 3, 1999. The agency received over 52,000 public comments. The final regulation, the Privacy Rule, was published on December 28, 2000. In March 2002, HHS proposed and released modifications to the Privacy Rule for public comment. The final modifications were published on August 14, 2002.

Who Does the Privacy Rule Cover?
The HIPAA privacy standards ensure patients have access to their medical records and provide more control over how their personal health information is used and disclosed.

What Information Is Protected?
The major goal of the Privacy Rule is to assure that an individual's health information is properly protected while allowing the flow of the data needed to provide and promote high-quality healthcare and to protect the public health and well being.

The Aftermath & Approach Needed
It's clear that there can be significant consequences not only for operating your business model inefficiently, but having a model that doesn't comply with privacy regulations. Progressive business change calls for a scientific management-and-development approach. BPM is the kind of methodical approach that collaboratively helps expose the process and any inefficiencies and helps implement recommendations to core organization pillars such as business, IT, HR, and legal to capitalize on building and maintaining a successful business model.

Over the next few years, electronic medical records and other healthcare-oriented models will need intelligent models to achieve business goals as they relate to customers and adapt to new industry and compliance standards. Process Model Adaptation is very significant from the standpoint of cost-effectiveness over time and also a challenge we face as process modelers and automation engineers. It is however part of a larger and broader challenge to foster and promote new ways of developing opportunities in process patterns, modeling techniques, and workflow automation scenarios individually and combined all together.

More Stories By Praveen K. Chhangani

As a certified IBM WebSphere MQ Workflow Specialist, Praveen K. Chhangani is part of Prolifics' specialized team of WebSphere consultants whom IBM calls upon to service its most challenging customer requirements by providing training, custom-ization, administration and configuring, architecture design, development, and deployment of distributed architectures.

Mr. Chhangani has several years of experience and is well rounded as a developer, analyst, adminis-trator and solutions architect. His extensive experience with IBM WebSphere MQ Workflow, WBI Modeler, Monitor and Process Choreography has proven invaluable in a full lifecycle of projects from requirement analysis, pro-cess design and automation, solution design, development to testing and mentoring for clients such as MCI and Principal Financial Group. Praveen K. Chhangani is also an IBM Certified SOA Associate as well as an IBM Certified Business Process Analyst - Webpshere Bisiness Modeler Advanced v6.0.2

More Stories By RC Chhangani

A distinguished professor in the field of International Human Rights Law, Prof. R. C. Chhangani has published several articles and a book dealing with contemporary issues relating to refugee problems. His writings thus far have focused on a holistic approach from legal and humanitarian perspectives. He has served as an attorney and has also taught undergraduate and graduate classes around the world in leading universities in the Netherlands, America, India, Nigeria and more. In recent years he taught at the John Marshall Law School of Chicago in areas of International Law, and is currently the Dean, Faculty of Law at Nasarawa State University, Keffi, Nigeria.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.