The organization must be clear about the risks arising from a particular PSP setup and to the business. Map these risks in the context of patient solutions, for example, interference between the communications between the provider and a patient in the PSP context.
But these risk factors will vary between jurisdictions; so, it is important to create a tailored program and identify the higher risk areas given the way the PSPs might be run and then focus on those risk areas. Other risk areas may include the independence of decision-making and independence of patient identification. Conflict of interest is another risk area, along with the risk of inducements and data privacy. Another key area is equal access.
Once all risks have been identified, then it is a matter of working through the scenarios and developing a system, a set of rules, and procedures to address each of these risk areas in the context in which the PSP is utilized.
Having clear responsibilities is important, especially in a program where you are at the cutting edge and constantly pushing the limits. Having strong buy-in with employees is important.
Audits that put stress on the system in place and try to find weaknesses in what has been developed are important measures. These include random audits, stepping back and taking stock to look at where the program stands, identifying the weaknesses, and of course, updating and improving the program. Technology is becoming more crucial in conducting effective audits in the compliance space.