Compliance Risk

Caught in the Middle

Even when innocent of wrongdoing, chief compliance officers face liability when their companies act unethically or illegally.
By: | October 1, 2016

In June 2015, SFX Financial Advisory and Management Enterprises, a subsidiary of Live Nation, fired Brian Ourand, the company’s president.

A few years earlier, Eugene Mason, chief compliance officer of SFX, suspected Ourand was stealing money from athletes who used the firm for investments and financial services. He promptly conducted an internal investigation and concluded that more than $650,000 was missing from three clients’ funds. Allegedly, one of them was former boxing champion Mike Tyson.

Advertisement




SFX reported the alleged theft to criminal authorities, and in December 2015, Ourand was arrested by the FBI. He is awaiting trial on the criminal charges.

In March 2016, Ourand was found guilty of embezzlement by an administrative law judge of the U.S. Securities and Exchange Commission, who fined him $671,000 and barred him from the securities industry.

Mason’s reward for his efforts? In June 2015, he was officially censured by the SEC.

“SFX’s compliance policies and procedures were not reasonably designed, and were not effectively implemented, to prevent the misappropriation of client funds,” the SEC concluded, fining Mason $25,000 and fining SFX $150,000.

That was not the first time — and it probably won’t be the last — that the SEC decided that a chief compliance officer’s inadequate policies and procedures were at least partly responsible for an organization’s unethical or criminal behavior — even though the CCO was not involved in the wrongdoing.

Many CCOs in the financial services industry are aware of the potential liability they face and are wary.

Compliance officers in other industries, however, may be unaware of this potential liability, and it may be only a matter of time for other federal regulators to consider targeting CCOs when misconduct occurs.

Some experts speculate that the Foreign Corrupt Practices Act and the False Claims Act are two laws that might ensnare compliance officers in their position between wrongdoing companies and aggressive enforcement agencies.

“It’s a confluence of events that would make me nervous if I was a compliance officer.” — Jessica Flinn, senior vice president, Integro Insurance Brokers

“There remains a high level of concern on the part of compliance officers,” said Richard D. Marshall, a partner at Katten Muchin Rosenman LLP.  “I think this is spreading into other areas [than those in the SEC’s purview].

“Will this apply to a chief compliance officer at a cement company? It’s a different world. I think compliance there has a different meaning than in financial services,” he said.

But, health care may not be as far-fetched.

“If I would go out on a limb, I think health care [compliance officers have the potential to be targeted], mainly because of Medicare and Medicaid payments, and False Claims Act exposures,” said Jessica Flinn, senior vice president at Integro Insurance Brokers.

“Anything from a regulatory perspective where they can set their eyes on someone else, yes, I would be worried. … It’s a confluence of events that would make me nervous if I was a compliance officer,” she said.

As for the FCPA, Pat Harned, CEO of the nonprofit Ethics & Compliance Initiative, noted that the Department of Justice enacted a program to look at corporate ethics.

“I think there is every reason to think that the SEC won’t be the only agency to look at whether the ethics and compliance function is in place,” she said. “And if not, why not?”

Jessica Flinn, senior vice president, Integro Insurance Brokers

Jessica Flinn, senior vice president, Integro Insurance Brokers

The SEC’s action in the SFX Financial case and another involving BlackRock Advisors — where a CCO was fined $60,000 after a portfolio manager (who was not sanctioned) had a conflict of interest that the firm failed to disclose — prompted then-SEC Commissioner Daniel M. Gallagher to issue a statement criticizing the enforcement actions.

“Actions like these are undoubtedly sending a troubling message that CCOs should not take ownership of their firm’s compliance policies and procedures, lest they be held accountable for the conduct that … is the responsibility of the [financial] adviser itself,” he wrote in June 2015.

In the statement, Gallagher said the SEC was creating “perverse incentives … targeting compliance personnel who are willing to run into the fires that so often occur at regulated entities.”

“As it stands, the Commission seems to be cutting off the noses of CCOs to spite its face,” he said.

The National Society of Compliance Professionals is also troubled by the SEC’s second-guessing of compliance officers, “particularly where the obligation to execute those procedures rests with the business,” wrote Lisa D. Crossley, executive director of the society to the SEC’s director of enforcement.

Advertisement




Compliance officers, she wrote, could be investigated and face “potentially career-altering liability for simple mistakes or errors of judgment which could somehow be connected to a primary violation committed by others.”

Mark Weintraub, vice president, insurance and claims counsel, Lockton, said, “I know a lot of CCOs in particular are really afraid of this, and that they are going to find themselves second-guessed.”

“I don’t think [the SEC is] truly looking to catch CCOs unaware or play gotcha with them,” he said. “They really only want them to do their jobs.

“Ideally, a compliance officer should have policies and procedures in place to prevent [theft or conflicts of interest] and that did not happen in those enforcement actions,” he said.

The SEC’s actions are based on its interpretation of a “failure to supervise,” which has been extended to include compliance officers, Marshall said.R10-1-16p48-50_5Compli2.indd

“The theory is you weren’t trying hard enough to prevent [the wrongdoing],” he said. “It has created a lot of concern.

“Unfortunately,” said Marshall, “it seems every couple of years, there is some controversy about this.”

The disconnect occurs because CCOs usually do not have the authority to stop misconduct on their own. They rely on corporate leaders to enforce and fund compliance programs.

“It turns the whole system on its head,” Marshall said. “Compliance helps companies that are well-intentioned to do the right thing so we want to support them so they are more likely to do the right thing.

“If you just whack people when something doesn’t get prevented, what incentives are you creating? It’s discouraging good people from being compliance officers,” he said.

“The theory seems to be that compliance is some insurance policy guaranteeing that nothing ever goes wrong. Therefore, if something goes wrong, the compliance system is defective,” Marshall said.

“That’s ridiculous.”

“There’s no question,” said Harned of the Ethics & Compliance Initiative, “that it’s getting harder to recruit chief compliance officers. You see it more in some industries than in others. It’s true in financial services in particular … because of the personal liability.”

Putting protection in place can be challenging, Lockton’s Weintraub said.

“These aren’t classic D&O cases,” he said.

Richard D. Marshall, partner, Katten Muchin Rosenman LLP

Richard D. Marshall, partner, Katten Muchin Rosenman LLP

Wrongful acts are generally covered under D&O, but if the CCO was “taken to task for failure to write a policy [as opposed to an overt action], coverage would depend on the allegation. It can be tricky,” he said.

The other hurdle will be the investigatory phase. Typically, coverage is triggered when an individual is named as part of the allegations, and that tends to happen at the very end of the investigation, Weintraub said.

“You can be paying your own bills for a while until the insurance coverage is triggered and comes to bear,” he said.

If the compliance officer is not covered under the D&O policy, the E&O policy would generally cover them, said Michael Klaschka, managing principal, EPIC Brokers & Consultants.

“As to which policy would apply, it would really depend on the claim itself,” he said. “Is it a claim alleging a wrongful act arising from professional services or in an officer-type capacity such as a breach of fiduciary duty? Either way, you have to make sure the wording is drafted correctly,” he said.

“I have definitely received phone calls from CCOs about this,” he said. “They want to know, ‘Am I covered? What should I be thinking about?’

“There are insurance products out there specifically for them but they usually require an underlying D&O or E&O contract. If the company has appropriate D&O or E&O cover, they should be fine. It’s just a question of whether the limits of liability are adequate.”

Even if a policy is triggered, fines and penalties are usually uninsurable. And criminal or fraudulent acts are generally excluded from coverage.

“If, in fact, they committed fraud, they will not be covered,” Klaschka said. “If someone else within the organization did, and the personal conduct exclusions in the D&O and E&O policy are crafted correctly, they will still have coverage.”

“If I were a CCO,” Weintraub said, “I would want more of a contract, an indemnity agreement, with the company to spell out what they would do for me to address this type of thing,” he said. “If I am fined for whatever reason or there is a settlement, if possible I would want to make my employer pay it.

“Insurance is really the last line of defense. The first line is corporate indemnity. You want to drive things there,” he said.

“If you just whack people when something doesn’t get prevented, what incentives are you creating?” — Richard D. Marshall, partner, Katten Muchin Rosenman LLP

Marshall said a compliance officer, who “was trying to do the right thing,” was sued last year after a person at his company committed wrongdoing, but there was no indemnification because the company went bankrupt and the individual possessed limited funds for his own defense.

“He ended up settling on very unfavorable terms. It was a very sad thing,” he said.

Advertisement




Best practices for policies and procedures are important, but consistent training and guidance are equally important, Klaschka said.

“You could have the best practice in the world; it’s making sure they are followed,” he said. “It’s like having a privacy policy on a website, everybody has access but are they following it? Are they reading it?”

CCOs should review the organizational reporting structure to better protect themselves, he said.

“The key is making sure there is a direct line to the board,” Klaschka said. “If the board is unwilling to make those decisions, they should leave the firm.”

“Unfortunately,” said Integrto’s Flinn, “many organizations don’t become proactive until there is an incident. The barn has to be burning until they spend the money. That’s a problem for many CCOs.” &

The late Anne Freedman is former managing editor of Risk & Insurance. Comments or questions about this article can be addressed to [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.

PART ONE: CRACKS IN THE FOUNDATION

Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.

PART TWO: BETRAYAL

As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.

PART THREE: FALLING DOMINOES

Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &

Bar-Lessons-Learned---Partner's-Content-V1b

Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.




Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]