Overview

This Standard Operating Procedure operationalizes POL-003: Compliance Reporting, Investigation, and Resolution. It defines required actions, owners, timelines, and documentation standards for managing compliance tickets.

Oversight model: Compliance Officer with Compliance Committee governance.

Tools: the support ticket system, the anonymous web form, HIPAA-compliant cloud storage.

Roles

Lifecycle Steps

Step 1: Intake and Logging (Day 0-1)

Owner: Compliance Officer or designee

Actions:

1. Create a compliance ticket immediately upon receipt of a concern. For submissions received through the anonymous web form, the email notification to the compliance monitor serves as the initial receipt. The compliance monitor logs the ticket in the support ticket system (manually or via auto-routing).
2. Assign a unique Ticket ID (generated by the support ticket system upon ticket creation).
3. Capture the original narrative verbatim.
4. Record intake source and date/time.
5. Restrict access to intake record.

Checklist:

• [ ] Ticket created
• [ ] Original narrative preserved verbatim
• [ ] Intake source documented
• [ ] Access restricted

Artifact: Unredacted Intake Record (Form 1)

Step 2: Triage and Risk Classification (Within 1-2 Business Days)

Owner: Compliance Officer

Actions:

1. Assess credibility and urgency.
2. Identify the applicable oversight and governance sources, including but not limited to: MassHealth, commercial payers, HIPAA, or the MA Board of Allied Mental Health for clinical and billing matters; Massachusetts labor law and HR guidance for workforce matters.
3. Assign risk level (Low / Medium / High / Critical).
4. Assign Case Owner.
5. Determine need for interim controls.

Governance sources: Department training identifies which governance applies to each ticket type. Current governance documents are kept for reference in the governance folder on the company server; large or frequently amended sources, such as Massachusetts statutes, are consulted at their authoritative published source rather than from stored copies.

Checklist:

• [ ] Credibility assessed
• [ ] Risk level assigned
• [ ] Oversight and governance sources identified
• [ ] Case Owner assigned
• [ ] Interim controls considered

Artifact: Triage and Risk Classification Form (Form 3)

Step 3: Redaction and Working Case Creation

Owner: Compliance Officer

Actions:

1. Create a redacted working version of the intake.
2. Remove reporter identity unless required by law.
3. Remove unnecessary PHI or identifiers.
4. Preserve original intake separately.

Checklist:

• [ ] Reporter identity removed (if applicable)
• [ ] Unnecessary PHI removed
• [ ] Original intake preserved
• [ ] Redaction log completed

Artifacts: Redacted Working Case File, Redaction Log (Form 2)

Step 4: Aggregation and Pattern Review

Owner: Case Owner

Actions:

1. Review prior compliance tickets for related issues.
2. Determine whether issue is isolated or systemic.
3. Document related ticket IDs.
4. Escalate to Compliance Committee if systemic risk is identified.

Artifact: Aggregation and Pattern Review Form (Form 4)

Step 5: Investigation

Owner: Case Owner / Investigator

Actions:

1. Document investigation plan and scope.
2. Collect and preserve evidence.
3. Conduct interviews if applicable.
4. Maintain evidence log.
5. Separate factual findings from analysis.
6. Disclose any conflict of interest and recuse if necessary (per POL-003, Section 5.5).
7. Recommend referral to outside counsel if the matter exceeds in-house capabilities or involves potential legal liability.

Checklist:

• [ ] Investigation plan documented
• [ ] Scope defined
• [ ] Conflict of interest assessed and documented
• [ ] Evidence logged and preserved
• [ ] Interviews documented
• [ ] Findings supported by evidence
• [ ] Outside counsel need evaluated

Artifacts: Investigation Plan (Form 5), Evidence Log (Form 6), Interview Summaries (Form 7)

Step 6: Findings Determination

Owner: Case Owner, reviewed by Compliance Officer

Actions:

1. Classify each allegation as substantiated, unsubstantiated, or inconclusive.
2. Reference supporting evidence.
3. Cite applicable policy or regulatory standards.

Artifact: Findings Summary (Form 8)

Step 7: Resolution and Corrective Action

Owner: Compliance Officer

Actions:

1. Identify root cause.
2. Develop Corrective Action Plan (CAP) for substantiated findings.
3. Assign owners and deadlines.
4. Define verification method.

Checklist:

• [ ] Root cause identified
• [ ] CAP documented
• [ ] Owner assigned
• [ ] Deadline set
• [ ] Verification method defined

Artifact: Corrective Action Plan (Form 9)

Step 8: Notification and Reporting

Owner: Compliance Officer

Actions:

1. Identify internal notification recipients.
2. Complete required notifications.
3. Determine external reporting obligations.
4. Document reporting or non-reporting decisions with rationale.

Checklist:

• [ ] Internal notifications completed
• [ ] External reporting evaluated
• [ ] Reporting decisions documented

Artifacts: Notification Log (Form 10), External Reporting Record (Form 11)

Step 9: Closure and Follow-Up

Owner: Compliance Officer

Actions:

1. Confirm investigation completion.
2. Confirm CAP completion or scheduling.
3. Complete closure summary.
4. Schedule follow-up monitoring if required.

Checklist:

• [ ] Investigation complete
• [ ] CAP completed or scheduled
• [ ] Documentation finalized
• [ ] Closure approved by Compliance Officer
• [ ] Follow-up scheduled if required

Artifact: Case Closure Summary (Form 12)

Grievance Lane

A grievance is a complaint about ABAS services or a client's rights, filed by a client, a family member, or a member of the public. Grievances run through the same ticket lifecycle (Steps 1–9) and the same forms (CFM-005) as every other compliance ticket. What distinguishes the lane is who files, and what ABAS owes them in response: written confirmation, a written response within defined timelines, and a second tier of review on request.

Intake in the field

Grievances arrive through any channel: phone, mail, email to ethics@abaswma.org, the anonymous web form, or directly to a care team member in person, by text, or by email. Two rules govern field intake:

1. Resolving a concern in conversation is a legitimate outcome. Note the conversation in the participant's case record.
2. Anything substantial becomes a ticket. A concern is substantial when it is unresolved after conversation, the filer asks for formal handling, or it involves personal rights, billing, safety, or privacy. The receiving team member, typically the Supervising BCBA, completes a Compliance Intake Form (Form 1) on paper or enters the ticket in the support ticket system within one working day of receipt and routes it to the Compliance Officer.

Commitments to the filer

Anonymous grievances that provide no reply channel receive no confirmation or response, but they are triaged and investigated on the same clocks, with the outcome documented in the ticket record.

The written confirmation and the written responses use the communication templates in CFM-005 (Forms 13 through 15), which carry the sharing and tone rules for filer-facing correspondence.

Concerns involving personal rights are expedited: triage within one working day, with any interim safety steps taken the same working day. Where a grievance alleges abuse or neglect, mandatory reporting duties run on their own statutory clocks, independent of grievance handling.

If the grievance concerns the Supervising BCBA, the Compliance Officer reassigns Tier 1 or routes the matter directly to the Executive Director, following the conflict-of-interest procedure in POL-003, Section 5.5.

Proportionality

Investigation scales to the matter. Most grievances need Form 1, the investigation record, and the written response. The full form set applies when triage (Step 2) assigns Medium risk or higher. The written response states what was reviewed, what was found, what changes (if any), and how to request Tier 2 review.

Documentation

The ticket record is the system of record for the grievance, and all grievance documentation lives in the compliance case workspace, moving to the closed-case area at closure like every other ticket (see Where Documentation Lives). Raising a grievance never affects the participant's services, and retaliation against any filer is prohibited.

Filing outside ABAS

Filers may contact the participant's health plan or an advocacy organization at any time, before, during, or after this process, and the written confirmation says so.

Manual and Electronic Realization

The paper process is the complete process: a trained team member with the CFM-005 forms can run this lane end to end without software. The support ticket system is the electronic realization of the same lane. A new intake or reporting channel takes effect only after it is tested and verified for protected health information.

Where Documentation Lives

Every artifact this SOP produces has a defined home. The working rule for every ticket type: if it is not in the compliance case workspace, it does not exist. No in-process ticket documentation lives in personal drives, local folders, or email. Paper forms completed in the field are scanned into the workspace as each step completes.

The compliance case workspace is a managed-access directory in HIPAA-compliant cloud storage, shared with management. It holds every open ticket's working documentation, whatever the intake channel. Closed tickets move to the workspace's closed-case area, the single long-term home for compliance documentation.

Access at every stage follows the need-to-know principle in Policy 5.1: compliance documentation is available to those with an assigned duty on the ticket, and no wider. The closed-case registry indexes every closed ticket by participant and by employee, so history questions are answered through the Compliance Officer without opening case files or HR records.

Record Retention

Compliance tickets and associated documentation are retained for a minimum of six to ten years, depending on issue type and applicable regulatory requirements. Records are stored securely with role-based access controls.

Forms Reference

All forms referenced in this SOP are maintained in the Compliance Ticket Forms and Templates Pack (CFM-005):