Glenn T. Troyer 

Glenn Troyer is an attorney with the Indianapolis-based law firm of Krieg 
DeVault LLP. Mr. Troyer received his B.A. from Wittenberg University, 
Springfield, Ohio, in 1967, his M.H.A. from Indiana University, Indianapolis, 
Indiana, in 1971, and his J.D. from Capital University Law School, Columbus, 
Ohio, in 1975. He is admitted to the bars of Ohio and Indiana. Mr. Troyer's 
main area of practice is in health care, with more than 28 years of experience 
in providing legal representation to hospitals, physicians, mental health 
centers, nursing facilities, and other healthcare providers in business trans­
actions, health law matters, and compliance-related issues. 

Mr. Troyer has written numerous articles and given numerous presentations 
on health law and risk management issues. He was a founding director and 
the third President of the American Society of Healthcare Risk Management 
(an affiliated professional society of the American Hospital Association) and 
now contributes to its publications. He has co-authored a corporate com­
pliance chapter in the fourth edition of that organization's RISK MANAGEMENT 
HANDBOOKFORHEALTHCARE ORGANIZATIONS (2004). He also co-authored 
and co-edited the book entitled HANDBOOK OFHEALTHCARE RISK MANAGE­
MENT (1986). He is a past chair of the Physician Recruitment Task Force of 
the American Academy ofHealthcare Attorneys, now known as the American 
Health Lawyers Association, which published the PHYSICIAN REcRUITMENT 
AND RETENTION GUIDEBOOK (1997). He co-authored the ST. CHRISTOPHER 
CORPORATE COMPLIANCE MANuAL (1996), and the HIPAA COMPLIANCE 
MANuAL (2001). 

He is an active member of the American Health Lawyers Association and the 
Health Care Compliance Association. Prior to entering private practice, he 
served in various administrative capacities in hospital settings in Columbus, 
Ohio; Chicago, lllinois; and Indianapolis, Indiana, including five years as 
General Counsel and Director of Risk Management for Methodist Hospital of 
Indiana, Inc. 



David E. Jose 

David Jose is an attorney with the Indianapolis-based law firm of Krieg 
De Vault LLP. David Jose concentrates his practice in health care, corporate, 
administrative, and regulatory law. He handles regulatory compliance and 
administrative appeals, contract review and negotiation, mergers and acquisi­
tions, and general commercial and corporate legal matters for for-profit and 
non-profit organizations, trade associations, and individuals. After graduating 
from Earlham College with an A.B. in 1975 and the University of Wisconsin 
with an M.A. in 1976, David Jose attended Boston College Law School where 
he was the Executive Editor of the Uniform Commercial Code Reporter 
Digest and graduated with honors in 1981. 

David has written articles and given presentations to civic, business, and pro­
fessional organizations on a variety of health care, business, and regulatory 
topics. In addition, David is the immediate past Chair of the Healthcare and 
Medicine Law Section of the Indiana State Bar Association. His professional 
associations and memberships include the Indianapolis Bar Association, 
Indiana State Bar Association, American Bar Association, and the American 
Health Lawyers Association. 



Andrea D. Brashear 

Andrea Brashear is an attorney with the Indianapolis-based law finn of Krieg 
DeVault LLP. She concentrates her practice in health care, corporate, 
regulatory, and administrative law, providing legal services to long tenn care 
facilities, hospitals, community mental health centers, health care practices, 
and individual health care professionals. Her experience includes regulatory 
compliance, contract development and review, administrative litigation, and 
general business matters. She is a frequent speaker and author on health care 
topics, including HIP AA, fraud and abuse, and medical records law. 

Brashear graduated from Indiana University School of Law- Indianapolis and 
received her undergraduate degree in chemistry from DePauw University. 
While in law school, Brashear served as an editor of the Indiana International 
and Comparative Law Review, and was the recipient of the Henry B. 
Blackwell award for her law review note. She also was recognized for her 
efforts in moot court, being named to the Order of Barristers and selected to 
participate in and coach various national moot court teams. 

Brashear is admitted to the Indiana Bar and is a member of the Indiana Bar 
Association, Indianapolis Bar Association, and American Bar Association. 
She is also a member of Executive Women in Health Care. 





GOVERNANCE ISSUES FOR NONPROFIT HEALTHCARE 
0RGANUATIONSANDTHElMPUCATIONSOFTHE 

SARBANES-OXLEY ACT 

Glenn T. Troyer 
David E. Jose 

Andrea D. Brashear* 

INTRODUcriON 

The topic of "corporate governance" has received attention during the 
past few years. This attention has increased recently due to high-profile 
corporate scandals that have received extensive and prolonged media 
coverage. As a result, officers, directors, and outside professional advisors are 
seeking ways to respond to the scrutiny of regulators, legislators, the general 
public, and constituency groups such as investors and investment analysts. 

Many of these scandals have occurred in the for-profit, general business 
environment. However, beneath these high-profile events, there have been 
corollary legal activities in the nonprofit and tax-exempt arenas. These 
developments reflect a significant undercurrent of changes for healthcare 
organizations. The combination of these events is destined to provide 
dramatic inducement for healthcare organizations to evaluate and modify their 
organization and operations. At the same time, the passage of the American 
Competitiveness and Corporate Accountability Act of 2002, widely known as 
the Sarbanes-Oxley Act ("SOXA"), is an example of the legislative response 
to these "scandals" and corporate governance issues. SOXA is also an 
opportunity for healthcare organizations to stay "ahead of the compliance 
curve" by adapting and "transposing" the legislation from the for-profit, 
publicly-traded corporate arena to the nonprofit sector. 

This Article will briefly describe some of the recent corporate scandals 
and the lessons they may provide in the area of nonprofit healthcare gover­
nance. It will then describe various sources of guidance and standards, as well 
as enforcement activities, that are stimulating the evolution of corporate 
governance for nonprofit healthcare organizations. Those stimuli arise out of 
traditional state and federal sources such as state corporate and licensing laws, 
federal tax and Medicare certification statutes, and accreditation criteria. New 
stimuli are also rising from more active federal tax and healthcare regulatory 
efforts along with state attorney general initiatives. The Article will then 
briefly analyze some specifics of SOXA within this rapidly evolving 

* Glenn Troyer and David Jose are partners, and Andrea Brashear is an associate in the 
healthcare practice group with the law finn of Krieg DeVault U.P, which is based in 
Indianapolis, Indiana. The authors would like to thank Brett J. Henry, associate, and Kelly J. 
Green, law clerk, for their assistance in preparing this Article. 



180 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

environment and evaluate some of the implications that it contains or suggests 
for healthcare organizations in the corporate governance legal arena. 

I. THE IMPACT OF HIGH PROFILE, FOR-PROFIT SCANDALS 

The terms corporation and scandal have become so frequently inter­
twined in recent years that many individuals may believe that you cannot have 
one without the other. The publicity has been exacerbated by prominent 
individuals associated with the corporations, such as Ken Lay at Enron, 
Bernard Ebbers at WorldCom, Martha Stewart's relationship to ImClone 
Systems, Richard Grasso's compensation at the New York Stock Exchange, 
and many others. The media's personification of these scandals has conse­
quences in many directions. 

Enron apparently took advantage of an accounting loophole that allowed 
the company to use gross value instead of net value when calculating profits 
from energy contracts. It then compounded the distortion by selling the same 
product repeatedly to sham partnerships created by Enron executives. 1 

WorldCom created its own "loophole" by treating ongoing operating costs as 
capital investments, which resulted in lower annual operating expenses since 
they were spread into the future.2 In these and other situations, the perfor­
mance and independence of auditors have raised fundamental fiduciary 
business practice questions. Those questions have also been turned upon the 
governing boards and their audit committees. This is one reason why SOXA 
focuses so much attention on the independence of outside auditors as well as 
the composition and operation of board audit committees. 

With respect to the healthcare field, perhaps the highest profile "cor­
porate scandal" has been with HealthSouth Corp. ("HealthSouth"). This 
company rapidly grew from the mid-1980s to become the largest United States 
provider of outpatient surgery, diagnostic imaging, and rehabilitation services, 
with almost 1,700 sites in all fifty states and abroad.3 HealthSouth stands 
accused of significant accounting fraud and widespread abuse of Medicare 
reimbursement regulations.4 The Securities and Exchange Commission 
("SEC") has pursued enforcement actions, and the Department of Justice filed 
an eighty-five-count indictment against Richard Scrushy, the former CEO who 
has been portrayed as the mastermind of a multibillion-dollar scheme to 
defraud investors.5 At the time of the indictment, fourteen former Health-

1. For a discussion of the various corporate scandals, the role of auditors, and the 
response of the Sarbanes-Oxley Act, see Ethan G. Zelizer, The Sarbanes-Oxley Act: Accounting 
for Corporate Corruption?, 15 LoY. CONSUMER L. REv. 27 (2002). 

2. !d. 
3. J. Reeves, Health System Replaces Directors, PHILA. INQUIRER, Dec. 3, 2003, at C03. 
4. Reed Abelson & Melt Freudenheim, The Scrushy Mix: Strict and So Lenient, N.Y. 

TIMES, Apr. 20, 2003, at AI. 
5. Melt Freudenheim & Eric Uchtblan, Former HealthSouth Chief Indicted by U.S., 

N.Y. TIMES, Nov. 5, 2003, at Cl. 



2004] HEALTIICARE 0RGAN1ZATIONS AND THE IMPLICATIONS OF SOXA 181 

South executives and accounting managers, including all five of its former 
chief financial officers, had already pleaded guilty to various fraud charges. 6 

These cases have resulted in scrutiny beyond standard regulatory 
enforcement, shareholder lawsuits, and criminal charges. This is reflected by 
a lawsuit filed against HealthSouth by the Teachers Retirement System of 
Louisiana ("System"). 7 In its lawsuit, the System sought to change the way 
the company was governed rather than recover financi.allosses on its invest­
ments. Pointing to a variety of corporate governance issues involving the 
board and several of its members, the System pursued the dismissal of five 
long-time board directors at a promptly-scheduled shareholders meeting. 8 

Drawing an analogy from recent military activity, a lawyer for the System 
stated, "Regime change was desperately needed at HealthSouth."9 

The Wall Street Journal devoted an entire supplement to current con­
cerns about governance and its relationship with corporate scandals.10 The 
twelve-page section included topics such as how to be a good director, the best 
method for selecting directors, and the degree of disclosure or ''transparency" 
that companies should provide. 

These recent developments carry significant implications for the 
governance of healthcare organizations, including the individuals who may 
believe they are simply performing community service on a governing board 
for a community hospital. For instance, the federal government is taking a 
position that the criminal law components for violation of SOXA constitute 
a "lower intent" crime, heightening exposure for officers on boards who sign 
financial statements and independent members of board audit committees. 11 

In addition, Moody's Investors Service is considering extending governance 
ratings to nonprofit hospitals and health systems. 12 

Sage Givans, a memberofHealthSouth' s audit committee, described the 
difficulties and challenges for a governing board in this new era in his 
testimony before the House Energy and Commerce Committee's Oversight 
and Investigations subcommittee in November 2003: 

At HealthSouth, we had numerous controls and systems in 
place that should have helped detect this fraud. Unfortun­
ately, when high-level management conspires to commit a 
criminal act, I don 'tknow of any corporate governance policy 
that would prevent such behavior. How to prevent this type 

6./d. 
7. Michael Tomberlin, Louisiana Pension Fund Seeks to Remove HealthSouth Board, 

BIRMINGHAM NEWS, Sept. 10, 2003. 
8. Chris Gautreau, Pension Plan Forces HealthSouth Changes, BATONROUGEADVOC., 

Dec. 3, 2003, at LA. 
9. Reeves, supra note 3. 

10. WAIL ST. J., Oct. 27,2003, atRl-12. 
11. Julie Peotrowski, HealthSouth's Most Wanted, MOD. HEALTHCARE, Nov. 10, 2003, 

at6. 
12. Mary Chris Jaldevic, Rating Adjustment, MOD. HEALTHCARE, Dec. 1, 2003, at 12. 



182 INDIANA HEALTH LAW R.Ev1EW [Vol. 1:175 

of fraud in the future is certainly a challenge for boards all 
across the countryY 

The lessons that these for-profit corporations, like HealthSouth, have 
learned over recent years can be instructive for nonprofits and their boards. 

II. HISTORICAL CONTEXT FOR NONPROFIT VOLUNTEER BOARDS 

In order to achieve and maintain their tax-exempt status, nonprofit 
organizations must operate for the benefit of the public. One factor that can 
indicate an organization is operating for the good of the public is control by 
a board that is drawn from the comiilunity and that does not hold a direct 
economic interest in the organization.14 As a result, nonprofit boards have 
historically been composed of volunteers, who are often laypersons with 
respect to the operations of the organization that they govern. Volunteer 
board members may have once believed that they were personally insulated 
from liability due to their ''volunteer" status, or that decisions made in their 
volunteer board member capacity could not expose their organization to 
liability. .However, evolving law and emerging principles of corporate 
responsibility indicate otherwise. 

In the mid-1960s, Darling v. Charleston Community Memorial Hospi­
ta/15 represented a turning point for hospitals and their governing boards. In 
that case, the lllinois Supreme Court connected a hospital governing board's 
powers with a medical staff member's negligent actions in finding the hospital 
liable for negligent medical and hospital treatment. In affirming the appellate 
court's decision, the lllinois Supreme Court stated that a hospital's licensure 
regulations, accreditation standards, and bylaws, which delineate a governing 
board's responsibilities, collectively establish that it is "both desirable and 
feasible that a hospital assume certain responsibilities for the care of the 
patient."16 

While courts have found hospitals liable based upon their board's 
actions or inactions, courts have been reluctant to extend liability to board 
members individually. This is in part due to "volunteer director" immunity 
state legislation that began to emerge over a decade ago. To date, at least 
seventeen states17 have enacted legislation to protect volunteer directors; 

13. Peotrowski., supra note 11. 
14. BRUCER.HOPKINS, THEI..AWOFTAX-EXEMI'I'OROANJZATIONS 137 (6tbed.1992). 
15. Darling v. Charleston Cmty. Mem'l Hosp., 211 N.E.2d 253 (lll. 1965). 
16. /d. at257. 
17. See CAL. CORP. CODE§ 5239 (West 2003); COL REV. STAT. ANN.§ 13-21-115.7 

(West 2003); CONN. GEN. ST. ANN. § 52-557m (West 2003); FL. STAT. ANN. § 617.0834 (West 
2003); IND. CODE ANN.§ 34-30-4-2 (West 2003); KY. REV. STAT.§ 411.200 (Banks-Baldwin 
2003);LA.REV.STAT.ANN.§2792.1(West2003);ME.REV.STAT.ANN.§158-A(West2003); 
MD. CODE ANN.§ 5-417 (2003);MONT.CODEANN. § 27-1-732(2003);N.D. CENT. CODE§ to-
33-47 (2003); NEB. REV. ST. § 25-21, 191 (2003); N.M. ST. ANN. § 53-8-25-3 (Michie 2003); 



2004] HEALTHCARE ORGANIZATIONS AND THE lMPUCATIONS OF SOXA 183 

however, many of these state statutes are narrow in scope. 13 In light of today' s 
corporate governance environment and considering the fact that many states 
either do not clothe volunteer directors with immunity or substantially limit 
the scope of such immunity, board members must be cognizant of exposure to 
liability from both a personal and global perspective. Appreciating the scope 
of this exposure is conditioned upon an understanding of the state and federal 
authorities that shape nonprofit healthcare organizations. 

III. STATE NONPROFIT CORPORATE CODE 

A. Standards for Directors' Duties 

Some states have statutory law that specifically governs the corporate 
conduct of non profits. A few of these states' laws are based on the Revised 
Model Nonprofit Corporation Act ("Model Act"). 19 The Indiana Nonprofit 
Corporation Act of 1991 ("Indiana Nonprofit Act")20 is similar in many 
essential features to other state nonprofit corporation codes in the manner in 
which it regulates the activities of nonprofit corporations in Indiana. 

The Indiana Nonprofit Act mandates that a nonprofit corporation have 
a board of directors. 21 The Articles of Incorporation of a nonprofit corpora­
tion "may authorize a person or group of persons ... to exercise some or all 
of the powers that would otherwise be exercised by a board of directors."22 

However, the non-director person or group of persons authorized to exercise 
those powers normally reserved for members of the board of directors must 
abide by the duties and responsibilities imposed on corporate directors. 23 

The duties for directors of nonprofit corporations in Indiana, and the 
standards for those duties, are set out in the Indiana Nonprofit Act. In this 
respect, the Indiana Nonprofit Act has followed the precedent set by the 
Indiana Business Corporation Law4 ("Indiana Corporation Law") in its 

OKLA. STAT. ANN. tit. 18, § 866 (West 2003); S.D. CODIFlED LAWS§ 47-23-32 (Michie 2003); 
VA. CODE ANN.§ 8.01-220.1:4 (Michie 2003); W.VA. CODE§ 55-7C-3 (2003). 

18. Even though Indiana Code section 34-30-4-2 does provide limitation ofliability for 
directors, it does not protect the directors from incurring the cost of defense. 

19. REVISED MODEL NONPROFIT CORPORATION ACT (1967) [hereinafter MODEL ACT]. 
The Model Act represents, in essence, suggestions of the American Bar Association as to how 
state laws should be formulated. Kevin M. Boyle, Nonprofit Corporation Act of 1991: 
Introduction to Significant Changes, 35 REs GESTAE 462,462 n.2 (1992). The Model Act has 
been adopted in some form by several states other than Indiana, including Alaska, Georgia, 
Montana, and Oregon. /d. Other states are considering adopting the Model Act as well. /d. 

20. IND. CODE§ 23-17 (2004). 
21. /d.§ 23-17-12-l(a). 
22. 1d. § 23-17-12-l(c). 
23. /d.§ 23-17-12-l(c)(l). 
24. /d. § 23-1. 



184 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

adoption of statutory standards for directors of business corporations. 25 

Specifically, a nonprofit corporate director is required to discharge his or her 
duties, based on facts then known to him or her, "(1) (i]n good faith, (2) [ w ]ith 
the care an ordinarily prudent person in a like position would exercise under 
similar circumstances, [and] (3) [i]n a manner the director reasonably believes 
to be in the best interests of the corporation."26 

· The Indiana Nonprofit Act thus imposes both a duty of care and a duty 
of loyalty on a nonprofit director.27 Traditionally, neglect, mismanagement, 
and improper (but disinterested) decision-making have been addressed under 
a board member's duty of care. Separately, issues relating to fraud, self­
dealing, improper diversions of corporate assets, misappropriation of 
corporate opportunities, and other conflicts of interest have been raised under 
a board member's duty ofloyalty.28 While many states treat the duty of care 
as separate and distinct from the duty of loyalty, the Indiana Nonprofit Act 
combines them. 29 

In addition to the duties of care and loyalty, the Indiana Nonprofit Act 
designates standards of conduct for a director of a nonprofit corporation. In 
discharging his or her duties of care and loyalty, a director is permitted to rely 
on information, opinions, reports, or statements, including financial statements 
and other financial data, prepared or presented by certain persons delineated 
by the statute in whom confidence by the director is justified. 30 Nevertheless, 
a director is not acting in good faith if the director has knowledge concerning 
a matter in question that makes reliance-that would otherwise be statutorily 
permitted-unwarranted. 31 

The provisions in the Indiana Nonprofit Act that mandate the duties and 
standards of conduct for nonprofit directors contain language that is quite 
similar to that in the Model Act. 32 However, while both the Indiana Nonprofit 
Act and the Indiana Corporation Law require "willful misconduct or reckless­
ness" by a director in order for him or her to be held liable under Indiana 

25. Paul J. Galanti, Business Organizations, 20 IND. PRAC. SERIES§ 53.10, 102 (Supp. 
2003). 

26. IND. CODE§§ 23-17-13-1(a)(l)-(3) (2004). 
27. "The Duties of Care and Loyalty are the common tenns to describe the standards 

which guide all actions a director [or officer] takes. These standards are derived from a century 
oflitigation principally involving business corporations and are equally applicable to nonprofit 
corporations." Harvey J. Goldschmid, The Fiduciary Duties of Nonprofit Directors and 
Officers: Paradoxes, Problems, and Proposed Reforms, 23 J. CORP. L. 631,638 (1998). 

28. !d. at 646. 
29. David W. Barrett, Note, A Call for More Lenient Director Liability Standards for 

Small, Charitable Nonprofit Corporations, 71IND. L.J. 967,986 (1996). 
30. See IND. CODE§ 23-17-13-l(b) (2004). 
31. Id. § 23-17-13-1(c). 
32. Compare IND. CODE§§ 23-17-1 to -30 with MODEL ACT, supra note 19. 



2004] HEAL1HCARE ORGANJZATIONS AND 1HE IMPuCATIONS OF SOXA 185 

law ,33 the Model Act establishes a standard of "gross negligence" for liability 
of corporate directors. 34 · 

B. Case Law Interpretation of Fiduciary Duties 

There is a dearth of case law addressing and interpreting the statutory 
duties of a direetor of a nonprofit corporation. Under the common law, 
directors of Indiana nonprofit corporations have a general duty of loyalty and 
must act in good faith. 35 In one instance, the Indiana Court of Appeals, in 
Kirtley v. McClelland, 36 held that a director, despite a desire to support the 
organization, appropriated an opportunity belonging to the nonprofit unit 
owner's association, breaching his fiduciary duty of loyalty as a member of a 
board of a nonprofit organization.37 

Additionally, case law suggests that the suitable standard of care to be 
followed by directors of nonprofit corporations is "aligned with principles of 
corporate duty and not the strict 'prudent man' standard of trust law."38 The 
Supreme Court of Louisiana, in Mary v. Lupm Fouruiation,39 looked to a 
business corporation statute in interpreting a statutory provision concerning 
duties of directors of nonprofit corporations. 40 The Louisiana statute required 
nonprofit directors to discharge their duties in good·faith, with the diligence, 
care, judgment, and skill that an ordinary prudent person in a like position 
would exercise under similar circumstances.41 

Recent comments by the chief justice of the Delaware Supreme Court 
were an important reminder of the viability, but limitations, of the ''business 
judgment rule" for corporate directors. Chief Justice Veasey provided some 
relief by commenting that this protective ''rule" is "alive and well," but also 
noted that directors have a proactive oversight role under Delaware corporate 
law. Fiduciary duties are met by processes that demonstrate a board or 

33. /d.§§ 23-17-13-1(d), 23-1-35-l(e). 
34. See MODEL Acr, supra note 19, at § 8.30. The Model Act solely provides that "[a] 

director is not acting in good faith if the director bas knowledge concerning the matter in 
question that makes reliance permitted by subsection (b) unwammted," and does not have the 
explicit"willfulmisconductorrecklessness"IanguagefoundinlndianaCodesection23-17-13-
l(d)(2). Id.; see also Barrett, supra note 29, at 990. 

35. Galanti, supra note 25, at 102. 
36. Kirtley v. McClelland, 562 N.E.2d 27 (Ind. Ct. App. 1990). 
37. Id. at 36. 
38. Galanti, supra note 25, at 103 (citing Stem v. Lucy Webb Hayes Nat'l Training Scb. 

for Deaconesses & Missionaries, 381 F. Supp. 1003 (D.D.C. 1974) and Oberly v. Kirby, 592 
A.2d 445 (Del. 1991)). 

39. Mary v. Lupin Found., 609 So. 2d 184 (La. 1992). 
40. ld. at 187. "Provisions relating to nonprofit corporations have been conformed 

generally to those relating to business corporations." Id. 
41. ld.; LA. REv. STAT. ANN. § 12:226(A) (West 1994). 



186 INDIANA HEALTH LAW REvmw [Vol. 1:175 

corrunittee is operating in good faith and being proactive and inquisitive.42 

This is an interpretation that would be equally applicable to directors of 
nonprofit corporations. 

C. State Licensure and County Hospital Statutes 

Most healthcare organizations are licensed by the state in which they 
operate. State licensure laws for hospitals43 set forth the governing board's 
legal responsibilities and discretionary powers, while naming the board as the 
supreme authority of the hospital. fudiana' s hospital licensure statute makes 
the board generally responsible for the management, operation, and control of 
the hospital. 44 fudiana' s hospital licensure statute and regulations45 expressly 
hold the board responsible for specific issues related to the medical staff 
and bylaws,46 management,47 patient care,48 the institutional plan and 

42. Alison Carpenter & Susan Webster, Corporate Governance.: Business Judgment Rule 
Still Alive, Delaware's Veasey Tells Directors' Group, 12 Health L. Rep. (BNA) 1645 (Oct. 30, 
2003). 

43. Hospitals are the typical focus for discussions of nonprofit healthcare organizations. 
However, other healthcare organizations may obtain nonprofit status as well. A few examples 
include conununity mental health centers, nursing facilities, rehabilitation centers, and 
residential facilities. 

44. IND. CODE§ 16-21-2-5 (2004). 
45. See generally id. §§ 16-21-2-5 to -15; IND. ADMIN. CODE tit. 410, r. 15-1.4 (2004). 
46. Under Indiana law, the governing board's responsibilities with respect to the medical 

staff include the following: 
(A) "Ensure the medical staff has approved bylaws and rules and that they are 

reviewed and approved at least triennially." IND. ADMIN. CODE tit. 410, 
r. 15-1.4-l(a)(3)-(4),(b)(4); 

(B) "Assume responsibility of appointment, reappointment, and assignment 
of privileges to medical staff members." IND. CODE§ 16-21-2-5; 

(C) "Ensure that the medical staff is accountable and responsible to the Board 
for the quality of care provided to patients." IND. ADMIN. CODE tit. 410, 
r. 15-1.4-l(a); 

(D) "Maintain a liaison with the medical staff." /d. r. 15-1.4-1; and 
(E) "Ensure that the criteria for selection for medical staff membership are 

individual character, competence, education, training, experience, and 
judgment." Id. 

47. Under Indiana law, the governing board must, among a variety of duties relating to 
management, (A) appoint a chief executive officer ("CEO"), (B) develop in writing, 
responsibilities and authority of the CEO, (C) require the CEO to develop policies and programs 
in a variety of areas, and (D) require the CEO (or designee) to attend board and committee 
meetings and act as the board's representative at medical staff meetings. IND. ADMIN. CODE tit. 
410, r. 15-1.4-l(c). 

48. Under Indiana law, the governing board must (A) "ensure all patients are admitted to 
the hospital only by a licensed practitioner who has been granted admitting privileges;" (B) 
ensure a qualified licensed physician who is a member of the medical staff is responsible for the 
care and treatment of each problem present at admission or that develops during hospitalization; 
(C) make sure that the hospital provides required emergency care services; (D) ensure that 
policies are developed to cover impaired physician limited practice problems; and (E) ensure 
the hospital has certain policies on organ and tissue donation. Id. r. 15-1.4-l(d). 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPUCATIONS OF SOXA 187 

budget,49 and contracts. 50 

A governing board may have to be attentive to other licensing restric­
tions. For instance, in order to qualify as a ••county hospital" in Indiana, a 
hospital must meet various statutory and regulatory requirements, which 
delineate unique responsibilities of a county hospital's governing board. 51 In 
addition to such state licensing requirements, governing boards must also 
adhere to a variety of federal authorities, including, among many, those 
relating to Medicare certification and participation and the requirements of the 
Internal Revenue Service ("IRS") for tax-exempt status, as discussed below. 

IV. FBl>ERAL AU'IHORITIES 

A. Conditions of Participation 

In order to participate in the Medicare and Medicaid programs, 
healthcare organizations must meet and maintain compliance with specific 
requirements established by the Centers for Medicare and Medicaid Services 
e·CMS") of the United States Department of Health and Human Services. 
These requirements, known as conditions of participation, vary depending 
upon the type of healthcare organization. 

The conditions of participation for hospitals require a hospital to have 
an effective governing body that is legally responsible for the conduct of the 
hospital as an institution. 52 CMS has promulgated six general standards that 

49. Under Indiana law, the governing board must {A) oversee the preparation of the 
institutional plan, which shall include, but not be limited to, the programs and services provided 
and an annual operating budget prepared in accordance with generally accepted accounting 
principles; and (B) ensure the plan is reviewed and updated annually. ld. r. 15-1.4-l(e). 

SO. Underbidianalaw,thegovemingboardmust(A)ensurethatanycontractorproviding 
services does so as to ensure that the hospital is compliant with all applicable laws; (B) ensure 
that all contracted services are performed in a safe and effective manner and are included in the 
hospital's quality assessment and improvement program; and (C) ensure that the hospital 
maintains a list of all contracted services, including the scope and nature of the services. ld. r 
15-1.4-l(f). 

51. See generally IND. CoDE§§ 16-22-3-1 to -30. In Indiana, the county hospital statute 
places various responsibilities upon the board relating generally to the following: (A) the 
medical staff and bylaws; (B) management requirements; (C) financial matters; (D) patient care; 
(E) the hospital's budget; and (F) contracts. ld. 

52. 42 C.P.R. § 482.12 (2004). Aside from the condition of participation addressing the 
governing body of a hospital, there are several other conditions that must be satisfied for a 
hospital to participate in Medicare. ld. The conditions for participation that relate to 
administration are specifically titled Compliance with Federal. State. and local laws(§ 482.11) 
and Patient's rights(§ 482.13). Those conditions for participation relating to basic hospital 
functions include: Quality assessment(§ 482.21); Medical staff(§ 482.22); Nursing services 
(§ 482.23); Medical record services (§ 482.24);.Pharmaceutical services(§ 482.25); Radiologic 
services (§ 482.26); Laboratory services (§ 482.27); Food and dietetic services (§ 482.28); 
Utilization review(§ 482.30); Physical environment(§ 482.41); Infection control(§ 482.42); 
Discharge planning (§ 482.43); and Organ, tissue, and eye procurement (§ 482.45). The 



188 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

regulate the way a board must govern a hospital. The standards extend broad­
ly to the following areas of operation: (i) Medical Stafr,s3 (ii) Chief Executive 
Officer,54 (iii) Care of Patients,55 (iv) Institutional Plan and Budget,56 (v) 
Contracted Services,57 and (vi) Emergency Services.58 CMS has published 
interpretative guidelines with respect to the conditions of participation to 
assist hospitals with their corporate compliance and corporate governance 
initiatives.59 

B. Accreditation Requirements 

Many hospitals utilize independent accreditation organizations for 
marketing and managed care contracting purposes. Another benefit of the 
accreditation process is that it may substitute for CMS' s survey and certifica­
tion process through a process known as "deeming." CMS has recognized 

conditions of participation relating to optional hospital services include: Surgical services (§ 
482.51); Anesthesia services (§ 482.52); Nuclear medicine services (§ 482.53); Outpatient 
services(§ 482.54); Emergency services(§ 482.55); Rehabilitation services(§ 482.56); and 
Respiratory care services (§ 482.57). There are additional conditions of participation for 
specialty hospitals. See 42 C.F.R. pt. 482, subpt. E. 

53. A hospital governing board must (A) assure the approval of the medical staffs 
bylaws; (B) appoint members of the medical staff after considering recommendations of the 
existing members; (C) ensure that the medical staff is accountable to the board for quality of 
care; and (D) establish categories of practitioners and ensure that the members of the medical 
staff are selected based upon the individual character, competence, training, experience, and 
judgment. 42 C.F.R. § 482.12(a). 

54. A hospital governing "board must appoint a chief executive officer who is responsible 
for managing the hospital." ld. § 482.12(b ). 

55. A hospital governing board must (A) ensure there are hospital policies that provide 
for patients to be under the care of an appropriate professional staff following admission; and 
(B) ensure an appropriate physician is on duty or on call at all times. ld. § 482.12(c). 

56. A hospital governing board must have an overall institutional plan with an annual 
operating budget prepared in accordance with general accepted accounting principles that 
includes all anticipated income and expenses. ld. §§ 482.12(d)(l)-(2). The plan must provide 
for capital expenditures for at least a three-year period. ld. § 482.12(d)(3). The plan must 
include and identify in detail the objective of, and the anticipated sources of financing for, each 
anticipated capital expenditure in excess of six hundred thousand dollars ($600,000). ld. § 
482.12(d)(4). 

57. A hospital "governing board must ensure that a contractor of services (including one 
for shared services and joint ventures) furnishes services that permit the hospital to comply with 
all applicable conditions of participation." 42 C.F.R. § 482.12(e). 

58. If emergency services are provided, a hospital governing board must (A) ensure that 
emergency services are organized under the direction of a qualified member of the medical staff 
and integrated with other departments of the hospital and (B) ensure there are adequate medical 
and nursing personnel qualified in emergency care to meet procedures established for the 
hospital and the needs anticipated by the hospital. ld. §§ 482.12(1), 482.55. 

59. CTR.s. FOR MEDICARE & MEDICAID SERVS., Hospitals Interpretive Guidelines and 
Survey Procedures, at http://www.crns.hhs.gov/manuals/pub07pdf/AP-a.pdf (last visited Feb. 
25, 2004). 



2004] HEALTHCARE ORGANJZATIONS AND THE IMPUCATIONS OF SOXA 189 

certain national accrediting bodies as "deemed organizations."60 Because of 
the deemed organizations' high standards, CMS has granted them "deeming 
authority" to review hospitals for certification in addition to accreditation.61 

Hospitals which meet an appropriate deeming authority's high standards are 
granted "deemed status" and become exempt from the CMS survey and certifi­
cation process so long as they maintain this status. 62 A primary accrediting 
organization for hospitals is the Joint Commission on Accreditation of Health­
care Organizations ("JCAH0").63 JCAHO has identified specific standards 
and elements of performance that are applicable to how a board shall govern 
a hospital. 64 

C. IRS Pronouncements 

A healthcare provider may qualify for tax-exempt status under Internal 
Revenue Code § 501(c)(3) if it is organized and operated exclusively for 
charitable purposes. 65 In order to fulfill this charitable purpose requirement, 
the healthcare provider must operate to meet the community benefit stand­
ard. 66 This is the starting point for a governing board to appreciate some of 
the outside "constituencies" being served as a quid pro quo for the organi­
zation's tax-exempt status. According to the governing regulations, the 
organization must be engaged ''primarily in activities which accomplish one 

60. CrRs.R>RMEDICARE&MEDICAIDSERVS., Conditions ofParticipation (May 3, 2002), 
at http://www.cms.hhs.gov/cop/. 

61. 42 C.F.R. § 488.5 (2004); see also JOINT COMM'N ON ACCREDITATION OF HEALTH­
CARE 0RGS., Federal Deemed Status and State Recognition (Sept. 2002), at http://www.jcaho 
.orglabout+uslgovernment+relationslfed_st_rec.htm. 

62. Id. 
63. Another accrediting organization that has "deeming authority" is Health Facilities 

Accreditation Program, which is couunonly known as ''HFAP." AM. OSTEOPATHIC Ass'N, 
About Healthcare Facilities Accreditation Program (2003), at http://www.aoa-net.org/ 
AccreditationiHFAP/about.htm. 

64. The presentJCAHO standards :require a hospital governing board to perform a variety 
of specific and general functions, including (i) define governance responsibilities in writing, (ii) 
provide for organizational management and planning, (iii) demonstrate a commitment to the 
organization's community, (iv) define the qualifications and competence for the medical staff 
and provide adequate resources for the care and services provided, and (v) annually evaluate 
performance in relation to the organization's vision, missions, and goods. JoiNT COMM'N ON 
ACCREDITATION OF HEALTHCARE 0RGS., COMPREHENSIVE ACCREDITATION MANuAL FOR 
HOSPITALS: THE OFFICIAL HANDBOOK (2004). It is interesting to note that the recent JCAHO 
standards blur some of the distinction between an organization's board of directors and its 
management under the topic of "Leadership" standards. 

65. I.R.C. § 501(c)(3) (2003). 
66. Rev.Rul.69-545, 1969-2C.B.l17 (describingthecommunitybenefitstandard). For 

a discussion of the issues and steps for healthcare organizations applying for tax-exempt status, 
seeJanetE. Oitterman & MarvinFriedlander.Health Care Provider Reference Guide, available 
at www.irs.gov/publirs-tegeleotopicc04.pdf (last visited Feb. 24, 2004). 



190 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

or more of its exempt purposes ... [with no] more than an insubstantial part 
of its activities ... not in furtherance of an exempt purpose."67 

The concept of "community benefit" may vary with the type of 
healthcare organization. For hospitals, the focus of attention will be on the 
people within the community being served, nondiscriminatory treatment of 
Medicare and Medicaid patients, the extent of charity care provided, and the 
availability of an emergency room without regard for a person's ability to 
pay.6s 

Beyond serving the public constituency, a governing board of a tax­
exempt organization must at the same time protect against activities that result 
in "private inurement" and "private benefit." The restriction against "private 
inurement" is a strict prohibition against any part of the organization's net 
earnings inuring in whole or in part to the benefit of any "private shareholder 
or individual." In practice, since nonprofit corporations do not have share­
holders, the target for this prohibition is generally referred to as "insiders"­
individuals with an interest in or opportunity to influence the activities of the 
organization.69 Violation of the prohibition against private inurement results 
in a loss of tax -exempt status. Therefore, a governing board must be attentive 
to this concept and the severe consequences of the strict liability exposure. 

A second prohibited activity relates to "private benefit." The targeted 
area of potential beneficiaries extends beyond "insiders," but a violation does 
not necessarily result in loss of tax-exempt status. Any "private benefit" must 
be both qualitatively and quantitatively incidental compared to the public 
benefit and charitable purpose otherwise being served.70 While many of the 
recent corporate scandals have involved excessive benefits for corporate 
insiders, the concept of "private benefit" for tax-exempt governing boards 
requires that attention be given to benefits provided for non-insiders. An 
organization and its management may often have an "explanation" for such 
"private benefits," and the governing board's duty requires a "peripheral 
vision" and inquisitiveness to determine the degree to which such benefits are 
appropriate and insubstantial. 

Internal Revenue Code § 4958 was enacted as part of the Taxpayer Bill 
of Rights 271 imposing "intermediate sanctions" short of tax exemption 
revocation on certain "excess benefit transactions" between the organization 

67. Treas. Reg.§ 1.501(c)(3)-l(c) (as amended in 1990). 
68. A good review of the basic principles discussed in this section was provided by T.J. 

Sullivan, Tax Law Update, Presentation at American Health Lawyers Association Annual 
Meeting (June 29-July 2, 2003). For a description of the factors evaluated in detennining a 
"conununity benefit" for a hospital, see Rev. Rul. 69-545, 1969-2 C.B. 117. 

69. See Sullivan, supra note 68, at 2; see also Gittennan & Friedlander, supra note 66, 
at4. 

70. Gen. Couns. Mem. 37,789 (Dec. 18, 1978). 
71. Taxpayer Bill of Rights 2, Pub. L. No. 104-168, § 1311, 110 Stat. 1452 (1996). 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPLICATIONS OF SOXA 191 

and "disqualified persons. "72 Final regulations were issued by the IRS in 
2002.73 This is a tool for heightened regulatory enforcement, allowing the IRS 
to avoid the "death penalty" of losing tax-exempt status, presented by the 
strict prohibition on private inurement. As a result, governing boards will now 
face increased scrutiny in this area. 74 Briefly, this statute imposes a significant 
excise tax on the value of excess benefits the organization provides to a 
"disqualified person,"75 with a very steep tax if not promptly corrected. 
Targeted transactions include ones in which the disqualified person pays less 
than fair-market value for a good or service, receives unreasonable compensa­
tion, or where there is inappropriate "revenue sharing."76 

While the threat of intermediate sanctions hangs over an organization's 
management and governing board, the IRS has provided some guidance for 
compliance. In this era of internal investigation and self-reporting encouraged 
by corporate compliance activity, the IRS has announced a desire to solicit 
comments on the scope and content for voluntary compliance program 
guidance. 77 More immediately, the regulations issued by the IRS provide a 
"rebuttable presumption" procedure to establish the reasonableness of 
compensation transactions. 78 The governing board is brought directly into the 
process, and is required to approve the transaction based upon appropriate 
data as to comparability, while documenting the basis for its determination.79 

The IRS has also provided encouragement through published guidance 
in the area of conflicts of interest. In 1997, the IRS developed a conflicts of 
interest policy for tax-exempt organizations that can help illuminate and avoid 
potential private inurement, private benefit, and intermediate sanctions 
violations.80 The IRS focuses its attention on "interested persons," which 

72. See Sullivan, supra note 68, at 4-8; see also Gitterman & Friedlander, supra note 66, 
at 5-6. 

73. Excise Taxes on Excess Benefit Transactions, 67 Fed. Reg. 3076 (Jan. 23, 2002) 
(codified at Treas. Reg.§§ 53.4958-1 to 53.4958-8 (2004)). 

7 4. For an extensive discussion of this topic and its application for healthcare providers, 
see the presentation by Gerald M. Griffith, Dealing with Excess Benefit: The New Tax 
Compliance Challenge, Presented at the Hospitals and Health Systems Law Institute, American 
Health Lawyers Association (Feb. 6-7, 2003). 

75. "Disqualified persons" are persons in a position, whether by organizational title or 
other means, to exercise substantial influence over the organization. See Sullivan, supra note 
68, at 5; see also Gitterman & Friedlander, supra note 66, at 6. 

76. See Sullivan, supra note 68, at 4. 
77. Announcement 2001-14, 2001-1 C.B. 648 (2001); see also Griffith, supra note 74, 

at22. 
78. Treas. Reg.§§ 53.4958-l(d)(4)(iv), -6(b) (2004); see Griffith, supra note 74, atS-16; 

Stephen T. Miller, Rebuttable Presumption Procedure is Key to Easy Intermediate Sanctions 
Compliance, TAXNOTESTODAY92-63 (May 11, 2001). 

79. See Sullivan, supra note 68, at 8. 
80. See Lawrence M. Brauer & Charles F. Kaiser, Tax Exempt Organizations Community 

Board and Conflicts of Interest Policy, Presented at the IRS Exempt Organizations Continuing 
Professional Education Technical Instruction Program for Fiscal Year 1997 (updated in 2000), 
available at http://www.irs.gov/pub/irs-tege!topic-c.pdf (last visited Apr. 5, 2004). 



192 INDIANA HEALTH LAw REviEW [Vol. 1:175 

includes a trustee or director, a principal officer, or a member of a committee 
with board-delegated powers who has a direct or indirect financial interest in 
the organization. 81 Adoption of the conflicts of interest policy is only the first 
step for the governing board. The board must then develop a process for 
evaluating disclosures and a procedure to deal with conflicts. The procedures 
should include minutes of meetings that reflect the board's understanding and 
application of the policy and its relationship to the organization's charitable 
purpose.82 

V. REVIEWOFREcENTSTATEATI'ORNEYGENERALlNITIATIVES 

As questions about "corporate governance" escalate in the for-profit 
arena, state attorneys general are taking a closer look at the way in which non­
profit boards govern their organizations. They are initiating investigations, 
filing lawsuits, and lobbying for legislation to safeguard the interest of the 
communities that nonprofits serve. This activity will directly or indirectly 
affect governance issues for nonprofit organizations in every state. 

A. Minnesota: Allina Health System and Management Excesses 

Minnesota's Attorney Gene~ Mike Hatch, initiated an investigation 
against his state's largest healthcare system, Allina Health System ("Allina"), 
in 2001. Subsequent to the investigation, Hatch raised various issues with 
respect to how Allina and its HMO, Medica, both nonprofit companies, 
managed certain funds. Specifically, Hatch claimed that as much as forty­
seven percent of the health insurance premiums paid to Medica were spent on 
Allina's administration rather than on medical care for its members.83 This 
greatly exceeded the ten percent that Medica had reported. 84 

Hatch pointed to specific expenditures to support his allegations. 
Examples included expensive outings for Medica employees, lavish company 
parties, questionable executive compensation, and hefty consultant fees. 85 

While Hatch acknowledged that these administrative costs and "perks" were 
not necessarily illegal, he stated that they do raise questions of possible 
mismanagement. 86 Consequently, he filed a lawsuit against Allina. 

81. A sample conflict of interest policy ("Sample Policy") recommended by the IRS is 
included in Brauer & Kaiser, supra note 80, at 25 and Gitterman & Friedlander, supra note 66, 
at30. 

82. See the Sample Policy discussed, supra note 81. 
83. Attorney General Files SuitAgainstAllina, MINNEAPOUSSTAR TRIB., Mar. 22,2001, 

available at http://thenationalcoalition.org/SuitAgainstAilina.htm [hereinafter Attorney 
General]. 

84. /d. 
85. /d. 
86. /d. 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPUCATIONS OF SOXA 193 

Allina settled the lawsuit with the Attorney General at the end of 2001. 
As a result, the parties entered into a Memorandum of Understanding, which 
placed certain restrictions on expenses, executive compensation, third party 
contracts, relations with affiliates, and the interaction between the Allina and 
Medica management.87 Hatch's efforts to protect the community did not end 
with Allina. as he also initiated investigations against two other large health 
plans: HealthPartners and Blue Cross and Blue Shield of Minnesota. 88 He 
also issued a memorandum on ''Corporate Responsibility," which is directed 
to both for-profits and nonprofits, urging political leaders to take "aggressive 
action to stop the hemorrhaging of our corporate institutions and financial 
markets."89 

B. North Dakota: Banner Health System and Community Assets 

In 2002, North Dakota's Attorney General, Wayne Stenehjem, filed a 
lawsuit against Banner Health System ("Banner''), a charitable nonprofit 
organization authorized to do business in North Dakota. 90 Banner had 
operated five nursing homes in North Dakota, which it sold in 2001.91 The 
litigation centered around Banner's removal of certain assets, including the 
funds from the sale of these facilities, from North Dakota for use in other 
states. The Attorney General maintained that this money belonged to the 
North Dakota communities in which the nursing homes had operated. 92 

Throughout the litigation, the Attorney General argued that Banner, as 
a nonprofit organization, was required to hold these proceeds and contri­
butions in a constructive trust for the benefit of the community these entities 
had served.93 However, the district court dismissed the case, stating that the 
Attorney General had failed to allege facts to satisfy the elements necessary 
to impose a constructive trust.94 The Attorney General appealed the district 
court's decision. The Attorney General's appeal, as well as litigation initiated 
by Banner in federal court, remained open until recently, when the parties 

87. Memorandum of Understanding between Allina and the Minnesota Office of the 
Attorney General, at http://www.ag.state.mn.us/consumer/PDF/allina/MemUnder.pdf (last 
visited Feb. 25, 2004). 

88. Attorney General, supra note 83. 
89. OFFICE OF MINN. ATI'Y GEN. MIKE HATCH, Corporate Responsibility, at 

http://www.ag.state.mn.uslpdf/corporate_Responsibiities_Report.pdf (last visited Feb. 25, 
2004). 

90. Banner Health System, North Dakota AG Settle Claims Over Charitable Assets, 12 
Health L. Rep. (BNA) 1903 (Dec. 18, 2003) [hereinafter Banner Health System]. 

91. /d. 
92. /d. 
93. See Banner Health Sys. v. Stenebjem, No. A3-02-121, 2003 U.S. Dist. LEXIS 2702, 

at *2 (D.N.D. Feb. 25, 2003). 
94. /d. 



194 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

agreed to settle for one million dollars, contingent upon both parties dismiss­
ing all pending litigation.95 

C. New Hampshire: Community Benefits Statute 

Various states have enacted community benefits legislation that requires 
nonprofit hospitals to publicly disclose what community benefits and services 
they are providing in exchange for their tax-exempt status.96 Many states97 

with this type of legislation require the nonprofit hospital to annually file a 
report with the state attorney general's office or the state department of health 
regarding the level of benefit the nonprofit provides to the community it 
serves.98 

New Hampshire's community benefits statute (N.H. REv. STAT. ANN. 
§§ 7:32-c to 7:32-1 (1999)) is the most extensive in scope, extending not only 
to nonprofit hospitals but also to ''healthcare charitable trusts," including 
community health centers and visiting nurses associations. 99 The framework 
of the New Hampshire legislation is structured around three themes: (1) 
public accountability, (2) community involvement, and (3) collaboration 
among charitable entities.100 

The notion of public accountability is addressed in the legislation by 
placing a reporting duty upon§ 501(c)(3) entities, requiring them to file an 
annual community benefits report with the attorney general.101 Since the 
effective date of the legislation, the New Hampshire Attorney General has 
been reviewing these reports in an attempt to provide nonprofits with ''best 
practices. "102 

. The community involvement element requires the nonprofit hospital to 
obtain community input in determining the community's needs.103 This in-

95. See Banner Health System, supra note 90, at 1903. Utigation involving the sale of 
Banner assets in South Dakota and issues similar to those raised in the North Dakota litigation 
is still pending in both South Dakota state and federal courts. Id. 

96. MICHAEL W.PEREGRINE&JAMESR. ScHWARTZ, THEAPPucATIONOFNONPROFIT 
CORPORATION LAW TO HEALTHCARE ORGANIZATIONS 53 (Am. Health Lawyers Ass'n 2002). 

97. The states that have this type of public disclosure requirement include California, 
Georgia, Idaho, Indiana, Minnesota, New Hampshire, New Yolk, Pennsylvania, and Utah. See 
id. 

98./d. 
99. Id. at 53-54. 

100. See OFFICE OF HEALTH PLANNING & MEDICAID, N.H. DEP'T OF HEALTH & HUMAN 
SERVS., TElLING OUR STORY: NEW HAMPSHIRE'S CoMMUNITY BENEFITS REPoRT 2 (2002) 
[hereinafter TElLING OUR STORY], available at http://www.dhhs.nh.gov/DHHSIHPR/Library/ 
Research/Community-benefits.htm. 

101. See N.H. DEP'T OF JUSTICE, GuiDELINES FOR PREPARATION OF THE COMMUNITY 
BENEFITS PLAN PURsUANT TO RSA 7:32-e [hereinafterGUIDEIJNES], available at http://www. 
doj.nh.gov/publications/combenguide.btml (last visited May 20, 2004). 

102. See TElLING OUR STORY, supra note 100. 
103. See GUIDELINES, supra note 101. 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPUCATIONS OF SOXA 195 

volves seeking assistance from public officials and the community-at-large. 104 

Specifically, this requirement has prompted New Hampshire healthcare 
entities to hold public forums, organize focus groups, and survey the public 
in order to identify the community's needs and determine how best to respond 
to them. 105 

Moreover, the statute also encourages collaboration among healthcare 
charitable trusts in the preparation of community need assessments.106 While 
New Hampshire's legislation does not mandate such collaboration, it strongly 
suggests it in order to minimize duplication of efforts and control costs. 107 

D. Indiana: Conner Prairie and Donor's Intent 

Earlham College ("Earlham") was made the trustee of a public charit­
able trust, established by Eli lilly (''Lilly") for the purpose of creating and 
operating an Indiana history museum, now known as Conner Prairie. In 2003, 
the President of Earlham, as the controlling member of the nonprofit corpora­
tion, fired all of the non-Earlham affiliated board members of the nonprofit 
corporation created to oversee the museum's affairs.108 Earlham's action led 
to a dispute between the dismissed former board members, now operating as 
a nonprofit organization named "Save the Prairie," and the college. 

Prior to the mass dismissal, the board had been working with Earlham 
to determine whether the museum could be completely separated from 
Earlham and how to divide up various gifts from Lilly that were given to 
Earlham for the benefit of Earlham and Conner Prairie.109 The negotiations 
apparently broke down when the museum board rejected Earlham's interpreta­
tion of Lilly's intent regarding the extent of the funds that should be allocated 
to Earlham rather than Conner Prairie. 110 

Ultimately, the Save the Prairie group sought assistance from Indiana 
Attorney General, Steve Carter, claiming that Earlham improperly shifted 
about $30 million to itself that was donated by lilly and intended for Conner 
Prairie. 111 The Attorney General initiated his investigation in June 2003 and 

104. Jd. 
105. Id. 
106. Jd. 
107. Jd. 
108. See Save the Prairie, Inc., Save the Prairre, at http://www.savetheprairie.org/ 

filesfmdex.pdf (last visited Feb. 22. 2004); see also Earlham College, Earlham Resumes 
Management of Conner Prairie (June 11, 2003), at http://www.earlham.edu/-publicaf/ 
connerprairie061103.html. 

109. Mary Sell, Prairie Issue Revolves Around $130 Million, PAILADWM-ITBM (July 2, 
2003), available at http://www.pal-item.comlnews/stories/20030702/localnews/582000.html 
[hereinafter Prairie Issue]. 

110. Jd. 
111. WISHTVS, Attorney General to Investigate Conner Prairie Dispute (June 24, 2003), 

at http://www. wishtv.comlgloballstory .asp?s=l334287&Client1'ype=Printable. 



196 INDIANA HEALTH LAW REviEW [Vol. 1:175 

is continuing to review whether or not charitable donations given to Earlham 
were being used as intended by Lilly. 112 

E. Maryland: CareFirst and Conflict of Interest 

In 2001, CareFirst, formerly known as Maryland Blue Cross/Blue Shield 
Company, announced its intention to convert from a nonprofit insurer to for­
profit status. 113 As a result of CareFirst's announcement, Maryland Attorney 
General, Joseph Curran, Jr., announced his interest in CareFirst's proposal. 114 

He stated that the issue was not only whether to allow the conversion, but also 
whether, as a nonprofit, CareFirst should be forced to alter its conduct to 
conform with that expected of a nonprofit entity .115 

One of Curran's concerns regarding the conversion centered around 
CareFirst' s disclosure of its proposed compensation packages for its execu­
tives, which collectively equaled $42 million dollars.116 Curran feared that the 
insiders who negotiated would be well compensated, while Marylanders and 
the Maryland healthcare system would be left behind.117 

After reviewing an opinion by the Maryland Attorney General118 and 
CareFirst' s application for the conversion, the Maryland Insurance Admin­
istration ("MIA") rejected CareFirst' s proposed conversion because it was not 
in the public interest as required by Maryland law.l19 At the same time, 
Curran continued to express concerns overprotecting the charitable assets and 
the public.120 Subsequent to MIA's decision to reject CareF'rrst's conversion 

112. ld. 
113. OFFICEOFMD. ATI'YGEN.J.JOSEPHCURRAN,JR.,NewsRelease,AttomeyGeneral 

Takes Issue with Conversion, Urges Marylanders to Read Abell Foundation Report (Dec. 3, 
2001 ), at http://wwww.oag.state.md.us/Press/200111203d01.htm [hereinafter Conversion]. 

114. See id. 
115. See id. The Abell Foundation Report criticized CareFll'St for significantly changing 

its purpose and focus. Id. CareFtrSt formerly functioned as an insurer for high-risk individuals. 
I d. However, it took steps to eliminate coverage for the under-insured portion of the population, 
except through an expensive open enrollment program offered only twice a year. Id. The State 
subsidized this program, leading to net earnings for the company. Conversion, supra note 113. 
This was in addition to the significant reserves that CareFirst also carried, which were above 
industry standards. Id. 

116. OFFICE OF MD. ATI'Y GEN. J.JOSEPHCURRAN, JR., Curran Responds to Disclosure 
of Compensation Packages for CareFirst Execs (Mar. 7, 2002), at http://www.oag.state. 
md.us/Press/2002/030702.htm. 

117. ld. 
118. See generally 87 Op. Md. Att'y Gen. 02-019 (2002) (opinion that the Maryland 

Insurance Commissioner had the authority to review certain transactions associated with the 
proposed merger and conversion of CareFirst to for-profit status). 

119. See MD. ATI'Y GEN. REPORT 2003-02-032 (2003) [hereinafter REPoRT]. See also 
OFFICE OF MD. ATI'Y GEN., Attorney General Applauds Process, Commissioner's Decision in 
Proposed CareFirst Sale (Mar. 5, 2003), athttp://www.oag.state.md.us/Press/2003/030503 .htm 
[hereinafter Commissioner's Decision]. 

120. See Commissioner's Decision, supra note 119. 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPLICATIONS OF SOXA 197 

proposal, the Attorney General testified during the 2003 Legislative Session. 
His testimony focused on his support of substantive changes to Maryland law 
in order to address the threat to the public interest posed by CareFirst' s 
questionable management practices. 121 The changes were enacted into law as 
a part of the emergency nonprofit health service plan reform legislation.122 

VI. THE RECENT ARRivAL OF "CORPORATE COMPLIANCE" 

During the past twenty-five years, healthcare providers, both institu­
tional and individual, have become more interested in and educated about the 
regulatory environment in which they conduct business or practice. This 
stems from external enforcement pressures exerted on healthcare providers to 
conform their business practices to a variety of state and federal regulations 
or face significant criminal and civil penalties. Well-publicized cases involv­
ing violations of the Anti-Kickback Statute are examples of such enforcement 
activities that assisted in getting both the healthcare providers' and the 
public's attention. 123 

The high profile pressure facing today' s healthcare providers has been 
largely instigated by the federal and state fraud and abuse laws created in the 
last quarter of the twentieth century. These laws have been used by a variety 
of federal and state enforcement agencies to prohibit illegal activities, recover 
substantial overpayments, and assess fines and penalties. These federal 
statutes include the Anti-Kickback Statute, 124 the False Oaims Act, 125 the 
Stark law/26 the civil monetary provisions of various laws,l27 the federal 
healthcare program exclusion provisions, and healthcare fraud statutes affect­
ing governmental and nongovernmental third-party payors.128 

Many states have also enacted fraud and abuse statutes designed to 
address varying public policy considerations. These statutes often follow not 
only the federal Anti-Kickback and False Oaims statutes, but also the 
physician self-referral prohibitions found in the Stark law. Additionally, 
prohibitions against fee-splitting and deceptive trade practices,· along with 
consumer protection statutes and professional licensing statutes, have been 
designed and interpreted to protect the public from fraudulent, abusive, and 
unprofessional conduct. 

121. REPoRT, supra note 119. 
122. Id. 
123. See, e.g., United States v. Greber, 760 F.2d 68 (3d Cir. 1985); United States v. Kats, 

871 F.2d 105 (9th Cir. 1989); United States v. Bay State Ambulance & Hosp. Rental Serv ., 874 
F.2d 20 (1st Cir. 1989). 

124. 42 U.S.C. § 1320a-7b(b) (2004). 
125. 31 u.s.c. § 3729 (2004). 
126. 42 U.S.C. § 1395nn (2004). 
127. Id. § 1320a-7a 
128. 18 u.s.c. §§ 1035, 1345 (2004). 



198 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

Congress and the Department of Health and Human Services ("HHS") 
have attempted to provide direction and encouragement in conjunction with 
the multiple sources for penalties and prosecution. In 1987, Congress directed 
the Secretary of HHS to promulgate "safe harbor" regulations that would 
describe the business practices and relationships, regardless of the provider's 
state of mind, which would be free from prosecution. 129 The safe harbors 130 

that have been developed and proposed131 have emphasized the importance 
and benefit of caution and compliance in structuring transactions and relation­
ships. Additionally, since 1998, the Office of Inspector General ("OIG") of 
HHS has developed eleven different compliance program guidance documents 
in order to assist those providers with development of compliance programs 
oriented toward the fraud and abuse laws.132 Further, the OIG provides direc­
tion annually through the publication of its "Work Plan,"133 identifying the 
types of enforcement activities that it intends to pursue in the coming year, 
organized by types of providers. For healthcare providers, this Work Plan can 
be useful in identifying high-risk compliance problem areas, which should be 
incorporated into the provider's compliance program for review and manage­
ment.I34 

A major impetus for healthcare providers to develop compliance 
programs began on November 1, 1991, with the publication of the United 
States Sentencing Guidelines for organizations involved in federal criminal 
violations.135 A crucial component of the federal sentencing guidelines is the 
recognition of sentencing credit for organizations that utilize an "effective 

129. 42 U.S.C § 1320a-7b(b)(3). 
130. The safe harbors are located at 42 C.F.R. § 1001.952 (2004). 
131. To date, the Secretary of HHS through its Office of Inspector General has promul­

gated twenty-four safe harbors under the Anti-Kickback Statute to guide the myriad of health­
care providers contracting with the federal and state governments under the Medicare and 
Medicaid and TriCare programs. 

132. The compliance plans address the following healthcare organizations: Hospitals (63 
Fed. Reg. 8987 (Feb. 23,1998)); HomeHealthAgencies(63Fed. Reg. 42,410(Aug. 7, 1998)); 
Clinical Laboratories (63 Fed. Reg. 163 (Aug. 24, 1998)); Third-Party Medical Billing Com­
panies (63 Fed. Reg. 70,138 (Dec. 18, 1998)); Durable Medical Equipment Suppliers ( 64 Fed. 
Reg. 36,368 (July 6, 1999)); Hospices (64 Fed. Reg. 54,031 (Oct. 5, 1999)); Medicare +Choice 
Organizations (64Fed. Reg. 61,893 (Nov. 15, 1999));NursingFacilities (65 Fed. Reg. 14,289 
(Mar. 16, 2000)); Individual and Small Group Physician Practices (65 Fed. Reg. 59,434 (Oct. 
5, 2000)); Ambulance Suppliers (68 Fed. Reg. 14,245 (Mar. 24, 2003)); Pharmaceutical Manu­
facturers (68 Fed. Reg. 23,731 (May 5, 2003)). 

133. OFFICE OF INSPECTOR GEN., DEP'T OF HEALTH & HUMAN SERVS., Work Plan Fiscal 
Year2004,athttp://oig.hhs.gov/publications/docs/workplan/2004/Work%20Plan%202004.pdf 
(last visited Mar. 9, 2004). 

134. /d. 
135. U.S. SENTENCING COMM'N, 2003 SENTENCING GUIDEUNE MANUAL ch. 8, available 

at http://www.ussc.gov/2003guid/CHAP8.htm (last visited Mar. 9, 2004) [hereinafter SEN­
TENCING GUIDEUNES]. 



2004] HEALTH CARE ORGANIZATIONS AND THE IMPUCATIONS OF SOXA 199 

program to prevent and detect violations of law."136 The importance of the 
Sentencing Guidelines "recommendation" for an effective compliance pro­
gram, and its relevance for a governing board, received a significant boost 
following the Caremark137 decision in 1996. 

Central to any corporate compliance program is the role of the organiza­
tion's governing board. This important role was emphasized and discussed in 
a recent joint publication of the OIG and the American Health Lawyers 
Association. 138 In that publication, not only are the traditional fiduciary duties 
of loyalty and due care described, but with respect to the oversight responsi­
bility of the latter, corporate board compliance activities are discussed in a 
way that requires the board to assure that the organization (1) has a function­
ing information reporting system and (2) such a system provides the board 
with timely information that will enable the organization to achieve compli­
ance with applicable laws.139 

In the face of an ever increasing compilation of healthcare statutes and 
regulations, and the expanding array of technological advances and broad 
service offerings, an effective compliance program, with its attendant policies, 
protocols, and procedures, is a crucial managerial tool today for healthcare 
providers and their governing boards to achieve meaningful oversight of their 
organization's day to day activities. 

VII. SARBANES-OXLEY AND RELATED PRINCIPLES 

In response to the Enron implosion, President George W. Bush signed 
SOXA on July 30, 2002.140 SOXA is designed to uphold the integrity of 
financial reports submitted to the SEC by publicly-traded companies and 
protect the shareholders of such companies from severe fmancial loss. 141 

136. /d. § 8C2.5(t). For healthcare providers, the Department of Health and Human 
Services through its OIG has, in fact, published compliance program guidance documents. The 
content of such compliance program guidance documents will play a significant role in deter­
mining whether the organization has developed an effective compliance program to ensure com­
pliance with the various laws under which it is obligated to conduct its activities. See U.S. 
Dep't of Health & Human Servs. Office of Inspector Gen., Fraud Prevention and Detection 
Compliance Guidance at http: //www.oig.hhs.gov/fraudlcomplianceguidance.html#l (last visited 
May 3, 2004). 

137. In re Caremark Int'l Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). 
138. OFFICEOFINSPECTORGEN.,U.S.DEP'TOFHEALTH&HUMANSERVS.&AM.HEALTH 

LA WYERS ASS'N, Corporate Responsibility and Corporate Compliance: A Resource for Health 
Care Boards of Directors, at http://oig.hhs.gov/fraudldocs/complianceguidancei040203Corp 
RespRsceGuide.pdf (last visited Mar. 9, 2004) [hereinafter Corporate Responsibility]. 

139. Id. 
140. Sarbanes-Oxley Actof2002, Pub. L. No. 107-204, 116 Stat 745 (2002)(codifiedin 

scattered sections of 15 U.S.C.) [hereinafter SOXA]. 
141. Cynthia A Glassman, SEC Comm'r, Sarbanes-Oxley and the Idea of "Good" Gover­

nance, Speech Before the American Society of Corporate Secretaries (Sept. 27, 2002), at 
http://www.sec.gov/news/speech/spch586.htm. The Commissioner stated that the impetus 
behind the quick government response to the Enron and other corporate scandals is the "effect 



200 INDIANA HEALTH LAw REviEW [Vol. 1:175 

SOXA and the SEC's quick regulatory response to Enron and other corporate 
scandals reflect strict governance standards that require top corporate officials 
in publicly traded companies to be held accountable for a company's financial 
accountings and disclosures and to act as the "conscience" of the company, all 
in an effort to prevent fraudulent acts and potentially harmful conflicts of 
interest.142 Failure to adhere to these new corporate governance standards will 
subject such officials to substantial penalties. 143 

The corporate governance policies of SOXA include: heightened 
accountability for financial reports that are submitted to the SEC along with 
augmented disclosures concerning the internal controls of a company; 
enhanced professional responsibility of corporate attorneys to report evidence 
of a material violation of the securities laws; internal independent corporate 
audit committees; and external auditor independence.144 Two other areas that 
SOXA highlights include prohibiting company officials from fraudulently 
influencing the company's external auditor and enhanced conflict of interest 
provisions making it unlawful for a company to extend a personal loan to any 
director or executive officer, except for certain commercial loans that would 
be made to the general public.145 

A. Accountability for Financial Reports 

One of the key aspects of SOXA' s new corporate governance standards 
is the heightened amount of responsibility executive officers have in 
overseeing the financial reports submitted to the SEC146 and the corresponding 

these scandals have had on innocent investors." /d. Approximately "88 million shareholders, 
representing 51 percent of U.S. households, invest in the markets today . . . ... /d. The Com­
missioner stated that the increase in the number of shareholders is largely due to the popularity 
of employee 40l(k) plans. Id. These employee stock plaDs have provided many benefits for 
employee investors, but these plans have also led many employees to invest most of their money 
in one company instead of diversifying their stock portfolio; thus, placing these investors at risk 
of a greater financial loss if there is financial fraud perpetrated by the company. Id. 

142. /d. 
143. SOXA § 1106, 15 U.S.C. § 78ff(a) (2004). The enactment of SOXA increased the 

criminal penalties for those who violate any of the SEC laws. rules, or regulations. A person 
who commits a willful violation can receive up to a $5,000,000 fine or up to twenty years in 
prison or both; if it is not possible to convict a "natural" person, then a fine of up to 
$25,000,000 may be imposed upon a company. /d. 

144. SOXA §§ 201-501 (codified in scattered sections of 15 U.S.C.). 
145. /d. 
146. SOXA § 302(a)(6), 15 U.S.C. § 7241. The Chief Executive Officer ("CEO") or Chief 

Financial Officer (''CFO") of a company is required to certify in each financial report filed with 
the SEC that such officer has: (1) reviewed the report; (2) determined that the report contains 
all relevant information and such information is not false or misleading; (3) determined that the 
report is an accurate description of the ~al health of the company; (4) evaluated the 
company's internal controls regarding financial matters and reported to the external auditors any 
substantial deficiencies in the internal controls that could possibly affect the outcome of the 
financial report; (5) reported to the external auditors any fraud regarding those employees who 



2004] HEALTIICARE 0RGAN1ZATIONS AND TilE IMPliCATIONS OF SOXA 201 

penalties for failure to comply. Three basic requirements included within this 
enhanced responsibility and oversight for financial reporting are: (1) maintain 
all of the internal controls within the company that oversee the company's 
financial reporting practices; (2) provide a written annual evaluation of the 
effectiveness of such internal controls; and (3) review and attest to the annual 
evaluation by the external auditor and submission of that attestation along 
with the company's financial report to the SEC.147 

Concerning the first requirement, an independent Public Company 
Accounting Oversight Board ("PCAOB")148 was established; it will require 
internal control policies and procedures relating to a company's "maintenance 
of accounting records, the authorization of receipts and disbursements," the 
protection of assets, and its "process for preparing financial statements in 
accordance with generally accepted accounting principles."149 Under the 
second requirement, the executive officers of a company are required to pre­
pare an annual written evaluation of the company's internal control systems 
that recognizes the executive's responsibility for the control systems and 
identifies any "material weaknesses" in any of the control systems.150 

take part in the internal controls of the company; and (6) "indicated in the report whether or not 
there were significant changes in internal controls or in other factors that could significantly 
affect internal controls." /d. 

147. SOXA §§ 302,404, lS U.S.C. §§ 7241,7262. 
148. SOXA §§ 101-09, 15 U.S.C. §§ 7211-19. The PCAOB is not an agency of the 

government but instead is a nonprofit corporation, formed for the pmpose of overseeing 
financial audits of publicly-traded compllllies. ld. The PCAOB also has the power to 
investigate, inspect, and sanction public accounting firms. Id. Furthermore, to protnote high 
professional standards, the PCAOB may promulgate rules or orders concerning any aspect of 
the auditing process. Id. 

149. PuB. Co. ACCOUNTING0VERSIGIITBD., Briefing Paper, Proposed Auditing Standard 
-An. Audit of Internal Control Over Fmancial Reporting Performed in Conjunction With an 
Audit of Financial Statements, Oct. 7, 2003 at 2, available at http://www .pcaobus.orglrules/ 
2003-10-07 _Proposed_Auditing__Standard.pdf [hereinafter Proposed Auditing Standard]. 

150. Management's Reports on Intemal Control over Fmancial Reporting and Certification 
of Disclosure in Exchange Act Periodic Reports, 68 Fed. Reg. 36,636, 36,642 (June 18, 2003). 
The SEC stated that the Committee of Sponsoring Organizations of the Treadway Commission 
control framework met its criteria regarding the evaluation of a company's internal control 
mechanisms. ld. See also COMM. OF SPONSORING ORGS. OF THE TREADWAY COMM'N 
("COSO"), Internal Control-Integrat.ed Framework-&ecutive ·Summary, available at 
http://www.coso .org/Publications/executive_summary_integrafed_framework.htmOastvisited 
Dec. 30, 2003). COSO is a private organization with the goal of improving the quality of 
financial reporting through business ethics, appropriate internal controls, and corporate 
governance. Id. COSO sets forth five components of internal control: (1) control environment 
that sets the corporate mood and operating style; (2) assessment of potential financial risks; (3) 
control activities consisting of policies and procedures regarding all financial aspects of a 
company; (4) a process for tnonitoring internal control systems with appropriate reporting 
procedures for deficiencies; and (5) the identification of pertinent financial information or 
factors that could possibly affect the company's financial status and proper communication 
among all levels of a company. PCAOB, An Audit oflnternal Control over Financial Reporting 
Performed in Conjunction with an Audit ofFmancial Statements, Proposed Auditing Standard 
A-50-S 1 (Oct. 7, 2003), available at http://www.pcaobus.org/rules/Release2003-017 .pdf. The 



202 INDIANA HEALTII LAW REVIEW [Vol. 1:175 

Concerning the third requirement, the external auditor's review will evaluate 
the executive's evaluation and reveal whether there are any material weak­
nesses that should have been included in the internal control report. 151 If all 
requisite steps are followed regarding the enhanced financial reporting 
standards, the result should be a strong set of checks and balances that 
promote the new and improved corporate conscience concerning corporate 
accountability and responsibility. 

B. Ethical Obligations for Corporate Counsel 

SOXA has also had a dramatic effect on the relationships among 
corporations and their legal counsel. Section 307 of SOXA requires attorneys 
"appearing and practicing before the Commission ... to report evidence of a 
material violation of securities law or breach of fiduciary duty ... by the 
company ... to the chieflegal counsel or the chief executive officer."152 If the 
chief legal counsel or chief executive officer does not respond appropriately 
to the attorney's report, the attorney must then report the material violation 
"up the ladder" to the corporation's audit committee.153 This may appear to 
be irrelevant for nonprofit organizations since SOXA principally relates to 
publicly-traded, for-profit corporations. Nonetheless, the "ripple effect" of 
these relatively narrow provisions reveals how a legislative initiative in one 
arena can spread to have an impact beyond the initial confines of the statute. 

The SEC significantly expanded § 307 by publishing its final rules 
regarding professional conduct for attorneys on February 6, 2003.154 First, the 
final rules broadly defined what attorneys would be considered as "appearing 

PCAOB also sets forth certain requirements pertaining to the external auditor's attestation 
report. !d. 

151. Proposed Auditing Standard, supra note 149. 
152. SOXA § 307, 15 U.S.C. § 7245; see also 17 C.F.R. § 205.2 (2004). "Material 

violation" is defined as an activity that would violate any federal or state laws, any securities 
laws, or "a material breach of fiduciary duty arising under federal or state law." !d. 

153. SOXA § 307, 15 U.S.C. § 7245 (suggesting that an appropriate response would be 
issuing sanctions or providing remedial measures concerning the material violation); 17 C.F .R. 
§ 205.3. 

154. Implementation of Standards of Professional Conduct for Attorneys, 68 Fed. Reg. 
6296 (Feb. 6, 2003) (codified at 17 C.F.R. § 205). The rationale behind the promulgation of 
the standards of professional conduct for attorneys was to protect shareholders and promote 
shareholder confidence in public companies by requiring attorneys employed or retained by 
such companies to respond swiftly and affinnatively to any possible material violation of the 
SEC's rules. !d. Section 205.1 sets forth that the professional standards supplied by the SEC 
shall supplant any conflicting state standards. /d. The SEC explained in the final rule that their 
standards are not meant to preempt more stringent state standards. Id. However, the SEC's 
standards will apply over less stringent or conflicting state standards. !d. In addition to the 
already codified rules that have extended the original professional standards of SOXA, the SEC 
is still considering the requirement of a ''noisy withdrawal"-wbereby the withdrawing attorney 
must notify the SEC of his or her withdrawal-by an attorney who did not receive an appro­
priate response from a company after reporting evidence of a material violation. /d. 



2004] HBALTHCARE ORGANIZATIONS AND THE IMPllCATIONS OF SOXA 203 

and practicing., before the SEC. 155 Second, the final rules allow corporate 
counsel to skip a step in the chain of command by reporting a suspected 
material violation directly to the audit committee, thus bypassing the chief 
legal officer or chief executive officer. 156 Furthermore, under certain circum­
stances, a reporting attorney who reasonably believes that he or she did not 
receive an appropriate response in a reasonable amount of time from the audit 
committee may report the suspected material violation to the SEC without the 
consent of the corporation. 157 Third, the SEC imposes the same disclosure 
requirements on any supervisory attorney as on the subordinate reporting 
attorney.158 Fmally, the final rules set forth that an attorney not in compliance 
with the standards of professional conduct will be subject to civil penalties 
and SEC disciplinary actions. 159 

In response to the SEC's new standards of professional responsibility for 
attorneys, the American Bar Association's ("ABA .. ) House of Delegates 
revised its Model Rules of Professional Conduct, specifically Rules 1.6 and 
1.13, to allow attorneys to comply with the reporting responsibilities ofSOXA 

155. 17 C.P.R. §§ 205.2, 205.3. The SEC defines "appearing and practicing" before the 
SEC as: (1) any form of communication with the SEC; (2) representing a corporation in a SEC 
administrative proceeding or any other type of investigation or activity with the SEC; (3) 
advising clients on any aspect of securities laws or the SEC's rules and regulations in 
preparation of tiling any documentation; and (4) providing advice to a corporation concerning 
whether or not information is required to be filed with the SEC. Id. See also Implementation 
of Standards of Professional Conduct for Attorneys, 68 Fed. Reg. at 6296. The SEC set forth 
that an attorney "appearing and practicing" before the Commission need not be employed as an 
in-house attorney for a company-there only needs to be an attorney-client relationship and 
such a relationship can be formed without evidence of a formal retainer. Id. A clarification in 
the final rules explains that attorneys are not considered as "practicing or appearing'' before the 
Commission if they had no notice or never intended a document to be filed with the SEC. Id. 

156. 17 C.P.R.§ 205.3(b)(4) (setting forth that the reporting attorney must reasonably 
believe ''that it would be futile to report evidence of a material violation to the issuer's chief 
legal officer and chief executive officer''). 

157. Id. § 205.3( d)(2). The SEC sets forth three sets of circumstances in which a reporting 
attorney may report the material violation to the SEC without the corporation's approval: (1) 
stopping an issuer from committing a material violation that would adversely affect the financial 
interest of the corporation or its investors; (2) preventing a corporation from committing perjury, 
suborning perjury or committing an act that is likely to "perpetrate a fraud upon the Com­
mission;" or (3) remedying a material violation that caused great financial injury to the corpora­
tion or its investors "in the furtherance of which the attorney's services were used." Id. 

158. Id. § 205.4 (2004). See also id. § 205.2(b) (defining "appropriate response" as a 
response to the reporting attorney in which such attorney reasonably believes that: no material 
violation has occurred or is likely to occur in the future; the company has taken steps to remedy 
any ongoing material violations or prevent any violations from occurring in the future; or the 
company, with the consent of the audit committee, bas hired another attorney to investigate and 
evaluate whether a material violation has occurred). 

159. Id. §§ 205.6-205.7. Section 205.6 also sets forth that attorneys acting in good faith 
in complying with the SEC rules will not be "subject to discipline or otherwise liable under in­
consistent standards imposed by any state." 17 C.P.R.§§ 205.6-205.7. Moreover, section 
205.7 gives the SEC exclusive rights to enforce its required standards of professional conduct. 
/d. 



204 INDIANA HEALTII LAW REVIEW [Vol. 1:175 

and to disclose confidential information to prevent fmancial injuries. The 
ABA extended Model Rule 1.6 beyond disclosure of acts that will result in 
bodily hann or death; now an attorney may also disclose confidential informa­
tion without consent to preclude any "substantial injury to financial interests 
or property of another."160 Before the revision of Model Rule 1.13, attorneys 
-were only allowed to report unlawful acts of a company to a higher authority 
within the company; now under certain circumstances, an attorney may also 
report such unlawful acts to the SEC.161 Thus, the ABA has removed many 
of the ethical obstacles that formerly served as deterrents to reporting "up the 
ladder." Although the Model Rules were amended to reflect the goals of 
SOXA, the states must now (because the Model Rules are not legally binding) 
decide whether to revise their own rules of ethics to comply with the SEC's 
standards or to maintain the status quo. 

160. MODEL RULES OF PROF'L CONDUCT R. 1.6 (2003), available at http://www.abanet 
.orglleadership/2003/journal/119a.pdf (last visited Mar. 9, 2004) [hereinafter MODEL RULES]. 
Rule 1.6 states in relevant part: 

I d. 

A lawyer may reveal information relating to the representation of a client to the 
extent the lawyer reasonably believes necessary: to prevent reasonably certain 
death or substantial bodily harm; to prevent the client from committing a crime 
or fraud that is reasonably certain to result in substantial injury to the fmancial 
interests or property of another and in furtherance of which the client has used 
or is using the lawyer's services; to prevent, mitigate or rectify substantial injury 
to the financial interests or property of another that is reasonably certain to result 
or has resulted from the client's commission of a crime or fraud in furtherance of 
which the client has used the lawyer's services; to secure legal advice about the 
lawyer's compliance with these Rules .... 

161. ld. at R.l.13, available at http://www.abanet.org/cpr/mrpc/new_rulel_l3.pdf (last 
visited Mar. 9, 2004). Rule 1.13 states in relevant part: 

!d. 

If a lawyer for an organization knows that an officer, employee or other person 
associated with the organization is engaged in action, intends to act or refuses to 
act in a matter related to the representation that is a violation of a legal obligation 
to the organization, or a violation of law that reasonably might be imputed to the 
organization, and that is likely to result in substantial injury to the organization, 
then the lawyer shall proceed as is reasonably necessary in the best interest of the 
organization. Unless the lawyer reasonably believes that it is not necessary in the 
best interest of the organization to do so, the lawyer shall refer the matter to 
higher authority in the organization, including, if warranted by the circumstances 
to the highest authority that can act on behalf of the organization as determined 
by applicable law. Except ... if despite the lawyer's efforts ... the highest 
authority that can act on behalf of the organization insists upon or fails to address 
in a timely and appropriate manner an action, or a refusal to act, that is clearly a 
violation of law, and the lawyer reasonably believes that the violation is 
reasonably certain to result in substantial injury to the organization, then the 
lawyer may reveal information relating to the representation whether or not Rule 
1.6 permits such disclosure, but only if and to the extent the lawyer reasonably 
believes necessar· •'l prevent substantial injury to the organization. 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPUCATIONS OF SOXA 205 

C. Role of Independent Auditors Internally and Externally 

SOXA also requires an "independent" accounting ftrm. to perform the 
financial audits for a corporation.162 One safeguard through which SOXA en­
sures auditor independence is by requiring auditors to submit reports directly 
to a corporation's audit committee,163 composed of board members who are 
not employed by or under contract (e.g., as an independent consultant) with 
the corporation. Another significant safeguard is that an accounting firm pro­
viding auditing services is prohibited from contemporaneously supplying the 
corporation with non-audit services including a wide variety of financial and 
management consulting services. 164 However, SOXA does allow certain non­
auditing services to be performed by the same accounting firm subject to pre­
approval by the corporation's audit committee.165 

Auditor independence is also safeguarded by the requirement of audit 
partner rotation.166 To maintain a "fresh look'' with regard to the external 
auditing team, the SEC requires that audit partners, the persons who are 
primarily responsible for coordinating and overseeing the audit, be rotated to 
another assignment after five years of consecutive service with the same 
corporation. 167 SOXA provides a similar safeguard regarding independent 

162. SOXA § 204, 15 U.S.C. § 78j-l(k) (2004). Auditors must provide the audit com­
mittee with infonnation regarding all ac::countingprocesses to be employed during the audit, "all 
alternative treatments of financial information within generally accepted ac::counting principles 
that have been discussed with management officials" of the corporation, the consequences of 
utilizing such alternative treatments, which treatment is favored by the auditors, and finally, any 
substantial written communication between the auditors and the corporation's management 
regarding the audit. /d. 

163. /d. 
164. SOXA § 201, 15 U.S.C. §§ 78j-1(g)-(h). Prohibited non-auditing services include: 

services related to accounting records; ''financial information systems design and implementa­
tion; actuarial services; internal audit outsourcing services;" managerial duties; financial invest­
ment services; "legal services and expert services unrelated to the audit; and any other service 
that the [PCAO] Board determines, by regulation, is impermissible." /d. 

165. SOXA §§ 201-02, 15 U.S.C. § 78j-1 (g)-(i). Any non-auditing service not mentioned 
in§ 201 may be allowed but must be pre-approved by the corporation's audit committee. /d. 
Moreover, the specific services listed in§ 201 may be performed by a corporation's auditing 
team if the PCAOB determines that an exemption of such services is necessary for the protection 
of a corporation's shareholders or in the public's best interest. /d. The pre-approval 
requirement is waived if: 1) the total amount paid to the ac::counting firm for non-audit services 
does not exceed five percent of the compensation paid by the corporation to the accounting firm 
during the fiscal year; 2) the corporation did not consider the services to be non-auditing 
services at the time the accounting firm was hired to perform auditing services; and 3) such 
services are promptly reported to the corporation's audit committee and the committee approves 
such services prior to the completion of the audit. /d. 

166. SOXA § 203, 15 U.S.C. § 78j-l(j). 
167. /d. See also Strengthening the Commission's Requirements Regarding Auditor 

Independence, 68 Fed. Reg. 6006,6017 (Feb. 5, 2003); 17 C.F.R. § 210.2-0l(f)(7)(ii) (2004). 
The SEC defines an audit partner as a person "who is a member of the audit engagement team 
who has responsibility for decision-making on significant auditing, ac::counting, and reporting 
matters ..•. " 17 C.F.R. § 210.2-0l(f)(7)(ii). An audit partner includes lead or coordinating 



206 INDIANA HEAL1H LAW REvlEW [Vol. 1:175 

auditors: it is unlawful for an accounting firm to perform a financial audit of 
a corporation that has hired one of its former employees who ''participated in 
any capacity" in a previous audit of that corporation during the one year time 
period preceding the initiation of any subsequent audit.168 The SEC defines 
this one-year time lapse as a "cooling off' period in which any conflicts of 
interest could dissipate.169 

Vill. IMPUCATIONS FOR THE NONPROFIT HEALUICARE ORGANIZATION 

Just as the development of "corporate compliance" incentivized health­
care organizations to respond to specific concerns, such as billing matters, 
SOXA provides a similar incentive for entities to internally develop a 
governance compliance program. While SOXA principally relates to for­
profit, publicly-traded companies rather than nonprofits, 170 it can assist them 
in identifying issues of concern in order to develop an appropriate governance 
compliance program. Some of the specific suggestions that SOXA lends to 
non profits are set forth below. 

A. Expansion and Clarity of Conflicts of Interest Policies 

Conflicts of interest, both disclosed and undisclosed, were sources of 
some of the most serious charges raised in the HealthSouth proceedings. The 
IRS has underscored the importance of this issue for tax-exempt organizations 
since 1997 through its imprimatur on a sample conflicts of interest policy for 
adoption by governing boards. SOXA focuses on company loans to directors 
or executives of the company. However, the concerns of the multiple 
"constituency groups" that oversee, regulate, or otherwise hold a nonprofit 
organization accountable demonstrate a broader range of potential conflict 

partners, partners who perform a subsequent level of review ensuring that the audit complies 
with generally accepted accounting principles, and other partners "who provide more than ten 
hours of audit, review, or attest services in connection with the annual ... financial statements 
.... " Id. § 210.2-01(t)(7Xii)(C). 

168. SOXA § 206, 15 U.S.C. § 78j-1(/). See also U.S. Strengthening the Commission's 
Requirements Regarding Auditor Independence, 68 Fed. Reg. at 6008 n.32. Persons subject to 
the conflicts of interest provision include the lead partner, concurring partner, and any other 
person involved in the audit who has provided "more than ten hours of service during the audit 
period." Id. The lead and concurring partners of the auditing team ate not subject to the ten­
hour requirement; they are always subject to the conflicts of interest provision regardless of the 
amount of time spent on the audiL Id. The prohibited time period begins the day after the prior 
year's financial report to the SEC was filed and ends when the current year's report is filed with 
the SEC; hence, the "one year'' time period could actually be longer. ld. at 6009. 

169. ld. at6007. 
170. SOXA § 1107, 18 U.S.C. § 1513(e); see also discussion infra Part VIIT.F. 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPLICATIONS OF SOXA 207 

transactions. 171 The trend in nonprofit healthcare organizations to engage in 
business transactions and joint ventures with for-profit entities prompted the 
IRS to develop its conflicts of interest policy .172 The challenge for governing 
boards now is to extend their conceptual understanding of a "conflict" beyond 
the realm of such financial transactions. For instance, a board member or 
senior manager may present a conflict for the organization in meeting its 
community benefit obligations, or in satisfying a credentialing standard for a 
healthcare professional. A conflicts of interest policy must define the 
"interests" of the organization in sufficiently broad terms so that full disclo­
sures from decision makers can be secured. This will also help educate the 
governing board on its expanding responsibility for proper "corporate gover­
nance." 

B. Policies for Board Audit Committees 

SOXA contains several provisions directed at "independence" in the 
audit process. This was certainly an issue in the Enron and WorldCom set­
tings.173 An internal target for this concern in SOXA is a company's audit 
committee. SOXA requires that the audit committee members be independent 
of management and a compensation relationship (e.g., as a consultant) with 
the company. SOXA also raises the issue of competence by implying that a 
financial expert serves on the audit committee. 

SOXA squarely addresses the importance of an independent audit 
committee and the role it performs. While it may concentrate on the com­
pleteness and accuracy of financial statements, an audit committee for a non­
profit healthcare organization is faced with many other areas of inquiry and 
oversight. Examples of unique concerns for the nonprofit's governing board 
are loss of tax-exempt status and imposition of intermediate sanctions. 

Severe penalties for noncompliance in the billing, accreditation, or 
Medicare and Medicaid certification areas of operation reflect unique con­
cerns for the committee arising out of the healthcare field. Training in finan­
cialliteracy as well as corporate compliance will lead to increased recruitment 
burdens for the nonprofit organizations seeking broad community representa­
tion on its governing board. 174 These considerations will soon become the 
"best practices" and then the "standard of care" for finance and audit com­
mittees. Accordingly, nonprofit healthcare organizations will need to begin 
developing policies so that their committees meet these expectations. 

171. See BoardSource & Independent Sector, New Report Offers Nonprofits Guidance on 
the Sarbanes-Oxley Act (Oct. 10, 2003), at http://www.independentsector.org/media/ 
sarbanesoxleypr.html. 

172. See Brauer & Kaiser, supra note 80. 
173. See Michael W. Peregrine et al., The New "Corporate Responsibility" Law: How It 

Affects Health Care, 11 Health L. Rep. (BNA) 1231 (Aug. 22, 2002). 
174. See BoardSource & Independent Sector, supra note 171. 



208 INDIANA HEALTH LAW REVIEW [Vol. 1:175 

C. Evaluation and Use of Independent Auditors 

The independence of the outside auditor was an inevitable target of 
concern for SOXA. Several of the corporate scandals leading up to the 
passage of SOXA involved serious questions of independence. This has been 
a growing concern in recent years as accounting fmns developed a variety of 
consulting services to be "cross-marketed" to their audit clients. SOXA 
responded to these developments in two primary ways that have implications 
for nonprofit healthcare organizations. The first is the rotation of the audit 
firm's lead and reviewing partner (or the rotation of the audit firm itself) every 
five years. The second is a prohibition of the audit firm from providing a 
variety of non-audit services. 

Due to the limited number of accounting fums with expertise in the 
essential financial features of reimbursement for healthcare services as well 
as accounting practices for tax-exempt entities, the utilization of independent 
auditors may present special problems for nonprofit healthcare organizations. 
Using other organizations for consulting will reinforce the organization's 
commitment to avoiding conflicts of interest This will also provide "checks 
and balances" for the recommendations from consultants, who may primarily 
focus on revenue generation without consideration of the other "constituen­
cies" and purposes to be served by the nonprofit healthcare provider. 

D. Policies and Protocols for Financial Reports 

A key feature of SOXA is the requirement that a company's CEO and 
CFO certify the accuracy and fair presentation of the financial condition of the 
company when they sign the company's financial statements. Financial and 
criminal penalties add ''teeth" to this requirement This requirement is intend­
ed to assure the accuracy of financial reports in order to enhance the integrity 
of the financial markets for lenders and investors. Once again, nonprofit 
healthcare organizations must be concerned with a broader range of "consti­
tuency groups" aside from the investment community. 

Healthcare providers already face the possibility of severe financial and 
criminal repercussions threatened by regulatory agencies and other govern­
mental authorities. Exposure to civil and criminal penalties for the submission 
of false claims to third party payors serves the purpose of encouraging a 
healthcare provider's governing board to ensure the accuracy and complete­
ness of the financial systems and controls. Accuracy in Form 990s, which re­
quires the signature of an officer of the organization, is currently sporadic, but 
may become a source of additional individual or organizational liability. 175 As 

175. See id. 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPLICATIONS OF SOXA 209 

state attorneys general seek greater authority to oversee broad "community 
benefit" questions for nonprofit organizations, financial reports and tax returns 
will need to accurately disclose additional aspects of compliance. Ultimately, 
the governing board must develop policies and protocols for financial report­
ing and disclosure that address these growing concerns and potential 
liabilities. 

E. Procedures for Legal Counsel's Advice to Board and Management 

SOXA and the ABA are raising similar issues that may dramatically 
affect the role of legal counsel for, and their relationship to, the publicly­
traded, for-profit corporation. The focus of SOXA is to encourage an attorney 
for an organization to report a "material violation" of a state or federal law to 
the CEO or Chief Legal Officer in order to receive an "appropriate response." 
The ABA' s modification of the Rules of Professional Responsibility was 
intended to encourage attorneys to take action-that he or she reasonably 
believes is necessary to address illegal activity by or on behalf of the 
organization-when that activity is likely to result in substantial injury to the 
organization. Given the multitude of regulations, statutes, and accreditation 
standards applicable to healthcare organizations, these developments may 
present difficult and complicated implications. 

While these implications may appear drastic to others, "many health 
care lawyers are already sensitive to the manner in which compliance concerns 
are addressed by the client."176 The importance of this development was 
foreshadowed by the indictment of healthcare attorneys involved in drafting 
documents for a hospital system seeking a legitimate contractual relationship 
with referring physicians. 177 Government prosecutors seeking waivers of 
attorney-client privileges and regulatory agencies encouraging corporate 
compliance programs that result in self-reporting of wrongful acts are further 
examples of the disturbance of the "traditional" insulated attorney-client 
relationship for healthcare organizations. The nonprofit governing board will 
be required to develop reporting mechanisms that recognize and respond to the 
constriction of the privileged and confidential relationship, while facing 
increased exposure from many directions. 

F. Whistle-Blower Procedures and Protections 

Many states, whether by statute or court decisions, have extended 
protections to whistle-blowers. SOXA provides protection in the form of 

176. Peregrine, supra note 173, at 35. 
177. United States v. Anderson, 85 F. Supp. 2d 1047 (D. Kan. 1999), rev'd in part by 

United States v. McClatchey, 217 F.3d 823 (1Oth Cir. 2000), and affd in part by United States 
v. LaHue, 254 F.3d 900 (lOth Cir. 2001). 



210 INDIANA HEALTH LAW REviEw [Vol. 1:175 

criminal penalties against an organization that seeks to retaliate against a 
whistle-blowing employee who provides information about illegal activity to 
federal authorities. These penalties provide enforcement ''teeth" to arrange­
ments many healthcare organizations incorporate into their corporate 
compliance plans in which whistle-blowers can report violations anonymously 
and with assurances of non-retaliation. 

SOXA serves as an anticipated extension of the federal government's 
expectations under various model corporate compliance plans that have been 
published in recent years. Nonprofit healthcare organizations are burdened 
with standards and obligations from many sources, so the potential variety of 
whistle-blowers could become a large symphony. It is reasonable to anticipate 
that the standards currently imposed and enforced by regulatory agencies will 
serve as areas of protection for whistle-blowers in light of the increased 
expectation of corporate compliance and self-reporting programs. This is 
important since § 1107 of SOXA expressly prohibits any person or organiza­
tion, whether for-profit or nonprofit, from retaliating against an employee for 
providing truthful information to a law enforcement officer relating to the 
commission or possible commission of any federal offense.178 It is vital for 
the governing board to establish a culture of compliance, since retaliation is 
generally imposed by supervisors and senior management. In addition, it is 
also important for the governing board to establish a compliance committee 
on the board, with mechanisms for reporting and oversight. 

G. Document Management, Retention, and Production Policies 

One of the critical features of the Enron scandal relates to the destruc­
tion of internal financial and legal documents. Obstruction of an investigation 
has been an important criminal penalty in the arsenal of federal authorities. 
SOXA enhances this area of enforcement by making it a crime to alter, cover 
up, falsify, or destroy any document to prevent its use in any federal 
investigation or official proceeding. Healthcare organizations are currently 
subjected to concurrent or retrospective audits by third-party payors, 
government agencies, and accreditation organizations. Therefore, the avail­
ability of complete and accurate records is a significant priority. 

There is increased scrutiny of tax-exempt and healthcare organizations 
by agencies, authorities, and other interests desiring greater transparency, 
accessibility, and compliance. As a result, nonprofit governing boards will 
need to assess the sources of such oversight. Perhaps more challenging will 
be to anticipate what documents, reports, or other information these entities 
might want to review or inspect years in the future relative to the organiza­
tion's current activities. A document management and retention policy to 
respond to such retrospective evaluations is an important issue for the 

178. SOXA § 1107, 18 U.S.C. § 1513(e)(2004). 



2004] HEALTHCARE ORGANIZATIONS AND THE IMPliCATIONS OF SOXA 211 

governing board. The recent corporate scandals and the criminal enforcement 
features of SOXA in this area highlight the significance of the policy. 

IX. CONCLUSION 

It is inevitable that an organization's activities today will be retros­
pectively judged in the future through a lens that applies future standards. 
Members of governing boards for nonprofit healthcare organizations must be 
aware of that probability as they study the rapid changes taking place with 
respect to the standards and expectations for corporate governance. The 
public to be served has become more multifaceted, and the sources for 
accountability have increased. The consequences of ignoring one's duties on 
a board are increasingly complicated and threatening for the board member 
and the organization. 

Nonprofits should not view these various developments narrowly or in 
isolation. Rather, they should strive to understand the broader and deeper 
context of "corporate governance," so that the single legislative initiative 
represented by SOXA can be better appreciated. On its face, SOXA may be 
dismissed or given little attention since it only applies to for-profit, publicly­
traded corporations. However, in the broader context, as described in this 
Article, SOXA can and should be more fully appreciated as a catalyst of 
change, enhancing the responsibilities of the nonprofit healthcare organiza­
tion's governing board to meet the needs of its community. 

Gone are the days when a community leader can simply "show up" for 
periodic meetings and fund-raising events and fulfill his or her civic duty on 
the community hospital board. State and federal laws, regulations, and 
standards are undergoing significant changes, and high-profile scandals raise 
the political profile of governance issues, resulting in legislative enactments 
and oversight investigations. The nonprofit governing board of today needs 
to understand these developments and anticipate the scrutiny that both it and 
its organization will face tomorrow.