Editor's note: This is the second in a two-part series.

While health care headlines focus on the implementation of Obamacare's individual mandate and establishment of insurance exchanges, the landmark legislation also is going to affect long-term care for older Americans.

Medicare- and Medicaid-certified nursing facilities must have had compliance and ethics programs in place by March, but regulations are still forthcoming.

Compliance programs for the health industry are not a new thing, said Susan V. Kayser, a partner with Duane Morris' New York office who chairs the long-term care and senior services subgroup of that firm's health law practice. The U.S. Department of Health and Human Services' Office of the Inspector General issued guidance in the 1990s for compliance programs on the basis of the federal sentencing guidelines, she said. New York is the first state to require Medicaid providers to have a compliance plan, she also added.

"I suspect that by and large, most nursing homes until earlier this year may not have had one," Kayser said. "And now they are required to have one."

Due to the fact the Centers for Medicare and Medicaid Services has not yet issued the regulations that would put the meat on the skeleton of the Affordable Care Act, "you have a legal requirement to have a compliance program with no real governing regulations," said consultant David Hoffman, whose firm works on compliance programs for nursing homes and is a former federal prosecutor who specialized in health care fraud and abuse.

But while there is a lot of angst among smaller facilities that compliance programming will be unaffordable, Hoffman said that effective compliance programs can be built without prohibitive cost in smaller buildings.

William J. Mundy, a Harrisburg attorney who is co-chair of Burns White's health care and professional liability group and who has a longtime practice focusing on long-term health care legal issues, said this is not the first time that health laws have stalled while waiting upon CMS to roll out regulations.

"The thing about laws is when they're passed, they have laudable goals and policies behind them," Mundy said. "The devil is in the details; in this case, the regs."

Compliance with the regulations is essential for long-term care facilities because 90 to 95 percent of funding is through Medicare or Medicaid, and receiving such funding is contingent upon complying with all regulations, Mundy said.

Paula G. Sanders, a Harrisburg attorney who is chair of Post & Schell's health care practice group, including long-term care legal issues, said prior to Obamacare, the federal approach was always that compliance programs were advisable, but discretionary.

Until the regulations are in place, CMS can't kick facilities out of the Medicare program, Sanders said, but not having a compliance program in place could impact how the U.S. Department of Justice and the OIG view a facility in determining sanctions and culpability.

"We do not recommend facilities sit back on their heels waiting for CMS to issue regulations," Sanders said.

Under the new law, compliance and ethics programs must have eight components, including assigning high-level personnel to have responsibility and sufficient resources to ensure compliance, to communicate the compliance standards to employees, and mechanisms like reporting systems to correct noncompliance.

It is not yet clear what the consequences will be for not having compliance programs or not following all of the compliance rules, Kayser said, but it could involve terminations from the Medicaid or Medicare programs.

While long-term care facilities may try to make more money by understaffing their facilities, they face the risks of violating their compliance requirements, of being found guilty of health care fraud, of having to pay large jury verdicts and, most importantly, of putting residents in harm's way, Hoffman said.

One area that is not clearly delineated yet, Hoffman said, is the oversight by a corporation's board of directors of compliance.

Under the premise that compliance is a top-down initiative, the board of directors must send the message that its facilities are compliant with care and financial processes, Hoffman said, and the board needs to hear regularly on why compliance is or is not occurring.

The best practice would be for compliance officers to report directly to the board and not go through third parties, and every board meeting should have compliance on the agenda, Hoffman said.

The new law has more teeth than prior guidance issued by OIG by requiring that a high-level person in a nursing home not only have responsibility, but resources and the authority to ensure compliance, Sanders said.

Compliance officers must "not be given a title without authority," Sanders said.

Obamacare also has an increased emphasis on ensuring that the workforce within a nursing home can report concerns without fear of retribution or retaliation, Sanders said.

Since nurses' aides deliver 95 percent of the care in the long-term care industry, they must be integrated completely into the compliance programs and feel confident that they can come forward with concerns, Hoffman said.

The measure also is requiring for the first time that the long-term care industry periodically assess the effectiveness of its compliance programming, Sanders said.

The ACA has moved "from a static, 'Here's your compliance manual,' to 'Is compliance integrated into your day-to-day operation?'" Sanders said.

Another big issue in the new compliance regime is the falsification of records, Hoffman said. Integrity in the recordkeeping of events that are reportable to regulators "should be something of paramount importance" in compliance programs, Hoffman said.

While there are many details to be worked out on how compliance programs will be rolled out in the long-term care industry, lawyers said that the programs will benefit patient safety.

"A compliance plan can be a really good thing," Kayser said. "It allows a nursing home … to have reporting systems that will allow possible failures, possible irregularities, questions about what's proper, to be addressed before the problem gets bigger and before auditors come in from the outside and say, 'You have a problem.'"

There are silos in the long-term-care industry, Hoffman said, with quality assurance people and the financial teams and the operational managers separated from each other. But, "the compliance threads should go through all of them," Hoffman said. "That's why an effective compliance program … has quality assurance people on the [compliance] committee along with administrative and senior leadership."

When compliance programs came onto the health care scene, there were "precooked" programs that looked solely at billing issues, Sanders said.

But such programs won't be sufficient to meet the rigors of the ACA, Sanders said.

"The new requirements are really looking for a living, breathing and flexible program," Sanders said.