“The Roger Federer of Compliance” – Transcript
[INTRO/MUSIC PLAYING]
VERONICA CAREY
But we do have the ability to change the world.
PAUL FLANAGAN
In my world, I’ve never anticipated easy.
AROUTIS FOSTER
We’re also trying to change the paradigm.
CHARLES COOK
We’re more than just a collection of hammers and saws.
KRISTEN BETTS
It is such an exciting opportunity to really change brains.
JOE HANCOCK
We always lose touch with common things that everyone uses and where they come from.
MAURICE BAYNARD
Welcome to Drexel’s 10,000 Hours Podcast. Our goal is to mine the stories behind our region’s innovators, inventors, and thought creators. We’ll be talking to experts in subjects from fashion to neuroscience to find out where their passion for work and inspiration for ideas comes from. I’m your host, Maurice Baynard.
PAUL FLANAGAN
And law school wasn’t easy. And compliance hasn’t been easy. So I mean, in my world, I’ve never anticipated easy.
[MUSIC PLAYING]
MAURICE
That’s Paul Flanagan, assistant professor of law at Drexel University’s Thomas R. Kline School of Law and one of the first compliance specialists in the country. He’s held compliance- and privacy-related positions around the country and is published widely on these topics. He’s also, as I find out, a pretty great tennis player.
Yeah, I mean, at any time, I could just insert a “Paul Flanagan, welcome to the 10000 Hours.” But I’m not going to start there. We are going to start with competitive tennis because I’m super excited. So where’d you grow up in the US?
PAUL
I was born here in Philadelphia. But then my dad, who’s a physician, moved me because he had kind of a streak in him that he wanted to see the country, which isn’t your typical physician. He moved us to Arizona.
MAURICE
Wow. That’s a long way.
PAUL
It’s a long way. I moved all the way across the country to a little town called Prescott, Arizona, which is about– there was about 16,000 people there.
MAURICE
Did he move there because he was then going to be the one physician in Prescott?
PAUL
No. I think he went there because he had wanderlust. He became a doctor so he could call the shots and basically go where he wanted to go. It wasn’t that he wanted to start a practice and then get it big. He wanted to be able to see the world.
And as a physician, I think he had the opportunity to do that. And I think my dad’s wanderlust has always kind of followed me along because I think I got the same wanderlust.
MAURICE
So let’s do tennis.
PAUL
I would love to.
MAURICE
When did you get into tennis? When did you first pick up a racket?
PAUL
Oh, that’s a really– this is a good que– I was six years old. And my brother was a tennis player. And my sister was a tennis player. And I’m very competitive. I’ve always been competitive. Mostly competitive because they were older than me. And as a baby, you are always competitive with your brother and sister.
And they were always doing things. And I was always envious that they were out doing stuff. And so they were out playing tennis. And I’ll never forget. There was a store called Yellow Front. They bought me a wooden tennis racket.
And from there, I would just play against my sister, who was much better than me. She’s only two years older. But she used to beat the crap out of me. And my competition with her was I just wanted to beat her no matter what.
MAURICE
She’s placing balls with precision.
PAUL
And she’s hitting me, too.
MAURICE
–the court. Oh, wow. She’s hitting right at you.
PAUL
Yeah, and when the arguments would go–
MAURICE
What was the day that you beat your sister?
PAUL
Oh God. That was a wonderful day. It’s interesting. I can say this on the radio. But I went through puberty. And–
MAURICE
Oh, you got bigger.
PAUL
I got a little bigger.
MAURICE
Stronger and faster.
PAUL
I’m a guy. So I actually caught her. And I–
MAURICE
She didn’t know what was coming.
PAUL
And she didn’t know it was coming.
And I just started getting a little better. My serve was a little stronger. My forehand was a little bit stronger. And I eventually caught her. And I think I beat her 6-4. And she handled it well.
MAURICE
And that was the last day she played you.
PAUL
Things changed after that. They did.
MAURICE
Did you hit her with the ball?
PAUL
I did, actually.
MAURICE
Of course you did.
PAUL
I did. I chased her.
Yeah, we were 14 and 16. But there comes a point when you hit puberty where you realize that you’re bigger than your sister, and you stop.
MAURICE
So at your height, how good were you?
PAUL
I got pretty good. I got nationally ranked.
MAURICE
What was your state and national ranking? Let’s do it.
PAUL
You’re going to ask me that.
MAURICE
Let’s do it.
PAUL
I was number two in Arizona, number 17th in the southwest, and 122nd in the country. I love that. I’d get it on a plaque and just–
And thank you for asking that because I don’t think I’ve been asked that question in 20 years.
MAURICE
What was your first undergrad? Where’d you go?
PAUL
I went to a Catholic university in Washington DC. And that was an amazing experience. Again, man, I grew up in a small town.
MAURICE
–tennis team. Did you join?
PAUL
I was on track to go to a Division I school. I was on track to probably be a scholared tennis player playing on a tennis scholarship. And the goal of all tennis players is to go to Stanford. That’s where John McEnroe went.
But we moved to the East Coast when I was 16 and 1/2. And then you’re moving across country. I was going to a public school. And then I ended up going to a private school. I went to Malvern Prep. In Malvern Prep, everybody wore ties. I actually tucked my tie in. I didn’t know how to wear a tie because in Arizona, everybody is–
MAURICE
There’s no ties in Arizona.
PAUL
No, I had never wore a jacket in my life. So I even wore shorts to school occasionally. It was Arizona. So when I went out to [? Malvern ?] Prep, I tucked my tie in. And I was made fun of the day number two. I had no idea what I was in for.
But the competitor in me said, I am going to survive. First six weeks, I ate lunch in the cafeteria– I mean, in the library because I was just–
MAURICE
Because you didn’t know–
PAUL
I didn’t know anybody. No, I didn’t know anybody.
MAURICE
–know anybody.
PAUL
I didn’t know anybody.
MAURICE
It’s a really sad story. This has gotten very dark.
PAUL
No, the grit is that I pulled out. I made a lot of friends by– but what happened is I dropped tennis. I came out. And I dropped tennis. I think the only reason they accepted me is they found out my dad went to Georgetown. And I played tennis. So they accepted me.
MAURICE
You got him. We’ll take it.
PAUL
So I played tennis and did very well there. But when you’re in that competitive of a level, if you drop even six weeks, it’s over. You can’t stop. Just losing that edge enough was enough for me to say, I don’t think I’m going to do the Division I thing.
For me, you don’t do all this not thinking you’re going pro, right?
MAURICE
Right. That’s what you’re going to do.
PAUL
I mean, that’s what you’re going to do. From the time I was six, I thought I’m going pro. That’s it. I’m going to go pro. I’m going to go pro. And when we moved, I realized probably within six weeks that that wasn’t going to happen.
But then I transferred all that into let’s go to school. And so I picked a Division III school on purpose so that I would not be–
MAURICE
Tempted?
PAUL
–tempted– perfect word– because I think if I went to a Division I, I’d walk on. If I went to a Division III, I would think I’m too good for the Division III. And I would just ignore him.
MAURICE
This was you making a conscious decision that I’m not going to go pro. And to do that, I’m not even going to tempt myself with good players.
PAUL
I was all-in or all-out. And I went all-out. I just said, why am I going to go torture myself?
MAURICE
Was there one moment of regret?
PAUL
Yeah, oh yeah.
MAURICE
You’re just like, every day. Right now.
PAUL
No, I think there was two years of regret. The first girl I dated, when I was in college, didn’t understand why I was moody.
MAURICE
She’s like, why are there so many rackets in this room?
PAUL
We’re all freshman. We’re all moody. We’re going through life. But I was moody for another reason. And that reason was I should be at Stanford. Or I should be playing tennis somewhere.
And really, the first year was me just trying to figure out what this all meant because you have to realize, I mean, from the time I was six, I was preparing myself for this life that– and so I think the next eight years was me dealing with that. I needed another thing.
MAURICE
Another thing.
PAUL
Another thing.
[MUSIC PLAYING]
PAUL
When the law school popped in, I thought, now that one’s out of my reach. But I knew I had to do something. And so I put–
MAURICE
Did you know you could do it by the time you took the LSATs?
PAUL
No, no.
MAURICE
Interesting.
PAUL
I didn’t know I could do it until second year of law school.
MAURICE
[LAUGHING]. You’re like, I actually got in law school and still didn’t think–
PAUL
No, I’m sitting in law school. And I’m wondering, what the heck am I doing here? I’m competitive. But to me, when I went to law school, I’m like, OK, I’m back at [? Nationals ?] [? Tennis. ?] Nobody here has a weakness.
Everybody here is studying harder than you. Everybody’s taking this more seriously than you. And I’m going to have to go back to hitting 500 backhands and forehands a day just for me to compete to thrive in here. And it took me two years to really get my bearings in law school.
MAURICE
Right. So you figured it out. But you finished law school. And you still don’t just go out and hang a shingle, right? You don’t–
PAUL
That was–
MAURICE
Go get a client.
PAUL
I mean, basically the first day I graduated, I got a job at a hospital. And then–
MAURICE
How does that come about? How does a guy with a law degree get that hospital job?
PAUL
Well, I had such a chip on my shoulder about being a lawyer that I thought, well, my wife’s going to be the lawyer. And she already had a job. So I was going to do something in a hospital.
MAURICE
Right. You didn’t know what, but you could do something.
PAUL
Yeah. But I said I had to get a job.
MAURICE
Did you tell people you were a lawyer?
PAUL
No.
MAURICE
Oh, that’s great.
PAUL
I didn’t say–
MAURICE
–like, I have a degree.
PAUL
No, I was thrilled. I mean, I always thought that if– I kind of thought if I didn’t make it, no matter what, if I graduated, I can always say I’m a lawyer. And then I could go down to Mexico and fish and be a bartender. And then nobody would be able to say anything because if anybody said, well, you’re just a bartender. I’d be like, well–
MAURICE
No, actually, I’m a lawyer.
PAUL
Actually, I’m a lawyer. But I’m down here bartending. To me, that was my fantasy to go down there. But when I married my wife, who was top of her class, I’m like, oh, God, now I have to compete with her. And marriage does that.
MAURICE
You can’t just go become a bartender down in Cabo.
PAUL
Wives don’t like that.
MAURICE
She didn’t like that.
There are not a lot of wives that go, you don’t go to Cabo–
PAUL
No, she was not going for that. And she said, well, you have a master’s in hospital administration. You have a law degree. You’re not going to just become a bartender. You’re going to do something with that.
MAURICE
So you walk into a hospital. And they go, we’ve got a closet for you.
PAUL
I walked into a hospital and showed my degree. And I thought, I don’t know if anyone’s ever going to hire me. And there was this job working for the chief medical officer as a medical legal affairs. I mean, they were paying peanuts. But the good news on that was that–
MAURICE
But better than bartending.
PAUL
Better than bartending.
My wife’s OK with the fact that I got a job in a hospital. I’m not a practicing attorney. But I’m actually working in a hospital. And it was credentialing, which is– it was I would say bottom of the barrel. But it was an entry-level job.
But the good news– and I didn’t even know this because I had never really had a job before– was that I was working for the chief medical officer, which I now know is kind of a big deal.
MAURICE
Did you even know what that was or not?
PAUL
No idea–
MAURICE
Go ahead.
PAUL
All I knew is this– I got a job.
MAURICE
It was this guy.
PAUL
I came home–
MAURICE
I have a boss.
PAUL
Yeah, I have a boss. And I show up. And they took me into the room. And it was the suite. This is the neat story is that this suite– it was a big suite. It was a big glass doors. You walk in the glass doors. And straight ahead of you is the CEO’s office, chief executive officer. And to your right was the chief medical officer.
And then you go back down this hallway. And they open the door. And it was a closet. And they were able to put a desk in the closet. And my drawers couldn’t even come out. The drawers pull out just enough before you’ve got six inches of stuff to put in there.
But I was thrilled. I had a job. The good news is that every day I walked in, I would walk by the CEO’s office. He waved at me. I’d wave at him. And then I arranged golf tournaments. I did whatever for the doctors because this is credentialing. But it was credentialing in Gopher.
And my wife kept saying, well, you’re going to end up doing something with your law degree. I know you will. She was being funny. And she was being sarcastic at the same time.
MAURICE
As wives want to do.
PAUL
Yeah, she wasn’t. And I got it. She was pushing me a little bit. But I was just thrilled that I could run on her paycheck. She made fun of me because I used to stare at the paycheck at night.
MAURICE
Did you?
PAUL
Yeah, when I–
MAURICE
Like really?
PAUL
Yeah, because I never had a paycheck.
MAURICE
You’re like, this is amazing.
PAUL
I just stare at it.
MAURICE
You go. You do stuff. And then they pay you.
PAUL
Yeah, and after eight or nine hours, you’re like, wow. I did something.
MAURICE
Do you remember the first paycheck?
PAUL
Yeah. She laughs at me because I was laying in bed. And I just was looking at the blue paycheck and looking at the taxes that came out and looked at everything. I didn’t care. I just couldn’t believe that someone gave me money. And I was thrilled to have the job.
MAURICE
When did they move you out of the closet?
PAUL
So there was a moment there where compliance broke. And no one knew what this was. And–
MAURICE
What’s year are we talking?
PAUL
This is like 1996– 1995 actually.
I kept walking by the CEO. And we would chat. And he started to like me. And I liked him back. But he was kind of a rotund guy. And I think he enjoyed me because I think I was clueless. And when you’re clueless, you don’t know you’re supposed to be afraid of the CEO.
MAURICE
Right. Because you don’t even really know what he does.
PAUL
There was a certain kind of cluelessness that allowed me to not think of him other than a human being. And that really helped. Well, and this is the story. And this is right out of The Graduate. Do you remember The Graduate?
MAURICE
I do remember The Graduate.
PAUL
OK. So this is straight out of The Graduate.
So he puts his arm around me. He goes, Paul, one word.
And I said, what?
And he said, compliance.
And I said what everybody else said for the next five years, what’s compliance? And I said, what about it? I think I said, what is that? He said, that’s going to be the future. You need to get into it. I want you to put a presentation together.
And we’re going to start a new system. It’s called Allegiant Health. It was a 10-hospital system. And I want you to give a presentation to this newly formed board about being a compliance officer. And I said, OK. If I wasn’t the first, and I think I was, but if I wasn’t the absolute first, I was one of the first chief compliance officers in the country, having no idea what it was.
[MUSIC PLAYING]
MAURICE
So compliance has grown over time. So as technology has grown as what hospitals and organizations have to be thinking about in the world. And as more and more regulation, you’ve had to kind of evolve the–
PAUL
When I got involved, they said there was very few of us in 19–
MAURICE
We’re back in the ’90s.
PAUL
–’95, ’96. And I was part, very early on, at the compliance officer association. There was really about five or six of us at the time. And then it exploded.
MAURICE
So a really small national meeting.
PAUL
Yeah, now there’s 20,000.
MAURICE
So I think of something really recent. So it turned out that Uber got hacked. All of our personal Uber data got stolen. Then they paid the guys that hacked them to keep it quiet.
PAUL
Yeah, that’s interesting.
MAURICE
Right. To make a fix and also to keep it quiet– and when you hear that story, do you go, that’s an industry without a compliance officer?
PAUL
Yeah, I mean, I’m glad you mentioned. So compliance grew. And privacy was always the ugly stepsister. Nobody wanted to deal with privacy. And most compliance officers still don’t like privacy. But privacy’s gotten so big with its own set of teeth and that it’s exploded.
And it’s a subset of compliance. Everything’s a subset of complaints, though, isn’t it?
MAURICE
Right.
PAUL
So what we’re finding out in bringing to Uber story is this whole cyber world, cyber security, and all the cyber issues. Doesn’t it sound a little bit like the wild, wild west of compliance 20 years ago?
MAURICE
It does. Right.
PAUL
So I mean, it doesn’t take a rocket science for something, a light bulb to go off in my head. I’m like, oh, my God. You know what they need? They really kind of need a framework, a structure. They need something.
I know they do. They have the NIST standards and they all– I feel like they’re behind the eight ball all day long because the technology has grown so fast. The Internet of Things and our smartphones are basically– the more you read about hackers and cyber security and the cyber world out there, the more you panic because you realize that Facebook and the Amazons of the world– big data, they said, is the new oil.
MAURICE
And so back in the ’90s, early 2000s, it was easy to say, oh, as a doctor, you shouldn’t take a bunch of private medical records, stick them in your bag, and take them home to work on them. That’s unsecure. That’s a bad idea. You also shouldn’t be sitting at the table pointing out to your relatives like, look what this guy–
PAUL
Right. I mean, so the world’s come from me starting on in compliance where I would lecture. Or I would train physicians or anybody else to say, don’t take your medical record into Denny’s. And don’t leave it there.
MAURICE
Right, that’s a bad idea.
PAUL
Or at the salad bar as you’re eating your salad– don’t leave it there and go back to your thing. True story– actually happened.
MAURICE
Because that really happened.
PAUL
And another thing that really happened is when you throw the medical record in the dump without shredding it and it flies up in the air and lands on someone’s lap in a swimming pool– true story. We’ve come from there to–
MAURICE
Today, all that seems like common sense. And we have an expectation that no one’s going to do or behave in that way. And if you did, you’re just an idiot. You deserve to–
PAUL
Right. And now we come all the way to–
MAURICE
It’s on my laptop.
PAUL
It’s on your laptop. It’s on your phone.
MAURICE
It’s all on my phone. I walk around with it.
PAUL
And some part of what compliance is is the laws, rules, and regs putting policies in place. And some of the policies that are outdated are when you say, do not be on your cell phone. Don’t take pictures on your cell phone. Don’t be on your cell phone as you walk around the hospital.
Well, that’s an outdated policy because the reality is everybody’s using their cell phone, right? So we’re either going to keep telling people, don’t do that. Don’t do that. Meanwhile, right in front of me, everybody’s going to walking around with their cell phone, right? They’re using it.
Are you going to tell a 27-year-old medical student or a doctor now not to use them? No, they all do. Not only do they use it, they take pictures with it. And there’s patient identifiable information on it.
MAURICE
My patient is on that photo.
PAUL
And that’s great. If your phone’s encrypted, that’s wonderful.
MAURICE
But no one’s phone’s encrypted.
PAUL
But you just sent it somewhere, right?
MAURICE
Yeah.
PAUL
Do I know that that’s encrypted? Do I know where that is? You basically just sent it out to the world. So how is the compliance officer– am I supposed to– how can I tackle that? So that’s why this is the wild, wild west right now.
MAURICE
I mean, is the answer just to stop thinking about everything being so private and to think that when you’re born into the world now, everybody knows everything about you?
PAUL
I think you’re getting to the issue. I think that’s really what we have to come to grips with about privacy. How do we view privacy? And what do we want to do to protect our privacy? How private are we if we’re putting everything on the internet?
MAURICE
Have we gone too far? Can we go back to being private people?
PAUL
Well, this is kind of where I’m at actually in my career. I’m looking at how do I bring all of my– the 23 years of compliance and the 20 years of tennis into my world of how do I tackle this new particular area that seems to be falling somewhat– or a parallel or something related to compliance. How do you address it?
And I think a framework needs to be involved, not a framework to solve it but a framework to corral it and to address it, to deal with it. Educating– some sort of risk management type of thing where you’re dealing with risk so that people are aware, hey, when you get that email that doesn’t look quite right, don’t click on it. Or if you think it’s funny, don’t do it.
But unless you train– and that’s what I learned in compliance of one of the elements of compliance is training. Unless you train people, is that going to solve it? No. But again, like compliance, are you able to be compliant with everything? No. But you’re putting a framework in place to at least–
MAURICE
What question–
PAUL
Otherwise, you give up. And I don’t think that’s the answer here. With my job or just–
–with regard to– yeah. [INAUDIBLE].
No.
MAURICE
This could go far and wide. Yeah, specifically–
PAUL
There again with the issue– in law school, I always wanted to know the why. I am always wanting to know the why. And so if somebody would just say, why to me, I think I can nail it by saying because it’s the right thing to do, right? It’s the right thing to do.
So why? Why are you doing this? I mean, why is this in your– you’re going to get all the other reasons. And you can poo poo it all you want. But at the end of the day, it is the right thing to do, isn’t it?
MAURICE
Yeah.
PAUL
I mean, truly– I mean, to be compliant, it’s a good thing. And I’ve been with other people that got it. And they always called it– they preached it as the good news of compliance, not the bad news.
And I think too many not-so-good compliance officers walk in with a club. And they say, no. And they’re angry. And they’re, I got you. I’ve never been that route. My route is even when the person says, you going to be able to work with us? I know what they meant.
But I also know what I meant. And what I meant was of course. I’m always trying to build bridges. I’m not here to put up a wall. I’m a bridge maker.
MAURICE
Paul Flanagan, thank you so much.
PAUL
Thank you. Thank you. You were great. I enjoyed this very much, more than I even realize.
PAUL
The 10000 Hour podcast is powered by Drexel University Online.
[MUSIC PLAYING]