Site Overlay

OIG Self-Disclosure Protocol

By support@poweredbygnosis.com

Why Self-Disclosure Is Important

The OIG has long emphasized the importance of dealing with Federal healthcare programs with integrity. All healthcare industry members have a legal and ethical duty to do so.

This duty includes an obligation to detect and prevent fraudulent and abusive activities, including implementing specific procedures and mechanisms to investigate and resolve instances of potential fraud involving the Federal health care programs.

Whether as a result of voluntary self-assessment or in response to external forces, participants in the healthcare industry must be prepared to investigate such instances, assess the potential losses suffered by the Federal healthcare programs, and make full disclosure to the appropriate authorities.

Benefits of Disclosure

The OIG recognizes that whether to disclose potential fraud to the OIG is a significant decision. However, there are substantial benefits to disclosing potential fraud to the OIG that should make that decision easier.

First, good faith disclosure of potential fraud and cooperation with the OIG’s review and resolution process indicates a robust and effective compliance program.

As a result, the OIG has instituted a presumption against requiring integrity agreement obligations in exchange for releasing the OIG’s permissive exclusion authorities in resolving an SDP matter.

Second, the OIG believes that persons who use the SDP and cooperate with OIG during the SDP process deserve to pay a lower multiplier on single damages than would usually be required in resolving a Government-initiated investigation. The specific multiplier accepted may vary depending on the facts of each case.

The OIG’s general practice in CMP settlements of SDP matters is to require a minimum multiplier of 1.5 times the single damages. However, the OIG determines whether a higher multiplier may be warranted in each case.

Third, the OIG believes using the SDP may mitigate potential exposure under section 1128J(d) of the Act, 42 US Code 1320a-7k(d).

Section 1128J(d)(2) of the Act requires that a Medicare or Medicaid overpayment be reported and returned by the later of:

  • (1) the date that is 60 days after the date on which the overpayment was identified or
  • (2) the date any corresponding cost report is due, if applicable.

Any overpayment retained by a “person,” as defined in section 1128J(d)(4)(C) of the Act, after this deadline may create liability under the Civil Monetary Penalties Law (CMPL), section 1128A of the Act, and the False Claims Act (FCA), 31 US Code 3729.

In its Final Rule, 81 Fed. Reg. 7654–7684 (February 12, 2016), the Centers for Medicare & Medicaid Services (CMS) agreed to suspend the obligation to report overpayments under section 1128J(d) of the Act when the OIG acknowledges receipt of a submission to the SDP so long as the submission is timely made.

CMS also agreed to suspend the obligation to return overpayments until a settlement agreement is entered or the person withdraws or is removed from the SDP.

Finally, the OIG commits to working with persons who use the SDP in good faith and cooperate with the OIG’s review and resolution process.

The OIG created the SDP to provide a specific and detailed process that can be relied upon by all healthcare industry participants, which the OIG will consistently follow.

As part of this commitment, the OIG streamlined its internal process to reduce the average time a case is pending with OIG to less than 12 months from acceptance into the SDP.

To further facilitate timely resolutions of SDP matters, the OIG changed the timeframe for submitting the findings of the completed internal investigation.

The damages calculation is 90 days from acceptance into the SDP and 90 days from the initial submission date.

Who May Use the SDP

All healthcare providers, suppliers, or other persons subject to OIG’s CMP authorities found at 42 CFR Part 1003 are eligible to use the SDP.

The SDP is not limited to any particular industry, medical specialty, or type of service.

For example, a pharmaceutical or medical device manufacturer may use the SDP to disclose potential violations of the Federal anti-kickback statute (AKS), section 1128B(b) of the Act, because such violations trigger CMP liability under section 1128A(a)(7) of the Act, a provision of the CMPL.

For purposes of the SDP, the OIG refers to all persons who submit the SDP as “disclosing parties.”

The disclosing party should disclose conduct for which it may be liable, including potential successor liability based on its purchase of another entity.

For example, a disclosing party could have liabilities due to a merger or an acquisition. However, disclosing parties should not use the SDP to reveal the conduct of another unrelated party.

The OIG’s hotline should be used to report potential misconduct of other parties (1-800-HHS-TIPS or https://oig.hhs.gov/fraud/report-fraud/index.asp).

Disclosing parties already subject to a Government inquiry (including investigations, audits, or other oversight activities) are not automatically precluded from using the SDP.

The disclosure, however, must be made in good faith and must not be an attempt to circumvent any ongoing inquiry.

Disclosing parties under Corporate Integrity Agreements (CIAs) may use the SDP.

The disclosure must reference that the disclosing party is subject to a CIA, and the disclosing party must send a copy of the disclosure to the disclosing party’s OIG monitor.

Disclosures that are Reportable Events as defined by the CIA must also be disclosed to the OIG, as required by the CIA.

Conduct Eligible for the SDP

The SDP is available to facilitate the resolution of matters that, in the disclosing party’s reasonable assessment, potentially violate Federal criminal, civil, or administrative laws for which CMPs are authorized (if your disclosure relates to an HHS grant or contract, however, please see the OIG’s resources on self-disclosures on its website).

In disclosing, a disclosing party must acknowledge that the conduct is a potential violation. Disclosing parties must explicitly identify the potentially violated laws and should not refer broadly to, for example, “Federal laws, rules, and regulations” or “the Social Security Act.”

The OIG has found that disclosing parties who avoid acknowledging that there is a potential violation are more likely to have unclear or incomplete submissions or unrealistic expectations about resolutions, which result in a lengthier review and resolution process.

In addition, statements such as “the Government may think there is a violation, but we disagree” raise questions about whether the matter is appropriate for the SDP.

The resulting back-and-forth over these issues can create unnecessary delays in resolving and may result in the disclosing party’s removal from the SDP.

Conduct Ineligible for the SDP

First, the SDP is not available for a matter that does not involve potential violations of Federal criminal, civil, or administrative law for which CMPs are authorized, such as one exclusively involving overpayments or errors. The matter should be disclosed to the appropriate CMS or responsible contractor under the payor’s voluntary refund process.

Second, the SDP is not available to request an opinion from OIG regarding whether an actual or potential violation has occurred.

For example, a disclosure that broadly describes a business arrangement and requests a determination from the OIG regarding whether the arrangement violates the AKS is inappropriate for the SDP.

The advisory opinion process is the only way to obtain an OIG opinion, as described at https://oig.hhs.gov/compliance/advisory-opinions/index.asp.

Third, the SDP cannot disclose an arrangement that involves only liability under the physician self-referral law, section 1877 of the Act (the Stark law), without accompanying potential liability under the AKS for the same arrangement.

Disclosing parties must analyze each arrangement involving a physician to determine whether it raises potential liability under the AKS, the Stark law, or both.

Stark-only conduct should be disclosed to CMS through its Self-Referral Disclosure Protocol (SRDP), which can be found at: http://www.cms.gov/PhysicianSelfReferral/.

The OIG reserves the right to determine whether an arrangement is appropriate for resolution in the SDP.

Fourth, the SDP is not available for conduct more appropriately disclosed through the OIG’s Grant Self-Disclosure Program or the OIG’s Contractor Self-Disclosure Program.

Visit the OIG Grant Self-Disclosure webpage (https://oig.hhs.gov/compliance/self-disclosureinfo/grant.asp) and the OIG Contractor Self-Disclosure webpage (https://oig.hhs.gov/compliance/self-disclosure-info/contractor.asp) for more information.

Tolling the Statute of Limitations

As described above, one of the benefits of disclosure is that CMS has proposed that the time for repayment of an identified overpayment under section 1128J(d) of the Act will be tolled for the disclosing party.

To preserve the rights of the parties while the matter is being resolved through the SDP, the OIG expects disclosing parties to disclose with a good faith willingness to resolve all liability within the CMPL’s 6-year statute of limitations as described in section 1128A(c)(1) of the Act.

Accordingly, the disclosing party agrees, as a condition precedent to the OIG’s acceptance into the SDP, to waive and not to plead the statute of limitations, laches, or any similar defenses to any administrative action filed by the OIG relating to the disclosed conduct, except to the extent that such defenses would have been available to the disclosing party had an administrative action been filed on the submission date.

Corrective Action

Before disclosure, the disclosing party should ensure that the conduct has ended or, at least, in the case of an improper kickback arrangement, that corrective action will be taken, and the inappropriate arrangement will be terminated within 90 days of submission to the SDP.

Additionally, all other necessary corrective actions should be complete and effective at the time of disclosure.

Requirements for All Disclosures

The disclosing party is expected to conduct an internal investigation and report its findings to the OIG in its submission.

If the disclosing party cannot complete its internal investigation before submitting. In that case, the disclosing party must certify in its submission that it will complete the internal investigation within 90 days of its initial submission date.

Disclosures must be submitted through the OIG’s Web site at https://oig.hhs.gov/compliance/self-disclosure-info/provider-self-disclosure-protocol/.

The submission must include:

  1. The name, address, type of health care provider, provider identification number(s), and tax identification number(s) of the disclosing party and the Government payors (including Medicare contractors) to which the disclosing party submits claims or a statement that the disclosing party does not submit claims.
  2. If the disclosing party is an entity that is owned or controlled by or is otherwise part of a system or network, an organizational chart, a description or diagram describing the pertinent relationships, the names and addresses of any related entities, and any affected corporate divisions, departments, or branches.
  3. The name, street address, phone number, and email address of the disclosing party’s designated representative for purposes of the voluntary disclosure.
  4. A concise statement of all details relevant to the conduct disclosed, including, at minimum, the types of claims, transactions, or other conduct giving rise to the matter; the period during which the conduct occurred; and the names of persons believed to be implicated, including an explanation of their roles in the matter.
  5. A statement of the Federal criminal, civil, or administrative laws that are potentially violated by the disclosed conduct.
  6. The federal healthcare programs that were affected by the disclosed conduct.
  7. An estimate of the damages, as described in the applicable section below, to each Federal health care program relevant to the disclosed conduct or a certification that the estimate will be completed and submitted to the OIG within 90 days of the submission date. This estimate should identify the total estimated damages amount for each affected Federal healthcare program and the sum of estimated damages for all affected Federal healthcare programs. When a disclosing party can determine the actual damages to Federal health care programs, the actual damages amount must be provided instead of an estimate.
  8. A description of the disclosing party’s corrective action upon discovering the conduct.
  9. A statement of whether the disclosing party knows the matter is under current inquiry by a Government agency or contractor. If the disclosing party knows of a pending inquiry, it must identify any involved Government entity and its representatives. The disclosing party must also disclose whether it is under investigation or any other inquiry for any other federal health care program matters and provide similar information about those other matters.
  10. The name of an individual authorized to enter into a settlement agreement on behalf of the disclosing party.
  11. A certification by the disclosing party or, in the case of an entity, an authorized representative on behalf of the disclosing party, stating that to the best of the individual’s knowledge, the submission contains truthful information and is based on a good-faith effort to bring the matter to the Government’s attention to resolve potential liability to the Government and to assist the OIG in its resolution of the disclosed matter.

Requirements for Conduct Involving False Billing

When a disclosure involves submitting improper claims to Federal healthcare programs, the disclosing party must conduct a review to estimate the inappropriate amount paid by the Federal healthcare programs (referred to as “damages”) and prepare a report of its findings.

The OIG will verify a disclosing party’s calculation of damages.

The disclosing party’s estimation of damages must consist of a review of either:

  • (1) all the claims affected by the disclosed matter or
  • (2) a statistically valid random sample of the claims that can be projected to the population of claims affected by the matter.

A disclosing party may not extend the time to resubmit claims to Federal health care programs through the SDP; therefore, the damages estimation must not include a reduction or “netting” for any underpayments discovered in the review.

When estimating damages, the disclosing party must use a sample of at least 100 items and the mean point estimate to calculate damages.

If a probe sample was used, those claims may be included in the 100-item sample if statistically appropriate.

The SDP does not require a minimum precision level to review claims to avoid unreasonably large sample sizes.

As a result, the disclosing party may select an appropriate sample size to estimate damages if the sample size is at least 100 items.

As a general rule, smaller sample sizes (closer to 100) will suffice where the population has a high homogeneity, and larger sample sizes will be necessary where the population contains a more diverse mixture of claim types.

The disclosing party should remember that a careful and complete definition of the population will assist in making accurate findings.

If the financial review was based on a sample, the review report must also include the sampling plan that was followed.

The disclosing party’s report must include, at a minimum, the following information:

  1. Review Objective: A statement clearly articulating the objective of the review.
  2. Population: A description of the group of claims about which information is needed, an explanation of the methodology used to develop the population, and the basis for this determination.
  3. Sources of Data: A complete description of the source of the data reviewed and the information upon which the review was based, including the sources of payment data and the documents that were relied upon.
  4. Personnel Qualifications: The names and titles of the individuals who conducted the review. The review should be undertaken by qualified individuals, e.g., statisticians, accountants, auditors, consultants, and medical reviewers, and the review report should describe their qualifications.
  5. Characteristics Measured: The review report should identify the factors used for testing each item. For example, in a review designed to estimate the value of overpayments due to duplicate payments, the characteristics used are those that must exist for an item to be a duplicate. The amount of the duplicate payment is the measurement of the overpayment. The report must also explain the method for determining whether an item entirely or partially meets the criterion for measuring the characteristics.

If the financial review was based on a sample, the review report must also include the sampling plan that was followed. At a minimum, this includes:

  1. Sampling Unit: Any designated elements that constitute the population of interest.
  2. Sampling Frame: The totality of the sampling units from which the sample was selected and how the audit population differs from the sampling frame (and the effect this difference has on conclusions reached as a result of the audit).
  3. Sample Size: The size of the sample reviewed to reach the estimate of the damages. The sample size must be at least 100 claims.
  4. Source of Random Numbers: The sample must be selected through random numbers. The source of the random numbers used must be shown in the report. We strongly recommend using the OIG’s Statistical Sampling Software, also known as ‘‘RAT-STATS,’’ currently available free of charge at https://oig.hhs.gov/compliance/rat-stats/index.asp.
  5. Method of Selecting Sampling Units: The process for selecting the sample units.
  6. Sample Design: The review should use simple random sampling unless the disclosing party demonstrates the need to use a different sample design. If necessary, the disclosing party may use stratified or multistage sampling. The review report should include strata, stages, and cluster details.
  7. Missing Sample Items and Other Evidence: If the review was based on a sample, missing sample items should be treated as errors under Federal health care program rules requiring retaining supporting information for submitted claims. Missing sample items should be noted in the report. The report must also describe any evidence, other than the sample results, considered in arriving at the review results.
  8. Estimation Methodology: If the review was based on a sample because the general purpose of the evaluation is to estimate the monetary losses to the Federal health care programs, the methodology to be used must be variables sampling (treating each item in the population as a sampling unit) using the difference estimator (estimates of the total errors in the population are made from the sample differences by multiplying the average audited difference by the number of units in the population).

Requirements for Conduct Involving Excluded Persons

Many SDP submissions disclose employment or contracting with persons that appear on the OIG’s List of Excluded Individuals and Entities (LEIE).

The OIG provides additional guidance to help disclosing parties gather the necessary information for a complete disclosure.

In addition to providing the general information required, the disclosure must provide the following information:

  1. The identity of the excluded person and any provider identification number.
  2. The job duties performed by that person.
  3. The dates of the person’s employment or contractual relationship.
  4. A description of any background checks the disclosing party completed before and/or during the person’s employment or contract.
  5. A description of the disclosing party’s screening process (including any policy or procedure in place) and any flaw or breakdown in that process that led to the hiring or contracting with the excluded person.
  6. A description of how the conduct was discovered.
  7. A description of any corrective action (including a copy of any revised policy or
  8. procedure) implemented to prevent future hiring of excluded persons.

In addition, before disclosing the employment of an excluded person, a disclosing party must screen all current employees and contractors against the LEIE. Once this has been done, the disclosing party should disclose all excluded persons in one submission.

Requirements for Conduct Involving the Anti-Kickback Statute and Physician Self-Referral Law

Another large category of SDP submissions relates to potential violations of the AKS (including conduct that violates both the AKS and the Stark law).

Any disclosure must acknowledge that the disclosing party’s reasonable assessment of the information available at the time of the disclosure and the subject arrangement(s) constitutes potential violations of the AKS and, if applicable, the Stark law.

Some disclosing parties have previously failed to include this acknowledgment in their submissions to the SDP. In contrast, others have phrased their acknowledgments as suggestions that OIG could view the disclosed conduct as potential violations.

The OIG will not accept any disclosing party into the SDP that fails to acknowledge clearly that the disclosed arrangement constitutes a possible violation of the AKS and, if applicable, the Stark law.

As with other self-disclosed conduct, the OIG needs to understand the precise nature of the disclosed conduct that creates potential AKS liability or both AKS and Stark law liability.

Therefore, the disclosing party must include in its narrative submission (not by reference to attachments or other documents) a concise statement of all details directly relevant to the disclosed conduct and a specific analysis of why each disclosed arrangement potentially
violates the AKS and Stark law.

The description should include the participants’ identities, their relationship to one another to the extent that the relationship affects their potential liability (e.g., hospital-landlord, referring physician-tenant), the payment arrangements, and the dates for each suspect arrangement.

Further, the disclosure should explain the relevant context and the arrangement features that raise potential AKS or both AKS and Stark law liability.

Below are several examples of the type of information the OIG finds helpful in assessing and resolving disclosed conduct involving potential AKS and, if applicable, Stark law violations. These illustrations are not comprehensive or exclusive; instead, they reflect some common issues that have arisen in SDP submissions.

  1. How was fair market value determined, and why is it now in question?
  2. Why were required payments from referral sources, under leases or other contracts, not made or collected promptly, or did not conform to the negotiated agreement, and how long did such lapses exist?
  3. Why was the arrangement arguably not commercially reasonable (e.g., lacked a reasonable business purpose)?
  4. Whether payments were made for services not performed or documented and, if so, why.
  5. Whether referring physicians received payments from Designated Health Service entities that varied with, or took into account, the volume or value of referrals without complying with a Stark law exception. Finally, the submission must describe the corrective action taken to remedy the suspect arrangement(s) and any safeguards implemented by the disclosing party to prevent the conduct from reoccurring.

Resolution

The resolution of a matter in the SDP depends on cooperation, realistic expectations, and clear communication between the OIG and the disclosing party.

Cooperation Is Essential

The benefits of self-disclosure, such as a speedy resolution, lower multiplier, and an exclusion release without integrity agreement obligations, depend on the disclosing party’s willingness to work cooperatively with the OIG throughout the process.

Cooperation includes, for example, conducting a thorough investigation, submitting all necessary information, communicating through a consistent point of contact, being responsive to the OIG requests for additional information, and being willing to pay a penalty or multiplier of damages for self-disclosed conduct.

Disclosing parties who fail to cooperate with the OIG in good faith will be removed from the SDP.

OIG Coordination With DOJ

The OIG will coordinate with the Department of Justice (DOJ) to resolve SDP matters. If the OIG is the sole agency representing the Federal Government, the matter will be settled under the OIG’s applicable CMP authorities.

In some cases, the DOJ may choose to participate in the settlement of the matters, and in other instances, disclosing parties may request release under the FCA.

If the DOJ participates in the settlement, the matter will be resolved as it determines is appropriate and consistent with its resolution of FCA cases, which could include a calculation of damages resulting from violations of the AKS based on paid claims.

The OIG will advocate that the disclosing party receive a benefit from disclosure under the SDP and that the matter be resolved in a manner consistent with the OIG’s approach in similar cases. However, the DOJ determines the approach in cases in which it is involved.

The OIG also coordinates with the DOJ on disclosures involving potential criminal conduct.

The OIG’s Office of Investigations investigates criminal matters, and any disclosure of criminal conduct through the SDP will be referred to the DOJ for resolution.

OIG Coordination With the SRDP

Disclosing parties must decide whether the OIG’s SDP or CMS’s SRDP is the appropriate protocol to disclose potential Stark law violations. Both protocols should not be used for the same arrangement.

As stated above, disclosing parties must analyze each arrangement to determine whether the arrangement raises potential violations of the AKS, the Stark law, or both.

If the arrangement raises a potential violation of only the AKS or of both the AKS and the Stark law, the arrangement should be disclosed to the OIG under the SDP.

If the arrangement raises a potential violation of only the Stark law, the arrangement should be disclosed to CMS under the SRDP.

The OIG coordinates with CMS on reviewing and resolving matters disclosed to either agency as appropriate. However, the OIG does not participate in SRDP settlements.

Minimum Settlement Amounts

While OIG does not demand an admission of liability in settlement agreements, disclosing parties should expect to pay above single damages for disclosed conduct that potentially violates Federal law.

The OIG’s general practice requires a minimum multiplier of 1.5 times the single damages, although we determine whether a higher multiplier is appropriate in each case.

As a general practice, for settlement purposes in the SDP, the OIG applies this multiplier to the amount paid by federal health care programs, not the amount claimed.

The OIG requires a minimum settlement amount for self-disclosed matters to allocate better-disclosing parties and OIG resources in resolving issues through the SDP and to promote transparency and realistic expectations in the SDP process.

For kickback-related submissions accepted into the SDP, OIG will require a minimum $100,000 settlement amount to resolve the matter.

This minimum amount is consistent with OIG’s statutory authority to impose a penalty of up to $100,000 for each such transaction and an assessment of up to three times the total remuneration.

See section 1128A(a)(7) of the Act. For all other matters accepted into the SDP, OIG will require a minimum $20,000 settlement amount to resolve the matter.

This minimum amount is consistent with OIG’s statutory authority to impose a penalty of up to $20,000 for each improper claim submitted as described in the CMPL, section 1128A(a) of the Act.

These minimum amounts account for damages to the federal health care program and any relevant multiplier.

Section 50412 of the Bipartisan Budget Act of 2018 (BBA) amended the CMPL to increase specific civil money penalty amounts contained in 42 US Code 1320a-7a(a) and (b).

Regarding the SDP, the BBA increased maximum civil money penalties in section 1128A(a) of the Act (42 US Code 1320a-7a) for false claims from $10,000 to $20,000 and for kickback-related conduct from $50,000 to $100,000

In the unusual instance when the OIG determines that no potential fraud liability exists for conduct disclosed under the SDP, the OIG will refer the matter to the appropriate payor for acceptance of the overpayment, and no CMP release will be provided.

Financial Inability To Pay

In some situations, disclosing parties may be unable to pay otherwise appropriate settlement amounts. In preparing the disclosure, disclosing parties should determine whether an inability to pay may be an issue.

Suppose a disclosing party asserts it cannot pay a proposed settlement amount (i.e., damages plus a multiplier or penalty amount). In that case, OIG will require extensive financial information, including audited financial statements, tax returns, and asset records.

Disclosing parties must certify the truthfulness and completeness of the financial disclosure. In addition to submitting the financial forms, disclosing parties should include an assessment of how much they believe they can afford to pay.

Disclosing parties should raise potential inability-to-pay issues as soon as possible, preferably in the SDP submission. Doing so enables the OIG to send the disclosing promptly party the financial disclosure forms and consider that information in determining an appropriate resolution.

Overpayment Reconciliation

If, before resolving an SDP matter, a disclosing party refunds an overpayment related to the same conduct disclosed under the SDP, OIG will credit the amount paid toward the ultimate settlement amount. However, the OIG is not bound by any amount that is repaid outside the
SDP process.

The OIG may question the methodology of the overpayment calculation, notably if the disclosing party estimated the overpayment amount using some method other than the one described in the SDP.

Suppose the OIG disputes the methodology used to calculate the overpayment. In that case, they may require the disclosing party to redo the review or conduct an independent damages review, resulting in higher damages or overpayment amounts than the disclosing party’s estimate.

Moreover, even if the OIG agrees with the methodology used to calculate the overpayment, the disclosing party should expect to pay a multiplier on the damages under the SDP.

FOIA Implications of Disclosure

Disclosing parties should identify any portion of their submissions that they believe are trade secrets or are commercial, financial, privileged, or confidential and, therefore, potentially exempt from disclosure under the Freedom of Information Act (FOIA), 5 US Code §552.

Information identified as exempt must meet the criteria for exemption from disclosure under FOIA as determined by an OIG FOIA officer.

Consistent with HHS FOIA procedures, outlined in 45 CFR Part 5, OIG will make a reasonable effort to notify a disclosing party before any release by OIG of information submitted by a disclosing party and identified upon submission by a disclosing party as trade secrets or as commercial, financial, privileged, or confidential under the FOIA rules.

Concerning such releases, a disclosing party will have the rights set forth at 45 CFR §5.65(d).

Current Information

Additional Resources

CategoriesOIG

Table of Contents

→ Index