HHS Office of Inspector General Issues Important Update to Self-Disclosure Protocol

By Paul J. Giancola and Claudia E. Stedman

For the first time since 2013, on November 8, 2021, the Health and Human Services Office of Inspector General (“HHS-OIG” or “OIG”) made a number of significant updates to its Health Care Fraud Self-Disclosure Protocol (“SDP”), which was formally known as the “Provider Self-Disclosure Protocol.” The SDP may be used by health care providers, suppliers, and other individuals or entities subject to Civil Monetary Penalties (“CMP”) to voluntarily disclose evidence of potential violations of criminal, civil, or administrative law and resolve their liability. The OIG has authority to seek CMPs, assessments, and exclusion against an entity based on a variety of prohibited conduct.

Some common examples where OIG may use its CMP authority are: (1) Drug Price Reporting; (2) False and Fraudulent Claims; (3) Grants, Contracts, and Other Agreements; (5) Kickbacks (under the Anti-Kickback Statute); (6) Patient Dumping (under EMTALA); and (7) Physician Self-Referrals (under the Stark law). The SDP is not available for potential violations involving overpayment or errors. For those potential violations the OIG recommends that such matters be disclosed directly to CMS or other responsible contractor under the payor’s voluntary refund process.

What are the benefits to self-disclosure?

Broadly speaking, voluntary disclosures to the SDP may assist health care providers in resolving matters that violate federal criminal, civil, or administrative laws in a more efficient and cost-effective manner.

Individuals or entities who voluntarily disclose potential health care fraud through the SDP and cooperate with OIG during the SDP process frequently pay a lower multiplier on single damages than in an investigation prompted by the Government. Voluntary disclosure in this context matters because OIG often imposes a multiplier of 1.5 on single damages in CMP settlements of SDP matters. And in some cases that multiplier might be even higher. There is also a presumption against requiring a disclosing entity or individual to enter into a Corporate Integrity Agreement (“CIA”) with OIG if that entity or individual has made a voluntary disclosure.

Utilizing the SDP may also limit exposure under 42 U.S.C. 1320a-7k(d), which requires that a Medicare or Medicaid overpayment be reported and returned by the later of (1) within 60 days of the date that the overpayment was discovered, or (2) the date that any corresponding cost report is due. Potential liability may exist under the CMP and False Claims Act for any retained overpayments. Voluntary disclosure of overpayments through the SDP tolls this 60-day period.

What has changed?

1. Self-disclosure submissions now must be made through OIG’s website. A link to the Self-Disclosure Online Submission form can be found here.
2. OIG has doubled the minimum settlement amounts required to settle under the SDP. For example, for kickback-related potential health care fraud, OIG increased the minimum settlement amount from $50,000 to $100,000. For all other types of matters, OIG has increased the minimum settlement amount from $10,000 to $20,000. Current CMP maximum penalties can be found here.
3. OIG has reiterated that the SDP is not an appropriate vehicle for disclosures related to recipients of HHS grants or for federal contractors. Instead, these matters should be disclosed through the OIG Grant Self-Disclosure Program and the Contractor Self-Disclosure Program.
4. OIG clarified that CIA-reportable events can now be disclosed under the SDP. With this update, the OIG requires an organization to reference that it is subject to a CIA as well as send a copy of the disclosure to its OIG monitor. Importantly, this update to the SDP does not change the OIG rule that any disclosure constituting a reportable event (as defined by that entity’s particular CIA) must be reported to OIG.
5. OIG reiterated that the Department of Justice (“DOJ”) sometimes settles SDP cases, and the OIG will coordinate with the DOJ. In the SDP the OIG states that it will “advocate that the disclosing party receives a benefit from disclosure under the SDP” for civil matters.¹ This provision has been removed as it applies to criminal matters. OIG has also indicated that any disclosure of criminal conduct through the SDP will be referred to DOJ for resolution.
6. Disclosures must include a damages calculation for each affected federal health care program and the sum of all damages. The estimate of damages must also include an itemization of damages for each federal health care program.

What has not changed?

1. Timelines and content requirements of the SDP.
2. Methods for calculating damages.
3. Potential for more timely settlement with a lower multiplier and exclusion release.

Individuals or health care entities who have identified potential instances of health care fraud should coordinate with legal counsel and discuss the benefits and drawbacks to voluntary disclosure through the SDP.

The benefits of self-disclosure remain in place. However, those considering disclosure should be aware that merely because the entity has self-disclosed, this will not guarantee that the OIG will reduce penalties. After submitting a disclosure to the SDP, the disclosing party has to conduct an internal investigation and report its findings to OIG or certify that it will do so within 90 days of the disclosure.² Finally, as mentioned above, OIG is required to refer any criminal conduct to the DOJ. An effective compliance program remains the best method to identify potential violations subject to the SDP.