Report Template Update:  04-03-08  
    
 Department of Health and Human Services
OFFICE OF 
   
INSPECTOR GENERAL 
 
 
 
 
 
 
CMS  R
  EPORTING TO THE 
 
H I
EALT  HCARE  NTEGRITY AND 
 
P D B  
ROTECTION  ATA  ANK 
 
 
 
 
 
 
 
 
Daniel R. Levinson  
Inspector General 
 
September 2010 
OEI-07-09-00290 
    Report Template Update:  04-03-08 
  
   
 E X E C U T I V E   S U M M A R Y  
OBJECTIVE
 
To determine whether the Centers for Medicare & Medicaid Services 
(CMS) reported all of its adverse actions to the Healthcare Integrity and 
Protection Data Bank (HIPDB) as required. 
BACKGROUND 
The HIPDB is a national data bank containing reports of adverse 
actions against health care practitioners, providers, and suppliers 
(hereinafter referred to as providers).  The HIPDB plays an important 
role in preventing the employment of potentially fraudulent or abusive 
providers, so it is important that the information it contains be complete 
and accurate.  The HIPDB is administered by the Health Resources and 
Services Administration (HRSA) through a Memorandum of 
Understanding with the Office of Inspector General. 
The Social Security Act defines the types of adverse actions that must 
be reported to the HIPDB.  These include licensure and certification 
actions, exclusions from participation in Federal and State health care 
programs, criminal convictions, civil judgments related to health care, 
and any other adjudicated actions or decisions that the Secretary of 
Health & Human Services establishes by regulation.  CMS takes several 
types of adverse actions that are required to be reported to the HIPDB, 
including revocations and suspensions of laboratory certifications; 
terminations of providers from participation in Medicare; and civil 
monetary penalties against all types of providers, managed care plans, 
and prescription drug plans.  Federal and State government agencies 
and health plans are required to report certain adverse actions to the 
HIPDB. 
We reviewed the data contained in the HIPDB as of April 30, 2009, to 
determine the extent of CMSs reporting of adverse actions as of that 
date.  We conducted structured interviews with CMS officials in each 
division that is responsible for oversight and/or HIPDB reporting of 
Medicare providers.  For CMS divisions that maintained lists of 
imposed adverse actions, we collected documents or data to support the 
number of adverse actions imposed. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  i  Report Template Update:  04-03-08 
  
   
E X E C U T I V E   S U M M A R Y  
FINDING 
CMS took adverse actions against providers, but did not report all of 
these actions to the HIPDB as required.  CMSs reporting to the 
HIPDB varied by provider type; CMS officials believe that only adverse 
actions related to fraud and abuse should be reported to the HIPDB.  
However, the Social Security Act does not limit the reporting of adverse 
actions to cases of fraud and abuse.  CMS failed to report the following 
adverse actions or failed to report them within the required timeframes: 
  None of the 148 adverse actions imposed against laboratories in 
2007 and the 30 adverse actions imposed against managed care and 
prescription drug plans between January 1, 2006, and July 31, 2009 
(the last action was effective March 7, 2009), had been reported to 
the HIPDB at the time of our review.   
  None of the adverse actions against durable medical equipment 
(DME) suppliers taken after 2008 had been reported to the HIPDB. 
However, as of April 30, 2009, the HIPDB contained 5,125 adverse 
actions against DME suppliers imposed from 1998 through 2008.  
According to the officials with whom we spoke, as a cost-saving 
measure, CMS is no longer reporting adverse actions taken against 
DME suppliers to the HIPDB.    
  None of the 45 nursing homes terminated from participating in 
Medicare from 20042008 were reported to the HIPDB until 2009, 
well after the required reporting timeframe.   
The Division of National Systems (DNS), the group within CMS 
responsible for reporting adverse actions against certified provider 
types, did not report any actions between 20012008.  DNS uses an 
electronic system to track adverse actions against providers that are 
required to have a State survey or are accredited by an accrediting 
organization, such as hospitals and nursing homes.  DNS officials 
indicated that they report only termination actions that are for failure 
to meet health and safety requirements and that have gone through the 
entire appeals process, after which the terminated providers will no 
longer participate in Medicare.  However, adverse actions are required 
to be reported within the timeframes specified by law regardless of 
whether appeals are pending.   
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  ii  Report Template Update:  04-03-08 
  
   
EE XX EE CC UU TT II VV EE    SS UU MM MM AA RR YY   
RECOMMENDATION 
CMS should report all adverse actions as required.  To accomplish 
this, CMS should educate staff and contractors about the types of 
adverse actions required to be reported and the timeframes for 
reporting.   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
In its written comments on the report, CMS concurred with our 
recommendation.  CMS described planned efforts to report adverse 
actions imposed against nursing facilities, laboratories, and DME 
suppliers, including working with HRSA to develop technical procedures 
and educating staff and contractors about HIPDB reporting.  We did not 
make any changes to the report based on CMSs comments. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  iii  Report Template Update:  04-03-08  
 
 
 T A B L E   O F   C O N T E N T S  
EXECUTIVE SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
 
 
I N T RO DUC T IO N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 
 
 
F I N D IN G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 
CMS took adverse actions against providers, but did not report  
all of these actions to the HIPDB as required . . . . . . . . . . . . . . . . . 7  
 
R E C O MMEN D A T ION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 
Agency Comments and Office of Inspector General Response . . . 11 
 
APPENDIXES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 
A:  Types of Adverse Actions Required To Be Reported  
to the HIPDB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 
B:  Agency Comments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 
 
 
A C K NO WL E D G M E N T S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 
    OEI-07-09-00290  CMS REPORTING TO THE HIPDB  iv  Report Template Update:  04-03-08  
 
 
 I N T R O D U C T I O N  
OBJECTIVE 
To determine whether the Centers for Medicare & Medicaid Services 
(CMS) reported all of its adverse actions to the Healthcare Integrity and 
Protection Data Bank (HIPDB) as required. 
BACKGROUND 
The HIPDB is a national data bank containing reports of final adverse 
actions (e.g., exclusions from participation in a Federal health care 
program, health-care-related criminal convictions) against health care 
practitioners, providers, and suppliers (hereinafter referred to as 
providers).  State and Federal agencies and health plans may query the 
HIPDB to assist them in preventing the employment of potentially 
fraudulent or abusive providers.  As of April 30, 2009, the HIPDB 
contained information on 389,273 adverse actions.1   
The HIPDB plays an important role in preventing fraud and abuse, so it 
is important that the information it contains be complete and accurate.  
Furthermore, users pay fees for each query they submit to the HIPDB 
with the expectation that they will receive complete and accurate 
information in return.   
Federal and State government agencies and health plans are required 
to report to the HIPDB certain final adverse actions that they take 
against providers relating to a health care item or service.  Within the 
Department of Health & Human Services (HHS), CMS oversees health 
care programs that serve the largest percentage of health care 
consumersan estimated 45 million Medicare beneficiaries and 
59 million Medicaid beneficiaries.2  CMS may take many types of 
adverse actions against the providers it oversees, including revocations 
and suspensions of certifications, terminations of participation in 
Medicare, and civil monetary penalties (CMP).  State agencies also 
report final adverse actions imposed against providersfor example, an 
adverse action that could be taken by a State agency is the loss of a 
 
1 Of the 389,273 adverse actions, 328,516 were reported by State agencies, 55,385 were 
reported by Federal agencies, and 5,372 were reported by health plans. 
2 Medicare Enrollment:  National Trends 1966-2008.  Accessed at 
http://www.cms.hhs.gov on January 4, 2010.  Total Medicaid Enrollment, FY 2006, The 
Henry J. Kaiser Family Foundation.  Accessed at http://www.statehealthfacts.org on 
December 9, 2009.  
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  1  Report Template Update:  04-03-08 
  
   
I N T R O D U C T I O N  
providers license or certification agreement for participation in its 
Medicaid program.3 
Establishment of the HIPDB 
Section 221 of the Health Insurance Portability and Accountability Act 
of 1996 amended the Social Security Act by adding section 1128C, which 
required the Secretary of HHS, acting through the Office of Inspector 
General (OIG) and the United States Attorney General, to create a 
national health care fraud and abuse control program, including a 
national data bank containing certain adverse actions against providers.  
This data bank, known as the HIPDB, became operational in 1997.   
The HIPDB is administered by the Health Resources and Services 
Administration (HRSA) through a Memorandum of Understanding with 
OIG.  HRSA also administers the National Practitioner Data Bank 
(NPDB), which collects information related to the professional 
competence and conduct of physicians, dentists, and other health care 
practitioners.  HRSA contracts the operations of both data banks to a 
private company, SRA International.   
Purpose of the HIPDB 
The purpose of the HIPDB is to prevent health care fraud and abuse 
and to improve the quality of patient care within the United States.4  To 
that end, the HIPDB should contain all adverse actions subject to 
reporting requirements in the implementing regulations found in 
45 CFR pt. 61.  The HIPDB information is intended to be used in 
combination with information from other sources (e.g., peer 
recommendations, verification of training and experience) when making 
determinations about employment, affiliation, certification, or licensure. 
Section 1128E of the Social Security Act and the implementing 
regulations require the reporting of a variety of adverse actions to the 
HIPDB and do not limit the reporting of adverse actions to cases of 
fraud and abuse.  The Federal Register containing the final rule 
implementing section 1128E states: 
Congress used the term health care fraud and 
abuse only once in the provisions opening 
paragraph for purposes of naming the data 
 
3 45 CFR  61.7. 
4 HIPDB Guidebook, p. A-2.  Accessed at http://www.npdb-hipdb.com on 
November 30, 2009. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  2  Report Template Update:  04-03-08 
  
   
II NN TT RR OO DD UU CC TT II OO NN   
collection program.  The term does not appear 
elsewhere, especially with regard to limiting the 
scope of reportable actions ....  To limit the 
adverse actions collected by the data bank to only 
those that are based on health care fraud and 
abuse would create a data bank that does not fully 
capture the types of reports that Congress clearly 
intended to be collected in accordance with the 
statute.5 
HIPDB Reporting Requirements 
Federal and State government agencies and health plans are required 
to report certain final adverse actions (hereinafter referred to as adverse 
actions) that they take against providers.  The regulations in 
45 CFR  61.761.11 describe which adverse actions must be reported 
to HIPDB; however, neither the Social Security Act nor the regulations 
list the specific agencies required to report.  Section E of the HIPDB 
Guidebook provides further explanation of each type of action, which 
includes licensure and certification actions, exclusions from 
participation in Federal and State health care programs, criminal 
convictions, civil judgments related to health care, and any other 
adjudicated actions or decisions that the Secretary of HHS establishes 
by regulation.  Table 1 gives an overview of the types of adverse actions 
that must be reported to the HIPDB.  See Appendix A for more detailed 
information about each type of reportable action. 
Adverse actions must be reported within 30 calendar days of the date 
the action was taken or the date the reporting entity became aware of 
the action or by the close of the next monthly reporting cycle as 
determined by the entity, whichever is later.6  If an appeal overturns a 
reported action, the reporting entity must submit a revised report to the 
HIPDB.7  Information reported to the HIPDB is maintained 
permanently, unless it is corrected or voided from the system.  A 
correction or void may be submitted only by the reporting entity or at 
the direction of the Secretary of HHS.8
 
5 64 Fed. Reg. 57740 (Oct. 26, 1999). 
6 45 CFR  61.5. 
7 45 CFR  61.6(b); HIPDB Guidebook, pp. E-5 and E-15.  Accessed at  
http://www.npdb-hipdb.com on November 30, 2009. 
8 HIPDB Guidebook, p. E-14.  Accessed at http://www.npdb-hipdb.com on 
November 30, 2009. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  3  Report Template Update:  04-03-08 
  
   
II NN TT RR OO DD UU CC TT II OO NN   
CMS reporting to the HIPDB.  As shown in Table 1, CMS takes several 
types of adverse actions that are required to be reported to the HIPDB, 
including revocations and suspensions of laboratory certifications; 
terminations of providers from participation in Medicare; and CMPs 
against all types of providers, managed care plans, and prescription 
drug plans.  The CMS Division of National Systems (DNS) maintains 
the electronic system CMS uses to track adverse actions for 
Medicare-certified provider types (i.e., providers that are required to 
have a State survey or that are accredited by an accrediting 
organization) and reports those actions to the HIPDB.  As of 
April 30, 2009, the HIPDB contained 5,146 adverse actions reported by 
CMS. 
Table 1:  Types of Adverse Actions Reportable to the HIPDB 
Is This Action 
Type of Action  Example 
Taken by CMS? 
The denial of an application for licensure or certification 
Licensure and Certification Actions  Yes  because of a provider's deliberate failure to report a licensure 
disciplinary action taken by another licensing agency 
Exclusion of a provider because he or she has filed false 
Exclusions  No*  claims or because his/her medical license has been 
suspended 
Health-Care-Related Criminal  Conviction and fining of a mental health institution for 
No 
Convictions  condoning physically abusive methods of controlling patients 
A judgment against a nursing home for neglect of and failure 
Health-Care-Related Civil Judgments  No 
to adequately clean patient rooms 
Termination of a Federal or State government contract for 
Other Adjudicated Actions  Yes 
cause 
*42 CFR  402.200 authorizes CMS exclusion authority, but CMS had not exercised this authority at the time of this review. 
Source:  HIPDB Guidebook, 2009. 
 
Querying the HIPDB   
Federal and State government agencies and health plans are eligible to 
query the HIPDB.  The information may be used for employment, 
affiliation, certification, or licensure decisions.  Federal Government 
agencies may query the HIPDB without charge.  State government 
agencies and health plans must pay a per-query fee of $4.75.  Providers 
may self-query the HIPDB for a fee of $8.00; they are allowed to access 
only information about themselves.   
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  4  Report Template Update:  04-03-08 
  
   
II NN TT RR OO DD UU CC TT II OO NN   
Related Report and Legislation 
An October 2005 OIG report on HHS agencies reporting to the NPDB 
found that between June 1997 and September 2004, HHS agencies 
failed to report as many as 474 medical malpractice cases that should 
have been reported.  The underreporting was caused by factors 
including lost or incomplete files and the lack of an identifiable HHS 
contact for the NPDB reporting.9 
The information in the HIPDB and the NPDB overlaps, but agencies are 
required to report information to the HIPDB that is not required to be 
reported to the NPDB.  On March 23, 2010, legislation was enacted that 
will consolidate this information within the NPDB and terminate the 
HIPDB.10  When the legislation is implemented, agencies that currently 
report to the HIPDB will be required to report to the NPDB.   
METHODOLOGY 
HIPDB Data 
We obtained a copy of the data contained in the HIPDB as of 
April 30, 2009.  We reviewed the data to determine the extent of CMSs 
reporting as of that date.  We conducted structured interviews with 
HRSA staff to understand the data fields and ensure we had a complete 
understanding of HIPDB reporting. 
CMS Division Interviews and Adverse Action Data 
We conducted structured interviews with CMS officials in each division 
that is responsible for (1) oversight of providers that participate in 
Medicare and (2) reporting of adverse actions.  In these interviews, we 
asked CMS officials about the provider type(s) with which they worked, 
the adverse actions that they were authorized to impose, whether they 
maintained a list of the adverse actions they imposed, and their 
knowledge of HIPDB reporting.  Respondents offered reasons why they 
believed imposed adverse actions were not reportable to the HIPDB.  
For CMS divisions that maintained lists of imposed adverse actions, we 
collected documents or data to support the number of adverse actions 
imposed.11  We verified whether the listed adverse actions had been 
 
9 OIG, HHS Agencies Compliance With the National Practitioner Data Bank Malpractice 
Reporting Policy (OEI-12-04-00310), October 2005.  
10 The Patient Protection and Affordable Care Act, P.L. 111-148  6403. 
11 Each division that supplied documents or data used a different timeframe. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  5  Report Template Update:  04-03-08 
  
   
I N T R O D U C T I O N  
reported to the HIPDB.  Table 2 illustrates the adverse actions 
contained in the data and documents provided to us. 
Table 2:  Adverse Actions Taken by CMS Divisions That Maintained Lists of Actions 
CMS Division  Timeframe of Data Provided  Number of Actions 
Division of Laboratory Services  January 1December 31, 2007  148 
Program Compliance and Oversight Group  January 1, 2006July 31, 2009*  30 
Survey and Certification Group  October 1, 2004December 31, 2008  45 
*The effective date for the latest action in these data is March 7, 2009. 
Source:  CMS staff divisions, 2009. 
 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspections approved by the Council of the Inspectors General on 
Integrity and Efficiency. 
 
 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  6  Report Template Update:  04-03-08 
  
   
F I N D I N G  
 F I N D I N G  
A variety of adverse actions that 
CMS took adverse actions against 
CMS takes against providers, such 
providers, but did not report all of these  
as certification actions and other 
 actions to the HIPDB as required
adjudicated actions, are required to 
be reported to the HIPDB.  However, many CMS divisions that took 
adverse actions did not report all of them as required.  Additionally, the 
division responsible for tracking and reporting adverse actions against 
certified providers did not report any actions between 20012008.  
Finally, some of the adverse actions CMS did report were not reported 
within required timeframes.   
CMSs reporting to the HIPDB varied by provider type; CMS officials were 
unaware that adverse actions related to program compliance should be 
reported 
Laboratories.  Within CMS, the Division of Laboratory Services imposes 
terminations, certification actions, and CMPs against laboratories that 
do not meet Medicare requirements.  These adverse actions meet the 
definitions of certification actions and other adjudicated actions in  
45 CFR  61.7 and must be reported to the HIPDB.   
CMS imposed 148 adverse actions against laboratories in 2007, none of 
which had been reported to the HIPDB at the time of our review.  As of 
April 30, 2009, the HIPDB contained only one adverse action reported 
by the Division of Laboratory Services; this report was submitted in 
1998.  CMS officials overseeing laboratories stated their belief that only 
adverse actions related to fraud and abuse should be reported to the 
HIPDB.  They were unaware that adverse actions related to program 
compliance should also be reported.   
Managed care and prescription drug plans.  CMS imposes terminations 
and CMPs against managed care and prescription drug plans that fail 
to comply with Medicare requirements.  These adverse actions meet the 
definitions of certification and other adjudicated actions in  
45 CFR  61.11 and must be reported to the HIPDB.   
CMS imposed 30 adverse actions against managed care and prescription 
drug plans between January 1, 2006, and July 31, 2009 (the last action 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  7  Report Template Update:  04-03-08 
  
   
F I N D I N G  
was effective March 7, 2009), none of which had been reported to the 
HIPDB at the time of our review.12  CMS officials overseeing managed 
care and prescription drug plans, like officials overseeing laboratories, 
stated that they believed only adverse actions related to fraud and 
abuse must be reported to the HIPDB.  However, neither section 1128E 
of the Social Security Act nor the HIPDB regulations limit the reporting 
of adverse actions to cases of fraud and abuse. 
Durable medical equipment suppliers.  CMS terminates durable medical 
equipment (DME) suppliers that fail to comply with Medicare 
requirements.  These adverse actions meet the definition of certification 
actions in 45 CFR  61.7 and must be reported to the HIPDB.   
As of April 30, 2009, the HIPDB contained 5,125 adverse actions against 
DME suppliers imposed from 1998 through 2008.  The HIPDB 
contained no adverse actions against DME suppliers taken after 2008, 
although DME fraud is an ongoing issue in MedicareMedicare paid 
more than $30 million in fraudulent claims to DME suppliers in 2008 
alone.13 
According to the officials with whom we spoke, CMS is no longer 
reporting adverse actions taken against DME suppliers to the HIPDB.  
CMS officials responsible for overseeing provider enrollment explained 
that the 5,125 adverse actions were reported by a contractor that 
processes enrollment applications for DME suppliers.  However, in 
October 2008, CMS issued a new Statement of Work discontinuing the 
requirement for this contractor to report enforcement actions to the 
HIPDB.  CMS officials said this change was a cost-saving measure.     
Nursing homes.  CMS terminates or imposes CMPs against nursing 
homes that fail to comply with Medicare requirements.  These adverse 
actions meet the definitions of certification and other adjudicated 
actions in 45 CFR  61.11 and must be reported to the HIPDB.  
The CMS Survey and Certification Group terminated 45 nursing homes 
from participating in Medicare from 2004 to 2008.  CMS officials stated 
 
12 The report provided to us with these data included adverse actions between 
January 1, 2006, and July 31, 2009.  We obtained a copy of the data contained in the 
HIPDB as of April 30, 2009.  However, the last adverse action imposed against managed 
care and prescription drug plans was effective March 7, 2009, within our period of review.  
13 Fact Sheet:  Phase Two Medicare Fraud Strike Force Los Angeles Metro Area.  HHS 
and Department of Justice.  Accessed at http://www.stopmedicarefraud.gov on 
January 20, 2010.  
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  8  Report Template Update:  04-03-08 
  
   
FF II NN DD II NN GG   
that these 45 nursing home terminations were not reported to the 
HIPDB until the fall of 2009.  They further stated that they plan to 
report nursing home terminations annually.  However, annual reporting 
of nursing home terminations does not comply with the reporting 
requirements in 45 CFR  61.5 as to timeframe.   
Additionally, in fiscal year 2008, the CMS Office of Financial 
Management collected over $37 million in CMPs, of which CMS officials 
estimated that 85 percent were from nursing homes.  However, CMS 
had not reported any CMPs to the HIPDB as of April 30, 2009.  CMS 
officials stated that CMPs against nursing homes need not be reported 
to the HIPDB for two reasons.  First, CMS officials stated that reporting 
is required only for adverse actions due to fraud and abuse.  Many 
CMPs are intended to correct lack of compliance with provider 
standards, not to deter fraud and abuse.  However, section 1128E of the 
Social Security Act does not limit the reporting of adverse actions to 
cases of fraud and abuse.  Second, CMS officials said that if providers 
correct the noncompliance, the CMP is rescinded and the provider never 
pays the penalty imposed.  However, neither section 1128E of the Social 
Security Act nor the HIPBD regulations contain exceptions to reporting 
for adverse actions that may be rescinded.  CMS must report all 
imposed adverse actions; if the actions are later rescinded, CMS must 
submit a revised report to the HIPDB indicating the rescission. 
CMS did not report any adverse actions against Medicare-certified provider 
types between 2001 and 2008 
We identified 20 reports of adverse actions against providers of various 
types (e.g., laboratories, clinics, medical doctors) imposed in 2000 that 
DNS reported to the HIPDB.14  As of April 30, 2009, the HIPDB 
contained no further reports from DNS after 2000. 
DNS uses an electronic system to track adverse actions against 
providers that are required to have a State survey or are accredited by 
an accrediting organization, such as hospitals and nursing homes.  DNS 
officials told us that they would report only terminations for nursing 
homes, despite having information on other types of providers in their 
system.  DNS reports only termination actions that are imposed for 
failure to meet health and safety requirements and that have gone 
 
14 Medicare-certified providers are required to have a State survey or be accredited by an 
accrediting organization.  Medical doctors are not certified by Medicare.  We could not 
determine why DNS reported adverse actions against medical doctors. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  9  Report Template Update:  04-03-08 
  
   
F I N D I N G  
through the entire appeals process, after which the terminated 
providers will no longer participate in Medicare.  However, adverse 
actions must be reported within the timeframes specified by law 
regardless of whether appeals are pending.
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  10  Report Template Update:  04-03-08 
  
   
FF II NN DD II NN GG SS   
 R E C O M M E N D A T I O N  
 
CMS did not report all adverse actions to the HIPDB as required by 
Federal law.  CMS officials stated that they believe only adverse actions 
related to fraud and abuse must be reported to the HIPDB.  
Furthermore, the division within CMS responsible for tracking adverse 
actions against certified provider types did not report any actions 
between 2001 and 2008.  However, neither section 1128E of the Social 
Security Act nor the HIPDB regulations limit reporting to cases of fraud 
and abuse, nor do they contain any exceptions to required reporting 
based on costs of reporting.   
Section 6403 of the Patient Protection and Affordable Care Act 
(P.L. 111-148) transfers information from the HIPDB to the NPDB and 
terminates the HIPDB.  Implementation is to be 1 year after enactment 
or when final regulations are promulgated, whichever occurs later.  
When implementation occurs, CMS will be required to report to the 
NPDB information that CMS is currently required to report to the 
HIPDB. 
To address our finding we recommend: 
CMS should report all adverse actions as required   
To accomplish this, CMS should educate staff and contractors about the 
types of adverse actions required to be reported and the timeframes for 
reporting.   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
In its written comments on the report, CMS concurred with our 
recommendation.  CMS described planned efforts to report adverse 
actions imposed against nursing facilities, laboratories, and DME 
suppliers, including working with HRSA to develop technical procedures 
and educating staff and contractors about HIPDB reporting.  CMS 
issued instructions to the National Supplier Clearinghouse (the DME 
supplier enrollment contractor) to submit reports for suppliers whose 
Medicare billing privileges were revoked in 2009 and will establish 
procedures to ensure the contractor reports adverse actions monthly to 
the HIPDB.  CMS stated that further discussion with HRSA and OIG is 
necessary to clarify whether some actions are reportable.  We did not 
make any changes to the report based on CMSs comments.  The full 
text of CMSs comments on the draft report can be found in Appendix B. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  11  Report Template Update:  04-03-08 
  
   
 A P P E N D I X   ~   A  
Types of Adverse Actions Required To Be Reported to the 
Healthcare Integrity and Protection Data Bank 
Licensure or certification actions.  Federal and State agencies responsible 
for the licensing and certification of providers must report adverse 
licensure actions taken against practitioners, providers, and suppliers to 
the Healthcare Integrity and Protection Data Bank (HIPDB).15  The 
actions must be formal or official actions; they need not be related to 
professional conduct or competence.  Examples of reportable adverse 
licensure and certification actions include: 
  any loss, revocation, or suspension of a license or certification 
agreement or contract for participation in Federal or State health 
care programs;  
  any loss of the right to apply for or renew a license, certification 
agreement, or contract;  
  any reprimand, censure, or probation; and 
  any other negative action or finding by a Federal or State agency 
that is publicly available information and is rendered by a licensing 
or certification authority, including limitations on the scope of 
practice, liquidations, injunctions, exclusions, revocations, 
suspensions or forfeitures, and excluding administrative fines or 
citations and corrective action plans and other personnel actions 
unless they are connected to the billing, delivery, or provision of 
health care services and taken in conjunction with other licensure or 
certification actions. 
Exclusions from participation in Federal or State health care programs.  The 
term exclusion is defined as a temporary or permanent debarment of 
an individual or entity from participation in Federal or State 
health-related programs, in accordance with which items or services 
furnished by the person or entity will not be reimbursed by the 
program.  Sections 1128B(9)(f) and (h) of the Social Security Act specify 
which Federal and State health care programs are included in this 
definition.  Examples of reportable exclusions include a practitioner who 
is excluded because he or she has filed false claims or because his or her 
medical license has been suspended. 
 
15 All of the examples presented in this Appendix are adapted from the HIPDB 
Guidebook, February 2000.  Accessed at http://www.npdb-hipdb.com on November 30, 2009. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  12  Report Template Update:  04-03-08 
  
   
A P P E N D I X   ~   A  
Health-care-related criminal convictions.  Federal, State, and local 
prosecutors must report criminal convictions and injunctions that are 
related to the delivery of health care items or services and that are 
taken against health care practitioners, providers, and suppliers.  These 
criminal convictions include situations in which a judgment or 
conviction has been entered in a Federal, State, or local court, 
regardless of whether an appeal is pending or whether the record has 
been expunged; a finding of guilt has been entered; a plea of guilty or 
nolo contendere has been accepted; or an arrangement in which 
judgment or conviction has been withheld, such as a first offender or 
deferred adjudication program.  Examples of criminal convictions that 
must be reported to the HIPDB include:  
  the conviction and fining of a mental health institution for 
condoning physically abusive methods of controlling patients, 
  the conviction and fining of both a chiropractor and a medical supply 
company for providing kickbacks in exchange for patient referrals, 
  the deferred conviction of a practitioner for accepting money for 
referrals to a specialist and sentencing of the practitioner for a 
2-year probationary period, and 
  an injunction by the Food and Drug Administration against a 
pharmaceutical company to stop the production of a drug found to 
produce harmful side effects. 
Examples of criminal convictions that would not be reported to the 
HIPDB include: 
  a civil judgment against a physician for medical malpractice 
resulting in an award to the plaintiff and 
  a deferred conviction of a practitioner for possession and abuse of 
drugs and sending the practitioner to a rehabilitation facility. 
Health-care-related civil judgments.  Federal and State attorneys and 
health plans must report civil judgments against practitioners, 
providers, and suppliers related to the delivery of a health care item or 
service, regardless of whether the judgments are being appealed.  If a 
government agency is party to a multiclaimant suit, it is responsible for 
reporting the entire action.  When there are multiple health plans as 
claimants but no government agency, the health plan that received the 
largest award is responsible for reporting the total action.  Examples of 
reportable civil judgments include: 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  13  Report Template Update:  04-03-08 
  
   
A P P E N D I X   ~   A  
  a judgment against a clinical laboratory for fraudulent billing and 
misleading marketing, 
  a judgment against a nursing home for neglect of and failure to 
adequately clean patient rooms, and 
  a judgment against a plastic surgeon for misrepresenting claims as 
noncosmetic procedures in order to receive payment for them. 
Examples of nonreportable civil judgments include: 
  a judgment imposing a fine on a medical supply company for hiring 
discrimination, 
  a judgment against a practitioner for medical malpractice, and 
  a judgment against a practitioner stemming from an automobile 
accident not related to the delivery of health care. 
Other adjudicated actions or decisions.  Federal and State government 
agencies and health plans must report adjudicated actions or decisions 
against practitioners, providers, and suppliers.  Other adjudicated 
actions or decisions are those which ... include the availability of a due 
process mechanism and [are] based on acts or omissions that affect or 
could affect the payment, provision, or delivery of a health care item or 
service.  Examples of other adjudicated actions or decisions include a 
personnel-related action, such as a termination and a Federal or State 
government contract terminated for cause.16 
 
16 HIPDB Guidebook, p. E-11.  Accessed at http://www.npdb-hipdb.com on 
November 30, 2009. 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  14  x 
A  P  PEN  D  B 

AGENCY COMMENTS 

l":1.. -"
I'"..., 
~ ~:~~TMENT ~.H~.A Ce~n_rt._"'_foI_Mo<I
\,  OF HEAl:TH  __N_ S_E_R_V_IC_E_S_  ______  __icII_re_&_M9d_Ito._kl_S4_N_lce. 
..... 	 Admi,.lstr4to, 

Waolllr1ytQn. DC 20201 

A~JG  5 2010
nATE: 
TO: 	 Daniel R. Levinson 

Inspector <A:neral 
FROM: 	 Donald1Vlmerwlft, rvY.ft. 

Administrator 

SUBJECT: 	 Otl\ce of Inspector Genernl (010) Draft Report eMS Reporting to the 
Healthcare Integrity and Protection Data Bank (OEI"(}7-09-00290) 
'Ibank you for the opportunity to review and comment on lhe above-referenced report from 010. 
Uu: Ccnters for Medicare & Medicaid Service,; (eMS) appreciates the input by OIG in ns-'lCssing 
efforts to prevent the employment of pote[Jtially fraudulent or abusive hcalthcare providerS and 
supplierS. The purpose ofthis report was to evaluate whether eMS reported all of its adverse 
actions to the Healtlt.carc Integrity and Protection Data Bank (HIPDB), a national data bank 
containing reports of adverse actions against health care providers taken by Federal and St[;lle 
govemment agencies and health plans. 
We hope to engage with the Health Resources and Services Administration (HRSA) and 010 to 
address the many isslles relating to the HIPDB that were omside the scope of this report, as those 
efforis will fac.ilitate adoption of the 010 recommendation. 
OIG R~ommendation 
The eMS should report an adverse actions as required. To accomplish this, eMS should eQ\lCute 
stafflind cootractors about the types of adverse action~ required to be reported and the 
timeframes for reporting to the relevant data bank. 
(~MS Response 
The eMS ooncurs with lhis recommendation. 
The eMS provided the ouutnndillg nursing home tcnnirmli()n daia from 2004 through 2008. as 
well as 2009 terminations. in June. In additio[J, we arc investigating. the most feasible methods 
to provide additional data on nursing home denial of payment for new admissions. and 
laboratories wll[}se partio,;ipation in the Clinical Laboflllory Improvement Amendments of 1988 
program Iu1s beel1 revoked or suspended. eMS issued instructions to tbe National Supplier 
Cicilrillghouse (NSC) LO submit 2009 fCvocation data to the H1PDB by September 1,2010 when 
oE'07 090 0290  eMS REPORTING TO THE HIPDB  15  Report Template Update:  04-03-08 
  
   
A P P E N D I X   ~   B  
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  16  Report Template Update:  04-03-08 
  
   
 A C K N O W L E D G M E N T S  
A P P E N D I X ~ A  
This report was prepared under the direction of Brian T. Pattison, 
Regional Inspector General for Evaluation and Inspections in the 
Kansas City regional office, and Deborah K. Walden, Deputy Regional 
Inspector General.   
Tricia Fields served as the team leader for this study.  Other principal 
Office of Evaluation and Inspections staff from the Kansas City regional 
office who contributed to the report include Michael P. Barrett and 
Michala Walker; central office staff who contributed include Heather 
Barton, Anne MacArthur, and Talisha Searcy.  
 
  OEI-07-09-00290  CMS REPORTING TO THE HIPDB  17  Report Template Update:  04-03-08  
 
 
Office of Inspector General 
http://oig.hhs.gov 
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services 
(HHS) programs, as well as the health and welfare of beneficiaries served by those 
programs.  This statutory mission is carried out through a nationwide network of audits, 
investigations, and inspections conducted by the following operating components: 
Office of Audit Services 
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 
audits with its own audit resources or by overseeing audit work done by others.  Audits 
examine the performance of HHS programs and/or its grantees and contractors in carrying 
out their respective responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and 
mismanagement and promote economy and efficiency throughout HHS. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud, waste, or abuse and promoting 
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 
of fraud and misconduct related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI utilizes its resources 
by actively coordinating with the Department of Justice and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to criminal 
convictions, administrative sanctions, and/or civil monetary penalties. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to 
OIG, rendering advice and opinions on HHS programs and operations and providing all 
legal support for OIGs internal operations.  OCIG represents OIG in all civil and 
administrative fraud and abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program guidance, publishes fraud alerts, and provides other 
guidance to the health care industry concerning the anti-kickback statute and other OIG 
enforcement authorities.