DEPARTMENT OF HE..I\LTH AND HUMA!~ SERVICES 
OFFICE OF INSPECTOR GENERAL 
WASHJNGTOJ\, DC  20201 
SEP  1 2 2012 
TO: 	 Marilyn Tavenner 
Acting Administrator 
Centers for Medicare & Medicaid Services 
FROM:  Stuart Wrighf 
Deputy Inspector General 
for Evaluation and Inspections 
SUBJECT: 	 Recommendation Followup Memorandum Report:  CMS Reporting to the 
Healthcare Integrity and Protection Data Bank, OEI-07-09-00292 
The Healthcare Integrity and Protection Data Bank (HIPDB) is a national data bank 
containing reports of adverse actions against health care practitioners, providers, and 
suppliers (collectively referred to as providers).  Complete and accurate HIPDB 
information helps prevent the employment of potentially fraudulent or abusive providers. 
In a 2010 report entitled CMS Reporting to the Healthcare Integrity and Protection Data 
Bank (OEI-07-09-00290), the Office oflnspector General (OIG) found that the Centers 
for Medicare & Medicaid Services (CMS) took adverse actions against providers but did 
not report all of these actions to the HIPDB as required.  For example, none of the 
adverse actions against durable medical equipment (DME) suppliers taken during 2008 
had been reported to the HIPDB as of April30, 2009.  In the 2010 report, OIG 
recommended-and CMS concurred-that CMS should report all adverse actions as 
required. This memorandum report provides an assessment ofCMS's reporting to the 
HIPDB approximately 2 years after the release of the initial report. 
SUMMARY 
To determine the extent to which CMS is addressing OIG's recommendation to report all 
adverse actions as required, we compared HIPDB data as of April I, 2012, with data 
reported in our 20 l 0 report.  We found that CMS improved its reporting of adverse 
actions for DME suppliers, but not for other types of providers.  We conclude that CMS 
has not fully addressed our 2010 report recommendation to report required adverse 
actions to the HIPDB.  Page 2  Marilyn Tavenner 
 
BACKGROUND 
 
The HIPDB is a national data bank containing reports of final adverse actions 
(e.g., exclusions from participation in a Federal health care program, criminal convictions 
related to health care) against providers.  State and Federal agencies and health plans may 
query the HIPDB to assist them in preventing the employment or contracting of 
potentially fraudulent or abusive providers.  As of April 1, 2012, the HIPDB contained 
information on 547,298 adverse actions.   
 
A 2010 Federal law requires the transfer of all data in the HIPDB to the National 
Practitioner Data Bank (NPDB), and for the HIPDB to cease operations, although 
agencies and health plans will still be required to report the same adverse actions to the 
NPDB.1 
 
Establishment of the HIPDB 
Section 221 of the Health Insurance Portability and Accountability Act of 1996 amended 
the Social Security Act by adding section 1128C, which required the Secretary of Health 
and Human Servicesacting through OIGand the United States Attorney General to 
create a national health care fraud and abuse control program.  One component of this 
program is a national data bank containing certain adverse actions taken against 
providers.  This data bank, known as the HIPDB, became operational in 1997. 
 
The HIPDB is administered by the Health Resources and Services Administration 
(HRSA) through a Memorandum of Understanding with OIG.  HRSA also administers 
the NPDB, which collects information related to the professional competence and 
conduct of physicians, dentists, and other health care practitioners.  Section 6403 of the 
Patient Protection and Affordable Care Act (P.L. 111-148) streamlines data bank 
operations by eliminating duplicative data reporting and access requirements between the 
two data banks.  Section 6403 requires the Secretary to establish a transition period to 
transfer all data in the HIPDB to the NPDB and, once completed, to cease HIPDB 
operations.  Information previously collected and disclosed through the HIPDB will then 
be collected and disclosed through the NPDB.  On February 15, 2012, HRSA published a 
Notice of Proposed Rulemaking to transfer the data in the HIPDB to the NPDB.  To date, 
HRSA has not promulgated final regulations.  
 
HIPDB Reporting Requirements 
Federal and State government agencies and health plans are required to report certain 
final adverse actions (adverse actions) that they take against providers.  The regulations 
in 45 CFR  61.761.11 describe which adverse actions must be reported to HIPDB.  
Section E of the HIPDB Guidebook provides further explanation of each type of action, 
which includes licensure and certification actions, exclusions from participation in 
Federal and State health care programs, criminal convictions, civil judgments related to 
health care, and any other adjudicated actions of decision that the Secretary establishes by 
regulation. 
                                                 
1
 P.L. 111-148  6403. 
CMS Reporting to the Healthcare Integrity and Protection Data Bank (OEI-07-09-00292)    Page 3  Marilyn Tavenner 
 
Adverse actions must be reported within 30 calendar days of the date that the reporting 
entity took the action, the date the reporting entity became aware of the action, or the 
close of the next monthly reporting cycle as determined by the entity, whichever is 
latest.2  If an appeal overturns a reported action, the reporting entity must submit a 
revised report to the HIPDB.3  Information reported to the HIPDB is maintained 
permanently, unless it is corrected or voided from the system.  A correction or void may 
be submitted only by the reporting entity or at the direction of the Secretary.4  
 
METHODOLOGY 
 
We obtained a copy of the data in the HIPDB as of April 1, 2012.  We compared these 
HIPDB data (e.g., the number, frequency, and types of adverse actions reported by CMS) 
with the data obtained for our 2010 report.  By comparing the data from April 1, 2012, 
with those from April 30, 2009, we were able to make conclusions about the extent to 
which CMSs reporting to the HIPDB addresses our 2010 report recommendation.   
 
Standards 
This study was conducted in accordance with the Quality Standards for Inspection and 
Evaluation issued by the Council of the Inspectors General on Integrity and Efficiency. 
 
 
RESULTS 
 
The HIPDB Contains Reports on Adverse Actions Taken Against DME Suppliers  
As of April 1, 2012, the HIPDB contained reports on 6,761 adverse actions against DME 
suppliers, or more than 1,600 additional adverse actions since the data reported in our 
2010 report.  CMS reported 734 adverse actions against DME suppliers in 2010 and 
796 adverse actions in 2011; as of April 1, 2012, CMS had reported 107 adverse actions 
in 2012.  As of April 30, 2009, the HIPDB contained reports on 5,125 adverse actions 
taken against DME suppliers from 1998 through 2008,5 which averages approximately 
466 per year during that period.  Additionally, the submission dates of adverse action 
reports reflect reports being made throughout the year, rather than in batches on a 
periodic basis.  The number, frequency, and types of reports indicate compliance with 
Federal requirements. 
   
                                                 
2 45 CFR  61.5. 
3 45 CFR  61.6(b); HIPDB Guidebook, pp. E-5 and E-15.  Accessed at http://www.npdb-hipdb.hrsa.gov/ on 
April 20, 2012. 
4
 HIPDB Guidebook, p. E-14.  Accessed at http://www.npdb-hipdb.hrsa.gov/on April 20, 2012. 
5
 As of April 1, 2012, the HIPDB contained 5,124 adverse actions against DME suppliers reported between 1998 
through 2008, indicating that one report from this time period was removed between 2009 and 2012. 
CMS Reporting to the Healthcare Integrity and Protection Data Bank (OEI-07-09-00292)    Page 4  Marilyn Tavenner 
 
The HIPDB Contains No Reports of Nursing Home Terminations Since June 2010 
As of April 1, 2012, the HIPDB contained 84 adverse actions against nursing homes; 
CMS reported 45 adverse actions on September 30, 2009, and 39 actions on 
June 23, 2010.  In 2009 and 2010, CMS reported annually on terminations.  However, 
annual reporting of nursing home terminations does not comply with the 
timeframe-related reporting requirements in 45 CFR  61.5.  Additionally, no further 
adverse actions were reported after June 23, 2010, which indicates that CMS may no 
longer be reporting any nursing home terminations to the HIPDB. 
 
The HIPDB Still Does Not Contain Adverse Actions Taken Against Certain Types 
of Providers 
As of April 1, 2012, the HIPDB still did not contain adverse actions that CMS imposed 
against a variety of provider types, including laboratories, managed care plans, and 
prescription drug plans.  The HIPDB is still missing reports of specific adverse actions 
we identified in our 2010 report, including:  148 adverse actions against laboratories in 
2007; 30 adverse actions against managed care and prescription drug plans between 
January 1, 2006, and March 7, 2009; and an unknown number of civil monetary penalties 
against nursing homes.6  In addition to missing these earlier adverse actions, the HIPDB 
does not contain any subsequent reports against these types of providers, which indicates 
that CMS does not report as required. 
 
CONCLUSION 
 
Federal law requires the reporting of certain adverse actions taken against health care 
providers to be reported to the HIPDB.  Complete and accurate HIPDB information helps 
prevent the employment of potentially fraudulent or abusive providers.  When HRSA 
promulgates final regulations to transfer the data in the HIPDB to the NPDB, CMS will 
be required to report to the NPDB certain adverse actions that the agency is currently 
required to report to the HIPDB.  We conclude from our followup review that CMS has 
not fully addressed our 2010 report recommendation to report required adverse actions to 
the HIPDB. 
 
This report contains no new recommendations; however, our 2010 recommendation that 
CMS should report all adverse actions as required remains open.  In its 2011 update to 
OIGs Compendium of Unimplemented Recommendations, CMS did not provide 
information on its efforts to report adverse actions.  This report is being issued directly in 
final form because it contains no recommendations.  If you have comments or questions 
about this report, please provide them within 60 days.  Please refer to report number 
OEI-07-09-00292 in all correspondence.   
 
cc:  HRSA 
                                                 
6 The CMS Office of Financial Management collected more than $37 million in civil monetary penalties in fiscal 
year 2008.  CMS officials estimated that 85 percent of this amount was from nursing homes.  
CMS Reporting to the Healthcare Integrity and Protection Data Bank (OEI-07-09-00292)