GENERAL COMPLIANCE PROGRAMGUIDANCE
(COVER TITLE PAGE) Users Guide
WelcometoOIGsGeneralComplianceProgramGuidance
(GCPG).
TheGCPGisareferenceguideforthehealthcare
compliancecommunityandotherhealthcarestakeholders.
TheGCPGprovidesinformationaboutrelevantFederal
laws,complianceprograminfrastructure,OIGresources,
andotherinformationusefultounderstandinghealthcare
compliance.
TheGCPGisvoluntaryguidancethatdiscussesgeneral
compliancerisksandcomplianceprograms. TheGCPGisnotbindingonanyindividualor
entity. Ofnote,OIGusesthewordshouldintheGCPGtopresentvoluntary,nonbinding
guidance.
TheGCPGsdetailedtableofcontentsallowstheusertodirectlyaccessthespecifictopicthey
areinterestedin,suchastheFederalanti-kickbackstatute,thecomplianceofficerrole,or
qualityconsiderations. ManysectionscontainlinkstootherpartsoftheGCPG,OIGswebsite,
orotherInternetlocationsthatcontainusefulinformation,includingrelatedtopicswithinthe
GCPG,OIGcomplianceresources,thecurrenttextoflawsandregulations,andother
informationOIGbelievesusersmayfindvaluable.
TheGCPGmaybeaccessedontheInternet,downloadedtotheuserscomputer,orprintedand
distributedinhardcopy. UsingtheGCPGonacomputerwillallowtheusertoefficiently
navigatetheGCPGandaccessthelinksOIGhasembeddedthroughoutthedocument.
TheGCPGcontainssomeuniquedefinedterms. Thesetermsarehyperlinkedtotheir
definition. UserswhochoosetoprintahardcopyofoneormoresectionsoftheGCPG,butnot
theGCPGinitsentirety,shouldbemindfulthatthedefinitionsmaynotbecontainedinthe
printedsections. Usersshouldconsidercopyingdefinitionsofanytermsdefinedoutsideof
theirindividualizedsectionsandincludingthosedefinitionswiththehard-copydocument.
UserswhoreadtheGCPGfrombeginningtoendmayfindthatitrepeatscertaininformation.
ThisisbecauseOIGrecognizesthatusersmayread,ormaylaterreference,specificsections
only,andnotthewholedocument. Therefore,relevantinformationmaybeincludedand
repeatedinmultiplesections. Table of Contents
I.Introduction.................................................................................................................................6
A.OIGsHistoryofComplianceProgramGuidance:CommitmenttoPreventingHealthCare
FraudandAbuse.........................................................................................................................6
B.OIGsCurrentComplianceGuidanceApproach: ARoadmapGoingForward.......................6
C.ApplicationoftheGCPGandICPGs........................................................................................8
II.HealthCareFraudEnforcementandOtherStandards:OverviewofCertainFederalLaws....10
A.FederalAnti-KickbackStatute...............................................................................................10
KeyQuestions.......................................................................................................................12
B.PhysicianSelf-ReferralLaw...................................................................................................15
C.FalseClaimsAct....................................................................................................................17
D.CivilMonetaryPenaltyAuthorities......................................................................................19
1.BeneficiaryInducementsCMP..........................................................................................20
2.InformationBlocking.........................................................................................................22
3.CMPAuthorityRelatedtoHHSGrants,Contracts,and OtherAgreements....................23
E.ExclusionAuthorities.............................................................................................................24
F.CriminalHealthCareFraudStatute......................................................................................28
G.HIPAAPrivacyandSecurityRules.........................................................................................28
III.ComplianceProgramInfrastructure:TheSevenElements......................................................32
Element1WrittenPoliciesandProcedures..........................................................................33
1.CodeofConduct................................................................................................................33
2.CompliancePoliciesandProcedures................................................................................34
PolicyMaintenance...............................................................................................................35
B.Element2ComplianceLeadershipandOversight.............................................................37
1.ComplianceOfficer............................................................................................................37
2.ComplianceCommittee....................................................................................................40
3.BoardComplianceOversight............................................................................................43
C.Element3TrainingandEducation.....................................................................................46 D.Element4EffectiveLinesofCommunicationwiththeComplianceOfficerandDisclosure
Programs...................................................................................................................................50
E.Element5EnforcingStandards: ConsequencesandIncentives.......................................53
1.Consequences...................................................................................................................53
2.Incentives..........................................................................................................................54
F.Element6RiskAssessment,Auditing,andMonitoring.....................................................55
1.RiskAssessment................................................................................................................55
2.AuditingandMonitoring...................................................................................................58
G.Element7RespondingtoDetectedOffensesandDevelopingCorrective
ActionInitiatives.......................................................................................................................59
1.InvestigationsofViolations...............................................................................................60
2.ReportingtotheGovernment..........................................................................................61
3.ImplementingCorrectiveActionInitiatives......................................................................63
IV.ComplianceProgramAdaptationsforSmallandLargeEntities..............................................65
A.ComplianceProgramsforSmallEntities..............................................................................65
1.ComplianceContact..........................................................................................................65
2.Policies,Procedures,andTraining....................................................................................66
3.OpenLinesofCommunication..........................................................................................67
4.RiskAssessment,Auditing,andMonitoring.....................................................................68
5.EnforcingStandards..........................................................................................................70
6.RespondingtoDetectedOffensesandDeveloping CorrectiveActionInitiatives...........70
B.ComplianceLeadershipforLargeEntities............................................................................71
1.ComplianceOfficer............................................................................................................71
2.ComplianceCommittee....................................................................................................73
3.BoardComplianceOversight............................................................................................73
V.OtherComplianceConsiderations............................................................................................76
A.QualityandPatientSafety....................................................................................................76
B.NewEntrantsintheHealthCareIndustry............................................................................78
C.FinancialIncentives:OwnershipandPayment FollowtheMoney...................................79
1.Ownership,includingPrivateEquityandOthers..............................................................79
2.PaymentIncentives...........................................................................................................79 D.FinancialArrangementsTracking.........................................................................................80
VI.OIGResourcesandProcesses..................................................................................................82
A.ComplianceToolkits;ComplianceResourcesforHealthCareBoards;ProviderCompliance
Training;ARoadmapforNewPhysicians;andRAT-STATSStatisticalSoftware......................82
B.OIGReportsandPublications...............................................................................................83
C.AdvisoryOpinions;SpecialFraudAlerts,Bulletins,andOtherGuidance;andSafeHarbor
Regulations................................................................................................................................84
1.AdvisoryOpinions.............................................................................................................84
2.SpecialFraudAlerts,Bulletins,andOtherGuidance;andSafeHarborRegulations........85
D.FrequentlyAskedQuestions.................................................................................................85
E.CorporateIntegrityAgreements...........................................................................................86
F.EnforcementActionSummaries...........................................................................................87
G.OIGSelf-DisclosureInformation...........................................................................................87
H.OIGHotline...........................................................................................................................88
VII.Conclusion...............................................................................................................................90
Definitions.....................................................................................................................................91 6
I. Introduction
Sinceitsestablishmentin1976andconsistentwithits
statutorycharge,theDepartmentofHealthandHuman Who We Are
Services(HHS)OfficeofInspectorGeneral(OIG)hasbeenat
theforefrontoftheNationseffortstofightfraud,waste,and
abuseandimprovetheefficiencyofMedicare,Medicaid,andmorethan100otherHHS
programs. OIGisthelargestcivilianinspectorgeneralsofficeintheFederalGovernment.
A. OIGs History of Compliance Program Guidance:
Commitment to Preventing Health Care Fraud and Abuse
OIGdevelopedcomplianceprogramguidancedocuments
(CPGs)asvoluntary,nonbindingguidancedocumentsto Existing Compliance
supporthealthcareindustrystakeholdersintheireffortsto Program Guidance
self-monitorcompliancewithapplicablelawsandprogram
requirements. TheseincludeCPGsdirectedat:(1)hospitals;
(2)homehealthagencies;(3)clinicallaboratories;(4)third-partymedicalbillingcompanies;
(5)thedurablemedicalequipment,prosthetics,orthotics,andsupplyindustry;(6)hospices;
(7)MedicareAdvantage(formerlyknownasMedicare+Choice)organizations;(8)nursing
facilities;(9)physicians;(10)ambulancesuppliers;and(11)pharmaceuticalmanufacturers.
B. OIGs Current Compliance Guidance Approach:
A Roadmap Going Forward
BasedonfeedbackreceivedaspartofOIGsModernizationInitiative andotherinput,we
understandthatCPGshaveservedasanimportantandvaluableOIGresourceforthehealth
carecompliancecommunityandindustrystakeholderssincepublicationofthefirstCPGin
1998. OIGhascarefullyconsideredwaystoimproveandupdateexistingCPGsandtodeliver
newCPGsspecifictosegmentsofthehealthcareindustryandtoentitiesinvolvedinthehealth
careindustrythathaveemergedinthepasttwodecades. InmodernizingOIGsCPGs,ourgoal
istoproduceuseful,informativeresourcestohelpadvancetheindustrysvoluntarycompliance
effortsinpreventingfraud,waste,andabuseinthehealthcaresystem.
Inanefforttoproduceuser-friendlyandaccessibleinformationandtopromotegreater
flexibilitytoupdateCPGsasnewriskareasemerge,OIGwillnolongerpublishupdatedornew 7
CPGsintheOIGwillnolongerpublishupdatedornewCPGsintheFederalRegister. Allcurrent,
updated,andnewCPGswillbeavailableonourwebsitewithinteractivelinkstoresources. OIG
isusingthefollowingformattomakeourguidance
moreuser-friendlyandaccessible:
GCPG
 KeyFederalauthoritiesfor
First,ourGeneralCPG(GCPG)appliestoall
entitiesengagedinhealth
individualsandentitiesinvolvedinthehealthcare
carebusiness
industry. TheGCPGaddresses:keyFederal  Sevenelementsofacompliance
authoritiesforentitiesengagedinhealthcare program
business;thesevenelementsofacompliance  Adaptationsforsmallandlarge
program;adaptationsforsmallandlargeentities; entities
othercomplianceconsiderations;andOIGprocesses  Othercomplianceconsiderations
 OIGprocessandresources
andresources. WeanticipateupdatingtheGCPGas
changesincompliancepracticesorlegal ICPGs
requirementsmaywarrant.
 Fordifferenttypesofproviders,
suppliers,andotherparticipants
Second,startingin2024,wewillbepublishing inhealthcareindustrysubsectors
industrysegment-specificCPGs(ICPGs)fordifferent orancillaryindustrysectors
typesofproviders,suppliers,andotherparticipants  Tailoredtofraudandabuserisk
areasforeachindustrysubsector
inhealthcareindustrysubsectorsorancillary
 Compliancemeasuresthat
industrysectorsrelatingtoFederalhealthcare
participantscantaketoreduce
programs. ICPGswillbetailoredtofraudandabuse
risk.
riskareasforeachindustrysubsectorandwill
addresscompliancemeasuresthattheindustry
subsectorparticipantscantaketoreducetheserisks. ICPGsareintendedtobeupdated
periodicallytoaddressnewlyidentifiedriskareasandcompliancemeasuresandtoensure
timelyandmeaningfulguidancefromOIG.
OIGwelcomesfeedbackfromthehealthcarecommunityandotherstakeholdersin
connectionwiththeGCPGandforthcomingICPGs. Wehavedesignatedanemailinboxat
Compliance@oig.hhs.govwhereanysuchfeedbackcanbesubmitted. 8
It is important to note that OIG has several options for receiving
communications about questions unrelated to the GCPG or ICPGs.
For example, questions regarding exclusions can be directed to
exclusions@oig.hhs.gov, and questions of a general nature can be
directed to Public.Affairs@oig.hhs.gov. For a full list of how best to
contact OIG, see the agencys Contact Uswebsite.
FortheGCPG,thetypeoffeedbacksoughtincludesgeneralcomplianceconsiderationsand
suggestionsforgeneralriskareastoincludeintheGCPGorotherresources. FortheICPGs,we
areseekingsuggestionsforriskareasspecificallyrelatedtothedifferenttypesofproviders,
suppliers,andotherparticipantsinhealthcareindustrysubsectorsorancillaryindustrysectors
thatareaddressedinaparticularICPG. Submissionswillgenerateanautomatedconfirmation
ofreceipt,whichwillbetheonlyresponsetoasubmissionunlessadditionalfollow-upis
needed. Inthatinstance,OIGmayreachoutdirectlytothesenderfortherelevantsubmission.
C. Application of the GCPG and ICPGs
OIGsexistingCPGs,thisGCPG,andourforthcomingICPGsdonot
constituteamodelcomplianceprogram. TheGCPGandICPGs
areforuseasaresourcebythehealthcarecommunity;theyare
notintendedtobeone-size-fits-all,completelycomprehensive,
orall-inclusiveofcomplianceconsiderationsandfraudandabuse
risksforeveryorganization. Rather,thegoalofthesedocuments
hasbeen,andwillcontinuetobe,tosetforthvoluntary
complianceguidelinesandtipsandtoidentifysomeriskareas
thatOIGbelievesindividualsandentitiesengagedinthehealth
careindustryshouldconsiderwhendevelopingand
implementinganewcomplianceprogramorevaluatingand
updatinganexistingone. OurexistingCPGsandsupplementalCPGswillremainavailablefor
useasanongoingresourcetohelpidentifyriskareasinparticularindustrysubsectorsaswe
developtheICPGs. ExistingCPGswillbearchivedbutstillavailableonourwebsitewhenICPGs
areissued. SECTION II
Health Care Fraud Enforcement and
Other Standards: Overview of Certain
Federal Laws 10
II. Health Care Fraud Enforcement and
Other Standards: Overview of Certain
Federal Laws
Thisguidancedoesnotcreateanynewlaworlegalobligations,andthediscussionsinthis
guidancearenotintendedtopresentdetailedorcomprehensivesummariesoflawfulor
unlawfulactivity.
Criticaltounderstandingcompliancerisksandtheframeworkoverlayingcomplianceprograms
isaworkingknowledgeofapplicablelaw. Consequently,theGCPGbeginswithanoverviewof
certainFederalauthoritiesthatmayapplytoentitiesinvolvedinhealthcare,whichincludethe
primaryFederalfraudandabuselawsandtheHealthInsurancePortabilityandAccountability
Actof1996(HIPAA)PrivacyandSecurityRules. Theseoverviewsareintendedtobesummaries
onlyandtheydonotaddresseverylegalobligationthatmaybeimposedonthehealthcare
communityandaffiliatedpartners. Forexample,wenotethatthisguidanceandtheselegal
overviewsdonotaddressStatefraudandabuselaws. Inaddition,theseoverviewsdonot
establishorinterpretanyprogramrulesorregulations. Ourgoalinsummarizingcertainkey
Federalauthoritiesistocreateawarenessandprovidetoolsandresourcestoaidcompliance
effortsinbothpreventingviolationsandidentifyingpotentialredflagsearlywithrespectto
theselawsandregulations. Governmentagencies,includingtheDepartmentofJustice(DOJ),
OIG,theCentersforMedicare&MedicaidServices(CMS),andtheHHSOfficeforCivilRights
(OCR),arechargedwithinterpretingandenforcingtheselawsandregulations. Itiscrucialto
understandtheseauthoritiesnotonlybecausefollowingthemistherightthingtodo,butalso
becauseviolatingthemcouldresultinanobligationtorepayoverpayments,criminalpenalties,
civiloradministrativefines,andexclusionfromtheFederalhealthcareprograms.
A. Federal Anti-Kickback Statute
TheFederalanti-kickbackstatuteprohibitsentitiesinvolvedinFederalhealthcareprogram
businessfromengaginginsomepracticesthatarecommoninotherbusinesssectors,suchas
offeringorreceivinggiftstorewardpastorfuturereferrals. Asageneralmatter,theFederal
anti-kickbackstatuteisanintent-based,criminalstatutethatprohibitsremuneration,whether
monetary,in-kind,orinotherforms,inexchangeforreferralsofFederalhealthcareprogram
business. Morespecifically,undertheFederalanti-kickbackstatute,itisacriminaloffenseto 11
knowinglyandwillfullyoffer,pay,solicit,orreceiveanyremunerationtoinduce,orinreturn
for,thereferralofanindividualtoapersonforthefurnishingof,orarrangingforthefurnishing
of,anyitemorservicereimbursableunderaFederalhealthcareprogram.1 Thestatutes
prohibitionalsoextendstoremunerationtoinduce,orinreturnfor,thepurchasing,leasing,or
orderingof,orarrangingfororrecommendingthepurchasing,leasing,ororderingof,any
good,facility,service,oritemreimbursablebyaFederalhealthcareprogram.2 Thestatute
coversactivityoccurringdirectlyorindirectlyaswellasovertlyorcovertlyinallinstances.
ForpurposesoftheFederalanti-kickbackstatute,remunerationincludesanythingofvalue,
whetherincash,inkind,orotherform. Bywayofexampleonly,remunerationmaytakethe
formofcash,cashequivalents,cost-sharingwaiversorsubsidies,anopportunitytoearnafee,
items,space,equipment,andservicesregardlessoftheamountofremunerationandin
somecircumstances,wheretheremunerationhasbeendeterminedtobefairmarketvaluein
anarms-lengthtransaction. Thestatutehasbeeninterpretedtocoveranyarrangementwhere
onepurposeoftheremunerationistoinducereferralsforitemsorservicesreimbursablebya
Federalhealthcareprogram.3
ViolationoftheFederalanti-kickbackstatuteconstitutesafelonypunishablebyamaximum
fineof$100,000,imprisonmentupto10years,orboth. Convictionalsowillleadtomandatory
exclusionfromFederalhealthcareprograms,includingMedicareandMedicaid. Liabilityunder
theFederalanti-kickbackstatuteisdeterminedseparatelyforeachpartyinvolved. Inaddition,
apersonwhocommitsanactdescribedinsection1128B(b)oftheSocialSecurityAct(the
Act)maybesubjecttoFalseClaimsActliability4andcivilmonetarypenalties(CMPs).5 OIG
alsomayinitiateadministrativeproceedingstoexcludesuchpersonfromFederalhealthcare
programs.6
CongresshasdevelopedseveralstatutoryexceptionstotheFederalanti-kickbackstatute.7 OIG
haspromulgatedsafeharborregulationsthatspecifycertainpracticesthatarenottreatedas
anoffenseundertheFederalanti-kickbackstatuteanddonotserveasthebasisforan
1Section1128B(b)oftheSocialSecurityAct(theAct),42U.S.C.1320a-7b(b).
2Section1128B(b)oftheAct,42U.S.C.1320a-7b(b).
3E.g.,UnitedStatesv.Nagelvoort,856F.3d1117(7thCir.2017);UnitedStatesv.McClatchey,217F.3d823(10th
Cir.2000);UnitedStatesv.Davis,132F.3d1092(5thCir.1998);UnitedStatesv.Kats,871F.2d105(9thCir.1989);
UnitedStatesv.Greber,760F.2d68(3dCir.1985).
431U.S.C.37293733.
5Section1128A(a)(7)oftheAct,42U.S.C.1320a-7a(a)(7).
6Section1128(b)(7)oftheAct,42U.S.C.1320a-7(b)(7).
7Section1128B(b)(3)oftheAct,42U.S.C.1320a-7b(b)(3). 12
exclusion.8 Inshort,thesafeharbors
Individuals and entities
protectremunerationfromresultingin
should evaluate arrangements
liabilityunderthestatute. Compliance
withasafeharborisvoluntary. Safe that implicate the statute and
harborprotectionisaffordedonlyto do not fit into a safe harbor by
thosearrangementsthatsquarelymeet
reviewing the totality of the
allconditionssetforthinthesafe
facts and circumstances,
harbor;theprotectionnolongerapplies
ifevenoneconditionisnotmet. That including the intent of
said,failuretomeetasafeharbordoes the parties.
notrenderanarrangement
automaticallyillegal. Individualsandentitiesshouldevaluatearrangementsthatimplicatethe
statuteanddonotfitintoasafeharborbyreviewingthetotalityofthefactsand
circumstances,includingtheintentoftheparties.
When attempting to identify problematic
arrangements under the Federal anti-kickback
statute, some relevant inquiries to explore and
consider can include the following. Thislistofquestionsisillustrative,notexhaustive,
andtheanswerstothesequestionsalonearenotdeterminativeastowhetheranarrangement
violatestheFederalanti-kickbackstatute.
Key Questions
Nature of the relationship between the parties.
 Whatdegreeofinfluencedothepartieshave,directlyorindirectly,onthegenerationof
Federalhealthcareprogrambusinessforeachother?
Manner in which participants were selected.
 Werepartiesselectedtoparticipateinanarrangementinwholeorinpartbecauseof
theirpastoranticipatedreferrals?
Manner in which the remuneration is determined.
 Doestheremunerationtakeintoaccount,eitherdirectlyorindirectly,thevolumeor
valueofbusinessgenerated?
842C.F.R.1001.952. OIGmostrecentlypublishedafinalrule,RevisionstoSafeHarborsUndertheAnti-Kickback
Statute,andCivilMonetaryPenaltyRulesRegardingBeneficiaryInducements,85Fed.Reg77684(Dec.2,2020)
(theOIGFinalRule),whichimplementedsevennewsafeharbors,modifiedfourexistingsafeharbors,and
codifiedonenewexceptionundertheCMPprovisionprohibitinginducementstobeneficiaries. 13
 Istheremunerationconditionedinwholeorinpartonreferralsorotherbusiness
generatedbetweentheparties?
Isthearrangementitselfconditioned,eitherdirectlyorindirectly,onthevolumeor
valueofFederalhealthcareprogrambusiness? Isthereanyserviceprovidedotherthan
referrals?
Value of the remuneration.
 Istheremunerationfairmarketvalueinanarms-lengthtransactionforlegitimate,
reasonable,andnecessaryservicesthatareactuallyrendered?
 Istheentitypayinganinflatedratetoapotentialreferralsource?
Istheentityreceivingfreeorbelow-market-rateitemsorservicesfromaprovider,
supplier,orotherentityinvolvedinhealthcarebusiness?
 Iscompensationtied,eitherdirectlyorindirectly,toFederalhealthcareprogram
reimbursement?
 Isthedeterminationoffairmarketvaluebaseduponareasonablemethodologythatis
uniformlyappliedandproperlydocumented?
Nature of items or services provided.
 Aretheitemsandservicesactuallyneededandrendered,commerciallyreasonable,and
necessarytoachievealegitimatebusinesspurpose?
Federal program impact.
 DoestheremunerationhavethepotentialtoaffectcoststoanyoftheFederalhealth
careprogramsortheirbeneficiaries?
 Couldtheremunerationleadtooverutilizationorinappropriateutilization?
Clinical decision making.
 Doesthearrangementorpracticehavethepotentialtointerferewith,orskew,clinical
decisionmaking?
 Doesthearrangementorpracticeraisepatientsafetyorqualityofcareconcerns?
 Couldthepaymentstructureleadtocherry-pickinghealthypatientsorlemon-dropping
patientswithchronicorotherpotentiallycostlyconditionstosaveoncosts?
Steering.
 Doesthearrangementorpracticeraiseconcernsrelatedtosteeringpatientsorhealth
careentitiestoaparticularitemorservice,orsteeringtoaparticularhealthcareentity
toprovide,supply,orfurnishitemsorservices?
Potential conflicts of interest.
 Wouldacceptanceoftheremunerationdiminish,orappeartodiminish,theobjectivity
ofprofessionaljudgment? 14
 Iftheremunerationrelatestothedisseminationofinformation,istheinformation
complete,accurate,andnotmisleading?
Manner in which the arrangement is documented.
 Isthearrangementproperlyandfullydocumentedinwriting?
 Arethepartiesdocumentingtheitemsandservicestheyprovide? Aretheentities
monitoringitemsandservicesprovided?
 Arearrangementsactuallyconductedaccordingtothetermsofthewrittenagreements
(whenwrittentocomplywiththelaw)?
Individualsorentitiesthathaveidentifiedpotentially
problematicarrangementsorpractices,throughthese
inquiriesorotherinquiries,cantakeseveralstepsto
reduceoreliminatetheriskofaFederalanti-kickbackstatuteviolation,includingevaluating
whetheranarrangementcanbestructuredorrestructuredtofitwithinasafeharbor. Ifaparty
determines,throughself-discoveredevidence,thatithasengagedinproblematicconduct
undertheFederalanti-kickbackstatuteandwouldliketoresolvepotentialCMPliabilitywith
OIG,theHealthCareFraudSelf-DisclosureProtocolisavailabletohealthcareproviders,
suppliers,orotherindividualsorentitiessubjecttoCMPstovoluntarilyself-disclosethe
evidenceofpotentialfraud. MoredetailedinformationabouttheOIGHealthCareFraudSelf-
DisclosureProtocolisavailablehere. 15
B. Physician Self-Referral Law
TheFederalphysicianself-referral(PSL)law,alsoknownastheStarklaw,prohibitsa
physicianfrommakingreferralsforcertaindesignatedhealthservices(DHS)payableby
Medicare9toanentitywithwhichthephysician(oranimmediatefamilymember)hasa
financialrelationship,unlessanexceptionappliesanditsrequirementsaresatisfied.10 Financial
relationshipsincludeownershipandinvestmentinterestsaswellascompensation
arrangements. Forexample,ifaphysicianinvestsinanimagingcentertowhichthephysician
refersMedicarebeneficiariesforDHS,thePSLrequiresthatthefinancialrelationshipsatisfies
allrequirementsofanapplicableexception. Ifitdoesnot,thePSLprohibitsthephysicianfrom
makingareferralforDHStobefurnishedbytheimagingcenterandprohibitstheimaging
centerfrombillingMedicare(oranyindividual,third-partypayor,orotherentity)forthe
improperlyreferredDHS.
Designated health services are:
 clinicallaboratoryservices;  parenteralandenteralnutrients,
equipment,andsupplies;
 physicaltherapy,occupationaltherapy,
andoutpatientspeech-language  prosthetics,orthotics,andprosthetic
pathologyservices; devicesandsupplies;
 radiologyandcertainotherimaging  homehealthservices;
services;
 outpatientprescriptiondrugs;and
 radiationtherapyservicesandsupplies;
 inpatientandoutpatienthospital
 durablemedicalequipmentand services.
supplies;
BecauseCMSsregulationsdefinecertaincategoriesofDHSbyCurrentProceduralTerminology
(CPT)andHealthcareCommonProcedureCodingSystem(HCPCS)codes,CMSpublishesan
updatedlistofcodesfortherelevantDHSannually.
9In1993,section13624oftheOmnibusBudgetReconciliationAct(P.L.No.103-66),ApplicationofMedicare
RulesLimitingCertainPhysicianReferrals,addedanewparagraph(s)tosection1903oftheAct,toextendaspects
ofthephysicianself-referralprohibitionstoMedicaid. Thissectioninpartstatesthatnopaymentshallbemade
toaStateunderthissectionforexpendituresformedicalassistanceundertheStateplanconsistingofa
designatedhealthservice(asdefinedinsubsection(h)(6)ofsection1877)furnishedtoanindividualonthebasisof
areferralthatwouldresultinthedenialofpayment.
10Section1877oftheAct,42U.S.C.1395nn;42C.F.R.411.35011.389. 16
WhenanalyzinganarrangementunderthePSL,itisimportanttodeterminewhethercertain
keyelementsarepresent. ThePSLisimplicatedonlywhenallsixofthefollowingelementsare
present:11
1. Aphysician 6. Withwhichthephysician(oranimmediate
familymember)orthephysicianorganization
2. Makesareferral
inwhoseshoesthephysicianstandshasa
3. Fordesignatedhealthservices financialrelationship(whichcouldbeadirect
orindirectownershiporinvestmentinterestin
4. PayablebyMedicare
theentityoracompensationarrangement
5. Toanentity
withtheentity).
Whereallsixelementsexist,thePSLprohibitsaphysicianfrommakingareferralforDHStothe
entitywithwhichtheyhavethefinancialrelationshipunlessanexceptionappliesandits
requirementsaresatisfied.
ThePSLisastrict-liabilitystatute,whichmeansproofofintenttoviolatethelawisnot
required. PenaltiesforphysiciansandentitiesthatviolatethePSLincludefinesaswellas
exclusionfromparticipationintheFederalhealthcareprograms.12
Here are some examples of referrals that are likely to be prohibited
under the PSL:
 Dr.Xworksinaphysicianpracticelocatedinamajorcity. Dr.Xssisterownsafree-
standinglaboratorylocatedinthesamecity. Dr.Xrefersallordersforclinical
laboratorytestsonMedicarepatientstothesistersfree-standinglaboratory.
 Dr.Yagreedtoserveasthemedicaldirectorofahomehealthagency(HHA)andwas
paidasumsubstantiallyabovethefairmarketvaluefortheirservices. Dr.Yroutinely
referredMedicarepatientstotheHHAforhomehealthservices.
 After10yearsofhavingDr.Zonitsmedicalstaff,ahospitalbeganpayingDr.Za
monthlystipendof$500toassistinmeetingpracticeexpenses. Dr.Zperformsno
specificserviceforthestipendandhasnoobligationtorepaythehospital. Dr.Zrefers
Medicarepatientstothehospitalforinpatientsurgery.
11DefinitionsandexceptionstothePSLarefoundatSection1877oftheAct,42U.S.C.1395nnandat42C.F.R.
411.350411.389.
12ViolationsofthePSLsubjectthebillingentitytodenialofpaymentfortheDHS,refundofamountscollected
fromimproperlysubmittedclaims,andaCMPofupto$15,000foreachimproperclaimsubmitted. Physicians
whoviolatethePSLmayalsobesubjecttoadditionalfinesperprohibitedreferral. Also,providersthatenterinto
anarrangementthattheyknoworshouldknowcircumventsthelawmaybesubjecttoaCMPofupto$100,000
perarrangement. Section1877(g)oftheAct,42U.S.C.1395nn. 17
Fromacomplianceperspective,itisimportantfor
entitiesthatfurnishDHStohaveamethodtokeeptrack
of,andreviewclosely,theirfinancialrelationshipswith
physicianswhoreferMedicarepatientstothem. CMS,whichistheGovernmentagency
chargedwithinterpretingthePSL,hasaCMSVoluntarySelf-ReferralDisclosureProtocol(SRDP)
thatenablesprovidersofservicesandsupplierstoself-discloseactualorpotentialviolationsof
thePSL.13 VisitCMSSRDPFAQsforadditionalguidanceandinformationabouttheSRDP.
ThroughtheSRDP,CMShastheauthoritytoreducetheamountdueandowingforPSL
violations. ForadditionalinformationregardingthePSL,includingFAQs,visit CMSsPhysician
Self-Referralwebsite.
It is important to understand that the PSL and the Federal anti-
kickback statute are two different laws requiring separate
evaluations. Once an arrangement that may implicate the PSL,
the Federal anti-kickback statute, or both is identified, it is usually
best to start with an assessment under the PSL because it is a
strict liability statute. If the arrangement is permissible under the
PSL, it still needs to be analyzed for compliance with the Federal
anti-kickback statute.
C. False Claims Act
ThecivilFalseClaimsActprovidesawayfortheGovernmenttorecovermoneywhenan
individualorentityknowinglysubmitsorcausestobesubmittedfalseorfraudulentclaimsfor
paymenttotheGovernment. TheFalseClaimsAct,14amongotherthings,prohibits:
 knowinglypresentingorcausingtobepresentedtotheFederalGovernmentafalseor
fraudulentclaimforpaymentorapproval;
 knowinglymakingorusingorcausingtobemadeorusedafalserecordorstatementto
haveafalseorfraudulentclaimpaidorapprovedbytheGovernment;and
13PSLviolationsmaygiverisetoFCAviolations,asdescribedinII.C.FalseClaimsAct.
1431U.S.C.37293733. 18
 knowinglymakingorusingorcausingtobemadeorusedafalserecordorstatementto
conceal,avoid,ordecreaseanobligationtopayortransmitmoneyorpropertytothe
Government.
TheFalseClaimsActdefinesknowingandknowinglytomeanthataperson,withrespect
toinformation(i)hasactualknowledgeoftheinformation;(ii)actsindeliberateignoranceof
thetruthorfalsityoftheinformation;or(iii)actsinrecklessdisregardofthetruthorfalsityof
theinformation;and...noproofofspecificintenttodefraudisrequired.15 Inshort,theFalse
ClaimsActdefinesknowingandknowinglytoincludenotonlyactualknowledgebutalso
instancesinwhichthepersonactedindeliberateignoranceorrecklessdisregardofthetruthor
falsityoftheinformation. Thismeansindividualsandentitiescannotavoidliabilityby
deliberatelyignoringinaccuraciesintheirclaims.
Filingfalseclaimsmayresultinliabilityofuptothreetimestheprogramslossplusan
additionalpenaltyperclaimfiled.16 UndertheFalseClaimsAct,eachinstanceofanitemora
servicebilledtoMedicareorMedicaidcountsasaclaim,soliabilitycanaddupquickly. Afew
examplesofhealthcareclaimsthatmaybefalseincludeclaimswheretheserviceisnotactually
renderedtothepatient,isalreadyprovidedunderanotherclaim,isupcoded,orisnot
supportedbythepatientsmedicalrecord. Aclaimthatistaintedbyillegalremunerationunder
theFederalanti-kickbackstatuteorsubmittedinviolationofthePSLisalsofalseorfraudulent,
creatingliabilityunderthecivilFalseClaimsAct.
Further,theFalseClaimsActcontainsawhistleblowerprovisionthatallowsaprivateindividual
tofilealawsuitonbehalfoftheUnitedStatesand,ifappropriate,entitlesthatwhistleblowerto
apercentageofanyrecoveries. Anyonewithknowledgeofpotentialfraudcanbea
whistleblower,includingcurrentorex-businesspartners,hospitalorofficestaff,patients,or
competitors. ThereisalsoacriminalFalseClaimsAct;17criminalpenaltiesforsubmittingfalse
claimsincludeimprisonmentandcriminalfines.
1531U.S.C.3729(b).
16PerclaimpenaltyamountsareupdatedperiodicallyandpublishedintheFederalRegister(e.g.,88Fed.Reg.
5776(Jan.30,2023)).
1718U.S.C.287. 19
Healthcareprovidersandother
If an entity identifies billing
industrystakeholdersshouldtake
mistakes or other non-compliance
proactivemeasurestoensure
compliancewithprogramrules, with program rules leading to an
includingregularreviewstokeep overpayment, the entity must
billingandcodingpracticesup-to-
repay the overpayments to
dateaswellasregularinternal
Medicare and Medicaid to avoid
billingandcodingaudits. Evenif
anentitymakesaninnocentbilling False Claims Act liability.
mistake,thatentitystillhasan
obligationtorepaythemoneytotheGovernment. TheAffordableCareActincludeda
requirementthatentitiesmustreportandrepayoverpaymentstoMedicareandMedicaidby
thelaterof:(A)thedatewhichis60daysafterthedateonwhichtheoverpaymentwas
identified;or(B)thedateanycorrespondingcostreportisdue,ifapplicable.18 Ifanentity
identifiesbillingmistakesorothernon-compliancewithprogramrulesleadingtoan
overpayment,theentitymustrepaytheoverpaymentstoMedicareandMedicaidtoavoid
FalseClaimsActliability.
D. Civil Monetary Penalty Authorities
OIGisauthorizedtopursuemonetarypenaltiesandexclusionthroughavarietyofcivil
authoritiesmostnotably,theCivilMonetaryPenaltiesLaw(CMPL). UndertheCMPL,OIGcan
pursueassessmentsinlieuofdamages,CMPs,andexclusionfromparticipationintheFederal
healthcareprograms. Withthisauthority,OIGcanaddressawidevarietyofimproperconduct
relatedtoFederalhealthcareprogramsandotherHHSprograms.19 TheCMPLprincipally
addressesfraudulentandabusiveconduct. InadditiontoOIGsCMPauthoritiesthatclosely
paralleltheFalseClaimsAct,OIGhasadditionalCMPauthoritiesaimedatcertainspecifictypes
ofconductuniquetoHHSandtheFederalhealthcareprogramsforexample,thepatient
dumpingCMP.20 WhileFalseClaimsActcasesarepursuedbyDOJonbehalfofHHSin
Federalcourt,CMPcasesareadministrativeandpursuedbyOIGbeforeanHHS
administrativelawjudge. Bystatute,differentcategoriesofconductresultindifferentpenalty
amounts(forexample,falseclaimsresultinpenaltiesofupto$20,000peritemorservice
18Section1128JoftheAct,42U.S.C.1320a-7k(d);seealso,42C.F.R.401.301305.
19SeeOIGCivilMonetaryPenaltyAuthorities.
20EmergencyMedicalTreatment&LaborAct(EMTALA),Section1867(d)(1)oftheAct,42U.S.C.1395dd(d)(1). 20
falselyclaimed,andimproperkickbackconductresultsinpenaltiesofupto$100,000per
violation).21
WeprovidemoredetaileddescriptionsofcertainCMP
authoritiesinthissection,butsomeillustrativeexamplesof
conductthatcouldleadtopotentialCMPliabilityinclude:
 presentingaclaimthatthepersonknowsorshouldknowisforanitemorservicethat
wasnotprovidedasclaimedorisfalseorfraudulent;22
 arrangingfororcontracting(byemploymentorotherwise)withanindividualorentity
thatthepersonknowsorshouldknowisexcludedfromparticipationinaFederalhealth
careprogramforthepurposeofprovidingitemsandservicesforwhichpaymentmaybe
madebyaFederalhealthcareprogram;23
 presentingaclaimforapatternofmedicalorotheritemsorservicesthataperson
knowsorshouldknowarenotmedicallynecessary;24
 committingactsdescribedintheFederalanti-kickbackstatute;25
 failingtoreportandreturnaknownoverpayment;26
 failingtoprovideanadequatemedicalscreeningexaminationforpatientswhopresent
toahospitalemergencydepartmentwithanemergencymedicalconditionorinlabor;27
and
 makingafalserecordorstatementmaterialtoafalseorfraudulentclaimforpayment
foritemsandservicesfurnishedunderaFederalhealthcareprogram.28
1. Beneficiary Inducements CMP
TheBeneficiaryInducementsCMP29providesfortheimpositionofCMPsagainstanyperson
whooffersortransfersremunerationtoaMedicareorStatehealthcareprogramthatthe
personknowsorshouldknowislikelytoinfluencethebeneficiarysselectionofaparticular
21Sections1128A(a)(1)(A)(B)oftheAct,42U.S.C.1320a-7a(a)(1)(A)(B);Section1128A(a)(7)oftheAct,42
U.S.C.1320a-7a(a)(7).
22Sections1128A(a)(1)(A)(B)oftheAct,42U.S.C.1320a-7a(a)(1)(A)(B).
23Section1128A(a)(6)oftheAct,42U.S.C.1320a-7a(a)(6).
24Section1128A(a)(1)(E)oftheAct,42U.S.C.1320a-7a(a)(1)(E).
25Section1128A(a)(7)oftheAct,42U.S.C.1320a-7a(a)(7).
26Section1128A(a)(10)oftheAct,42U.S.C.1320a-7a(a)(10).
27Section1867(d)(1)oftheAct,42U.S.C.1395dd(d)(1).
28Section1128A(a)(12)oftheAct,42U.S.C.1320a-7a(a)(12).
29Section1128A(a)(5)oftheAct,42U.S.C.1320a-7a(a)(5). 21
provider,practitioner,orsupplierfortheorderorreceiptofanyitemorserviceforwhich
paymentmaybemade,inwholeorinpart,byMedicareoraStatehealthcareprogram.
ThereareexceptionstothedefinitionofremunerationundertheBeneficiaryInducements
CMP. Foranyapplicableexceptiontoapply,eachconditionoftheexceptionmustbesquarely
satisfied. Theexceptionsinclude,forexample:
 nonroutinewaiversofcopaymentsanddeductiblesbasedonindividualized
determinationsoffinancialneed;
 preventivecareincentives;
 itemsandservicesthatpromoteaccesstocareandposealowriskofharm;
 retailerrewards;and
 itemsandservicestiedtomedicalcareforfinanciallyneedybeneficiaries.30
TheBeneficiaryInducementsCMPisdistinctfromtheFederalanti-kickbackstatuteandthe
correspondinganti-kickbackCMP,buttheBeneficiaryInducementsCMPandFederalanti-
kickbackstatuteoftenprohibitoverlappingconduct. TheBeneficiaryInducementsCMPisa
separateanddistinctauthority,completelyindependentofthe[Federal]anti-kickback
statute.31 ItisnarrowerthantheFederalanti-kickbackstatuteandtheanti-kickbackCMPin
severalways. Forexample:TheFederalanti-kickbackstatutesprohibitionappliesto
remunerationtoinduceorreward,amongotherthings,referralsofanindividualtoapersonfor
thefurnishingofanyitemorservice,andpurchasesofanygood,facility,service,oritem,
payablebyaFederalhealthcareprogram. Incontrast,theprohibitionundertheBeneficiary
InducementsCMPappliestoremunerationthatislikelytoinfluenceabeneficiarysselectionof
aparticularprovider,practitioner,orsupplierforitemsorservicesreimbursablebyMedicareor
aStatehealthcareprogram. Herearesomeadditionaldistinctions:
 TheBeneficiaryInducementsCMPappliesonlytothepersonofferingortransferringthe
remuneration. TheFederalanti-kickbackstatuteandanti-kickbackCMPapplytoboth
thepersonofferingorpayingtheremunerationandthepersonsolicitingorreceivingit.
 TheBeneficiaryInducementsCMPappliesonlytoitemsandservicesreimbursableby
MedicareoraStatehealthcareprogram(e.g.,MedicaidandChildrensHealthInsurance
Program(CHIP)). TheFederalanti-kickbackstatuteandanti-kickbackCMPapplyto
30SeeSection1128A(i)(6)oftheAct,42U.S.C.1320a-7a(i)(6);42C.F.R.1003.110fortherequirementsforthese
exceptionsaswellasotherexceptions.
31SeeRevisedOIGCivilMoneyPenaltiesResultingFromtheHealthInsurancePortabilityandAccountabilityActof
1996,63Fed.Reg.14393,14395(Mar.25,1998). 22
itemsandservicespayablebyanyFederalhealthcareprogram(e.g.,Medicare,
TRICARE,andCHAMPVA)orbyaStatehealthcareprogram.
 TheBeneficiaryInducementsCMPusesadefinitionofremunerationthatdoesnot
applyforpurposesoftheFederalanti-kickbackstatuteandtheanti-kickbackCMP.
RemunerationforpurposesoftheBeneficiaryInducementsCMPisdefinedas
includingtransfersofitemsorservicesforfreeorforotherthanfairmarketvalue.32
OIGhasdeterminedthatincentivesthatareonlynominalinvaluearenotprohibitedby
theBeneficiaryInducementsCMPandcurrentlyinterpretsnominalinvaluetomean
nomorethan$15peritemor$75intheaggregateonanannualbasis.33
 TheBeneficiaryInducementsCMPalsohasexceptionstothedefinitionof
remunerationthatdonotapplyforpurposesoftheFederalanti-kickbackstatuteor
theanti-kickbackCMP.34
Individualsandentitiesshouldbemindfulofthepotentialapplicabilityofthesestatutesto
thesameorsimilarconduct,aswellasthedifferencesinthesestatutes,whenconducting
training,designingriskassessments,anddevelopingandimplementingpoliciesregarding
remunerationtobeneficiaries.
2. Information Blocking
Pursuanttothe21stCenturyCuresAct,OIGhastheauthoritytoinvestigateclaimsthathealth
informationtechnology(IT)developersofcertifiedhealthIT(includingentitiesofferingcertified
healthIT),healthinformationexchangesandnetworks,andhealthcareprovidershaveengaged
inconductconstitutinginformationblocking.35 AhealthITdeveloperofcertifiedhealthIT36
andhealthinformationexchangesandnetworkscommitinformationblockingwhenthey
engageinapracticethatislikelytointerferewith,prevent,ormateriallydiscouragetheaccess,
exchange,oruseofelectronichealthinformation(EHI)andtheyknow,orshouldknow,the
practiceislikelytointerferewith,prevent,ormateriallydiscouragetheaccess,exchange,or
useofEHI. Ahealthcareprovidercommitsinformationblockingwhentheproviderengagesin
apracticethatislikelytointerferewith,prevent,ormateriallydiscouragetheaccess,exchange,
oruseofEHI,andtheproviderknowsthepracticeisunreasonableandislikelytointerfere
with,prevent,ormateriallydiscouragetheaccess,exchange,oruseofEHI. Information
32Section1128A(i)(6)oftheAct,42U.S.C.1320a-7a(i)(6).
33See,e.g.,MedicareandStateHealthCarePrograms:FraudandAbuse;RevisionstotheSafeHarborsUnderthe
Federalanti-kickbackstatuteandCivilMonetaryPenaltyRulesRegardingBeneficiaryInducements,81Fed.Reg.
88368,88394(Dec.7,2016);OfficeofInspectorGeneralPolicyStatementRegardingGiftsofNominalValueto
MedicareandMedicaidBeneficiaries.
34Section1128A(i)(6)oftheAct,42U.S.C.1320a-7a(i)(6);42C.F.R.1003.110.
35Section4004ofthe21stCenturyCuresAct,42U.S.C.300jj-52.
36ThisincludesentitiesthatoffercertifiedhealthITasdefinedin45C.F.R.171.102. 23
blockingdoesnotincludeanypracticethatisrequiredbylaworthatmeetsanexception. The
OfficeoftheNationalCoordinatorforHealthInformationTechnology(ONC)haspromulgated
regulationssettingforthimportantdefinitionsandexceptions,37andhasalsoissuedseveral
guidancedocuments.38 ItisimportanttounderstandthatONCsregulationsdefinetheconduct
thatconstitutesinformationblocking.
Thepenaltiesforengagingininformationblockingdependonthetypeofindividualorentity. A
healthITdeveloperofcertifiedhealthIT,healthinformationexchange,ornetworkthatengages
ininformationblockingmaybesubjecttoCMPsofupto$1millionperviolation. OIGhas
issuedaFinalRule39onitsinvestigationsofandtheimpositionofCMPsonhealthITdevelopers
ofcertifiedhealthIT(whichincludesentitiesthatofferhealthIT),healthinformation
exchanges,andhealthinformationnetworks. Ahealthcareprovidermaybesubjecttothe
appropriatedisincentivesassetforthbyHHSinafuturerulemaking.40 Individualsandentities
thatmeetthedefinitionofhealthcareproviderunderONCsregulationsshouldbemindfulthat
theymaybesubjecttoCMPsiftheymeetthedefinitionofhealthITdevelopersofcertified
healthITorhealthinformationexchangesandnetworksunderONCsregulations.41
3. CMP Authority Related to HHS Grants, Contracts, and
Other Agreements
OIGhastheauthoritytoimposeCMPs,assessments,andexclusionagainstindividualsor
entitiesthatengageinavarietyoffraudulentandotherimproperconductrelatedtoHHS
grants,contracts,andotheragreements.42 Forinstance,OIGmaypursueindividualsorentities
that,withregardtoHHSgrants,contracts,orotheragreements:
 presentafalseorfraudulentspecifiedclaim;
 makeafalsestatementoromission;
 makeoruseafalserecord;
 concealorimproperlyavoidanobligationowedtoHHS;or
 failtograntaccesstoOIGforthepurposeofaudits,investigations,orevaluations.
3745C.F.R.part171.
38SeeONCInformationBlockingResources;OIGInformationBlockingResources.
39OIGInformationBlockingFinalRule,88Fed.Reg.42820(July3,2023);42C.F.R.1003.1400.
40AtthetimeofpublicationoftheGCPG,HHShasapendingrulemakingintheUnifiedAgendaatRegulation
IdentifierNo.0955-AA05.
41ThisisdiscussedbothinONCsruleandinOIGsrule.
42Section1128A(o)oftheAct,42U.S.C.1320a-7a(o). 24
Here is an example of conduct that would create grant fraud CMP liability:
AgranteewasawardedHHSgrantfundsforthepurposesofpayingforsubstanceuse
disordertreatmentservicestomembersofalocalcommunity. Insteadoflimitinguseofthe
fundsforsuchtreatmentservices,thegranteeknowinglyusedthefundstoalsopayfor
prohibitedexpenses,suchastheclientsrent,mortgage,utilities,andautorepairs.
It is important for HHS awardees to understand what conduct
leads to liability under OIGs authority, as well as under other
fraud and abuse laws, and to put internal controls into place to
prevent and identify these issues early.
Moreinformationaboutfraudareasofconcernrelatedtogrants,contracts,andother
agreementsisavailablehere. Inaddition,self-disclosureinformationspecifictoHHSgrantsand
contractsarediscussedinsectionVI.G,OIGSelf-DisclosureInformation.
E. Exclusion Authorities
OIGhasthelegalauthoritytoexcludeindividualsandentitiesfromparticipationinallFederal
healthcareprogramsundersection1128oftheAct(42U.S.C.1320a-7). Federalhealthcare
programsincludeallplansandprogramsthatprovidehealthbenefitsfundeddirectlyor
indirectlybytheUnitedStates(exceptfortheFederalEmployeesHealthBenefitsProgram)or
anyStatehealthcareprogram.43 StatehealthcareprogramsincludeStateMedicaidprograms,
theMaternalandChildHealthServicesBlockGrantprogramunderTitleVoftheAct,Block
GrantstoStatesforSocialServicesundersubtitleAofTitleXXoftheAct,andtheChildrens
HealthInsuranceProgramunderTitleXXI.44 OIGmaintainsalistofallcurrentlyexcluded
individualsandentitiescalledtheListofExcludedIndividuals/Entities(LEIE). Informationabout
theLEIEmaybefoundontheOIGsExclusionsPage.
Mandatory Exclusions
OIGisrequiredbylawtoexcludefromparticipationinallFederalhealthcareprograms
individualsandentitiesconvictedofcertaintypesofcriminaloffenses,including:
 offensesrelatedtothedeliveryofanitemorserviceunderMedicareoraStatehealth
careprogram;
43Section1128B(f)oftheAct,42U.S.C.1320a-7b(f).
44Section1128(h)oftheAct,42U.S.C.1320a-7(h). 25
 patientabuseorneglect;
 felonyconvictionsforotherhealthcare-relatedfraud,theft,embezzlement,breachof
fiduciaryresponsibility,orotherfinancialmisconduct;and
 felonyconvictionsrelatingtotheunlawfulmanufacture,distribution,prescription,or
dispensingofcontrolledsubstances.45
Permissive Exclusions
OIGhasdiscretiontoexcludeindividualsandentitiesonanumberofgrounds,including(but
notlimitedto):
 misdemeanorconvictionsrelatedtohealthcarefraudnotinvolvingMedicareoraState
healthprogram;
 fraudinaprogram(otherthanahealthcareprogram)fundedbyanyFederal,State,or
localgovernmentagency;
 misdemeanorconvictionsrelatingtotheunlawfulmanufacture,distribution,
prescription,ordispensingofcontrolledsubstances;
 suspension,revocation,orsurrenderofalicensetoprovidehealthcareforreasons
bearingonprofessionalcompetence,professionalperformance,orfinancialintegrity;
 provisionofunnecessaryorsubstandardservices;
 submissionoffalseorfraudulentclaimstoaFederalhealthcareprogram;
 engaginginarrangementsthatviolatetheFederalanti-kickbackstatute;
 defaultingonhealtheducationloanorscholarshipobligations;and
 controllingasanctionedentityasanowner,officer,ormanagingemployee.46
TheeffectofanOIGexclusionisthatnoFederalhealthcareprogrampaymentmaybemadefor
anyitemsorservicesfurnished:(1)byanexcludedperson,or(2)atthemedicaldirectionoron
theprescriptionofanexcludedperson.47 PaymentforclaimssubmittedtoaFederalhealth
careprogramforitemsorservicesfurnishedbyanexcludedindividualorentityresultsinan
overpayment,regardlessofwhethertheexcludedindividualhadaprovideridentification
numberandtheabilitytobillseparately.48
OIGhasthelegalauthoritytoimposeCMPsonindividualsandentitiesthatarrangeorcontract
(byemploymentorotherwise)withanindividualorentitythatthepersonknowsorshould
45Section1128(a)oftheAct,42U.S.C.1320a-7(a).
46Section1128(b)oftheAct,42U.S.C.1320a-7(b).
4742C.F.R.1001.1901.
48See,e.g.,Section1128J(d)oftheAct,42U.S.C.1320a-7k(d). 26
knowisexcludedfromparticipationinaFederalhealthcareprogramforthepurposeof
providingitemsandservicesforwhichpaymentmaybemadebyaFederalhealthcare
program.49 OIGmayimposepenaltiesforeachitemorservicefurnishedbytheexcluded
individualorentityforwhichaclaimwassubmittedtoaFederalhealthcareprogram.
OIGrecommendsthatemployersstudytheresourcesprovidedonOIGswebsitetofully
understandtheeffectsofexclusion.
Many providers and their staff employ excluded individuals
because they incorrectly believe it is permissible (for example,
because an employee obtains a new health care license or has
received permission from a State agency to practice, has an
administrative role, cannot separately bill).
Someoftheseresourcescanbefoundatthefollowinglinks:UpdatedSpecialAdvisoryBulletin
ontheEffectofExclusiononParticipationintheFederalHealthCarePrograms andFrequently
AskedQuestions.
ToavoidoverpaymentandCMPliability,entitiesparticipatinginFederalhealthcareprograms
shouldchecktheLEIEbeforeemployingorcontractingwithindividualsandentities,and
periodicallychecktheLEIEtodeterminetheexclusionstatusofcurrentemployeesand
contractors. TheLEIEisatoolthatOIGhasmadeavailabletoprovidersandotherstoenable
themtoidentifypotentialandcurrentemployeesorcontractorsthatareexcludedbyOIG.
If an entity discovers that it has employed or contracted with an
excluded individual or entity, the entity should evaluate its
overpayment and CMP liability. We recommend that entities in
this situation consider whether to submit a self-disclosure through
theHealth Care Fraud Self-Disclosure Protocol.
OIGupdatestheLEIEmonthly,soscreeningeachmonthbestminimizespotentialoverpayment
andCMPliability.
ManyStateMedicaidprogramsnowhavetheirownexclusionauthoritiesandmaintaintheir
ownStateexclusionlists. Ifanentityemploysorcontractsorotherwiseengageswith
individualsorentitiesexcludedfromaStateMedicaidprograminwhichitparticipates,the
49Section1128A(a)(6)oftheAct,42U.S.C.1320a-7a(a)(6). 27
entitymayincuroverpaymentliability. ItmayalsoincurCMPliability. OIGrecommendsthat
entitiescheckemployees,contractors,andotherindividualsorentitiesthatprovideitemsand
servicesthatmaybepaidforbytheStateMedicaidprogramsinwhichtheyparticipateagainst
suchStateMedicaidprogramexclusionlists.
For example, if an entity has a hospital in Illinois that participates
in the Illinois and Iowa state Medicaid programs, OIG
recommends that the entity screen all employees and contractors
who provide items or services at the facility, or who provide
support to the facility, against both the Illinois and Iowa state
Medicaid exclusion lists. 28
F. Criminal Health Care Fraud Statute
Thereisacriminalhealthcarefraudstatutethatmakesitacriminaloffenseto
defraudahealthcarebenefitsprogram. Thecriminalhealthcarefraud
statuteprohibitsknowinglyandwillfullyexecuting,orattemptingtoexecute,
aschemetoeither:(1)defraudanyhealthcarebenefitprogram;or(2)to
obtain,bymeansoffalseorfraudulentpretenses,representations,or
promises,anymoneyorpropertyfromanyhealthcarebenefit
program.50 TheGovernmentmustproveitscasebeyondareasonable
doubtandprovethatthedefendantactedwithintenttodefraud;
however,specificintenttoviolatethisstatuteisnotrequiredfora
conviction. DOJ,OIG,andotherlawenforcementpartnershavesuccessfullyusedthisstatute
topursuedefendantswhoorchestratecomplexhealthcarefraudschemes. Casesthatinvolve
violationsofthecriminalhealthcarefraudstatutealsoofteninvolvecomplexmoney
laundering,tax,andotherassociatedfinancialcriminaloffenses. Thepenaltiesforviolatingthe
criminalhealthcarefraudstatutemayincludefinesofupto$250,000,imprisonmentofnot
morethan10years,orboth.
G. HIPAA Privacy and Security Rules
HHSsOCRisresponsibleforadministeringandenforcingtheHIPAAPrivacy,Security,and
BreachNotificationRules. TheStandardsforPrivacyofIndividuallyIdentifiableHealth
Information,knownasthePrivacyRule,addressestheuseanddisclosureofindividuals
identifiablehealthinformation(protectedhealthinformationorPHI)bycoveredentities,51
includinghealthplans,healthcareclearinghouses,andthosehealthcareprovidersthatconduct
certainhealthcaretransactionselectronically,andtheirbusinessassociates.52,53 ThePrivacy
RulerequiresappropriatesafeguardstoprotecttheprivacyofPHIandsetslimitsand
conditionsontheusesanddisclosuresthatmaybemadeofsuchinformationwithoutan
individualsauthorization. ThePrivacyRulealsogivesindividualsrightsovertheirprotected
healthinformation,includingrightstoexamineandobtainacopyoftheirhealthrecords,to
directacoveredentitytotransmittoathirdpartyanelectroniccopyoftheirprotectedhealth
informationinanelectronichealthrecord,andtorequestcorrections.
5018U.S.C.1347.
51Thedefinitionofcoveredentityisavailableat45C.F.R.160.103. CMSoffersaCoveredEntityDecisionTool
tohelpentitiesdetermineiftheyareacoveredentity.
52Thedefinitionofbusinessassociateisavailableat45C.F.R.160.103.
5345C.F.R.parts160and164,subpartsAandE. 29
An entity regulated by Privacy Rule requirements should ensure
that it is compliant with all applicable provisions of the Privacy
Rule, including provisions pertaining to required disclosures (and
permitted uses and disclosures), when developing its privacy
procedures that are tailored to fit the entitys particular size and
needs.
TheSecurityStandardsfortheProtectionofElectronicProtectedHealthInformation,knownas
theSecurityRule,54wasalsopromulgatedpursuanttoHIPAA. Itspecifiesaseriesof
administrative,physical,andtechnicalsafeguardsforcoveredentitiesandtheirbusiness
associatestoensure,amongotherprovisions,theconfidentiality,
integrity,andsecurityofelectronicPHI. Coveredentitiesandtheir
businessassociatescanconsidertheirorganizationandcapabilities,
aswellascosts,indesigningtheirsecurityplansandproceduresto
complywithSecurityRulerequirements. Notably,OCRandONC
jointlylaunchedaHIPAASecurityRiskAssessmentTool. Thetools
featuresmakeitusefulinassistingsmallandmedium-sizedhealth
carepracticesandbusinessassociatesastheyperformarisk
assessment. Also,theNationalInstituteofStandardsandTechnology(NIST)developedthe
NISTHSRToolkit,whichisaself-assessmentsurveyintendedtohelporganizationsbetter
understandtherequirementsoftheSecurityRule,implementthoserequirements,andassess
thoseimplementationsintheiroperationalenvironment.
TheNotificationintheCaseofBreachofUnsecuredProtectedHealthInformation,knownas
theBreachNotificationRule,55waspromulgatedpursuanttotheHealthInformation
TechnologyforEconomicandClinicalHealthAct,passedaspartofAmericanRecoveryand
ReinvestmentActof2009. TheBreachNotificationRulerequirescoveredentitiesandtheir
businessassociatestoprovidenotificationfollowingabreachofunsecuredPHI. Abreachis,
generally,animpermissibleuseordisclosureunderthePrivacyRulethatcompromisesthe
securityorprivacyofthePHI. Coveredentitiesandbusinessassociatesmustonlyprovidethe
requirednotificationsifthebreachinvolvedunsecuredPHI. UnsecuredPHIisPHIthathasnot
beenrenderedunusable,unreadable,orindecipherabletounauthorizedpersonsthroughthe
useofatechnologyormethodologyspecifiedbytheSecretaryinguidance.
5445CFRparts160and164,subpartsAandC.
5545CFRparts160and164,subpartsAandD. 30
ThestatutoryandregulatorybackgroundforthePrivacy,Security,andBreachNotification
Rules56canbefoundonHHSswebsite. Awealthofotherresources,includingFAQsand
informationspecifictocomplianceandenforcement,isalsopubliclyavailableonthewebsite.
WithincreasingnumbersofcybersecurityattacksaimedatHIPAA-
regulatedentitiesofallsizes,compliancewithPrivacy,Security,and
BreachNotificationRulerequirementsshouldbeatopcompliance
priorityandincludedinallriskassessments.
5645CFRParts160and164,subpartsAandE. SECTION III
Compliance Program Infrastructure:
The Seven Elements 32
III. Compliance Program Infrastructure:
The Seven Elements
Inthissection,wediscusstheseven
elementsofaneffectivecompliance
program. Acknowledgingthebroad
spectrumofentitiesplayingarolein
healthcaredeliverytoday,our
discussionbelowprovidesguidance
generallyapplicableacrosstheentire
spectrum. Wediscussmodifications
smallentitiesmayusetoimplement
thesesectionsinsectionIV.A.
Ourguidanceinthissectionreflects
ourpriorguidance;morethan25years
ofexperiencemonitoringCorporate
IntegrityAgreements(CIAs);feedback
receivedinvariousformsfromindustry
stakeholders;lessonslearnedfrom
enforcementactionsand
investigations;andtheongoing
evolutionofthehealthcaredeliverysystemandtechnologyusedtosupportthatdelivery
system.
OIGslongstandingbeliefisthatanentitysleadershipshouldcommittoimplementingallseven
elementstoachieveasuccessfulcomplianceprogram. Theguidanceinthissectionisintended
tohelpentitiesfulfillthatcommitmentinarobustandmeaningfulway. 33
Element 1Written Policies and Procedures
Generally,healthcareentitiesinstructtheiremployees,contractors,andmedicalstaffon
certaindutiesandanystandardparametersaroundtheperformanceofsuchdutiesthrough
policiesandprocedures. Morespecifically,throughwrittenpoliciesandprocedures,entities
canprovidearoadmapforrelevantindividuals,outliningtheirdutieswithintheorganization,
developingworkflowmanagement,imposingdocumentationrequirements,definingindividual
andorganizationaloversightroles,andimplementingcontrolsentity-widetomitigate
compliancerisksspecifictotheentity. Policiesandproceduresalsodemonstrateto
stakeholdersandotherinterestedparties,includingGovernmentregulators,howtheentity
strivestocomplywithapplicablelaws,regulations,andrequirements.
Acodeofconductandcompliancepoliciesarecriticalelementsofanycomplianceprogram.
Thecomplianceprogramshouldalsorequirethatalltheentityspoliciesandprocedures
incorporateacultureofcomplianceintoitsday-to-dayoperations. Thecodeofconductand
compliancepoliciesandproceduresshouldbedevelopedunderthedirectionandsupervision
ofthecomplianceofficerandtheComplianceCommitteeandshouldbemadeavailabletoall
relevantindividualswithintheorganization. Compliancewiththecodeofconductand
applicablepoliciesandproceduresshouldbepartoftheperformanceevaluationsofall
employeesandcontractors.
1. Code of Conduct
Acodeofconductisanimportanttooltocommunicateanorganizationsmission,goals,and
ethicalrequirementscentraltoitsoperations. Thecodearticulatestheentityscommitmentto
complywithallFederalandStatelawsandregulations. Itdefinestheentitysethicalstandards
necessarytofulfillitsmissionandgoverntheconductofitsofficers,employees,contractors,
medicalstaff,andotherswhoworkwithoronbehalfoftheorganization.
CEOs can demonstrate their embrace of the organization's
commitment to compliance with a signed introduction in the
code. To demonstrate broader organizational commitment to
compliance, the board also may wish to include a signed
endorsement or a similar written statement.
Althoughthecodebyitsdesignmaynotneedregularreview,anyhandbookdelineatingor
expandinguponthecodeofconductshouldberegularlyupdatedasapplicablestatutes,
regulations,andFederalhealthcareprogramrequirementschange. 34
Entities may wish to review their codes when a new CEO is hired,
particularly if the code contains a letter,quotations, or other
endorsements by the preceding CEO. Leadership change provides
an opportunity for the entity to ensure that its code reflects the
entitys ongoing commitment to compliance.
2. Compliance Policies and Procedures
Compliancepoliciesandproceduresshouldencompassatleasttwoareas:(1)the
implementationandoperationoftheentityscomplianceprogram,includingtheseven
elementsdiscussedinthissection;and(2)processestoreduceriskscausedbynoncompliance
withFederalandStatelaws.AdiscussionofFederalfraudandabuseauthoritiesisincludedin
SectionIIabove.Entitiesshouldassesshowtheiroperationsmaypresentriskareasspecificto
themanddesignpoliciesandproceduresthataddresstheserisks.
Some common compliance risk areas are:
 billing;
 coding;
 sales;
 marketing;
 qualityofcare;
 patientincentives;and
 arrangementswithphysicians,otherhealthcareproviders,vendors,andotherpotential
sourcesorrecipientsofreferralsofhealthcarebusiness.
OIG recommends that entities review the current health care
subsector Compliance Program Guidance on the OIG website for a
further discussion of subsector-specific risks.
TheComplianceCommitteeshouldensurethatasystemexiststoensurethattheentitys
policiesandproceduresfosterratherthanunderminetheentityscomplianceculture. When
theentitycreates,revises,ordeletesapolicy,itshouldconsiderwhetherthechangeaffectsthe
entityscompliancewithgovernmenthealthcareprogramrequirements,encouragesor
incentivizesnoncompliance,orimpairstheentitysrisk-mitigationefforts. 35
Allorganizationsshouldhaveapolicyandprocedureonthescreeningofemployees,
contractors,andotherindividualsandentitiesthatfurnishitemsandservicesfororonbehalf
oftheorganizationagainsttheLEIEandanyapplicableStateMedicaidprogramexclusionlists.
Thepolicyshouldclearlyidentifywhichindividual(s)intheorganizationareresponsiblefor
conductingthescreening,theprocessforperformingthescreeningandverifyinganypotential
matches,andthestepsthatshouldbetakenintheeventanentitylearnsthatanindividualor
entitythathasbeenexcludedbytheOIGoraStateMedicaidprogram. Moreinformationon
screeningmaybefoundintheUpdatedSpecialAdvisoryBulletinontheEffectofExclusion
FromParticipationinFederalHealthCarePrograms.
Entities may choose to rely on screening conducted by a
contractor (e.g., staffing agency, physician group, or third-party
billing or coding company), but OIG recommends that entities
validate that the contractor is conducting such screening on
behalf of the provider (e.g., by requesting and maintaining
screening documentation from the contractor). The entity
remains responsible for any overpayment or CMP liability that
may result from employing or contracting with an excluded
individual or entity in a manner that violates the exclusions
authorities.
Policy Maintenance
Allrelevantindividualsshouldbeabletoeasilyaccesstheirorganizationscode,policies,and
procedures. Manyentitiesnowmaintaintheircode,policies,andproceduresonaninternal
intranetsiteoruseotherelectroniccommunicationtoolstoensurethateveryonehasaccessto
thesamedocuments. Iftheentityscommunicationmethoddoesnotprovideaccesstoall
relevantindividuals,theentityshouldemployanalternativemechanismforsuchindividualsto
obtainaccesstothecode,policies,andprocedures. Besidesbeingaccessible,thecode,
policies,andproceduresalsoshouldbecomprehensiblebyallrelevantindividuals(e.g.,
translatedintootherlanguages,whereappropriate,andwrittenatappropriatereadinglevels). 36
Theorganizationscomplianceofficershouldensurethatcompliancepoliciesandprocedures
areeffectivelycreated,coordinated,andmaintained.
DOJhascompiledausefulsetofquestionsforentitiestoconsiderinsettingupand
reviewingtheirsystemofpoliciesandprocedures. Thesemaybefoundat DOJEvaluationof
CorporateCompliancePrograms.
TheOIGstoolkitonMeasuringComplianceProgramEffectivenessalsoprovidesusefultools
forevaluatingpoliciesandprocedures,aswellasidentifyinggapsthatmayrequirenewor
revisedpoliciesandprocedures. ItmaybefoundontheOIGs ComplianceToolkitspage.
Entities should set up a regular schedule for reviewing and
revising, as necessary, all policies and procedures. OIG
recommends that entities review policies and procedures at least
annually to ensure that such policies and procedures reflect any
modifications to applicable statutes, regulations, and Federal
health care program requirements.
Up-to-datepoliciesandproceduresarea
Who is a relevant individual?
criticalelementofacomplianceprogram.
Entitiesshouldensurethattheyfinalizeand
ForthepurposesofthisGCPG,a
makeavailabletorelevantindividualsanynew
relevantindividualmeansaperson
orrevisedpoliciesandproceduresbefore
whoseresponsibilitiesoractivitiesare
implementingoralteringpracticesand
withinthescopeofthecode,policy,or
processes. Theentitysemployees,
procedure. Relevantindividualscould
contractors,andotherrelevantindividuals
includeemployees,contractors,patients,
shouldbeabletorelyonanentityspolicies
customers,agencystaff,medicalstaff,
andproceduresastheentityscurrent subcontractors,agents,orpeoplein
instructionsonaparticularsubject. Having otherroles,orasubsetoftheabove.
policyandproceduredocumentsthatarenot Eachentityneedstodetermineforitself
uptodatediminishestheircredibilitytothe whotheirrelevantindividualsare.
usersofsuchpoliciesandproceduresand
otherinterestedparties,includingGovernmentregulators. Inaccurateorunreliablepolicies
andproceduresalsoreducethecomplianceprogramsauthority,credibility,andeffectiveness
attheentity.
OIGencouragesentitiestoincludeintheirdisclosureprogram(discussedfurtherin sectionIII.D
below)ameansforemployees,contractors,andotherrelevantindividualstocontactthe 37
complianceofficerormembersoftheComplianceCommitteewithquestionsaboutapolicyor
procedure.
If the procedure for policy revision and approval impedes rapid
implementation of a needed process change, OIG recommends
that the entity devise a means of communicating and
documenting interim policies and procedures to the relevant
impacted individuals.
B. Element 2Compliance Leadership and Oversight
Boardsandseniorleadershiparevitalto
Senior Leadership
effectivecomplianceprograms. Aneffective
complianceprogramreducesandmitigatesrisk,
providespatientssafeandhigh-qualitycare, ForthepurposesoftheGCPG,senior
leadershipmeansthegroupofleaders
andsavescosts. Tobeeffective,acompliance
whoreportdirectlytotheexecutive
programshouldhaveaboardandsenior
leadingtheentity,usuallytheCEO.
leadershipthatunderstanditsvalueandare
Someentitiesrefertothisgroupby
committedtoitssuccess. Oneofthesesenior
othernames,suchasexecutive
leadersshouldbetheComplianceOfficer.
leadership.
1. Compliance Officer
Everyentityshoulddesignatealeaderastheentityscomplianceofficer. Akeyindicatorofthe
boardandseniorleadershipscommitmenttocomplianceistheappointmentandsupportofa
complianceofficerwhohastheauthority,stature,access,andresourcesnecessarytoleadan
effectiveandsuccessfulcomplianceprogram. Designatingacomplianceofficerwith
appropriateauthorityisessentialtothesuccessofthecomplianceprogram.
The compliance officer should:

reporteithertotheCEOwithdirectandindependentaccesstotheboard57ortotheboard
directly;

havesufficientstaturewithintheentitytointeractasanequalofotherseniorleadersofthe
entity; 38

demonstrateunimpeachableintegrity,goodjudgment,assertiveness,anapproachable
demeanor,andtheabilitytoelicittherespectandtrustofentityemployees;and

havesufficientfunding,resources,andstafftooperateacomplianceprogramcapableof
identifying,preventing,mitigating,andremediatingtheentityscompliancerisks.
The Compliance Officers Primary Responsibilities
These should include:
 overseeingandmonitoringtheimplementationandoperationofthecomplianceprogram;
 advisingtheCEO,board,andotherseniorleadersoncompliancerisksfacingtheentity,
compliancerisksrelatedtostrategicandoperationaldecisionsoftheentity,andthe
operationoftheentityscomplianceprogram;
 chairingtheComplianceCommittee;

reportingtotheboardontheimplementation,operation,andneedsofthecompliance
program,thecomplianceriskstheentityfaces,andthemethodsthroughwhichtheentityis
addressingorcanaddressthoserisks;
 revisingthecompliance
The Compliance Officer's primary
programperiodicallyinlightof
responsibilities should include
changesintheneedsofthe
organization,applicablelaw, advising the CEO, board, and
andpoliciesandproceduresof
other senior leaders on
third-partypayors;
compliance risks facing the entity,
 coordinatingwithHuman
Resourcestoensurethatall compliance risks related to
directors,officers,employees, strategic and operational
contractors,andmedicalstaff,
decisions of the entity, and the
ifapplicable,arescreened
beforeappointmentor operation of the entitys
engagementandmonthly
compliance program.
thereafteragainsttheLEIEand
anyapplicableStateMedicaid
programexclusionlists; 39
 coordinatingwithotherrelevantentity
Quality
components(e.g.,asapplicable,Internal
Audit,Risk,Quality,IT)todevelopwork
plansforreviewing,monitoring,andauditing ForthepurposesofthisGCPG,quality
compliancerisks; meansbothqualityinmanufacturingand
supplyingdrugs,devices,andother
 independentlyinvestigatingandactingon
items,andqualityofcareinthe
mattersrelatedtocompliance,includingthe
provisionofitemsandservices.
flexibilitytodesignandcoordinateinternal
investigations(e.g.,respondingtoreports
involving,forexample,complianceconcernsorsuspectedlegalviolations)andtomake
recommendationsforprocessandpolicychangesandcorrectiveaction;and

developingpoliciesandprogramsthatencouragepersonneltoreportsuspectedfraudand
otherimproprietieswithoutfearofretaliation.
Tofulfilltheirduties,thecomplianceofficershouldbeempowered,andindependentofother
dutiestotheentitythatmightimpairtheirability,toidentifyandraisecompliancerisksand
adviseonhowtomitigaterisks,achieveandmaintaincompliancewithFederalhealthcare
programrequirements,andsucceedasacompliantentity. Thus,thecomplianceofficershould
notleadorreporttotheentityslegalorfinancialfunctions,andshouldnotprovidethe
entitywithlegalorfinancialadviceorsuperviseanyonewhodoes. Thecomplianceofficer
shouldreportdirectlytotheCEOortheboard.Usually,leadersofthesefunctionsarethe
generalcounselandthechieffinancialofficer,butsomeentitiesgivethemdifferenttitles.
Tobeeffective,thecomplianceofficershouldalsomaintainadegreeofseparationfromthe
entitysdeliveryofhealthcareitemsandservicesandrelatedoperations. Thus,thecompliance
officershouldnotberesponsible,eitherdirectlyorindirectly,forthedeliveryofhealthcare
itemsandservicesorbilling,coding,orclaimsubmission. Inaddition,involvementinfunctions
suchascontracting,medicalreview,oradministrativeappealspresentpotentialconflicts.
Wheneverpossible,thecomplianceofficerssoleresponsibilityshouldbecompliance.
Some compliance officers have the dual role of privacy officer. In
that case, OIG recommends that the entity ensure that the
compliance officer has sufficient staff and resources to perform
the additional duties associated with that
expanded role. 40
Coordinationandcommunicationarethecomplianceofficerskey
toolsforplanning,implementing,andmonitoringaneffective
complianceprogram. Thecomplianceofficershouldstriveto
develop,andtheentityshouldstrivetopromote,productive
workingrelationshipswithorganizationalleaders. Coordinating
workandsharinginformationwithleadersofothersupport
functions,including(asapplicable),Legal,InternalAudit,ITand
HealthInformationManagement(HIM),HumanResources,
Quality,RiskManagement,andSecuritywillenhancethestrength
andsuccessofthecomplianceprogram.
Thecomplianceofficershouldhavetheauthoritytoreviewalldocuments,data,andother
informationthatarerelevanttotheorganizationscomplianceactivities. Thisincludes,butis
notlimitedto,patientrecords,billingrecords,salesandmarketingrecords,andrecords
concerningtheentitysarrangementswithotherparties,includingemployees,independent
contractors,suppliers,physicians,andotherhealthcareprofessionals. Thecomplianceofficer
alsoshouldhavetheauthoritytointerviewanyonewithinorconnectedtotheorganizationin
connectionwithacomplianceinvestigation,ordesignateanappropriatepersontoconduct
suchaninterview.
2. Compliance Committee
TheComplianceCommitteespurposeistoaidandsupportthecomplianceofficerin
implementing,operating,andmonitoringtheComplianceProgram. TheCompliance
Committeeshouldmeetnolessthanquarterly. Havingaregularlyscheduledmeetingmay
enhanceroutineattendance.
The Compliance Committees Primary Duties
These should include:

analyzingthelegalandregulatoryrequirementsapplicabletotheentity;

assessing,developing,andregularlyreviewingpoliciesandprocedures;

monitoringandrecommendinginternalsystemsandcontrols;

assessingeducationandtrainingneedsandeffectiveness,andregularlyreviewingrequired
training; 41

developingadisclosureprogramandpromotingcompliancereporting;

assessingeffectivenessofthedisclosureprogramandotherreportingmechanisms;

conductingannualriskassessments;

developingthecomplianceworkplan;

evaluatingtheeffectivenessofthecomplianceworkplanandanyactionplansforrisk
remediation;and

evaluatingtheeffectivenessofthecomplianceprogram.
ThecomplianceofficershouldbethechairoftheComplianceCommittee. TheCompliance
Committeeshouldbecomprisedoftherelevantleadersofbothoperationalandsupporting
departments,whichcouldincludeBillingandCoding,ClinicalandMedical,Finance,Internal
Audit,IT,HIM,HumanResources,Legal,Quality,RiskManagement,SalesandMarketing,and
otheroperationalmanagers. Allmembersshouldbesufficientlyknowledgeableregardingtheir
departmentssubjectarea. Allmembersshouldhavetheauthorityandabilitytospeakforthe
departmenttheyrepresent.
Before joining the Compliance Committee, provide training to the
new member on the committees duties and responsibilities and
the entitys expectations of them in their role as a committee
member.
ActivelyleadingtheComplianceCommitteeanditsmeetingsisanimportantandintegral
functionofthecomplianceofficer. AstheComplianceCommitteechair,thecomplianceofficer
shouldestablishandfacilitatecommitteediscussionandencourageactiveparticipationbyall
committeemembers.
Circulating an agenda before the meeting will inform members of
the meeting topics and give them an opportunity to prepare.
Thecomplianceofficershouldassistwiththeidentificationofriskareasandmonitorandreport
onprogresstowardcommitteeobjectives. Thecomplianceofficershouldmediateany
disagreementbetweenoramongcommitteemembersandescalatecommitteemattersthat
remainunresolvedtotheCEO. ThroughouteachmeetingoftheComplianceCommittee,the
complianceofficershouldcontinuetofocusthecommitteesattentiononcomplianceprogram
effectivenessandthebenefitsofaneffectivecomplianceprogramtotheorganization. 42
Keeping minutes of Compliance Committee meetings will provide
a documentary record of the Committee's activities and
accomplishments.
Thetoneforallaspectsofthe
Member attendance, active
ComplianceProgram,including
participation, and contributions
theComplianceCommittee,
shouldbeestablishedand should be included in each
maintainedbyanorganizations members performance plan and
leadership,includingtheboard
compensation evaluation.
andtheCEO. Expectationsfor
regular,diligentmember
attendanceatComplianceCommitteemeetingsshouldbesetbytheboardandenforcedbythe
CEO. Memberattendance,activeparticipation,andcontributionsshouldbeincludedineach
membersperformanceplanandcompensationevaluation. Intheircommunicationswith
individualcommitteemembers,theboardandtheCEOshouldregularlyconveytheimportance
of,andtheirinterestin,themembersComplianceCommitteeresponsibilitiesand
participation.
Thecomplianceofficershouldperiodicallyprovideareporttotheboardassessingthe
ComplianceCommitteesperformance. Thisreportshouldcomparetheentitysexpectationsof
thecommitteesperformancewithitsactualperformance. Aspartoftheassessment,the
complianceofficershouldseekinputfromthemembersoftheComplianceCommittee,the
CEO,andtheboard. Thecomplianceofficeralsoshouldexaminehowtheentityimplemented
committeedecisionsandrecommendations. 43
Indicators of Committee Success

substantivecommitteediscussions;

activeengagementbycommitteemembers;

demonstrationsofauthorityandautonomy(withinthescopeofthe
ComplianceCommitteescharter);

accountabilityandfollow-throughofcommitteedeterminations;

establishmentofarobust,detailedworkplan;

andmitigationofcompliancerisks.
Intheirreporttotheboard,thecomplianceofficershouldincludeanyrecommendationsthey
mayhaveonadjustmentstoimprovetheComplianceCommitteesperformance. Adjustments
couldincluderevisionstocommitteecharter,scope,ormembership,expectationsregarding
membership,andmethodsofensuringcommitteeandmemberaccountability.
3. Board Compliance Oversight
TheUnitedStatesSentencingCommissionsGuidelinesrequirethatanentitysgoverning
authorityshallbeknowledgeableaboutthecontentandoperationofthecomplianceandethics
programandshallexercisereasonableoversightwithrespecttotheimplementationand
effectivenessofthecomplianceandethicsprogram.58
Boards should pay attention to the Commission's Guidelines
because federal courts consult when determining criminal
sentences. Corporate boards also have a fiduciary duty of care,
which requires that boards assure that information and reporting
systems exist in the organization that are reasonably designed to
provide to senior management and to the board itself timely,
accurate information to allow management and the board, each
within its scope, to reach informed judgments concerning ... the
58UnitedStatesSentencingCommission,GuidelinesManual,3E1.1(Nov.2021) 44
corporations compliance with the law . . . .  In re Caremark,698
A.2d 959, 970 (Del. Ch. 1996).
Theboardsexerciseofthis
The board should ensure that the
responsibilityshouldinclude
compliance officer has sufficient
overseeingthecomplianceofficer
andtheComplianceCommittee power, independence, and
andreceivingandreviewing resources to implement, maintain,
informationnecessaryto
and monitor the entitys
understandtheentitys
compliance program and advise
compliancerisks. Theboardalso
shouldhaveaccesstosufficient the board about the entitys
knowledgeandresourcestoallow
compliance operations and risk.
ittofulfillitscompliance-related
obligationscompetently.Oversight
ofthecomplianceofficerisacriticalcomponentoftheboardscompliancerole. Theboard
shouldensurethatthecomplianceofficerhassufficientpower,independence,andresourcesto
implement,maintain,andmonitortheentityscomplianceprogramandadvisetheboardabout
theentityscomplianceoperationsandrisk.
Toensurethecomplianceofficerissufficientlyempowered,theboardshouldassurethatthe
complianceofficersstatureiscommensuratewiththeirresponsibilitiesandthoseofother
entityseniorleadersandthattheorganizationisstructuredtopermitthecomplianceofficerto
informtheboardofchallengingcomplianceriskswithoutfearofpersonalorfinancial
repercussions. Regardlessofthereportingstructure,theboardshouldalsoensurethatthe
complianceofficerhasdirectanduninhibitedaccesstotheboardatanytime.
Toensurethecomplianceofficersindependence,theboardshoulddeterminethatthe
complianceofficerisfreeoforganizationalresponsibilitiesthatwouldimpedethecompliance
officersabilitytoevaluateandreportoncompliancerisk. TheComplianceOfficersection
discussesrolesandresponsibilitiesforwhichthecomplianceofficershouldnotbe
responsible.Theboardalsoshouldregularlyreviewwhetherthecomplianceofficerandthe
complianceprogramhavesufficientstaffandresourcesforanentityofitssize,complexity,and
interactionwithFederalhealthcareprograms.
Theboardshouldmeetwiththecomplianceofficeronaregularbasisandnolessthan
quarterly. Thecomplianceofficershouldprovidetheboardwithregularreportsregardingthe
entityscomplianceprogram,activities,andrisks,andparticipateinanoraldiscussionofthe
reportwithboardmembers. Theboardshouldreservetimeateachsessionforanexecutive 45
meetingwiththecomplianceofficer,withoutnon-boardmemberspresent,topermittheboard
andthecomplianceofficertohaveanuninhibiteddiscussionofcompliancerisksofconcern,
includingtheadequacyofcompliancestaffandresources.
As OIG has stated in the Practical Guidance for Health Care Boards
on ComplianceOversight, [s]cheduling regular executive sessions
creates a continuous expectation of open dialogue, rather than
calling such a session only when a problem arises, and is helpful to
avoid suspicion among management about why a special
executive session is being called.
AnotherimportantcomponentoftheboardscomplianceroleisComplianceCommittee
oversight. Theboardshouldensurethat:(1)theComplianceCommitteefullyunderstandsand
exercisesitsrole,(2)theComplianceCommitteesdecisionsandactivitiesareappropriately
implementedandperformed,and(3)theboardunderstandsandevaluateshowthe
ComplianceCommitteeaddressesrisk. ComplianceCommitteememberssometimes
mistakenlyseetheirroleasoverseeingthecomplianceofficerandthecomplianceprogram,
ratherthansupportingandworkingwiththecomplianceofficeronthecomplianceprogram.
BoardsshouldstrivetoensurethatComplianceCommitteememberscorrectlyunderstandtheir
role.
TheComplianceCommitteeshouldprovidetheboardwithregularreportsonmember
attendanceandtheboardshouldensurethattheCEOenforcesaccountability. Theboard
shouldalsoassurethatComplianceCommitteemembersroleandperformanceonthe
committeearereflectedintheirperformanceplansandconsideredincompensationand
promotiondecisions.
Theboardshouldtakeeveryopportunitytocommunicatetoeachofitsaudiencesits
commitmenttocompliance. Everyboardhasavarietyofaudiences,whichcouldinclude
entityleaders,personnel,individualowners,shareholders,customers,patients,payors,
FederalandStateGovernments,andthepublic.
TheboardshouldencouragetheComplianceOfficerandotherseniorleaderstoreportonhow
Committeedecisionsareimplementedandsupportedbyleadersthroughouttheorganization.
TheboardalsoshouldensurethatitunderstandshowtheComplianceCommitteeidentifies
andaddressesrisks,includinghealthcarecompliancerisksandanyotherrisksthatimpactthe
entitysdirectorindirectinteractionwithFederalhealthcareprogramsandbeneficiaries(e.g.,
privacy,quality,IT,data). Itshouldreceive,atleastannually,reportsontheentitys 46
effectivenessinaddressingandresolvingcommittee-identifiedrisks. Theboardalsoshould
periodicallyevaluatetheeffectivenessoftheComplianceCommitteesriskassessmentprocess.
Although it was written before OIG began recommending that the
Compliance Committee be responsible for the risk assessment and
internal review process, the Measuring Compliance Effectiveness
Toolkit, which may be accessedhere, provides useful tips on
evaluating the effectiveness of the risk assessment process.
ThePracticalGuidanceforHealthCareBoardsonComplianceOversight providesspecific
suggestionsforhowboardscaneffectivelyexercisetheiroversightrole.
C. Element 3Training and Education
Providingappropriateeducationandtrainingisavitalcomponentofaneffectivecompliance
program. Thecomplianceofficer,withthesupportandaidoftheComplianceCommittee,
shoulddevelopandcoordinateamultifacetededucationandtraining
programspecifictotheneedsofandriskspresentedbytheentity. The
programshouldincludeeducationandtrainingontheentitys
complianceprogram,FederalandStatestandardsapplicabletothe
entity,andboardgovernanceandoversightofahealthcareentity.
Thecomplianceofficershoulddevelopanannualtrainingplanthat
includesthetrainingtopicstobedeliveredandthetargetaudiencefor
eachtopic. Theannualtrainingplanshouldincorporatematerial
addressinganyconcernsidentifiedinauditsandinvestigations. TheComplianceCommittee
shouldreviewthetrainingplanatleastannuallytoensurethatcompliancetrainingtopicsand
materialsaddresscurrentneeds,includinganyissuesidentifiedthroughmonitoringand
auditingandchangestoFederalandStatehealthcarerequirements.
Allboardmembers,officers,employees,contractors,andmedicalstaff(ifapplicable)of
theentityshouldreceivetrainingatleastannuallyontheentityscomplianceprogramand
potentialcompliancerisks.
ThetrainingshoulddescribetheentityscommitmenttocomplyingwithFederalandState
standardsandreviewtheapplicablefraudandabuselaws(e.g.,theFederalFalseClaimsAct,
theFederalanti-kickbackstatute,PSL,andanyapplicableStatefraudandabuselaws). This
trainingalsoshouldexplaintheelementsoftheentityscomplianceprogram. 47
Specific topics should include, for example:
 theidentityandroleofthecomplianceofficer;
 theroleoftheComplianceCommittee;
 theimportanceofopencommunicationwiththecomplianceofficer;
 thevariouswaysindividualscanraisecompliancequestionsandconcernswiththe
complianceofficer;
 nonretaliationfordisclosingorraisingcomplianceconcerns;and
 themeansthroughwhichtheentityenforcesitswrittenpoliciesandprocedures
equitablyandimpartially.
Anentityalsomaydevelopandrequiretrainingsreflectiveofrisksspecifictotheentitys
business,roleinthehealthcaredeliverysystem,orany
risksrevealedthroughpriorinvestigationsoraudits.
Targetedtrainingsessionsshouldbedevelopedand
assignedbasedonindividualsrolesandresponsibilities
andanycompliancerisksspecifictothoserolesand
responsibilities. Thesetrainingsessionsshouldaddress
Federalhealthcareprogramrulesapplicabletotheentitys
business. Thetrainingsessionsshouldcoverany
compliancerisksspecifictothelearnersrolesand
responsibilities. Dependingonthelearnersroles,these
mayinclude,forexample,billing,coding,documentation,medicalnecessity,beneficiary
inducements,gifts,interactionswithphysiciansandothersourcesorrecipientsofreferralsof
Federalhealthcareprogrambusiness,andsalesandmarketingpractices. Theeducationand
trainingprogramalsoshouldincludearequirementthatlicensedpersonnelmustcompleteall
educationandtrainingmandatedbythelicensingboardthatgovernstheirlicense.
Targetedtrainingalsoshouldbedevelopedforboardmembers. Newboardmembersshould
receivetrainingontheirgovernanceandcomplianceoversightrolespromptlyafterjoiningthe
board. Theinitialboardtrainingshouldaddressthespecificresponsibilitiesofhealthcare
boardmembers,includingtherisks,oversightareas,andapproachestoconductingeffective
oversightofahealthcareentity. Thecomplianceofficershouldconsiderarrangingadditional,
periodictrainingtoupdatetheboardontheentityscompliancerisks,includingchangesto
applicableFederalandStatehealthcarerequirements. 48
Anentitymaychoosetodevelopitsowntrainingmaterials,purchasetrainingmaterialsfroma
third-partyvendor,orcontractwithanexternalpartytodevelopthetrainingmaterials. The
ComplianceCommitteeshouldensurethatthetrainingmaterials,whetherdevelopedinternally
orpurchasedexternally,appropriatelyaddresstheentityscomplianceprogramandspecific
compliancerisks.59
TheComplianceCommitteeshouldalsoensurethatthetrainingmaterialsareaccessibletoall
membersofthedesignatedaudience. Forexample,ifanentityhasaculturallydiversestaff,
trainingmaterialsmayneedtobeavailableinseverallanguages. Trainingmaybeprovidedin
manyformatslive(in-personorviavideoconference),acomputer-basedtraining,orthrough
watchingapre-recordedvideo. Regardlessoftheformat,theComplianceCommitteeshould
ensurethatthereisamechanismforparticipantstoaskquestionsaboutthecontent. For
example,thetrainingmaterialscouldencourageindividualstosubmitquestionstothe
complianceofficerviaemail.
Theentitymayincorporateaprocessthroughwhichcontractingentitiesemployeesmay
receiveatrainingwaiverbydemonstratingthatthecontractingentityscompliancetrainingand
educationprogramsatisfiescertainrequirements. Thecomplianceofficershouldensurethat
outsidecontractorsreceivinganysuchwaiverinformitsemployeesoftheentitysdisclosure
programandthewaysinwhichthecontractorsemployeesmayreportcomplianceconcernsto
theentitydirectly.
Participationinrequiredcompliancetrainingprogramsshouldbemadeaconditionof
continuedemploymentorengagementbytheentity. Failuretocomplywithtraining
requirementsshouldresultinconsequences,uptoandincludingpossibleterminationof
employmentorengagementwhenwarrantedbythecircumstances. Completionofmandatory
trainingshouldbeabasicrequirementofeachemployeesannualperformanceevaluation.
Completionofmandatorytrainingshouldalsobearequiredcomponentofevaluationof
contractors. Hospitalsandotherentitieswithmedicalstaffshouldworkcloselywiththeirchief
medicalofficersandchiefsofstafftoensureallmembersofthemedicalstaffcomplete
requiredcompliancetraining.
Educationshouldnotbelimitedtoannualformaltrainingrequirements. Thecompliance
officershouldseekanddevelopopportunitiestoprovideeducationoncompliancetopicsand
risksthroughouttheyear.
59Forexample,acompliancetrainingcoursedevelopedforhospitalswouldnotbeapplicabletoahomehealth
agency. 49
Some ideas to provide compliance-related education include:
 developingandupdatingFAQsontheentityselectroniccommunicationsiteoron
postersinemployeecommonareas;
 havingastandingcomplianceitemontheagendaforregularlyscheduledmeetings;
 writingaregularcolumnintheentitysnewsletter;
 postingvideoclips;
 participatingintheannualsalesmeeting;
 occasionallydroppinginonaninformalmorninghuddle;and
 walkingthefloors.
ThecomplianceofficeralsoshouldconsiderworkingwiththeComplianceCommitteetohave
variouscommitteemembersandentityleadersdelivercompliancetraininginmeetingsand
settingswheretheyalreadyappear. Thiswillhelpnormalizecomplianceasanintegralpartof
theentitysculture.
Having a standing compliance item on the agenda of regular
meetings is an excellent way to share information and underscore
the entitys commitment to compliance. For example, this could
include executive leadership meetings, entity all-hands meetings,
and medical staff meetings. 50
D. Element 4Effective Lines of Communication with the
Compliance Officer and Disclosure Programs
Anopenlineofcommunicationbetweenthecomplianceofficerandentitypersonnel(including
contractorsandagents)iscriticaltothesuccessfulimplementationofacomplianceprogram
andthereductionofanypotentialforfraud,waste,andabuse. Entitypersonnelshouldbe
informedaboutthewaystheycanreachthecomplianceofficerdirectly(e.g.,viaemail,
telephone,messaging). Thisinformationalsoshouldbepostedincommonlyfrequented
physicalandvirtualspaces. Thecomplianceofficermaywishtooccasionallypollentity
personnelonmeansofreachingthecomplianceofficertoensurethatdiversepersonnel
(includingpersonnelofdifferentgenerationsandcommunicationpreferences)havefamiliar
meansofcommunicatingwiththecomplianceofficer.
Entitypersonnelshouldbeencouragedtobringcompliancequestionstothecompliance
officer. Suchquestionscanbeausefulsourceofinformationforthecomplianceofficerand
mayhelp:
 createideasfornewFAQs;
 evaluatetheeffectivenessoftrainingandcompliancemessaging;
 determinewhetherpolicyorprocesschangesmaybeneeded;and
 identifypotentialcompliancerisks.
Writtenconfidentialityandnonretaliationpoliciesshouldbedevelopedanddistributedtoall
employeestoencouragecommunicationwiththecomplianceofficerandthereportingof
incidentsofpotentialfraudandothercomplianceconcerns.
OIG believes that whistleblowers should be protected against
retaliation, a concept embodied in the provisions of the False
Claims Act. In some cases, employees may sue their employers
under the False Claims Acts qui tam provisions out of frustration
because of the companys failure to act when a questionable,
fraudulent, or abusive situation was brought to the attention of
senior leaders. 51
TheComplianceCommitteealsoshoulddevelopseveralindependentreportingpathsforan
employeetodirectlyreportviolationsofFederalandStatehealthcarerequirements,suchas
fraud,wasteorabuse,andviolationsofentitypolicy,sothatsuchreportscannotbedivertedby
supervisorsorotherpersonnel. TheComplianceCommitteeshouldensurethattheentitydoes
notdeterindividualsfromcomingforwardwithcomplianceconcernsby,forexample,
requestingorrequiringthatpersonnelfirstbringsuchconcernstotheirmanagerorsupervisor
beforecontactingthecomplianceofficer.
Frequent communications with the compliance officer from the
same department or employees of the same supervisor may
identify an area of concern to be investigated for possible
compliance or human resources issues.
Theentityshouldhaveatleastonereportingpathindependentofthebusinessandoperational
functionsthatpermitsindividualstoreportconcernsanonymously. Thiscouldbethrougha
hotline,awebsite,anemailaddress,oramailbox. Optionsforanonymousreportingshould
bepubliclypostedinphysicalandvirtualspacesfrequentlyaccessedbyentitypersonnel.
Informationaboutcommunicatingcomplianceconcerns,includingtheoptiontoreport
anonymously,shouldbeincludedinentitytrainingaboutitscomplianceprogram.
Theentityshouldalwaysstrivetomaintaintheconfidentialityofthereportingemployees
identity. Butitalsoshouldexplicitlycommunicatetoanyindividualreportingacompliance
concernthattheremaybeapointwheretheindividualsidentitymaybecomeknownormay
havetoberevealed. Forexample,incertaininstancestheentitymayberequiredtoinform
governmentalauthorities.
Alldisclosuresofcomplianceconcerns,includingpotentialviolationsof
entitypoliciesorFederalorStaterequirements,shouldberecordedin
alogmaintainedbythecomplianceofficerortheirdesignee. All
disclosuresshouldbeloggedregardlessofhowtheyaremade.
whethermadedirectlytothecomplianceofficerorothercompliance
personnel,toanotherentityleader,orthroughtheanonymous
reportingmechanism, Theentityspoliciesshouldrequirethe
complianceofficerortheirdesigneetorecordthedisclosurepromptlyfollowingreceiptbythe
complianceofficerortheirdesignee. 52
Some entities may have compliance departments, any member of
whom may receive compliance concerns. Other entities may have
facilities in multiple locations, each with their own facility
compliance officer. Any of these would be considered designees.
Thedisclosurelogshouldincludepertinentinformationregardingeachdisclosure,suchasthe
datereceived,theindividualordepartmentresponsibleforreview,adescriptionofthe
investigationsfindings,anycorrectiveactionstaken,anypolicyorprocesschangesmadeasa
resultoftheinvestigation,thedateresolved,and,ifapplicable,anyresultingreferralor
disclosuretoFederalorStateauthorities.
The compliance officer may take responsibility for reviewing some
reported concerns, some reported concerns may be referred to
other leaders or departments, for example, Human Resources,
and some reports, such as those involving substantial legal
violations, may be referred to counsel or law enforcement. The
compliance officer should remain involved in all health care
compliance investigations in which counsel takes the lead.
Thecomplianceofficershouldregularlyincludeinformationaboutconcernsreceivedand
investigationsconductedintheircommunicationswiththeComplianceCommitteeandintheir
reportstotheCEOandtheboard. 53
E. Element 5Enforcing Standards:
Consequences and Incentives
Foracomplianceprogramtobeeffective,theorganizationshouldestablishappropriate
consequencesforinstancesofnoncompliance,aswellasincentivesforcompliance.
Consequencesmayinvolveremediation,sanctions,orboth,dependingonthefacts. Incentives
maybeusedtoencouragecomplianceperformanceandinnovation. Bothincentivesand
consequencesareimportanttoenforcingcompliance.
1. Consequences
Consequences,asusedhere,aretheresultofnoncompliantactions. Consequencesmaybe
educationalorremedialandnon-punitive,theymaybepunitivesanctions,ortheymayinvolve
both. Consequencesmaybeappropriatewherearesponsibleindividualsfailuretodetecta
violationisattributabletotheirignorance,negligence,orrecklessconduct. Intentionalor
recklessnoncomplianceshouldsubjectindividualstosignificantsanctions.
Theorganizationshouldestablishandpublicizeitsproceduresforidentifying,investigating,and
remediating(includingre-trainingordisciplinefortheinvolvedindividuals)actionsthatdonot
complywiththeentitysstandardsofconduct,policiesandprocedures,orFederalandState
laws. Theproceduresshouldidentify:thevariousconsequencesthatmaybeimposedunder
specificcircumstancesinvolvingnoncomplianceandthefunctions(e.g.,manager,human
resources)thatwillbeinvolvedinmakingdecisionsregardingappropriateconsequences.
Theentityshouldincludeinitsguidanceandcompliancecommunicationsitscommitmentto
takedisciplinaryactionorimposeother,remedialconsequencesonafairandequitablebasis.
Thecomplianceofficershouldmonitorinvestigationsandresultingdisciplinetoensure
consistency. Managersandsupervisorsshouldbemadeawarethattheyhavearesponsibility
toimposeconsequencesfornoncompliantbehaviorinanappropriateandconsistentmanner.
Todeternoncompliantconduct,theconsequencesofnoncomplianceshouldbeconsistently
appliedandenforced. Alllevelsofemployeesshouldbesubjecttothesameconsequencesfor
thecommissionofsimilaroffenses. Thecommitmenttocomplianceappliestoallpersonnel
levelswithinanentity,includingcontractorsandmedicalstaff. OIGbelievesthatcorporate
officers,managers,supervisors,healthcareprofessionals,andmedicalstaffshouldbeheld
accountableforfailingtocomplywith,orfortheforeseeablefailureoftheirsubordinatesto
adhereto,theapplicablestandards,laws,policies,andprocedures. 54
2. Incentives
Entitiesalsoshoulddevelopappropriateincentivestoencourage
participationintheentityscomplianceprogram. Thecomplianceofficer,
ComplianceCommittee,andotherentityleadersshouldthoughtfully
considerthecomplianceperformanceoractivitiestheywouldliketo
incentivize,bothacrosstheentityandwithinspecificdepartmentsor
positions. Excellentcomplianceperformanceorsignificantcontributions
tothecomplianceprogramcouldbethebasisforadditionalcompensation,
significantrecognition,orother,smallerformsofencouragement.
Although an entitymay not be able to publicly recognize an
individual who raises a substantiated concern that results in the
mitigation of harm or risk,the entity should find a way to
recognize this in the performance reviews of individuals. This, of
course, is not possible for people who wish to remain anonymous.
Also, this does not apply to individuals who raise compliance or
legal violations for which they themselves committed or were
responsible.
Otherbehaviorthatentitiesmaywanttoincentivizecouldinclude:
 theachievementofcompliancegoalsthatarespecifictoadepartmentoraspecific
positiondescription;
 achievementsthatreducecompliancerisk(e.g.,ateamthatdevelopsaprocessthat
reducescomplianceriskorenhancescompliantoutcomes,oranindividualwhosuggests
amethodofattainingastrategicgoalwithlessrisk);or
 performanceofcomplianceactivitiesoutsideoftheindividualsjobdescription(e.g.,
mentoringofcolleaguesincompliantperformanceorperformingasacompliance
representativewithintheirdepartmentorteam).
OIGencouragesthecomplianceofficerandtheComplianceCommitteetodevotetime,
thought,andcreativitytothecomplianceactivitiesandcontributionsthattheentitywouldlike
toincentivize.
TheComplianceCommitteeandotherentityleadersalsoshouldreviewwhethertheentitys
otherincentiveplanscanbeachievedwhileoperatinginanethicalandcompliantmanner. The
ComplianceCommitteeshouldaskwhether,forexample,salesgoalsoradmissiongoalsmay 55
inadvertentlyencourageriskyornoncompliantbehaviorsuchasofferinghealthcare
practitionersthingsofvalueinexchangefororderingorprescribinganentitysproductsor
referringpatientstotheentityshospitalornursinghome. TheComplianceCommitteealso
shouldexaminewhethersettingcertainperformancegoalsmayhaveunintended
consequences,suchasfalsifyingdocumentsorcoveringupincidentsthatwoulddetractfrom
goalachievement.
Achievementsincomplianceshouldbetreatedcommensuratelywithachievementsinother
areasvaluedbytheentity. Throughthethoughtfulanddeliberateuseofincentives,anentity
mayreduceitscompliancerisk,enhanceadherencetotheentityscomplianceprogram,and
developapositiveassociationwiththeentityscomplianceculture.
F. Element 6Risk Assessment, Auditing, and Monitoring
Riskassessment,auditing,and
...in recent years OIG, the
monitoringeachplayarolein
compliance community, and other
identifyingandquantifying
compliancerisk. Although stakeholders have come to
identifyingandaddressingrisk recognize and place increasing
havealwaysbeenatthecoreof
emphasis upon the importance of
complianceprograms,inrecent
a formal compliance risk
yearsOIG,thecompliance
community,andother assessment process as part of the
stakeholdershavecometo
compliance program.
recognizeandplaceincreasing
emphasisupontheimportanceof
aformalcomplianceriskassessmentprocessaspartofthecomplianceprogram.
1. Risk Assessment
Riskassessmentisaprocessforidentifying,analyzing,and
respondingtorisk. Acomplianceriskassessmentisariskassessment
processthatlooksatrisktotheorganizationstemmingfrom
violationsoflaw,regulations,orotherlegalrequirements. For
entitiesparticipatinginoraffectedbygovernmenthealthcare
programs,acomplianceriskassessmentfocusesonrisksstemming
fromviolationsofgovernmenthealthcareprogramrequirements
andotheractions(orfailurestoact)thatmayadverselyaffecttheentitysabilitytocomplywith
thoserequirements. 56
Periodiccomplianceriskassessmentsshouldbeacomponentofanentityscompliance
programandshouldbeconductedatleastannually.
Entities that want to conduct compliance risk assessments more
often should ensure that they dedicate the necessary time and
resources for each compliance risk assessment they perform
during the year.
Aformalcomplianceriskassessmentprocessshouldpullinformationaboutrisksfromavariety
ofexternalandinternalsources,evaluateandprioritizethem,andthendecidewhichrisksto
addressandhowtoaddressthem. TheComplianceCommitteeshouldberesponsiblefor
conductingandimplementingthecomplianceriskassessment. TheComplianceCommittee
mayfindithelpfultohavecompliance,audit,quality,andriskmanagementfunctions
coordinatetoconductajointriskassessmenttomaximizetheuseofentityresourcesand
reducethenumberandpotentialredundancyofsuchassessments. Withthisinformation,the
ComplianceCommitteecanworkwiththecomplianceofficertoprioritizeresourcesand
developthecomplianceworkplan,includingauditsandmonitoringofidentifiedrisksbasedon
priority. (Someentityfunctions,suchasaudit,mayneedtoperformadditionalrisk
assessmentstosatisfyotherrequirements,suchasfulfillingfederalgrant,contract,andother
awardobligationsunder45CFR75.303,forexample.)
Althoughconductingformalriskassessmentsmaybenewtomanycomplianceprograms,risk
assessmentsareanintegralpartofthefiscalinternalcontrolprocessandtoenterpriserisk
management,andarerequiredforrecipientsoffederalawards. ComplianceCommittees
shouldeducatethemselvesonriskassessmentmethodswhencreatingtheirowncompliance
riskassessmentprocess. Astandardresourceforriskassessmentsis EnterpriseRisk
Management:IntegratingwithStrategyandPerformance(2017),publishedbytheCommittee
ofSponsoringOrganizations(COSO)oftheTreadwayCommission. TheSocietyofCorporate
ComplianceandEthicsandtheHealthCareComplianceAssociation,withCOSO,subsequently
publishedComplianceRiskManagement:ApplyingtheCOSOERMFramework(2020),which
containsinformationonconductingacomplianceriskassessment. Anotherstandardresource
isTheGreenBook,publishedbytheU.S.GeneralAccountabilityOffice,whichcontainsasection
onriskassessments. Playbook:EnterpriseRiskManagementfortheU.S.FederalGovernment
(Fall2022Update),publishedbytheChiefFinancialOfficersCouncilandthePerformance
ImprovementCouncil,providesusefulrisk-assessmenttoolsinAppendicesFandG. Numerous
otherguidesandresourcesforconductingcomplianceriskassessmentsareavailableonthe
Internet. 57
Entitiesshouldconsiderusingdataanalytics,i.e.,analyzingitsdata,to
identifycomplianceriskareas. Allentities,regardlessofsize,should
haveaccesstothedatatheygenerate,eitherdirectlyorthroughathird
party,suchasabillingcontractor. Dataanalyticseffortsmayrangefrom
simpletocomplexdependingonanentitysvolumeofdataaswellasthe
entitysdataanalyticscapabilitiesandresources.
Allentitiesshouldbeabletocomparestandardmetricsoftheirhealthcareoperations
internallytodeterminewhetherthereareanyoutliersinanyparticularareaoffocus. Entities
mayusecommonlyavailablespreadsheetsoftwaretoanalyzetheirdata. Othersoftware
programsthatentitiesalreadyuse,suchasbillingsoftwareandelectronichealthrecords,may
alsohavecomponentsthatallowentitiestoanalyzethedatatheycontain. Largerentitiesor
thosewithmorecapabilitiesorresourcesshouldrunmoresophisticateddataanalytics
processestoassessanycomplianceriskspresentedbytheiroperations. Analyzingdataallows
entitiestoidentifypossibleriskareasbyhighlightingoutliersorotherdatatrendsindicating
potentialnoncompliance.
Betweencomplianceriskassessments,thecomplianceofficershouldcontinuetoscanfor
unidentifiedornewrisks,by,forexample,monitoringforlegalandregulatorychanges,
enforcementactionsandOIGworkplandevelopments,andnewentityacquisitions,
strategies,orinitiatives,andevaluatingauditsandinvestigationresults. Whenthe
complianceofficerortheComplianceCommitteeidentifiesanewrisk,theriskshouldbe
assessedwiththesamemethodsusedinthecomplianceriskassessment. Basedonthis
information,theComplianceCommitteecandecidewhetherandhowtoaddressthenewly
identifiedrisk. 58
2. Auditing and Monitoring
TheComplianceCommitteeshouldincludeinthe
complianceworkplanascheduleofauditstobe
conductedbasedonrisksidentifiedbytheannual
riskassessment. TheComplianceCommitteealso
shouldensurethatthecomplianceofficerhasthe
capacitytoperformoroverseeadditionalauditsbasedonrisksidentifiedthroughouttheyear,
forexample,aspartofaninvestigationintoanoverpaymentthatuncoversapotentialsystemic
issue. Theauditsmaybeconductedbyinternalorexternalauditorswhohaveexpertisein
FederalandStatehealthcarestatutes,regulations,andFederalhealthcareprogram
requirements.
Medicare requires, as a condition of payment, that items and
services be medically reasonable and necessary. Therefore,
entities should ensure that any claims reviews and audits include
a review of the medical necessity of the item or service by an
appropriately credentialed clinician. Entities that do not include
clinical review of medical necessity in their claims audits may fail
to identify important compliance concerns relating to medical
necessity.
Dependingontheentityssize,theentitymaydecidetohavededicatedcomplianceauditors
reportingtothecomplianceofficertoconductcomplianceaudits.
Thecomplianceworkplanalsoshouldcontainroutinemonitoringofongoingrisks,plusthe
capacitytomonitortheeffectivenessofcontrolsandriskremediation. Examplesofroutine
monitoringofknownrisksinclude:
 monthlyscreeningoftheLEIEandStateMedicaidexclusionlists;
 regularscreeningofStatelicensureandcertificationdatabases;and
 annualreviewoftheentityspoliciesandprocedures.
Entitiesmayidentifyotherareasappropriateforroutinemonitoringbasedontheirrisk
assessmentandtheirinteractionwiththeFederalhealthcareprograms,suchashigh-value
billingcodes,medicalrecorddocumentation,medicalnecessityofadmission,orbusiness-need 59
justificationsforcontractswithreferralsources. Short-termmonitoringis
usefulfordeterminingtheeffectivenessofriskremediation.
Entitiesmaywish,eitherperiodicallyorduringtheannualrisk
assessment,tore-assesstheirongoingmonitoringprogramtodetermine
whethermonitoringiseffective,stillneeded,orperformedatthe
appropriateinterval.
Entitiesalsoshouldperiodicallyassessthecomplianceprogramseffectiveness. The
reviewshouldincludeanassessmentofhoweffectiveeachelementofthecomplianceprogram
is. OIGhaspublishedatoolkit,MeasuringComplianceProgramEffectiveness,whichmayassist
withthisassessment. Thistoolkitprovidesalistofideas,organizedaroundtheseven
complianceprogramelements,fromwhichhealthcareorganizationscanselectevaluativetools
thatwillbestservetheirneeds. Itisintendedtobeasetoftoolsthatanyhealthcare
organization,regardlessofsizeorhealthcareindustrysegment,canuse.
As OIG noted in its Introduction to Measuring Compliance
Program Effectiveness, the toolkit is not intended to be a
checklist to assess an entire compliance program. Using all the
tools or many of them is impractical and not recommended.
Theboardshoulddirecttheentitytoperformthecomplianceprogrameffectivenessreview
andhavethereviewersreporttheirfindingsandrecommendationsdirectlytotheboard.
Dependingontheentitysresourcesandrecentcompliancehistory(e.g.,alargecompliance
failureoraseriesofeventsthecomplianceprogramdidnotidentifyandaddressasrisks),the
boardmaywanttoconsiderretaininganoutsideexperttoconductthereview.
G. Element 7Responding to Detected Offenses and
Developing Corrective Action Initiatives
Nomatterhowstronganentityscommitmenttocomplianceorhoweffectivethepoliciesand
procedures,training,andriskassessment,itisinevitablethatacomplianceofficerwillreceive
auditormonitoringresultsthatraiseconcernsorreceiveareportthroughthedisclosure
programthatrequiresinvestigating.
If, over time, a compliance officer does not receive this type of
information, the compliance officer should consider conducting a
compliance program effectiveness review. 60
Aninvestigationcouldshowthatnothingimproperoccurred,itcouldrevealanoverpayment
thatisowed,anditcoulduncoverinformationindicatingthatmisconducthasoccurred,
resultinginviolationsofapplicableFederalorStatelaw. Consequently,acomplianceprogram
shouldexpectanyoutcomeonthisspectrumandplanaccordinglythroughappropriatepolicies
andotherresources.
Morespecifically,complianceprogramsshouldincludeprocessesandresourcestothoroughly
investigatecomplianceconcerns,takethestepsnecessarytoremediateanylegalorpolicy
violationsthatarefound,includingreportingtoanyGovernmentprogramagenciesorlaw
enforcementwhereappropriate,andanalyzetherootcause(s)ofanyidentifiedimproprietyto
preventarecurrence. Howanentityrespondswhenitfindsaviolationresultinginasubstantial
overpaymentorseriousmisconductsetsapartthosethathaveastrongcomplianceprogram
fromthosewithacomplianceprogramthatismoreformthansubstance.
1. Investigations of Violations
Violationsofanentityscomplianceprogram,failurestocomplywith
applicableFederalorStatelaw,andothertypesofmisconductthreaten
anentitysstatusasatrustworthyorganizationcapableofparticipating
inFederalhealthcareprogramsandthehealthcareindustry. Detected
butuncorrectedmisconductcanseriouslyendangerthemission,
reputation,andlegalstatusoftheentity. Consequently,itisimportant
thatthecomplianceofficeractpromptlytonotifyappropriateleaders
andcoordinatewithentitycounselasneededuponreceiptofreportsorreasonableindications
ofsuspectednoncompliancetodeterminewhetheramaterialviolationofapplicablelawhas
occurred.
Whetheramaterialviolationofapplicablelawexistsmustbedeterminedonacase-by-case
basis. Theexistence,oramount,ofamonetarylosstoaFederalhealthcareprogramisnot
solelydeterminativeofwhetherornotaviolationhasoccurred. Allegationsofnoncompliant
conductshouldbeinvestigatedandtheoutcomeoftheinvestigationshoulddetermine
whether,andwhatkindof,reportingtotheGovernmentisnecessary. Theremaybematerial
violationsofapplicablelawwherenomonetarylosstoaFederalhealthcareprogramor
Governmententityhasoccurred;however,intheseinstances,correctiveactionandreporting
(e.g.,toCMSoraStateMedicaidprogram)arestillnecessarytoprotecttheintegrityofthe
applicableprogramanditsenrollees. 61
Mostinternalinvestigationswillrequireinterviewsandareviewof
relevantdocuments. Datareview,emailsearches,andauditsmayalso
berequired. Thecomplianceofficerorcounselshouldtake
appropriatestepstosecureorpreventthedestructionofdocuments
orotherevidencerelevanttotheinvestigation. Basedonthe
potentialscopeandseverityofthesuspectedviolationandthe
necessaryinvestigativetasks,entitiesshouldconsiderwhetherthey
needtoengageexternalcounsel,auditors,orhealthcareexpertstoaidwiththeinvestigation.
Ifcounselorthecomplianceofficerbelievestheintegrityoftheinvestigationmaybeatstake
becauseofthepresenceofemployeesunderinvestigation,thosesubjectsshouldberemoved
fromtheircurrentworkactivityuntiltheinvestigationiscompleted(unlessaninternalor
Government-ledundercoveroperationisineffect).
Regardlessofthesizeorseverityoftheviolationbeinginvestigated,acontemporaneousrecord
oftheinvestigationshouldbemaintained,sothatarecordoftheinvestigationcanbe
compiled. Therecordshouldinclude:
 documentationoftheallegedviolation;
 adescriptionoftheinvestigativeprocess;
 copiesofinterviewnotesandkeydocument;
 alogofthewitnessesinterviewedandthedocumentsreviewed;
 theresultsoftheinvestigation;and
 anydisciplinaryactiontakenorcorrectiveactionimplemented.
2. Reporting to the Government
Thissectionendeavorstodescribegeneralguidelinesrelatedtoreportingmisconducttothe
government. Itdoesnotaddressspecificreportingrequirementsmandatedbycertainlaws
(e.g.,HIPAAbreachnotificationrequirements;requirementsrelatedtoreportingallegationsof
abuseandneglectinnursingfacilities).
Asageneralmatter,ifcredibleevidenceofmisconductfromanysourceisdiscoveredand,after
areasonableinquiry,thecomplianceofficerorcounselhasreasontobelievethatthe
misconductmayviolatecriminal,civil,oradministrativelaw,thentheentityshouldpromptly
(notmorethan60daysafterthedeterminationthatcredibleevidenceofaviolationexists)
notifytheappropriateGovernmentauthorityofthemisconduct. 62
DependingonthenatureoftheviolationandtheGovernmentprograminvolved,appropriate
Governmentauthoritiesmayinclude:
 theCriminalorCivilDivisionsofDOJ;
 theUnitedStatesAttorneysOfficefortheentitysdistrict;
 OIG;
 CMS;
 theStateMedicaidFraudControlUnits;
 theDefenseCriminalInvestigativeService;
 theOfficeofInspectorGeneralfortheDepartmentofVeteransAffairs;and
 theOfficeofPersonnelManagement(whichadministerstheFederalEmployeesHealth
BenefitsProgram).
Promptreportingwilldemonstratetheentitysgoodfaithandwillingnesstoworkwith
governmentalauthoritiestocorrectandremedytheproblem.
Someviolationsmaybesoseriousthattheywarrantimmediatenotificationtogovernmental
authorities,priorto,orsimultaneouswith,commencinganinternalinvestigation. Thisincludes
conductthat:
 isaclearviolationofcriminallaw;
 hasasignificantadverseeffectoneitherpatientsafetyorthequalityofcareprovidedto
patients(inadditiontoanyotherlegalobligationsregardingqualityofcareorabuseor
neglect);or
 indicatesevidenceofasystemicfailuretocomplywithapplicablelaws,anexistingCIA,
orotherstandardsofconduct,regardlessofthefinancialimpactonFederalhealthcare
programs.
OIGbelievesintheimportanceofself-reporting. Tofacilitatethis,OIGmaintainsvoluntary self-
disclosureprogramsforentitiestousetoreportsuspectedfraud. OIGtakesintoconsideration
theentitysgood-faithvoluntarydisclosurewhenresolvingviolationssubmittedthroughoneof
theprograms. FormoreinformationabouttheOIGsvoluntaryself-disclosureprogramsand
howentitiescanbenefitfromusingthem,pleaseseeourdiscussionin sectionVI.G. 63
3. Implementing Corrective Action Initiatives
Oncetheentityhasgatheredsufficientcredibleinformationtodeterminethenatureofthe
misconduct,itshouldtakepromptcorrectiveaction,including:
 refundingofoverpayments;
 enforcingdisciplinarypoliciesandprocedures;and
 makinganypolicyorprocedurechangesnecessarytopreventa
recurrenceofthemisconduct.
Iftheentitydeterminesthatthemisconductresultedinan
overpayment,itshouldpromptlyrepaytheoverpaymenttoaffected
governmentagencies. Federallawrequiresentitiesrepayanyoverpaymentsreceivedfrom
MedicareoraStateMedicaidprogramwithin60daysafteridentification.60 Theentityshould
followandenforceitspoliciesandproceduresagainstresponsibleindividuals,includingthosein
leadershiporsupervisoryroleswhoseneglectorrecklessdisregardoftheirdutiesallowedthe
misconducttooccuruncheckedorpreventedtheentityfromidentifyingthemisconductearlier.
Throughoutaninvestigationofanynoncompliant
conductthecomplianceofficershouldbegathering
informationtoaidthemindeterminingtherootcauses
oftheconduct. Thecomplianceofficershould,ofcourse,
ensurethatanyongoingnoncompliantconductis
stoppedandmakeanyimmediatechangesnecessaryto
ensurethatitdoesnotresume. Butthecompliance
officershouldalsoworkwiththeappropriateindividuals
todeterminetherootcauseoftheconductsothatthe
entitycanmaketherequiredchangestopreventa
recurrence. Thecomplianceofficershouldalso
determinewhethertheconductexposedanycompliance
weaknessesthatcouldplacetheentityatriskforother,
unrelatedmisconduct. TheComplianceCommittee
shouldensurethattheentitytakesthenecessarysteps
topreventrecurrenceofthemisconductandto
strengthenanyidentifiedareasofvulnerability.
60 Section1128JoftheAct,42U.S.C.1320a-7k(d). SECTION IV
Compliance Program Adaptations for
Small and Large Entities 65
IV. Compliance Program Adaptations
for Small and Large Entities
Complianceprogramsmaybestructureddifferently
dependingontheentityssize. Smallentitiesandlarge
organizationsshouldthinkabouthowtoright-sizetheir
complianceprogramtomeettheirentitysneeds. Below,
OIGprovidesguidanceonhowsmallentitiescanimplementacomplianceprogramthatmeets
thesevenelementsevenwithlimitedresources. Forlargeorganizations,OIGdiscussestherole
ofthecomplianceofficer,theComplianceCommittee,andtheboardindevelopingand
monitoringacomplianceprogramcapableofmeetingtheneedsofalargerorganization.
A. Compliance Programs for Small Entities
Smallentities,suchasindividualandsmall-groupphysicianpractices,orotherentitieswitha
smallnumberofemployees,mayfacefinancialandstaffingconstraintsthatotherentitiesdo
not. Whilestillencompassingthesevenelementsdiscussedabove,asmallentityscompliance
programshouldbestructuredsothattheentitycangainthebenefitsandprotectionofa
complianceprogramwithintheconstraintsunderwhichtheentityoperates. OIGoffersthe
followingsuggestionsonhowthesevenelementscanbesuccessfullyimplementedatasmall
entity.
1. Compliance Contact
Smallentitiesthatcannotsupportacomplianceofficeroneitherafull-timeorpart-timebasis
shouldconsiderdesignatingonepersonastheentityscompliancecontactandhavethembe
responsibleforensuringthattheentityscomplianceactivitiesarecompleted. Thisperson
shouldnothaveanyresponsibilityfortheperformanceorsupervisionoflegalservicestothe
entityand,wheneverpossible,shouldnotbeinvolvedinthebilling,coding,orsubmissionof
claims. Intheabsenceofaboard,thecompliancecontactshouldreportatleastquarterlyto
theownerorCEOonthestatusoftheentityscomplianceactivities. TheownerorCEOis
ultimatelyresponsiblefortheentityscompliancewithFederalhealthcareprogram
requirements. 66
2. Policies, Procedures, and Training
Asmallentityshouldhavepolicies,procedures,andtrainingonhowto
performdutiesandactivitiesincompliancewithgovernmenthealthcare
andotherapplicablelegalrequirements. Itshouldalsoinstructits
personnelonitscomplianceprogram.
Entitiesmaybeabletoavailthemselvesofpolicyandprocedure
templatesandtrainingthroughtheirmanagementcompany(iftheyuse
one),aconsultant,oraprofessionalorganization. Theinternetmayalso
beasourceofpolicyandtrainingmaterial,althoughentitiesshould
reviewsuchmaterialcarefullyforitscontentandqualityandmodifythe
material,asnecessary,toreflectthespecificbusinessoperationsandcompliancerisksofthe
entity. Entitiescansupplementtheirownpolicieswithinformationprovidedbyapplicable
Federalagenciesandcontractors.
OIGmaintainsaseriesofComplianceTrainingVideosthatentitiesmayfindhelpful. Physician
practicesmayalsobeabletoobtaintrainingthroughahospitalorotherproviderwithwhich
theyareaffiliatedbutshouldbemindfulofpotentialFederalanti-kickbackstatuteand
physicianself-referralimplicationsthatmayarisefromsucharrangements.
OIGs guidanceA Roadmap for New Physicians may be a helpful
resource for experienced as well as new physicians. OIG also has a
companion PowerPoint and speaker note set for trainers that are
available on the same page.
Smallentitiesmayeducatetheirpersonnelontheentityscomplianceprogramthrougha
varietyofmeans,includingduringanentitymeeting,throughemail,onawebsite,orthrough
postingsinphysicalorvirtualcommonareas. Thisinformationshouldbeprovidedtonew
personnelwhentheyjointheentityandupdatesandremindersshouldbeprovidedto
personnelperiodically. 67
3. Open Lines of Communication
Althoughaformaldisclosureprogrammaynotbenecessaryorappropriate
forasmallorganization,asmallentityshouldensurethatitspersonnel
understandtheentityscommitmenttocomplianceandtononretaliation.
Smallentitiesshoulduseuser-friendlymethodsappropriatetotheirsizeand
settingtofacilitatecommunicationaboutcomplianceconcernsandpotential
issues. Thismayincludeanexplicitopendoorpolicyforpersonneltoraise
concernswiththecompliancecontact,theowner,ortheCEO. Thispolicymaybeimplemented
inconjunctionwithlessformalcommunicationtechniques,suchasnoticesinphysicalorvirtual
commonareas.
Evenintheabsenceofaformaldisclosureprogram,smallentitiesshouldhavepoliciesinplace
thatrequiregoodfaithreportingofcomplianceissuesorpotentialviolationsoflaw,outlinea
processfortheinvestigationandresolutionofreportedissuesorconcerns,andprohibit
retaliationforgoodfaithreporting.
Othermeansthatasmallentitycanusetofacilitatemeaningfulandopencommunication
includethefollowing:
 therequirementthatemployeesreportconduct
thatareasonablepersonwould,ingoodfaith,
believetobeerroneous,improper,orfraudulent;
 thecreationofauser-friendlyprocess(suchasan
anonymousdropbox)foreffectivelyreporting
erroneous,improper,orfraudulentconduct;
 apolicyindicatingthatafailuretoreport
erroneous,improper,orfraudulentconductisaviolationofthecomplianceprogram;
 thedevelopmentofasimpleandreadilyaccessibleproceduretoprocessreportsof
erroneous,improper,orfraudulentconduct;
 ifabillingcompanyisused,communicationtoandfromthebillingcompanys
complianceofficerorcompliancecontactandotherresponsiblestafftocoordinate
billingandcomplianceactivitiesoftheentityandthebillingcompany,respectively;
 theutilizationofaprocessthat,ifrequestedandtotheextentpossible,maintainsthe
anonymityofthepersonreportingtheconcern;and 68
 apolicyindicatingthattherewillbenoretributionforreportingconductthata
reasonablepersonactingingoodfaithwouldhavebelievedtobeerroneous,improper,
orfraudulent.
OIGrecognizesthatprotectinganonymitymaynotbefeasibleforsmallentities. OIGbelieves,
however,thatallpersonnelseekinganswerstoquestionsorreportingpotentialinstancesof
erroneous,improper,orfraudulentconductshouldknowtowhomtoturnforassistancein
thesemattersandshouldbeabletodosowithoutfearofretribution.
Whiletheentitymaystrivetomaintaintheanonymityofanemployeesidentity,itshouldalso
makeclearthattheremaybeapointatwhichtheindividualsidentitymaybecomeknownor
mayhavetoberevealedincertaininstances. Smallentities,particularlythoseforwhich
anonymityisnotpossible,shouldpostinformationabouthowtoaccessthe OIGHotlinein
physicalorvirtualcommonareas.
4. Risk Assessment, Auditing, and Monitoring
Smallentitiesshouldassesstheircompliancerisksatleastonceayear.
Small entities that want to conduct compliance risk assessments
more often should ensure that they dedicate the necessary time
and resources for each compliance risk assessment they perform
during the year. Small entities that receive federal awards should
be sure to comply with requirements at 45 C.F.R.  75.303.
Complianceriskassessmentsdonothavetobecomplicatedorresourceintensive. Guidance
andresourcesforconductingacomplianceriskassessmentareavailableontheInternet. One
resourcethatmaybeofinterestisComplianceRiskManagement:ApplyingtheCOSOERM
Framework(2020),writtenbytheSocietyofCorporateComplianceandEthicsandtheHealth
CareComplianceAssociation. Thisresourcediscusseshowtoapplytheenterpriserisk
managementframeworktocompliancerisk. Italsohasasectiononconductingacompliance
riskassessment. Smallentitiesshouldreviewtheirowndatatoidentifypotentialrisks,suchas
claimsdenials,challengestomedicalnecessity,andpatientsafetydata(e.g.,fallrates,product-
returnrates,complaints). OIGregularlyupdatesits WorkPlan,whichisalsoagoodresource
whenattemptingtoidentifypotentialrisks. Smallentitiescanalsogenerateriskinformation
by,forexample,brainstormingduringastaffmeeting. Afterthesmallentitysrisksare
identifiedandanalyzed,theentitycanthendecidehowtoaddressthehigh-priorityissues,such
asbyconductinganaudit,puttingmonitoringinplace,ormakingprocesschanges. Between 69
complianceriskassessments,leadersshouldcontinuetowatchforneworunidentifiedrisks. If
thesmallentityidentifiesanewrisk,itshouldassessitanddeterminehowtohandleit.
Smallentitiesshouldconductatleastanannualaudit. Theriskassessmentcanhelptheentity
todeterminewhattypesofclaimsorotherareastoselectfortheaudit. Basedontheaudit
results,theentitywillbeabletodeterminewhetherthereareissuesthatitshouldaddress.
Remediationcouldinclude:
 repaymentofoverpayments;
 changingofentityprocesses;and
 educationofpersonnel.
Auditresultsmayindicatethattherecouldbepotentialsystemicissuesortheymayidentify
potentiallyimproperconduct. Inthatcase,theentityshouldconsiderwhetheritneedsto
conductanexpandedauditorseekoutsideassistancetoinvestigateand,ifnecessary,address
andresolvetheissue.
Risksthatanentitybecomesawareofoutsideoftheannualriskassessmentmayrequire
additionalauditsiftheentityratesthemashighpriority.
Routinemonitoringcanbeaneffectiveandefficientmethodofmanagingknownrisks. This
shouldincluderoutinemonitoringoftheLEIE,applicableStateMedicaidexclusionlists,and
checksonpractitionerslicensureandcertificationstatus.
An excluded employee or an employee with a lapsed license can
have a significant impact on a small entity.
Smallentitiesshouldmonitorcommunicationstheyreceivefromthe
Federalhealthcareprogramsandcontractorssothattheycanmake
necessarypolicychangestoaddressneworrevisedprogram
requirements.
Smallentitiescanalsodevelopalistofriskindicatorsrelevanttotheir
businessorpracticeareaforwhichtheywanttomonitor,suchas
significantchangesinnumberortypeofclaimrejections,high-level
surveyfindings,illogicaloratypicalorderingpatterns,andunusual
changesincodeutilization. Whenmonitoringrevealsoneoftheseindicators,theentityshould
investigatetodeterminethecauseoftheindicatorandthendecidehowtoaddressit. 70
5. Enforcing Standards
Smallentitiesshouldensurethattheyhaveenforcementanddisciplinarymechanismsinplace
beforeviolationsofcompliancepolicies,governmenthealthcarerequirements,orother
applicablelawsoccur. Themechanismsshouldhavesufficientflexibilitytopermitpersonnelto
askquestionsanddisclosemistakeswhilealsoenforcingtheentityscommitmentto
compliance. Entitiesmightalsowanttocommunicatethatthefailuretoreportviolationsof
compliancepoliciesorlegalrequirementsmayleadtodiscipline. Entitiesmayalsowantto
considerimplementingincentivesforcomplianceperformanceandinnovation.
For more information, see Element 5--Enforcing Standards:
Consequences and Incentives
6. Responding to Detected Offenses and Developing
Corrective Action Initiatives
Whenimplementingacomplianceprogram,smallentitiesshouldanticipatethattheprogram
mayuncoverpotentiallegalviolationsorothernoncompliance.
Smallentitiesshouldbepreparedtodesignatesomeone,whetheritisthecompliancecontact,
anentityleader,oranotherdesignatedemployee,todeterminewhetheraviolationexistsand
thestepsnecessarytocorrectanyproblems. Asappropriate,suchstepscouldinclude:
 acorrectiveactionplan;
 thereturnofoverpayments;
 areporttotheresponsiblegovernmentagency;or
 adisclosuretoanappropriatelawenforcementagency,suchasadisclosuretotheOIG.
A corrective action plan may include policy and process revisions,
education of personnel, a revision to the entitys training plan, and
consequences for offending individuals. 71
B. Compliance Leadership for Large Entities
Inpriorboardguidance,OIGwrotethathealthcareboardmembersshouldconsiderthesize
andcomplexityoftheirorganizationsinreviewingthescopeandadequacyoftheentitys
complianceprogram. Whetherahealthcaresysteminalargemetropolitanareaorachain
retailpharmacyoramanufacturerwithlocationsandoperationsstatewideornationwide,large
organizationswillgenerallyneedsignificantcomplianceresourcesandexpertisetodevelopand
monitoracomplianceprogramcapableofaddressingthebreadthandcomplexityof
complianceissuesthatalargeorganizationfaces. Boardsoflargehealthcareorganizations
shouldthoughtfullyevaluatetheresourcesandexpertisetheywillneedatthecompliance
officer,ComplianceCommittee,andboardlevel.
1. Compliance Officer
Largeorganizationsareunlikelytoimplementandmaintainasuccessfulandeffective
complianceprogramwithasinglecomplianceofficer. Alargeorganizationwilllikelyneeda
departmentofcompliancepersonnelwithavarietyofskillsandexpertisetoimplementand
monitortheorganizationscomplianceprogramandaddressitsmanifoldcomplianceneeds.
Alargeorganizationshouldhireaknowledgeableandskilledcomplianceofficerandleaderas
itschiefcomplianceofficertooverseeanddirecttheorganizationscompliancefunctionand
leadthecompliancedepartment.
Boardsoflargeorganizationsshouldhaveinputontheappointment,performanceevaluation,
andcompensationofthechiefcomplianceofficer. Theyalsoshouldconsiderhavingthechief
complianceofficerreportdirectlytothem. Reportingtotheboardwillgivethechief
complianceofficerthestatureandindependencetheyneedtoleadasuccessfulcompliance
program. Inalargeorganizationwithmanycompetingpriorities,reportingdirectlytothe
boardwillsendastrongmessagetotheentireorganizationanditsstakeholdersaboutthe
boardscommitmenttocompliance.
Thechiefcomplianceofficershouldorganizethecompliancedepartmentsstafftoservethe
organizationmosteffectively. Dependingonthestructureandthenatureoftheorganization,it
maybeusefultohaveoneormoredeputycomplianceofficersresponsibleforspecificareas
(e.g.,complianceaudits,investigations,training,policies)orcomponentswithinthe
organization,regionalcomplianceofficersresponsibleforvariousgeographicregionsthe
organizationserves,facilitycomplianceofficersorliaisonsresponsibleforaspecificfacilityor
location,orsomecombinationthereof. 72
Thechiefcomplianceofficershouldconsiderthevaryingskillsthatmaybeneededwithinthe
department,suchasauditors,investigators,clinicians,anddataexperts,tooperateeffectively,
andwhetheruseofspecializedconsultantsorpart-timeemployeesmaybebeneficial. Ifthe
largeorganizationoperatesorcontrolsavarietyofprovidersandsuppliers(forexample,
operatinghomehealthagenciesandhospicesandprovidingrehabilitationtherapyservices),
thechiefcomplianceofficershouldensurethatthecompliancedepartmenthasthecompliance
knowledgeandexpertisetoaddressthecompliancerisksforeachhealthcarecomponentthe
entityoperatesorcontrols.
Thechiefcomplianceofficerandtheboardshouldperiodicallyevaluatethecompliance
departmenttodeterminewhetheritscurrentcompositioniseffectivelymeetingtheneedsof
theorganization.
Inalargeorganizationwithfacilitiesorlocationsacrossaregionorthecountry,itmaybemost
effectivetohavededicatedcomplianceresources,suchasafacilitycomplianceofficer
(sometimescalledafacilitycomplianceliaison),ateachfacilityorlocation.
To the extent possible, given the facility or locations staffing
constraints, the facility compliance officer should not have
responsibility for clinical, financial, legal,or operational duties.
Ifthefacilityorlocationcomplianceofficerresponsibilityisapart-
timeorsecondaryrolethattheindividualassumedinadditionto
thepositionforwhichtheywerehired,thechiefcomplianceofficer
shouldensurethatthefacilityorlocationcomplianceofficerhasa
dotted-linereportingrelationshiptothechiefcomplianceofficer
andisabletoperformtheircompliancedutiesatthedirectionof
thechiefcomplianceofficer(directlyorindirectlythroughadeputy
orregionalcomplianceofficer). Thiswillensurethatallthecompliancefunctionsofthelarge
organizationaredirectedandoverseenbythechiefcomplianceofficer. Thechiefcompliance
officershouldalsoensurethatthefacilityorlocationcomplianceofficerhastheskills,
knowledge,resources,andtimetofulfilltheircomplianceduties. 73
2. Compliance Committee
TheComplianceCommitteesoflargeorganizationsoften
havemanymembers,representingthevariousoperational
componentsinvolvedinthecomplianceprogram. Large-
organizationComplianceCommitteesmayfinditusefulto
createsubcommitteestoprovidesupporttothechief
complianceofficerundertheoversightoftheCompliance
Committee. Staffingsubcommitteeswithamixof
ComplianceCommitteemembersandsubjectmatterexperts
providestheComplianceCommitteewithadditionalexpertise
andground-levelexperiencewhileexpandinginvolvementintheimplementationand
operationofthecomplianceprogram. Subcommitteesmayberesponsibleforpoliciesand
procedures,trainingandeducation,complianceaudits,riskassessments,effective
communication,andotherareaspertinenttotheorganization. TheComplianceCommittee
mayalsowanttoformtemporaryworkgroupstoworkoninitiativesorothertime-limited
projects. UsingsubcommitteesandworkgroupspermitstheComplianceCommitteeto
substantivelysupportthechiefcomplianceofficerwhileallowingmoretimeatcommittee
meetingsforstrategicandsystemiccomplianceprogrammatters.
3. Board Compliance Oversight
Boardsoflargeorganizationsusuallyhaveseparate
boardcommittees,suchasaBoardAuditCommittee.
Manyboardsassigntheresponsibilityforcompliance
oversighttotheBoardAuditCommittee. Boardsshould
considercreatingaseparateBoardCompliance
Committeewithachartertooverseehealthcare
compliance. Thispermitseachcommitteetofocuson
theirareaofresponsibility. Separatecommitteescan
enableboardstoensurethateachcommitteehas
memberswithknowledgeandexpertiseintheComplianceCommitteesareaofresponsibility.
Forexample,compliance,governmenthealthcareprogramrequirements,andclinicalorother
expertiserelatedtotheorganizationshealthcareoperationslikelywouldbeusefulforthe
BoardComplianceCommittee,whilememberswithaudit,finance,andU.S.Securitiesand
ExchangeCommissionexpertiselikelywouldbemoreusefulfortheBoardAuditCommittee. If
thechiefcomplianceofficerreportstotheboard,theboardmaywishtodelegatethe
responsibilityforongoingcommunicationwiththechiefcomplianceofficertotheChairofthe
BoardComplianceCommitteeorotherboardcommitteeresponsibleforcompliance. 74
Somelargeorganizationsareownedorcontrolledbyaninternationalorganizationwith
headquarterslocatedinanothercountry. Boardsoflargeorganizationsoperatinginthe
UnitedStatesbutownedorcontrolledbyinternationalorganizationsshouldensurethatthe
parentboardisprovidedwithsufficientinformationabouttheapplicablelaw,Federalhealth
careprogramrequirements,andthecomplianceriskspresentedbytheoperationoftheU.S.
organization. Largeorganizationboardswithaninternationalparentmaywishtorecommend
thattheparentboardreceiveregularreportsfromandhavetheopportunitytoengagein
discussionswiththechiefcomplianceofficeroftheU.S.organizationandcounsel
knowledgeableinthelawsapplicabletotheU.S.organization(e.g.,theFalseClaimsAct,the
Federalanti-kickbackstatute,andthePSL). SECTION V
Other Compliance Considerations 76
V. Other Compliance Considerations
Inthissection,weoffersomeimportantcomplianceconsiderationsrelatedtoseveralgenerally
applicableriskareas.
Forthcoming ICPGs will address industrysubsector-specific risk
areas for different types of providers, suppliers, and other
participants in health care industry subsectors or ancillary
industry sectors relating to Federal health care programs. Our
existing CPGs and supplemental CPGs will remain available for use
as ongoing resources to help identify risk areas in particular
industry segments as we develop the ICPGs.
Webelievethatthismayfurtherassistentitiesindevelopingpoliciesandprocedures,aswellas
implementingpractices,toreduceoreliminatepotentialfraudandabuserisksintheseareas.
Wewillcarefullyconsidertimelyupdatesandadditionstothissectionbasedongeneral
complianceconcernsidentifiedthroughOIGwork,bytheenforcementcommunity,aswellas
feedbackreceivedfromindustrystakeholdersthroughouremailinboxat
Compliance@oig.hhs.gov.
A. Quality and Patient Safety
Qualityandpatientsafetyareoftentreatedaswhollyseparateanddistinctfromcompliance,
andthecomplianceprogramoftendoesnotcontainqualityandpatientsafetycomponents.
ButqualityandpatientsafetyareintegraltotheworkofHHS,CMS,FDA,andotheragencies.
AndOIGandDOJhavelongemphasizedtheimportanceofqualityandpatientsafety. OIGand
DOJhaveinvestigatedandsettledcasesbasedonthesubmissionoffalseclaimsforcarethatis
materiallysubstandard,resultingindeathorsevereharmtopatients. OIGhasenteredinto
CIAsfocusedonqualityofcareandpatientsafety. OIGhasissuedreports,toolkits,andboard
guidanceonqualityofcare. QualityandpatientsafetyarehighprioritiesofHHSandDOJ.
Entitiesshouldincorporatequalityandpatientsafetyoversightintotheircomplianceprograms.
Integratingqualityandpatientsafetyoversightintocomplianceprocessescanalerttheentity
ofqualityandpatientsafetyconcernsandenabletheentitytomitigateriskofpatientharm.
Besidespatientharm,qualityandpatientsafetyconcerns,suchasexcessiveservicesand
medicallyunnecessaryservices,canleadtooverpaymentsandmaycauseFalseClaimsAct
liability. Theboardshouldrequireregularreportsfromseniorleadershipresponsiblefor 77
qualityandpatientsafetyandfromthecomplianceofficeronoversightofqualityandpatient
safetycompliance. Theboardshouldreceiveregularreportsonthesystemofinternalquality
controls,qualityassurancemonitoring,patientsafety,andpatientcare.
TheOIGguidanceCorporateResponsibilityandHealth
CareQuality:AResourceforHealthCareBoardsof
Directorscontainsahelpfulquestion-and-answersection
onqualityandcompliancethatentitiesandtheirboards
mayfindusefulinstructuringboardoversight. Theboard
mayalsowishtoutilizeaqualitydashboardtoassistitin
monitoringtheentitysqualityperformance,including
patientsafety. OIGhasprovidedguidanceondashboards
forqualityinAcuteCareandLong-TermCare,whichcan
provideusefulinformationtoboardsinvarioushealthcare
sectors.
TheComplianceCommitteeshouldincludemembers
responsibleforqualityassuranceandpatientsafety. The
ComplianceCommitteeshouldreceiveregularreportsfromseniorleadershiponquality,
patientsafety,and,forproviderentitiesandphysicianpractices,adequacyofpatientcare. The
ComplianceCommitteeshouldestablishandimplementaprogramforperformingquality
auditsandreviews. Theprogramshould:
 auditandreviewqualityandpatientsafetyincidents;
 conductroot-causeanalyses;
 designorapprovecorrectiveactionplans;and
 tracktheimplementationandeffectivenessoftheplans.
ComplianceCommitteesofentitiesdirectlyfurnishingpatientcare,particularlyentitiessuchas
hospitals,long-termcarefacilities,andotherentitiesprovidingresidentialcare,shouldalso
assessstaffingfornursing,therapy,andotherclinicalservicestoensurethattheentityhasthe
appropriatequantity,quality,andcompositionofcareproviders.
Thecomplianceofficershouldberesponsibleforimplementingacomplianceprogramthat
includesandaddressesqualityandpatientsafetycompliancerisksjustastheydoforanyother
complianceriskareaintegraltotheentityshealthcaresegment. Tofulfillthisresponsibility,
thecomplianceofficershould: 78
 developproductiveworkingrelationshipswithclinicalandqualityleadership,sharing
informationandworkandadvisingoncompliancematters;
 beinformedaboutanyinternalqualityauditsandincidentreviews;and
 havetheresourcestoconductthequalitycomplianceauditsdiscussedabove,either
individuallyorincollaborationwithInternalAuditoroutsideresources.
Whenconductingriskassessments,ComplianceCommitteesshouldensurethatmedical
necessity,patientsafety,andotherqualitycomplianceissuesareincludedintheriskuniverse.
Medicarerequires,asaconditionofpayment,thatitemsandservicesbemedicallyreasonable
andnecessary. Therefore,entitiesshouldensurethatanyclaimsreviewsandauditsincludea
reviewofthemedicalnecessityoftheitemorservicebyanappropriatelycredentialedclinician.
Entitiesthatdonotincludeclinicalreviewofmedicalnecessityintheirclaimsauditsmayfailto
identifyimportantcomplianceconcernsrelatingtomedicalnecessity.
B. New Entrants in the Health Care Industry
Thehealthcaresectorisseeinganincreasingnumberofnewentrants,includingtechnology
companies(bothestablishedandstart-upcompanies),newinvestors,andorganizations
providingnon-traditionalservicesinhealthcaresettings(suchassocialservices,fooddelivery,
andcarecoordinationservices). Newentrantsareoftenunfamiliarwiththeuniqueregulations
andbusinessconstraintsthatapplyinthehealthcareindustry,aswellastherangeofFederal
andStategovernmentagenciesthatregulatehealthcareandenforcefraudandabuselaws.
Simplyput,businesspracticesthatarecommoninothersectorscreatecomplianceriskin
healthcare,includingpotentialcriminal,civil,andadministrativeliability. Newentrantsshould
takestepstoensurethattheyandanybusinesspartnerspossessasolidunderstandingofthe
Federalfraudandabuselaws,inadditiontootherapplicablelaws,andthattheypossessan
understandingofthecriticalroleaneffectivecomplianceprogramplaysinpreventing,
detecting,andaddressingpotentialviolations. ThisGCPGisapracticaltoolthatcanassistnew
entrantsinestablishingandoperatingeffectivecomplianceprogramsforhealthcarelinesof
business.
Inaddition,healthcareorganizationsarethemselvesenteringnewarenas. Forexample,
providersareofferingmanagedcareplansanddevelopinghealthcaretechnology. Whilethese
organizationsmaybefamiliarwithcompliancerisksapplicabletotheircurrentbusiness,they
shouldalsoevaluateandfamiliarizethemselveswithnewriskareasassociatedwithnewand
differentlinesofhealthcarebusiness. Growingentitiescanconsult OIGsexistingcompliance
programguidance,advisoryopinions,reports,andothercompliancematerials andforthcoming
ICPGstolearnandkeepupdatedaboutnewriskareas. 79
C. Financial Incentives: Ownership and Payment 
Follow the Money
Oneofthebestwaystoidentifyfraudandabuserisksistofollowthe
money. Inanincreasinglycomplexhealthcareecosystem,understanding
howfundsflowthroughbusinessarrangementsandthevaryingincentives
createdbydifferenttypesoffundingstructuresiskeytounearthingpotential
complianceissues,implementingeffectivemonitoring,andidentifyingpreventive
strategies.
1. Ownership, including Private Equity and Others
Thegrowingprominenceofprivateequityandotherformsofprivateinvestmentinhealthcare
raisesconcernsabouttheimpactofownershipincentives(e.g.,returnoninvestment)onthe
deliveryofhighquality,efficienthealthcare. Healthcareentities,includingtheirinvestorsand
governingbodies,shouldcarefullyscrutinizetheiroperationsandincentivestructurestoensure
compliancewiththeFederalfraudandabuselawsandthattheyaredeliveringhighquality,safe
careforpatients. Anunderstandingofthelawsapplicabletothehealthcareindustryandthe
roleofaneffectivecomplianceprogramisparticularlyimportantforinvestorsthatprovide
managementservicesorasignificantamountofoperationaloversightforandcontrolina
healthcareentity.
2. Payment Incentives
Complianceofficersshouldbeattunedtothevaryingrisksassociatedwiththepayment
methodologiesthroughwhichhealthcareentitiesarereimbursedfortheitemsandservices
theyprovide. Forexample,whenaninsurer,includingFederalhealthcareprograms,paysona
volume-sensitiveorfee-for-servicebasis,theremaybeincreasedrisksofoverutilization,
inappropriatepatientsteering,anduseofmoreexpensiveitemsorservicesthanneeded.
Whenaninsurerpaysonacapitatedbasis,heightenedrisksincludestintingoncareand
discriminatingagainstmorecostlypatients. Paymentsthattakeintoaccountqualityofcareor
otherperformancemeasuresmaygiverisetoriskofgamingofdatatoqualifyforperformance-
basedpayment. Whenpaymentincentivesandassociatedrisksarefullyunderstood,
complianceofficers,includingthoseatentitieswithprivateinvestment,arebetterpositioned
todesigninformedauditplans,conducteffectivemonitoring,detectproblemsearly,and
implementeffectivepreventivestrategies. 80
D. Financial Arrangements Tracking
EntitiesinvolvedinFederalhealthcareprogrambusinessmaymanage
asignificantvolumeoffinancialarrangementsandtransactional
agreements,includingthosebetweenreferralsourcesandreferral
recipients,whichcanimplicatetheFederalanti-kickbackstatuteand
thePSL,amongotherFederalfraudandabuselaws. Whilelegal
counselmaybeinvolvedintheinitialstructuringanddraftingofthese
agreements,ongoingmonitoringofcompliancewiththetermsand
conditionssetforthintheagreementsremainsequallyimportantfromafraudandabuse
perspective. Entitiesshouldconsiderwhattypeofcentralizedarrangementstrackingsystemto
establish,dependingonthesizeoftheirorganization,toensurethatpropersupporting
documentationismaintained,regularlegalreviewsareconducted,andfairmarketvalue
assessmentsareperformedandupdatedroutinelyasappropriate. Asapplicable,tracking
systemsshouldalsoaccountforserviceandactivitylogsanduseofleasespaceandequipment
toensureconsistencywithcontractterms. Thebusinessneedorrationaleforarrangements
shouldalsobedocumented. Aneffectiveandrobustarrangementstrackingsystemthatis
auditedregularlyisacompliancemeasurethatcanbetakentopreventviolationsand
mitigatepotentialliabilityundertheFederalfraudandabuselaws. SECTION VI
OIG Resources and Processes 82
VI. OIG Resources and Processes
OIGhasaComplianceSectiononitswebsitethatincludesnumerouscomplianceandlegal
resources,suchasourCPGs,AdvisoryOpinions,SpecialFraudAlerts,Bulletins,andOther
Guidance,SafeHarborRegulations,ComplianceToolkits,ComplianceResourcesforHealthCare
Boards,ProviderComplianceTraining,ARoadmapforNewPhysicians,RAT-STATS-Statistical
Software,CorporateIntegrityAgreements(CIAs),andSelf-DisclosureInformation. Wemost
recentlyaddedamorerobustsectiononFrequentlyAskedQuestions,withanewprocessfor
thehealthcarecommunitytosubmitquestions,asdiscussedfurtherbelow. Inaddition,under
theNewsroomtab,wehaveshort,educationalvideoscoveringavarietyofsubstantivetopics,
TestimoniesbeforeCongress,aswellasNewsReleases&Articles.
Tostayuptodate,weencourageyouto
subscribetoOIGsWhatsNewNewsletter
toreceiveemailnotificationswhenOIG
haspostednewinformationtoour
website,includingreports,enforcement
actions,andmore. OIGalsoencourages
youtosubscribetoemailnotifications
whentheListofExcludedIndividuals/Entitiesisupdated. Lastly,OIGhasvarioussocialmedia
accountsthatuserscanopttofollowtoviewOIGposts.
A. Compliance Toolkits; Compliance Resources for Health Care
Boards; Provider Compliance Training; A Roadmap for New
Physicians; and RAT-STATS Statistical Software
OIGhascreatedseveraltoolkitstoprovidethehealthcarecommunitywithastructured
approachtoassessprogramintegrityrisksintelehealth,measurecomplianceprogram
effectiveness,monitoradverseevents,advisehealthcareboards,andidentifypatientsatriskof
opioidmisuse. Thetoolkitonmeasuringcomplianceprogrameffectivenessisparticularly
importantforallentitiesengagedinFederalhealthcareprogrambusinesstoreview. Thisguide
listsmeasurementoptionsapplicabletoawiderangeoforganizationswithdiversesize,
operationalcomplexity,industrysegmentfocus,resources,andcomplianceprograms. As
discussedearlierinthisdocument,wealsocreatedawebpagewithcomplianceresources
targetedspecificallyforhealthcareboardsthatincludesadocumenttitled, PracticalGuidance 83
forHealthCareGoverningBoardsonComplianceOversight
thatcoverstopicsonboardrolesandrelationships,reporting
totheboard,identifyingandauditingpotentialriskareas,and
encouragingaccountabilityandcompliance. TheRoadmapfor
NewPhysiciansconsistsofeducationalmaterialsandcase
examplestoassistinteachingphysiciansabouttheFederal
lawsdesignedtoprotecttheFederalhealthcareprogramsand
programbeneficiariesfromfraud,waste,andabuse. OIG
offersadditionaltrainingtoolsrelatedtotheRoadmap,
includingabrochure,companionPowerPointpresentationwith
speakernotes,aswellasanaudionarration.
OIGalsomakesavailableRAT-STATSstatisticalsoftwarethat
providerscandownloadtoassistinclaimsreview. Thepackageistheprimarystatisticaltoolfor
OIGsOfficeofAuditServices. Amongothertasks,thesoftwareassiststheuserinselecting
randomsamplesandestimatingimproperpayments. WehaveattemptedtomakeRAT-STATS
asuser-friendlyaspossible,keepinginmindtheprogramusestechnicalstatisticalterms.61
B. OIG Reports and Publications
OIGreportsandpublicationsareusefultoolsthatcanhelpidentifyriskstoincludeinrisk
assessments,establishcompliancepriorities,andconducttargetedaudits. Someofthese
materialsincludetheOIGWorkPlan;OIGTopManagementChallenges;OIGSemiannual
ReportstoCongress;HealthCareFraudandAbuseControlProgramReports;OfficeofAudit
ServicesReports;andOfficeofEvaluationandInspectionReports. Thesepublicationsand
reportscanbeconsultedforbothgeneralrisktrendsaswellasindustrysubsector-specificrisks.
Inparticular,theOIGWorkPlansetsforthvariousprojects,includingOIGauditsand
evaluations,thatareunderwayorplannedtobeaddressedduringthecurrentfiscalyearand
beyondbyOIGsOfficeofAuditServicesandOfficeofEvaluationandInspections. OIGassesses
relativerisksinHHSprogramsandoperationstoidentifythoseareasmostinneedofattention
and,accordingly,tosetprioritiesforthesequenceandproportionofresourcestobeallocated
toconductthereviews. TheWorkPlanisaweb-basedpublicationthatdescribesthereviews
OIGisplanningandhasunderway,isupdatedmonthly,andissearchablebytopic.
The monthly update includes the addition of newly initiated Work
Plan items, which can be found on the Recently Added Itemspage.
Completed Work Plan items remain in the active Work Plan for
61OIGdoesnotprovidetechnicalsupportforRAT-STATS. 84
one month, after which they are moved into theArchive. Recently
completed reports can be found on OIG'sWhats New page.
C. Advisory Opinions; Special Fraud Alerts, Bulletins, and
Other Guidance; and Safe Harbor Regulations
1. Advisory Opinions
OIGadvisoryopinionsaretheproductofastatutorily
mandatedprocessthatallowsOIGtoissuelegalopinions
tooneormorerequestingpartiesabouttheapplicationof
OIGsfraudandabuseauthoritiestothepartysorparties
existingorproposedarrangement. Apartythatreceivesa
favorableadvisoryopinionisprospectivelyprotectedfrom
OIGadministrativesanctions,solongasthearrangementatissueisconductedinaccordance
withthefactssubmittedtoOIGthroughtheadvisoryopinionprocess. Whilethegoalofthe
advisoryopinionprocessistooffermeaningfuladvicetotherequestorsofadvisoryopinions,
theapplicablestatuteandregulationsmakeclearthatadvisoryopinionsarebindingandmay
legallybereliedupononlybytherequestorsoftheapplicableadvisoryopinionandthe
advisoryopinionisonlybindingontheSecretarywithrespecttotherequestingparty.
WepublishtheredactedformofeachissuedadvisoryopinionontheOIGwebsitefor
informationalpurposes,butagain,nothirdpartiesareboundbyormaylegallyrelyuponthese
advisoryopinions. OIGrecognizesthatstakeholdersoftenlooktopublishedadvisoryopinions
tounderstandOIGsviewsofparticulararrangementsandthatadvisoryopinionsmayinforma
partysreviewofapotentialbusinessarrangement,includingidentifyingrisksandpotential
applicationofsafeharbors. ItisimportanttobemindfulthatOIGreliesonthecertifiedfacts
andinformationsubmittedinconnectionwiththeapplicablerequestandtheadvisoryopinion
thatOIGultimatelyrendersisspecifictothedetailedfactscertifiedbytheapplicablerequestor.
Formoreinformationabouttheadvisoryopinionprocess,includinginformationregardinghow
tosubmitanadvisoryopinionrequest,pleaseseeOIGsoverviewoftheadvisoryopinion
process. 85
2. Special Fraud Alerts, Bulletins, and Other Guidance; and Safe
Harbor Regulations
OIGSpecialFraudAlertsaddressspecifictrendsofhealthcarefraudofanindustry-wide
character. IndevelopingSpecialFraudAlerts,OIGreliesonvarioussources,suchas
investigativetrendsidentifiedfromOI,DOJ,andstateenforcementagenciesaswellasreports
fromOASandOEIandindustryfeedback. Wemostrecentlyissuedspecialfraudalertson
telemedicineandspeakerprogramssponsoredbypharmaceuticalandmedicaldevice
companies. OIGalsoissuesSpecialAdvisoryBulletinsonvarioustopics,suchasGiftsandOther
InducementstoBeneficiaries,EffectofExclusionfromParticipationinFederalHealthCare
Programs,andContractualJointVentures. Importantly,OtherGuidanceincludespolicy
statementsthathelpinformthepublicaboutchangestoourproceduralrules,enforcement
priorities,andspecificupdates,suchaswhatamountsareconsideredtobe nominalvaluefor
thepurposesoftheBeneficiaryInducementsCMP. Lastly,preambletextaccompanyingour
safeharborregulationscanofferhelpfulinsightintothedevelopmentofthesafeharborsand
OIGsviewsoncertainfraudandabuserisksandpotentialsafeguardstoprotectagainstsuch
risks,includingresponsesreceivedtocommentssubmittedbyhealthcarestakeholders.
D. Frequently Asked Questions
OIGoffersanFAQprocesstoprovideinformal
feedbacktothehealthcarecommunityon TosubmitaquestionforOIGs
varioustopics. BeginningMarch2023,OIG considerationasanFAQ,email
OIGComplianceSuggestions@oig.hhs.gov.
expandedthetopicsitconsidersfornewFAQs
submittedbythehealthcarecommunity.In
particular,theagencyreviewsandconsiders:(1)generalquestionsregardingtheFederalanti-
kickbackstatuteandtheBeneficiaryInducementsCMPandOIGsadministrativeenforcement
authoritiesinconnectionwiththesestatutes;(2)inquiriesregardingthegeneralapplicationof
theFederalanti-kickbackstatuteandBeneficiaryInducementsCMPtoatypeofarrangement
thatmayimplicatethesestatutes;(3)questionsregardingcomplianceconsiderations;and(4)
inquiriesregardingOIGsHealthCareFraudSelf-DisclosureProtocol. OIGalsoreviewsand
considersgeneralquestionsrelatedtotopicscoveredbyFAQsexistingasofMarch2023,
namely:(1)advisoryopinions,(2)exclusions,and(3)itswhistleblowerprotectioncoordinator
function. 86
The current list of topics addressed in FAQs include:
 GeneralQuestionsRegardingCertainFraudandAbuseAuthorities;
 ApplicationofCertainFraudandAbuseAuthoritiestoCertainTypesofArrangements;
 ComplianceConsiderations;
 CorporateIntegrityAgreements;
 Exclusions;
 ContractorSelf-Disclosures;
 WhistleblowerProtection;and
 AdvisoryOpinions.
E. Corporate Integrity Agreements
OIGsCorporateIntegrityAgreementsandIntegrityAgreements(CIA)62
canserveasaresourcewhenahealthcareentityreviewsitscompliance
programsstructureandoperations. ACIAisadocumentthatoutlines
theobligationstowhichanentityagreesaspartofacivilor
administrativesettlement. AnentityagreestotheCIAobligationsin
exchangeforOIGsagreementthatitwillnotseektoexcludetheentity
fromparticipationinMedicare,Medicaid,orotherFederalhealthcare
programs.
CIAshavecommonrequirementsthattrackthesevenelementsandrequirereviewstobe
conductedbyindependentrevieworganizations(IROs). ThesubjectmatteroftheIROreviews
requiredbyaCIAcanvarybasedontheunderlyingconductthatledtothesettlement. For
example,acaseinvolvingaFederalanti-kickbackstatuteorPSLviolationmayleadtoaCIAwith
areviewofarrangementswithreferralsourceswhileacaseinvolvingfraudulentbillingwould
haveaclaimsreview. CIAsforpharmaceuticalanddevicemanufacturerstypicallyhaveunique
requirementstomonitortheirsalesforceactivities,suchas:aspeakermonitoringprogram;
directfieldobservationsofsalespersonnel;andmonitoringandreviewofotherrecords
relatingtosalespersonnelsinteractionswithhealthcarepractitionersandhealthcare
institutions. Casesinvolvingquality-of-careissuesmayresultinaCIAwithanindependent
monitorwithclinicalexpertiseappointedtoexaminetheentitysdeliveryofcareandevaluate
62AnIntegrityAgreementisadocumentthatoutlinestheobligationstowhichanindividualpractitioner,small
grouppractice,orsmallprovideragreesaspartofaciviloradministrativesettlement. IAscanserveasavaluable
complianceresourcefortheseentities,particularlywhenasmallproviderdoesnotknowwheretobeginwith
puttingcompliancemeasuresscaledtotheirsizeinplace. 87
theprovidersabilitytoprevent,detect,andrespondtopatientcareproblems. Otherquality-
of-careCIAsrequiretheprovidertoretainapeer-reviewconsultanttoevaluatetheproviders
peer-reviewandmedical-credentialingsystems. Wehighlighttheseexamplestoillustratehow
anentitythatisnotunderaCIAcouldlooktorequirementsforanentityinthesameindustry
subsectorthatisunderaCIAtogleanideasrangingfromcomplianceprogramstructureto
externalandinternalauditplandesigns.
F. Enforcement Action Summaries
Whendesigningriskassessmentsandmakingdeterminationsabout
compliancepriorities,itcanalsohelptoconsultinformationabout
enforcementactionspostedonourwebsite. Whenamatterissettledor
otherwiseresolved,OIGpostssummariesandlinkstopressreleases,
includingthosefromourgovernmentpartners,suchasDOJandState
AttorneyGeneralOffices,withmoreinformation. Actionsare
categorizedasfollowsonourwebsite:CriminalandCivil,State
EnforcementAgencies,CIAReportableEvents,CIAStipulatedPenalties
andMaterialBreaches,CivilMonetaryPenaltiesandAffirmativeExclusions,Self-Disclosure
Settlements,andGrantFraudSelf-Disclosures. Thisinformationcanalsobeusefultopresentto
boards,organizationalleaders,andemployeesandcontractorswhenexamplesofproblematic
conductcanhelpillustratetheneedforaparticularcompliancepolicyoraction. Theyarealso
helpfultoincludeascaseexamplesintrainingmaterials.
G. OIG Self-Disclosure Information
OIGhasseveralself-disclosureprocessesthatcanbeusedtoreportpotentialfraudinHHS
programs.
Self-Disclosure
Online Submissions
Healthcareproviders,suppliers,orotherindividualsorentitiessubjecttoCMPscanusethe
HealthCareFraudSelf-DisclosureProtocoltovoluntarilydiscloseself-discoveredevidenceof
potentialfraud. Self-disclosuregivesproviderstheopportunitytoavoidthecostsand
disruptionsassociatedwithaGovernment-directedinvestigationandciviloradministrative
litigation. 88
More detailed information about the OIG Health Care Fraud Self-
Disclosure Protocol is available here.
OIGscontractorself-disclosureprogramenablesHHScontractorstoself-disclosepotential
violationsoftheFalseClaimsActandvariousFederalcriminallawsinvolvingfraud,conflictof
interest,bribery,orgratuity. Contractorsareindividuals,businesses,orotherlegalentitiesthat
areawardedGovernmentcontracts,orsubcontracts,toprovideservicestoHHS. The
ContractorSelf-DisclosureProgramisavailableforthoseentitieswithaFederalAcquisition
Regulation-basedcontract.
HHSgrantrecipientsorsubrecipientsmustdiscloseevidenceofpotentialviolationsofFederal
criminallawinvolvingfraud,bribery,orgratuityviolations,potentiallyaffectingtheFederal
award. Thegoverningregulation,45CFR75.113,mandatesdisclosuresofcriminaloffenses
thatnon-FederalentitiesmustmakewithrespecttoHHSgrants. RecipientsofHHSawardsmay
voluntarilydiscloseconductcreatingCMPliabilityoranyotherconductsuchasconductthat
mightviolateciviloradministrativelawsthatdoesnotclearlyfallwithinthescopeofoffenses
describedat45CFR75.113 throughtheHHSOIGGrantSelf-DisclosureProgram.
H. OIG Hotline
TheOIGHotlineacceptstipsandcomplaintsfromallsourcesaboutpotentialfraud,waste,
abuse,andmismanagementinHHSprograms.
Submit a Complaint
Everyreportwereceiveisimportant;however,noteverysubmissionresultsinaninvestigation.
DuetothehighvolumeofcomplaintsOIGreceives,itisnotpossibletocontactevery
complainant. OIGrecommendsreviewingBeforeYouSubmitaComplainttounderstandthe
typeofcomplaintswedoanddonotinvestigateandthecomplaintprocess. SECTION VII
Conclusion 90
VII. Conclusion
ThisGCPGisintendedtoserveasageneralcomplianceresourceforthebroadlandscapeof
entitiesplayingaroleinhealthcaredeliverytoday. OIGrecognizesthatthehealthcare
industryinthiscountry,whichreaches
millionsofindividualsandexpends
We also seek input from
trillionsofdollarsannually,isconstantly
industry stakeholders who
evolving. WiththisGCPG,wetakethe
opportunitytobothaffirmand can submit feedback about
emphasizeourlongstandingand
general compliance
continuingcommitmenttosupport
considerations and risk areas
voluntarycomplianceeffortsandto
to Compliance@oig.hhs.gov.
updateandconsolidatecompliancetools
andresourcesconsistentwith
contemporaryindustrypracticesand
currentlaw. Becausecomplianceisadynamicprocess,OIGplanstoupdatethisGCPGasnew
developmentsoccurandnewresourcesbecomeavailable. Wealsoseekinputfromindustry
stakeholderswhocansubmitfeedbackaboutgeneralcomplianceconsiderationsandriskareas
to Compliance@oig.hhs.gov.
Aneffectivecomplianceprogramiscriticaltomeetinginternaloperationalgoals;decreasing
errors;improvingthequalityofpatientcareandpatientsafety;andpreventing,detecting,and
addressingfraud,waste,andabuse. ConsistentwithOIGsmission,itisourgoalthatthisGCPG
andforthcomingICPGswillbevaluabletoolsinachievingthesecompliancesuccesses. 91
Definitions
ComplianceCommitteeCharter
Astatementofpurpose,scope,rolesandresponsibilities,membership,meetingfrequency,
andotherfunctionsofthecompliancecommittee.
RelevantIndividuals
ForthepurposesofthisGCPG,arelevantindividualmeansapersonwhoseresponsibilities
oractivitiesarewithinthescopeofthecode,policy,orprocedure. Relevantindividuals
couldincludeemployees,contractors,patients,customers,agencystaff,medicalstaff,
subcontractors,agents,orpeopleinotherroles,orasubsetoftheabove. Eachentityneeds
todetermineforitselfwhotheirrelevantindividualsare.
SeniorLeadership,SeniorLeaders
ForthepurposesoftheGCPG,seniorleadershipandseniorleadersmeanthegroupof
leaderswhoreportdirectlytotheexecutiveleadingtheentity,usuallytheCEO. Some
entitiesrefertothisgroupbyothernames,suchasexecutiveleadership.
Quality
ForthepurposesofthisGCPG,qualitymeansbothqualityinmanufacturingandsupplying
drugs,devices,andotheritems,andqualityofcareintheprovisionofitemsandservices.