DEPARTMENT OF HE..I\LTH AND HUMA!~ SERVICES 

OFFICE OF INSPECTOR GENERAL 

WASHJNGTOJ\, DC 20201 

SEP 1 2 2012 

TO: 	 Marilyn Tavenner 

Acting Administrator 

Centers for Medicare & Medicaid Services 

FROM: Stuart Wrighf 

Deputy Inspector General 

for Evaluation and Inspections 

SUBJECT: 	 Recommendation Followup Memorandum Report: CMS Reporting to the 

Healthcare Integrity and Protection Data Bank, OEI-07-09-00292 

The Healthcare Integrity and Protection Data Bank (HIPDB) is a national data bank 

containing reports of adverse actions against health care practitioners, providers, and 

suppliers (collectively referred to as providers). Complete and accurate HIPDB 

information helps prevent the employment of potentially fraudulent or abusive providers. 

In a 2010 report entitled CMS Reporting to the Healthcare Integrity and Protection Data 

Bank (OEI-07-09-00290), the Office oflnspector General (OIG) found that the Centers 

for Medicare & Medicaid Services (CMS) took adverse actions against providers but did 

not report all of these actions to the HIPDB as required. For example, none of the 

adverse actions against durable medical equipment (DME) suppliers taken during 2008 

had been reported to the HIPDB as of April30, 2009. In the 2010 report, OIG 

recommended-and CMS concurred-that CMS should report all adverse actions as 

required. This memorandum report provides an assessment ofCMS's reporting to the 

HIPDB approximately 2 years after the release of the initial report. 

SUMMARY 

To determine the extent to which CMS is addressing OIG's recommendation to report all 

adverse actions as required, we compared HIPDB data as of April I, 2012, with data 

reported in our 20 l 0 report. We found that CMS improved its reporting of adverse 

actions for DME suppliers, but not for other types of providers. We conclude that CMS 

has not fully addressed our 2010 report recommendation to report required adverse 

actions to the HIPDB. 
Page 2 – Marilyn Tavenner

CMS Reporting to the Healthcare Integrity and Protection Data Bank (OEI-07-09-00292)

BACKGROUND

The HIPDB is a national data bank containing reports of final adverse actions 

(e.g., exclusions from participation in a Federal health care program, criminal convictions 

related to health care) against providers. State and Federal agencies and health plans may 

query the HIPDB to assist them in preventing the employment or contracting of 

potentially fraudulent or abusive providers. As of April 1, 2012, the HIPDB contained 

information on 547,298 adverse actions. 

A 2010 Federal law requires the transfer of all data in the HIPDB to the National 

Practitioner Data Bank (NPDB), and for the HIPDB to cease operations, although 

agencies and health plans will still be required to report the same adverse actions to the 

NPDB.1

Establishment of the HIPDB

Section 221 of the Health Insurance Portability and Accountability Act of 1996 amended 

the Social Security Act by adding section 1128C, which required the Secretary of Health 

and Human Services—acting through OIG—and the United States Attorney General to 

create a national health care fraud and abuse control program. One component of this 

program is a national data bank containing certain adverse actions taken against 

providers. This data bank, known as the HIPDB, became operational in 1997.

The HIPDB is administered by the Health Resources and Services Administration 

(HRSA) through a Memorandum of Understanding with OIG. HRSA also administers 

the NPDB, which collects information related to the professional competence and 

conduct of physicians, dentists, and other health care practitioners. Section 6403 of the 

Patient Protection and Affordable Care Act (P.L. 111-148) streamlines data bank 

operations by eliminating duplicative data reporting and access requirements between the 

two data banks. Section 6403 requires the Secretary to establish a transition period to 

transfer all data in the HIPDB to the NPDB and, once completed, to cease HIPDB 

operations. Information previously collected and disclosed through the HIPDB will then 

be collected and disclosed through the NPDB. On February 15, 2012, HRSA published a 

Notice of Proposed Rulemaking to transfer the data in the HIPDB to the NPDB. To date,

HRSA has not promulgated final regulations.

HIPDB Reporting Requirements

Federal and State government agencies and health plans are required to report certain 

final adverse actions (adverse actions) that they take against providers. The regulations 

in 45 CFR §§ 61.7–61.11 describe which adverse actions must be reported to HIPDB. 

Section E of the HIPDB Guidebook provides further explanation of each type of action, 

which includes licensure and certification actions, exclusions from participation in 

Federal and State health care programs, criminal convictions, civil judgments related to 

health care, and any other adjudicated actions of decision that the Secretary establishes by 

regulation.

 1 P.L. 111-148 § 6403.
Page 3 – Marilyn Tavenner

CMS Reporting to the Healthcare Integrity and Protection Data Bank (OEI-07-09-00292)

Adverse actions must be reported within 30 calendar days of the date that the reporting 

entity took the action, the date the reporting entity became aware of the action, or the 

close of the next monthly reporting cycle as determined by the entity, whichever is 

latest.

2

 If an appeal overturns a reported action, the reporting entity must submit a 

revised report to the HIPDB.3 Information reported to the HIPDB is maintained 

permanently, unless it is corrected or voided from the system. A correction or void may 

be submitted only by the reporting entity or at the direction of the Secretary.

4

METHODOLOGY

We obtained a copy of the data in the HIPDB as of April 1, 2012. We compared these 

HIPDB data (e.g., the number, frequency, and types of adverse actions reported by CMS) 

with the data obtained for our 2010 report. By comparing the data from April 1, 2012, 

with those from April 30, 2009, we were able to make conclusions about the extent to 

which CMS’s reporting to the HIPDB addresses our 2010 report recommendation. 

Standards

This study was conducted in accordance with the Quality Standards for Inspection and 

Evaluation issued by the Council of the Inspectors General on Integrity and Efficiency.

RESULTS

The HIPDB Contains Reports on Adverse Actions Taken Against DME Suppliers

As of April 1, 2012, the HIPDB contained reports on 6,761 adverse actions against DME 

suppliers, or more than 1,600 additional adverse actions since the data reported in our 

2010 report. CMS reported 734 adverse actions against DME suppliers in 2010 and

796 adverse actions in 2011; as of April 1, 2012, CMS had reported 107 adverse actions 

in 2012. As of April 30, 2009, the HIPDB contained reports on 5,125 adverse actions 

taken against DME suppliers from 1998 through 2008,

5 which averages approximately 

466 per year during that period. Additionally, the submission dates of adverse action 

reports reflect reports being made throughout the year, rather than in batches on a 

periodic basis. The number, frequency, and types of reports indicate compliance with 

Federal requirements.

 2 45 CFR § 61.5.

3 45 CFR § 61.6(b); HIPDB Guidebook, pp. E-5 and E-15. Accessed at http://www.npdb-hipdb.hrsa.gov/ on 

April 20, 2012.

4 HIPDB Guidebook, p. E-14. Accessed at http://www.npdb-hipdb.hrsa.gov/on April 20, 2012.

5 As of April 1, 2012, the HIPDB contained 5,124 adverse actions against DME suppliers reported between 1998 

through 2008, indicating that one report from this time period was removed between 2009 and 2012.
Page 4 – Marilyn Tavenner

CMS Reporting to the Healthcare Integrity and Protection Data Bank (OEI-07-09-00292)

The HIPDB Contains No Reports of Nursing Home Terminations Since June 2010

As of April 1, 2012, the HIPDB contained 84 adverse actions against nursing homes;

CMS reported 45 adverse actions on September 30, 2009, and 39 actions on 

June 23, 2010. In 2009 and 2010, CMS reported annually on terminations. However, 

annual reporting of nursing home terminations does not comply with the 

timeframe-related reporting requirements in 45 CFR § 61.5. Additionally, no further 

adverse actions were reported after June 23, 2010, which indicates that CMS may no 

longer be reporting any nursing home terminations to the HIPDB.

The HIPDB Still Does Not Contain Adverse Actions Taken Against Certain Types 

of Providers

As of April 1, 2012, the HIPDB still did not contain adverse actions that CMS imposed 

against a variety of provider types, including laboratories, managed care plans, and 

prescription drug plans. The HIPDB is still missing reports of specific adverse actions 

we identified in our 2010 report, including: 148 adverse actions against laboratories in 

2007; 30 adverse actions against managed care and prescription drug plans between 

January 1, 2006, and March 7, 2009; and an unknown number of civil monetary penalties 

against nursing homes.6

 In addition to missing these earlier adverse actions, the HIPDB 

does not contain any subsequent reports against these types of providers, which indicates 

that CMS does not report as required.

CONCLUSION

Federal law requires the reporting of certain adverse actions taken against health care 

providers to be reported to the HIPDB. Complete and accurate HIPDB information helps 

prevent the employment of potentially fraudulent or abusive providers. When HRSA 

promulgates final regulations to transfer the data in the HIPDB to the NPDB, CMS will 

be required to report to the NPDB certain adverse actions that the agency is currently 

required to report to the HIPDB. We conclude from our followup review that CMS has 

not fully addressed our 2010 report recommendation to report required adverse actions to 

the HIPDB.

This report contains no new recommendations; however, our 2010 recommendation that 

CMS should report all adverse actions as required remains open. In its 2011 update to 

OIG’s Compendium of Unimplemented Recommendations, CMS did not provide 

information on its efforts to report adverse actions. This report is being issued directly in 

final form because it contains no recommendations. If you have comments or questions 

about this report, please provide them within 60 days. Please refer to report number 

OEI-07-09-00292 in all correspondence. 

cc: HRSA

 6 The CMS Office of Financial Management collected more than $37 million in civil monetary penalties in fiscal 

year 2008. CMS officials estimated that 85 percent of this amount was from nursing homes.