Department of Health and Human Services: Office of Inspector General's Use of Agreements to Protect the Integrity of Federal Health Care Programs
Released: 2018-05-10T00:00:00

Letter

Background

HHS-OIG Exclusion Authority

HHS-OIG has the authority to exclude providers and other entities that have committed certain acts from participation in federal health care programs. According to HHS-OIG guidance, exclusion is a remedial measure designed to protect federal health care programs from any entity whose participation constitutes a risk to the programs or to program beneficiaries. Federal health care programs will not pay for any items or services furnished, ordered, or prescribed by excluded entities. Exclusions are mandatory under certain circumstances and permissive in others. In particular, mandatory exclusion applies to offenses that result in convictions relating to patient abuse or neglect and other crimes related to federal health care programs. When these offenses occur, but there is no criminal conviction, HHS-OIG may exercise its permissive exclusion authority.

In certain circumstances where HHS-OIG can exercise its permissive exclusion authority, it evaluates each situation and decides what action to take based on its assessment of the future risk the entity poses to federal health care programs. Actions that HHS-OIG can consider taking include the following:

Exclusion. HHS-OIG will exclude the highest-risk entities from participation in federal health care programs.

Require the entity to enter into an agreement. HHS-OIG can require an entity to enter into a CIA or IA in exchange for a release of HHS-OIG’s exclusion authority. According to HHS-OIG guidance, the goals of these agreements are to strengthen an entity’s compliance program and promote compliance so that any issues in the future can be prevented or identified, reported and corrected.

Heightened scrutiny. According to HHS-OIG officials, heightened scrutiny is reserved for situations in which the agency determined that an agreement was warranted but the entity was uncooperative. In such situations, HHS-OIG considers what other unilateral monitoring steps it can take to impose greater scrutiny. For example, according to HHS-OIG guidance, the agency has audited, evaluated, or investigated entities after fraud settlements when the entity would not enter into an agreement with HHS-OIG and it has made referrals to the Centers for Medicare & Medicaid Services for claims reviews.

Reserve exclusion authority. For certain entities, HHS-OIG may reserve its exclusion authority and take “no further action,” meaning that HHS-OIG will not exclude the entity at that time and will not require the entity to enter into an agreement.

Release of exclusion authority. In certain circumstances, HHS-OIG will release its exclusion authority without imposing additional requirements. Specifically, HHS-OIG may do this in situations in which the entity has self-disclosed the fraudulent conduct to HHS-OIG or has agreed to integrity obligations with a state or the DOJ that HHS- OIG has determined are sufficient.

Agreement Negotiation and Monitoring

In situations in which HHS-OIG is evaluating whether to exercise its permissive exclusion authority, DOJ is often separately negotiating a settlement of the civil and/or criminal case against the entity on behalf of the federal government. Typically, such settlements resolve allegations that the entity is liable under the False Claims Act for submitting false claims to federal health care programs. According to both HHS-OIG and DOJ officials, if there is a related DOJ civil or criminal case and HHS-OIG officials are also negotiating an agreement with the entity in lieu of exclusion, the DOJ and HHS-OIG negotiations often occur at the same time or “on a parallel track.” However, according to these officials, while HHS-OIG and DOJ officials share information as needed, each engage in separate negotiations with the entity. According to HHS-OIG officials, there are also situations in which HHS-OIG enters into an agreement when there is not a related DOJ legal settlement.

The Office of Counsel to the Inspector General within HHS-OIG is responsible for negotiating agreements and for monitoring them once they take effect. All agreements include provisions that identify the enforcement actions HHS-OIG can take when it finds that an entity has not complied with the terms of its agreement. These enforcement provisions outline the monetary penalties, referred to in the agreements as stipulated penalties, which HHS-OIG will demand if it identifies that the entity has failed to comply with certain agreement terms. The enforcement provisions also outline what constitutes a material breach of the agreement and indicate that exclusion can result if the entity is found to have materially breached its agreement. Examples of a material breach of the agreement include repeated violations of any of the agreement’s obligations and the failure to respond to a demand letter from HHS-OIG concerning the payment of stipulated penalties.

From 2005 through 2017, HHS-OIG Entered into Dozens of New Agreements Each Year, the Majority of Which Applied to Three Types of Entities

From July 2005 through July 2017, HHS-OIG entered into 652 new agreements—an average of about 50 agreements per year—ranging from a high of 83 to a low of 37. The agreements were almost exclusively CIAs, which apply to larger corporations, and IAs, which apply to individual practitioners and entities such as small physician groups. HHS- OIG has used CIAs and IAs exclusively since 2010. From 2010 to July 2017, 74 percent of agreements have been CIAs and 26 percent of agreements have been IAs. See figure 1 for more information on the number and types of agreements since July 2005.

HHS-OIG officials said that the agency transitioned away from other agreement types because of certain limitations that made them less useful than CIAs and IAs. For example, one historical agreement type— Certification of Compliance Agreements—did not provide sufficient opportunities for oversight, yet it required significant resources to create, officials said. Another discontinued agreement type—Settlement Agreement with Integrity Provisions—was negotiated as part of the DOJ settlement, such that HHS-OIG needed to work through DOJ if there was a need to take action for noncompliance. Although HHS-OIG and DOJ negotiate their agreements and settlements separately now, the majority of CIAs and IAs, are still associated with a DOJ legal settlement. Of the 652 agreements from July 2005 through July 2017, 619 were paired with a DOJ settlement, while 33 were the result of HHS-OIG independently exercising its exclusion authority.

The total number of agreements in effect each year for the period we reviewed, which includes new agreements and ongoing agreements from past years, has decreased. Between 2006 and 2016 (the earliest and latest full years included in HHS-OIG’s database), the number of agreements in effect for any part of the calendar year decreased by 44 percent (see fig. 2). According to HHS-OIG officials, this is because, over time, the agency has increasingly focused its resources on entities that present the highest risk of potential fraud. Specifically, HHS-OIG officials said that in 2006 they first imposed a monetary threshold for damages caused to federal health care programs, above which the agency would pursue an agreement. HHS-OIG officials told us that they initially set this threshold at $100,000, but that in 2014 the agency increased it to $500,000 for smaller entities (i.e., those eligible for IAs) and $1 million for larger entities (i.e., those eligible for CIAs). HHS-OIG officials added that the monetary threshold is one factor that triggers pursuit of an agreement, and that risk of beneficiary harm may also cause the agency to seek an agreement, even when damages are low. HHS-OIG, in using these criteria, said that it is foregoing pursuing agreements with low-damage, lower-risk entities, instead taking no further action but reserving its exclusion authority.

HHS-OIG entered into agreements with a wide range of entities, but most were concentrated among a few types of entities. Specifically, HHS-OIG entered into agreements with 30 different types of entities from July 2005 through July 2017, though slightly more than half of the agreements were with 3 types—individual/small group practices, hospitals, and skilled nursing facilities. Another quarter of the agreements were with medical group practices, pharmaceutical manufacturers, clinics, medical device manufacturers, and ambulance companies. (See fig. 3.)

HHS-OIG officials stated that it is rare for the agency to enter into multiple agreements with the same entity, adding that the few entities that have had multiple agreements were generally large corporations with multiple divisions or sites, and that the agreements applied to different areas of the firms’ business. Our analysis of HHS-OIG data showed that 15 entities had more than one agreement from July 2005 through July 2017. In other situations, HHS-OIG extended an ongoing agreement, rather than entering a new agreement with the same entity, in light of new allegations that arose during the time the agreement was in effect. From July 2005 through July 2017, the time periods for five agreements were extended beyond the standard five years to reflect new settlements with DOJ.

Almost all of the agreements we reviewed were negotiated by HHS-OIG at the same time DOJ was negotiating a legal settlement with the entity to resolve related allegations under the False Claims Act. Many of these allegations resulted from cases filed by a whistleblower under the False Claims Act’s qui tam provisions—commonly referred to as qui tam cases. Slightly more than half of HHS-OIG agreements are with entities who settled qui tam cases. From July 2005 through July 2017, agreements imposed by HHS-OIG as a result of claims alleged by a whistleblower in a qui tam case increased in prevalence compared to agreements that were not associated with a qui tam case. (See fig. 4.)

The DOJ-negotiated settlement amounts associated with qui tam cases, among those entities that also entered into an agreement with HHS-OIG, greatly exceeded the settlement amounts negotiated for non-qui tam cases and make up most of the total settlement amounts. From July 2005 through July 2017, total settlement amounts, among those entities that also entered into an agreement with HHS-OIG, were $16.1 billion for qui tam cases and $3.1 billion for all others. A spike in settlement amounts in 2012 reflects two settlements, one of $2 billion and another of $800 million, with two pharmaceutical manufacturers. (See fig. 5.)

Although pharmaceutical manufacturers accounted for about 6 percent of entities subject to an agreement with HHS-OIG from July 2005 through July 2017, they represent a large share of the settlement amounts DOJ negotiated with those entities: $11.8 billion out of $19.2 billion (62 percent). The next largest shares of settlement amounts DOJ negotiated were with hospitals at $2.5 billion and medical device manufacturers at almost $900 million. Most of the pharmaceutical settlements associated with HHS-OIG agreements were qui tam cases (31 of 37 agreements), and a third of all qui tam settlement amounts were associated with just 4 pharmaceutical qui tam cases.

HHS-OIG Considers Risk Factors, Such As an Entity’s Conduct, When Evaluating Whether to Exercise its Exclusion Authority and in Negotiating Agreements

HHS-OIG Has Criteria to Determine Whether to Pursue Exclusion or Enter into an Agreement; Certain Initial Allegations Were Common among Entities That Entered Into Agreements

HHS-OIG guidance includes the criteria that agency officials said they follow to determine whether to exercise the agency’s permissive exclusion authority, or take an alternate action, such as entering into an agreement with an entity. According to HHS-OIG officials and agency guidance, each situation is evaluated on a risk continuum and the course of action chosen is based on the agency’s assessment of the future risk the entity poses to federal health care programs. HHS-OIG has four broad categories of criteria that it applies in deciding where an entity falls on the risk continuum and which action to take. These four categories are (1) the nature and circumstances of the conduct; (2) conduct during the government’s investigation; 3) whether the entity has made efforts to improve its conduct; and 4) the entity’s history of compliance. According to HHS-OIG officials, the agency will exclude the highest-risk entities, and since fiscal year 2011, under its permissive exclusion authority, HHS-OIG has excluded 65 entities that were the subject of a related DOJ legal settlement. However, HHS-OIG guidance states that HHS-OIG often concludes that exclusion is not necessary, so long as the entity will enter into an agreement with the agency.

For new agreements from July 2005 through July 2017, our review of HHS-OIG data showed that there were four main types of initial allegations that resulted in the entity entering into an agreement with HHS-OIG. This included: billing for services not rendered - 194 agreements (about 30 percent); provision of medically unnecessary services - 136 agreements (about acts prohibited under the Anti-Kickback statute - 135 agreements (about 21 percent); and misrepresentation of services and/or products – 131 agreements (about 20 percent).

The majority of agreements (about 63 percent) were associated with one initial allegation. However, some agreements were associated with more than one initial allegation: about 23 percent of agreements from July 2005 through July 2017 were associated with two initial allegations and about 15 percent were associated with three or more initial allegations.

Agreements Included Standard Provisions with Some Variation to Address Risks Specific to the Entities

We compared the provisions required in selected agreements to those outlined in HHS-OIG’s current agreement templates and found that the provisions were generally similar. All of HHS-OIG’s templates and the agreements we reviewed were organized into the same broad sections. For example, all of the templates and agreements contained sections detailing the information entities were required to submit to HHS-OIG in an initial implementation report and in annual reports, and all agreements had a section that outlined the enforcement provisions for the agreement. In addition, there generally was a standard term for agreements of either three or five years depending on the type of agreement. All 23 of the CIAs we reviewed had a term of five years, and of the nine IAs we reviewed, five had a 5-year term and four had a 3-year term. The IAs with a longer 5-year term generally were older agreements from 2010 or 2011. According to HHS-OIG officials, the current practice is to negotiate 3-year terms for IAs and 5-year terms for CIAs.

HHS-OIG has developed agreement templates that include standard provisions to address the risks an entity’s noncompliance could pose to federal health care programs. Additionally, in some templates, provisions are included to address the specific types of conduct that gave rise to the agreement. HHS-OIG has four templates for use in negotiating CIAs and two for negotiating IAs, and HHS-OIG officials said that they will use one of the six templates as a starting point when drafting an agreement. HHS-OIG officials told us that the terms included in agreements are similar across CIAs and IAs because certain provisions are non- negotiable. For example, officials said that they always include provisions requiring an entity to hire a compliance officer, submit annual reports, and provide HHS-OIG with access to the entity when requested. Across the various types of templates, there are similar standard provisions, and our review of selected agreements found many of the same provisions. For example, among the 32 agreements we reviewed:

All 32 agreements required the entity to engage an independent review organization to perform the agreement’s required reviews, including claims reviews. Entities have retained a variety of individuals and businesses as their independent review organization, ranging from small regional consulting firms to large national consulting or accounting firms. For agreements HHS-OIG has entered into from July 2005 through July 2017, our review of the agency’s data found that there were 173 unique associated independent review organizations.

All 32 agreements had training and education requirements, although the specifics of the required training, such as the number of hours or the specific topics, varied across agreements.

28 of the 32 agreements reviewed required the entity to have a compliance officer. The four agreements that did not require this were two IAs for small group practices, one for a medical group practice, and one for a clinic that named an individual practitioner as a party to the agreement.

Although agreements shared many standard provisions, some provisions were unique to either CIAs or IAs. Many of the CIAs that we reviewed included provisions detailing specific responsibilities for the entity’s board of directors (18 of 23 CIAs) and requirements for certain high-level employees to annually certify that they were in compliance with federal health care program requirements and the provisions of the agreement (12 of 23 CIAs). None of the nine IA’s we reviewed included these provisions. On the other hand, all nine IAs we reviewed (and one CIA) had provisions regarding third-party billing. If the provider subject to the agreement contracted with a third-party billing company to submit claims on the provider’s behalf, these agreements required the provider to certify that they did not have an ownership or controlling interest in the third- party billing company.

In addition to agreement type, provisions also varied due to the nature of the conduct that led to the agreement or the type of entity entering into the agreement. For example, some agreements included provisions intended to ensure compliance with the Anti-Kickback statute and Stark law (8 of 32). HHS-OIG officials told us that specific provisions related to the Anti-Kickback statute and Stark law would only be present in agreements when the conduct that had led to the agreement involved acts prohibited under those statutes, such as prohibited kickbacks or improper referral arrangements. Other agreements include provisions specific to monitoring quality of care issues. For example, one of the agreements we reviewed was a quality of care CIA that required the entity to retain an independent monitor to examine, among other things, the entity’s internal quality control systems and its response to quality of care issues. In addition, 2 of the 32 agreements we reviewed were with pharmaceutical manufacturers and contained provisions not in other agreements because they would only be relevant to a pharmaceutical manufacturer. For example, both agreements we reviewed had a requirement that the manufacturers, within 30 days, provide HHS-OIG with a copy of any written communication with the Food and Drug Administration that materially discussed the actual or potential unlawful or improper promotion of the manufacturer’s product.

According to HHS-OIG data, most of the 652 agreements entered into from July 2005 through July 2017 (about 95 percent) required the entity to perform at least one review as part of the agreement. The most common types of required reviews captured in HHS-OIG’s database during this time were reviews of health care claims, unallowable costs, and arrangements. Slightly more than half of the agreements (19 of 32) we reviewed required the entity to perform a claims review. Fifteen of these were annual claims reviews and four were quarterly claims reviews. In addition, slightly more than a quarter of agreements we reviewed (9 of 32) required an unallowable costs review. Finally, a quarter of the agreements (8 of 32) required the entity to perform an arrangements review. The eight agreements requiring an arrangements review were the same agreements that included a section with provisions related to compliance with the Anti-Kickback statute and Stark law. A few agreements had required reviews that were not common across the agreements we reviewed and usually related to the types of services that the entity provided. For example, three agreements we reviewed required the entity to conduct a cardiac catheterization procedures review, described as an evaluation and analysis of the medical necessity and appropriateness of interventions performed either in the entity’s cardiac catheterization lab or by the provider.

HHS-OIG Uses Multiple Strategies to Ensure Compliance with Terms of Agreements and Imposes Certain Penalties When Noncompliance Is Identified

HHS-OIG Reviews Required Reports, Communicates with Entities, and Conducts Site Visits to Monitor Entities’ Compliance with Agreements

According to HHS-OIG officials, the agency assigns a monitor to each agreement—an HHS-OIG staff attorney or program analyst—who, for the duration of the agreement, oversees the entity’s compliance with the terms of its agreement. Per officials and what is outlined in internal agency documents that describe how to monitor agreements, the monitors’ responsibilities include:

Reviewing the information that entities provide in their initial implementation report, annual reports, and any other reports required under the agreement within the time frames established by internal HHS-OIG guidance.

Communicating with entities to provide assistance to those who need help in understanding the requirements or to request additional information when a required report has missing or incomplete information.

Reviewing and responding to periodic correspondence received from entities, including notifications required by the agreement, reportable event disclosures, and other communications from the entity.

Drafting any letters that are sent to the entity, if noncompliance is identified, including letters demanding the payment of penalties— referred to as stipulated penalty demand letters.

Conducting site visits to verify that the entities are complying with the agreements properly. According to internal HHS-OIG guidance, monitors are to select sites primarily based on concerns that they may have with specific entities, as well as other factors, such as the type of provider, the size or complexity of the entity, length of the agreement, and the severity or complexity of the offenses that resulted in the agreement.

According to internal HHS-OIG guidance regarding site visit protocol and agency officials we spoke to, during site visits, HHS-OIG officials may conduct document reviews of training records, policies and procedures, or other documents; hold meetings with the compliance officer or board members; or tour the facility, among other activities. Officials said that two HHS-OIG officials typically conduct the site visit—the agreement’s monitor and one other official—and the site visits typically last about one day to a day-and-a-half. For agreements entered into from July 2005 through July 2017, we found that HHS-OIG officials conducted 211 site visits that were associated with 155 agreements. Thirty of these agreements were associated with more than one site visit ranging from 2 to 10 visits. The majority of the 211 site visits were for CIAs (about 87 percent). During the full calendar years from 2006 through 2016, HHS- OIG completed an average of 18 site visits each year.

HHS-OIG Works with Entities to Ensure Compliance but May Impose Monetary Penalties or Exclude Entities for Noncompliance in Some Cases

Although most entities comply with the provisions of their agreements, according to HHS-OIG officials, when noncompliance occurs, the most common issue is the late submission of required reports or reviews. According to HHS-OIG officials, other types of noncompliance range from falsely certifying the accuracy of reported information to submitting reports that do not include the required elements. According to officials and as outlined in agreements, HHS-OIG addresses noncompliance through a series of escalating steps, which, in rare instances, may result in the HHS-OIG imposing penalties on an entity as laid out in the agreement (stipulated penalties) or even exclusion of an entity from federal health care programs. Steps HHS-OIG takes to address noncompliance may include:

Working with the entity before taking official action. For example, officials told us that monitors typically request additional documentation or information from providers when they identify potential issues rather than imposing stipulated penalties immediately.

Demanding that the entity pay stipulated penalties. HHS-OIG will send a stipulated penalties demand letter to an entity in accordance with the breach and default terms of the agreement. The stipulated penalty amounts for noncompliance with the different provisions are specified in the agreement. According to officials, the stipulated penalty amounts in agreements are non-negotiable and the amounts associated with noncompliance with specific provisions do not change across agreements. The stipulated penalties in agreements range from $1,000 to $50,000 per violation. For example, for each day an entity fails to submit a complete annual report to HHS-OIG by the submission deadline, the stipulated penalty is $2,500 for CIAs and $1,500 for IAs. In addition, for all agreements, each false certification submitted by or on behalf of the entity results in a stipulated penalty of $50,000.

For agreements entered into from July 2005 through July 2017, our review of HHS-OIG data found that HHS-OIG issued 41 letters demanding stipulated penalties (between 0 and 7 letters per year) for actions such as the failure to submit annual reports and employing individuals excluded from participation in federal health care programs. In total, HHS-OIG collected about $5.4 million in stipulated penalties during this time. Penalty amounts demanded in each letter ranged from $1,000 to over $3 million, with a median of $18,000. According to HHS-OIG, the stipulated penalty of over $3 million was a record penalty for failure to comply with an agreement. This penalty, according to HHS-OIG, resulted from the entity’s failure to correct improper billing processes and poor claims submission practices that had led to error rates and overpayments to the company by Medicare for hospice services. These issues were uncovered through the claims reviews required under the agreement and HHS-OIG’s site visits to the company’s facilities.

Determining that the entity is in material breach of the agreement. As defined in agreements, this determination may result from repeated or flagrant violations of agreement obligations; failure to notify HHS-OIG of certain reportable events; failure to take corrective actions or make appropriate refunds; failure to respond to a stipulated penalties demand letter; or failure to engage an independent review organization. From July 2005 through July 2017, HHS-OIG issued 10 material breach letters to entities informing them that HHS-OIG intended to exclude them. However, the 10 material breach letters were associated with only 6 agreements, and 5 of the 10 material breach letters issued were to the same entity. These five letters were issued to the entity between March 2012 and January 2014 for a series of alleged material breaches of its agreement including, among other things, a failure to report serious quality of care reportable events or to perform training required under the terms of its agreement. This entity, which was a national chain of clinics that primarily provided dental services to children on Medicaid, was ultimately excluded in September 2014 from participation in federal health care programs, including Medicaid, for a period of five years.

Excluding an entity from participation in federal health care programs.

For agreements entered into from July 2005 through July 2017, we found that HHS-OIG has issued five exclusion letters to entities for failing to adhere to their agreements. These exclusion letters were associated with four agreements—2 CIAs and 2 IAs. According to HHS-OIG’s data, these exclusions occurred in 2007 (1), 2014 (1), and 2015 (2). The four entities that were excluded included a durable medical equipment provider, a national chain of clinics, a practice management company, and a medical group practice. An agreement affords the entity the opportunity to respond to a material breach letter prior to the issuance of a notice of exclusion. However, an HHS-OIG official said that, given the multiple steps involved in the breach and default process, it is unlikely that a breach would be addressed satisfactorily by the entity at this stage in the process. Of the four entities that HHS-OIG excluded, three had also previously received a notice of material breach from HHS-OIG.

Agency Comments

We provided a draft of this report to HHS and DOJ for review and comment. These departments provided technical comments, which we incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS, the Attorney General, and the Inspector General of HHS. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix I.

Appendix I: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Karen Doran (Assistant Director), Alison Goetsch (Analyst-in-Charge), and Perry Parsons made key contributions to this report. Also contributing were Sam Amrhein, Muriel Brown, Dan Ries, Jennifer Rudisill, and Merrile Sing.