With the increased focus on health care fraud and abuse in recent years, the government has identified widespread improper billing by Medicare providers. While in the past the government might have simply sought repayment, it has begun to invoke the penalties and damages prescribed in the False Claims Act in some cases. The False Claims Act has become one of the government’s primary enforcement tools because it allows recovery of losses to federal health care programs, and the damages and penalty provisions provide a deterrent effect. The act provides that anyone who knowingly submits false claims to the government is liable for three times the amount of damages plus a mandatory penalty of $5,000 to $10,000 for each false claim. The term “knowingly” is broadly defined to mean that a person (1) has actual knowledge of the false claim, or (2) acts in deliberate ignorance of the truth or falsity of the information, or (3) acts in reckless disregard for the truth or falsity of the information. In the health care setting, where providers submit thousands of claims each year, the potential damages and penalties provided under the False Claims Act can be quite large. The widespread application of the False Claims Act to improper Medicare billings has heightened providers’ attention to the importance of compliance with Medicare program requirements. In February 1997, HHS-OIG released its first guidance for compliance programs in the health care industry—Model Compliance Plan for Clinical Laboratories. Since then, HHS-OIG has issued three additional provider-specific compliance guides and revised the laboratory model. Through these guides HHS-OIG encourages providers to improve and enhance their internal controls so that their billing practices are in compliance with Medicare’s rules and regulations. However, use of the guides remains voluntary. Table 1 shows the current HHS-OIG compliance guides and the dates they were issued. All of the HHS-OIG compliance guides provide for seven components of comprehensive compliance programs: 1. Written policies and procedures, including standards of conduct. 2. Designation of a compliance officer responsible for operating and monitoring the compliance program. 3. Regular employee education and training programs. 4. A reporting mechanism to receive complaints anonymously. 5. Corrective action policies and procedures, including disciplinary policies, to respond to allegations of noncompliance. 6. Periodic audits to monitor compliance. 7. Investigation and correction of identified systemic problems, including policies addressing the nonemployment of sanctioned individuals. Each of the compliance guides also highlights what HHS-OIG calls “risk areas,” or areas of special concern, which HHS-OIG has identified through its investigative and audit activities, and which it believes the internal policies and procedures of compliance programs should address. While the risk areas are generally specific to a type of provider, several of the risk areas are included in more than one guide. Risk areas identified by HHS-OIG include potential Medicare billing infractions such as billing for items or services not actually provided and billing for a more expensive item or service than provided. HHS-OIG cites other Medicare rules and regulations as risk areas as well, including the Stark physician self-referral law and the antikickback statute. HHS-OIG believes that the compliance guides have significantly advanced the cause of corporate compliance with federal health care program requirements and is planning to issue guides for other health care providers serving Medicare beneficiaries. These include durable medical equipment companies, Medicare+Choice organizations offering coordinated care plans, nursing homes, and hospices. (The regulations implementing the Medicare+Choice program require Medicare+Choice organizations to implement compliance plans.) Providers’ compliance programs, among other things, are to be considered by Justice attorneys in determining whether the provider “knowingly” submitted a false claim, according to detailed guidance on the use of the False Claims Act in health care matters which was issued by the Deputy Attorney General in June 1998. While this guidance primarily addresses national health care initiatives, such as the 72-hour Window Project, it also directs Justice attorneys to consider prior remedial efforts such as self-disclosure of potential wrongdoing. We recently issued the first of two legislatively mandated reports on Justice efforts to implement its new False Claims Act guidance. According to the results of two hospital surveys, our interviews with observers in the health care field, and our study of 25 hospitals, it is apparent that many hospitals are implementing formal compliance programs. However, the actual prevalence of such programs is difficult to determine precisely. Often hospitals are driven in their compliance efforts, at least in part, by the requirements of agreements with the government resolving allegations of provider misconduct. Hospitals that agreed to implement compliance procedures to resolve billing or fraud issues told us they are implementing compliance programs that go well beyond the requirements of the agreements. Because their programs are relatively new, only a few of the hospitals in our study have completely implemented all of the policies and procedures that they have identified as being part of their compliance program. Medicare providers are generally not required to report on their compliance programs to federal agencies or other entities so there are no readily available data on their prevalence. Even if providers were required to report this information, the task of measuring the prevalence and composition of compliance programs would still be complicated by several factors. Most important, the lack of an accepted definition of a compliance program would make any tabulation problematic. HHS-OIG’s hospital compliance guide itself states that “there is no single ‘best’ hospital compliance program, given the diversity within the industry.” In addition, determining whether or not the components of a compliance program have been meaningfully implemented is inherently subjective. For example, whether or not a provider is conducting billing audits is subject to interpretation. While two compliance programs may each call for a sampling of all claims, their sampling methodologies may differ significantly. Further, one provider may review past claims when a problem is identified, and another provider may audit only current claims. Despite these inherent measurement difficulties, there are indications that compliance programs are being implemented, in some fashion, by many hospitals. We spoke with members of hospital groups, federal agency representatives, and other observers in the health care and compliance fields who all said that compliance programs are increasingly prevalent. A few hospitals in our study told us that they believe compliance programs are becoming an industry standard. In addition, two recent hospital surveys indicate that compliance programs are being implemented. First, a February 1998 copyrighted survey by UHC (which has 84 academic health center members) found that 97 percent of the 64 respondents either had a compliance program in place or planned to implement one soon. Also, a recent survey of 4,300 hospitals by AHA found that 96 percent of the 1,902 respondents indicated that they have a formal compliance program in place or plan to implement one within the coming year. About 2,000 hospitals have agreed to implement certain compliance procedures—in some cases a full compliance program covering all Medicare risk areas—as part of an agreement with the government to settle billing issues under the False Claims Act. Nearly all of the 25 hospitals in our study had agreed to implement compliance procedures as part of a settlement agreement for at least some part of their operations. Seventeen of the hospitals in our study agreed to implement compliance procedures as part of a settlement under Justice’s 72-Hour Window Project. The 72-Hour Window Project investigates whether hospitals have separately billed Medicare for outpatient services, which are already covered by a Medicare inpatient payment, such as preadmission tests provided within 72 hours of admission. The compliance procedures required under this project include installing and maintaining computer systems to identify such outpatient services before the hospital bills Medicare as well as training billing personnel on the 72-hour rule. These settlements do not cover any risk area other than the 72-hour rule, do not require ongoing monitoring, do not require the appointment of a compliance officer, and do not impose any obligations on the hospital to report any potential violations uncovered. At least 6 of the 25 hospitals in our study agreed to implement more comprehensive corporate integrity agreements (CIA) to settle charges of misconduct in their Medicare operations. A CIA is an agreement between a health care provider and HHS-OIG in conjunction with the settlement of a case alleging health care fraud or abuse. CIAs are generally specific to the provider and case, set requirements for a term of 3 to 5 years, and are a condition of the provider’s continued participation in Medicare and other federal health care programs. While CIA requirements vary, they generally include (1) the appointment of a Compliance Officer; (2) mandatory compliance training; (3) internal and/or independent external reviews of either specified risk areas, the implementation of the agreement provisions, or both; (4) notice to HHS-OIG of material violations when identified; (5) annual reporting to HHS-OIG; and (6) continuing CIA responsibilities after organizational changes such as mergers and acquisitions. If a provider fails to comply with the CIA, HHS-OIG reserves the right to exclude the provider from Medicare and other federal health care programs or, alternatively, impose monetary penalties. HHS-OIG has recently negotiated CIAs that require compliance procedures covering all laws, regulations, and guidelines relating to federal and state health care programs—not only those relevant to the allegations in the case. Most of the hospital officials we interviewed told us that they felt compelled to implement more extensive compliance procedures than required of them by the federal government. Twenty-two of the 25 hospitals we reviewed have government-imposed compliance procedures of some type; nearly all of the 22 told us their compliance programs go beyond the requirements of any settlement agreements they are subject to—often far beyond. For instance, as of December 31, 1998, 10 of the hospitals in our study have only the compliance procedures associated with the 72-Hour Window Project imposed upon them. Yet 9 of those 10 say they have implemented or plan to soon implement a more comprehensive compliance program with procedures covering risk areas such as medical necessity, laboratory billing, and upcoding.