Healthcare Law Blog

OIG Updates Self-Disclosure Protocol, But Discourages Action, cont.

On Tuesday, the changes to eligibility and disclosure requirements for the OIG’s Self-Disclosure Protocol (“SDP”) were discussed. Now, let’s take a look at certain disclosures and what has changed from the ’98 version.

Disclosures Involving Excluded Persons

Many SDP disclosures involve violations of employing or contracting with individuals who are on OIG’s List of Excluded Individuals and Entities (“LEIE”).  With the update, OIG has specified what is needed for a complete disclosure of this violation. A disclosure must include, among other things, biographical information on the excluded party, description of the disclosing party’s screening process, and a description of how the conduct was discovered.  The disclosing party must also screen all current employees and contractors against the LEIE.

OIG has also provided guidance on calculating damages for this disclosure. For direct providers who bill separately, the disclosing party must provide the total amounts claimed and paid by federal health care programs for the items or services. If items or services are not billed separately, a formula will be used based on the excluded party’s total cost of employment or contracting. This amount will be multiplied by the disclosing party’s federal program payor mix.

Disclosures Involving Anti-Kickback and Stark Law

Since the 2009 Open Letter, conduct involving only potential violations of the Stark Law is not eligible for SDP. To qualify, violations must potentially involve both the AKS and Stark Law. It is the disclosing party’s responsibility to describe each disclosed arrangement and determine on their own why each arrangement may violate the AKS and, if applicable, the Stark Law.

If a disclosure is limited solely to the Stark Law, this potential violation should be disclosed to the Centers for Medicare and Medicaid Services (“CMS”) through their Self-Referral Disclosure Protocol (“SRDP”). Providers should be prepared for the possibility that OIG and CMS will work together.

A disclosing party must include the total remuneration provided through the agreement, but a party may explain why portions of the remuneration should not be considered by the OIG when determining the settlement amount.

Disclosures Involving False Billings

For potential improper claim disclosures, a disclosing party must estimate the total financial impact to government health care programs. To do this, a party can either disclose all claims with specific information or use a sample size. When using the latter method, a party must use a statistically valid sample of, at minimum, 100 claims and use the mean point estimate for calculating the effect. The ’98 version only required 30 claims and called for a “minimum precision level.”

The updated SDP does offer a short list of benefits for disclosing parties. Resolution will continue to occur in most matters without a corporate integrity agreement. This has been the general policy since the 2008 Open Letter. OIG will maintain its general practice to require a minimum multiplier of 1.5 times the single damages for many instances. Lastly, there will be a suspension of the obligation to report and return overpayments to the federal health care programs while the SDP is pending.

In evaluating the pros and cons of the updated SDP, the scales weigh heavily in favor of OIG and against self-disclosure. Entry into the SDP should be carefully considered. The new version offers only minor benefits while posing significant risks to a disclosing party who is seeking to come forth with potential violations.

Christopher J. Shaughnessy is a member at McBrayer law.  Mr. Shaughnessy concentrates his practice area in healthcare law and is located in the firm’s Lexington office.  He can be reached at cshaughnessy@mcbrayerfirm.com or at (859) 231-8780, ext. 1251. 

Services may be performed by others.

This article does not constitute legal advice.

OIG Updates Self-Disclosure Protocol, But Discourages Action

On April 17, 2013, the Office of Inspector General (“OIG”) issued an updated Provider Self-Disclosure Protocol (“SDP”). The initial protocol was created in 1998 (“’98 version”) with the goal of having providers voluntarily identify and disclose potential federal health care program fraud and work with the OIG to resolve the identified abuses. Specifically, the SDP offered guidance to providers (both individuals and entities) on how to investigate conduct, quantify damages, mitigate potential penalties, and report to OIG.  Further guidance came in a series of OIG Open Letters to the health care industry in 2006, 2008, and 2009. The updated SDP provisions supersede both the original version and the subsequent Open Letters. More >

Plan for the Worst, Hope for the Best: Why You Must Have a HIPAA Risk Assessment

“The single biggest and most common compliance weakness is the lack of a timely and thorough risk analysis.” More >

Tools for the Trade: Understanding HIPAA

As a result of the intricate details and requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), it comes as no surprise that HIPAA Privacy and Security Rules can cause challenges and confusion for even the most sophisticated providers. With this in mind, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) has recently provided tools meant to educate both consumers and providers on HIPAA. More >

Association Group Coverage Changes

Trade Associations in Kentucky are being asked to show that they meet ERISA “bona fide association” requirements in order to continue to provide group health insurance for their members under health reform requirements effective in 2014.  Such group health insurance may be a more affordable option for some businesses as new health reform requirements begin to take effect. More >

Doe v. Guthrie Clinic, Ltd.: A New Privacy Battleground?, cont.

Earlier this week, I mentioned the Doe v. Guthrie Clinic, Ltd.[1] case and what it may mean for provider liability. In a nutshell, the plaintiff in Guthrie seeks to extend the fiduciary duty of patient confidentiality beyond the licensed provider to the medical corporation, including hospitals and medical practices.  Under the proposed theory, the hospital or medical practice could be held directly liable for the unauthorized disclosure of patient information regardless of whether an employee disclosed the information within the scope of employment.  In other words, the unauthorized disclosure of patient information would be attributed to the medical corporation, which acting through its representatives, breached patient confidentiality. More >