Navigating HHS-OIG’s Self-Disclosure Protocol

The HHS-OIG Self-Disclosure Protocol is designed to encourage healthcare providers, suppliers, contractors, and grantees to self-report evidence of potential fraud or violations of federal healthcare program requirements. By voluntarily disclosing such conduct, entities may benefit from reduced penalties, a presumption against exclusion from federal programs, and a more collaborative resolution process, as opposed to facing government-initiated investigations or litigation.

To navigate the SDP effectively, providers and their counsel must promptly identify and investigate potential violations, quantify any resulting overpayments or damages, and submit a detailed disclosure to the OIG. The process is governed by statutory and regulatory requirements, including strict timelines for reporting and returning overpayments, and is supported by OIG guidance and enforcement experience. Recent enforcement actions demonstrate both the risks of non-disclosure and the tangible benefits of timely, good-faith participation in the protocol.

Background and Relevant Law

The legal foundation for the HHS-OIG Self-Disclosure Protocol is rooted in several federal statutes and regulations that govern the integrity of federal healthcare programs, including Medicare and Medicaid.

Key among these are:

·       42 U.S.C. § 1320a-7k: This statute imposes an affirmative obligation on any person or entity that has received an overpayment from a federal healthcare program to report and return the overpayment, and to notify the appropriate authority in writing of the reason for the overpayment. The statute sets a deadline for reporting and returning overpayments: the later of 60 days after identification or the due date of any corresponding cost report. Failure to comply with this requirement creates an "obligation" under the False Claims Act, exposing the entity to potential liability for knowingly retaining overpayments.

·       42 C.F.R. § 401.305: This regulation implements the statutory requirement for reporting and returning overpayments. Notably, it provides that the deadline for returning overpayments is suspended when the OIG acknowledges receipt of a submission to the Self-Disclosure Protocol, and remains suspended until the matter is resolved, withdrawn, or the entity is removed from the protocol. This regulatory provision underscores the importance of timely self-disclosure and its impact on compliance timelines.

·       42 C.F.R. § 1003.140: This regulation addresses the determination of penalties, assessments, and exclusions in cases of violations. It specifically recognizes that timely and appropriate corrective action—including disclosure through the OIG Self-Disclosure Protocol and full cooperation with the OIG's review—constitutes a mitigating circumstance that may reduce the severity of penalties or the period of exclusion.

The Self-Disclosure Protocol

The OIG has issued comprehensive guidance and maintains a structured process for self-disclosure, as reflected in its semiannual reports to Congress and on its official website. The protocol, established in 1998 and periodically updated, is available to healthcare providers, suppliers, contractors, and grantees who wish to voluntarily disclose evidence of potential fraud, overpayments, or other violations of federal law.

The OIG evaluates each disclosure and the results of the internal investigation to determine the appropriate course of action, which may include settlement, imposition of civil monetary penalties, or other administrative remedies. The protocol is designed to minimize the costs and disruptions associated with government-directed investigations and litigation, and to provide a pathway for fair monetary settlements and potential avoidance of exclusion from federal healthcare programs.

Scope of the Protocol

The SDP is available for a wide range of potential violations, including but not limited to:

·       False or fraudulent claims under the False Claims Act (FCA)

·       Violations of the Anti-Kickback Statute (AKS)

·       Stark Law violations (when accompanied by AKS violations)

·       Other conduct subject to civil monetary penalties (CMPs)

However, certain violations—such as isolated Stark Law violations without an AKS component—may not be eligible for resolution under the SDP and may require disclosure through other mechanisms.

Key Steps and Requirements for Navigating the SDP

1.     Internal Investigation and Identification of Violations

The process begins when a provider, supplier, or other entity identifies potential evidence of fraud, overpayment, or other violations. The entity must conduct a thorough internal investigation to determine the nature, scope, and cause of the issue, and to quantify the economic impact (i.e., the amount of overpayment or damages to federal healthcare programs).

The identification of an overpayment or violation triggers the statutory obligation to report and return the overpayment within 60 days, unless the deadline is suspended by submission to the SDP. The term "identified" generally means that the entity has determined, or should have determined through reasonable diligence, that an overpayment exists and can be quantified.

2.     Decision to Self-Disclose

Once a potential violation is identified and quantified, the entity must decide whether to self-disclose. The OIG and CMS strongly encourage voluntary disclosure, as it can result in significant benefits, including reduced penalties and a presumption against exclusion from federal programs.

The decision to self-disclose should be made promptly, as delay may result in the loss of mitigation benefits and increased risk of enforcement action. Legal counsel and compliance professionals play a critical role in advising on the timing and content of the disclosure.

3.     Preparation and Submission of the Disclosure

The disclosure must be submitted to the OIG in accordance with the protocol's requirements.

Key elements of a compliant disclosure include:

·       A detailed description of the conduct at issue, including the legal and factual basis for the potential violation

·       The results of the internal investigation, including the methodology used to quantify damages or overpayments

·       An estimate of the damages to federal healthcare programs (minimum thresholds apply: $20,000 for most matters, $100,000 for AKS-related violations)

·       A description of any corrective actions taken to address the underlying issue and prevent recurrence

·       A commitment to full cooperation with the OIG throughout the review and resolution process

The OIG's guidelines and online resources provide detailed instructions for structuring and submitting disclosures.

Suspension of Overpayment Return Deadline

Upon acknowledgment of the submission by the OIG, the deadline for returning overpayments is suspended until the matter is resolved, withdrawn, or the entity is removed from the protocol. This regulatory protection is critical for entities seeking to avoid additional liability while the disclosure is under review (42 C.F.R. § 401.305).

OIG Review and Resolution

The OIG evaluates the disclosure, the results of the internal investigation, and the proposed resolution. The OIG may request additional information, conduct its own investigation, or negotiate a settlement. The general practice is to resolve liability for civil monetary penalties using a multiplier of 1.5 times the single damages amount, which is significantly lower than the treble damages typically imposed under the FCA.

For AKS-related violations, the minimum settlement amount is $100,000; for other matters, the minimum is $20,000.

The OIG generally presumes against requiring a Corporate Integrity Agreement (CIA) as part of the settlement, further reducing the administrative burden on the disclosing entity.

Coordination with DOJ and Other Agencies

While the OIG has authority to resolve civil monetary penalty liability, it does not have authority to release entities from FCA liability, which remains within the purview of the Department of Justice (DOJ). The OIG coordinates with DOJ in cases involving potential FCA violations and may advocate for mitigation of penalties based on the entity's good-faith disclosure, but the final decision rests with DOJ.

Costs and Benefits of Self-Disclosure

Entities that follow the SDP and cooperate fully with the OIG may receive several important benefits:

·       Reduced penalties (1.5x single damages instead of treble damages)

·       Presumption against exclusion from federal healthcare programs

·       Presumption against the imposition of a CIA

·       Suspension of the 60-day overpayment return deadline during the review

·       Potential for faster and more predictable resolution compared to government-initiated investigations

Risks and Challenges

While the SDP offers significant benefits, it is not without risks and challenges. Disclosure may trigger additional investigations, expand the scope of government review, or have collateral consequences in related civil litigation. The process can be time-consuming and resource-intensive, and there is no guarantee of immunity from criminal prosecution or FCA liability, particularly in cases involving egregious or intentional misconduct. Furthermore, there is the potential that your self-disclosure may be subject to the Freedom of Information Act (FOIA).

Summary of Exceptions and Caveats

·       Scope Limitations: Not all violations are eligible for resolution under the SDP. For example, isolated Stark Law violations without an AKS component must be disclosed through other mechanisms.

·       No DOJ Release: The OIG cannot release entities from FCA liability; only DOJ can do so. The OIG may advocate for mitigation, but DOJ retains discretion in FCA matters.

·       Minimum Settlement Amounts: The OIG generally requires minimum settlement amounts for resolution, which may be significant for smaller providers.

·       Potential for Broader Investigations: Disclosure may lead to expanded government scrutiny or parallel investigations by other agencies.

Conclusion

The HHS-OIG Self-Disclosure Protocol is a critical compliance tool for healthcare providers, compliance professionals, and legal counsel seeking to address potential violations of federal healthcare program requirements. By conducting prompt and thorough internal investigations, quantifying damages, and making timely, complete disclosures to the OIG, entities can benefit from reduced penalties, avoid exclusion, and resolve matters more efficiently. The process is governed by clear statutory and regulatory requirements, and recent enforcement actions underscore both the risks of non-disclosure and the advantages of proactive engagement with the OIG. Effective navigation of the SDP requires careful attention to detail, full cooperation, and strategic legal guidance throughout the process.

This article is for informational purposes only and does not constitute legal advice. Reading or relying on this content does not create an attorney–client relationship. For advice specific to your organization or circumstances, consult qualified healthcare counsel experienced in OIG disclosures and federal compliance programs.