HHS-OIG Updates Its Self-Disclosure Protocol

On November 8, 2021, the U.S. Department of Health and Human Services Office of Inspector General (OIG) updated and renamed its Self-Disclosure Protocol (SDP). The OIG had last updated the SDP in 2013. The update changes and clarifies several features of the SDP.

Name Change

The OIG has changed the name of the protocol from the “Provider Self-Disclosure Protocol” to the “Health Care Fraud Self-Disclosure Protocol” (SDP). The new name clarifies that the SDP is available to any entity subject to Civil Monetary Penalties (CMP) that the OIG can impose, not just health care providers.  

Updated Statistics

In addition, the OIG reported in the update that, between the SDP’s launch in 1998 and 2020, it resolved more than 2,200 self-disclosures, resulting in recoveries to federal health care programs of more than $870 million. The OIG also reported that from 2016-2020, it settled 330 SDP disclosures and that, in every one of these settlements, the disclosing party avoided an integrity agreement.

Minimum Settlement Amounts

In the SDP update, the OIG increased the minimum settlement amounts that it will accept to resolve self-disclosed matters. The OIG doubled the minimum settlement amount for disclosed potential violations of the Anti-Kickback Statute from $50,000 to $100,000 and doubled the minimum settlement for all other matters from $10,000 to $20,000. 

Online Disclosures Only

Under the updated SDP, disclosing parties must now submit their disclosures through the OIG’s online portal. Previously, the SDP allowed parties to make disclosures online or by mail.

Role of DOJ/False Claims Act Releases

When the OIG settles matters disclosed under the SDP, the OIG releases claims that it may have under the Civil Money Penalties Law (CMP Law) against the disclosing entity. The OIG, however, does not have the authority to settle claims under the False Claims Act (FCA); only the Department of Justice can settle FCA claims for the government. SDP settlement agreements, therefore, do not routinely include an explicit release of the government’s FCA claims. However, as a practical matter, the risk of FCA exposure is remote in a matter where the OIG has released the government’s CMP Law claims, and the disclosure itself may preclude an FCA action as a matter of law under 31 U.S.C. § 3730(e)(3).

The SDP states that the OIG will coordinate with the DOJ in resolving SDP matters. The update clarifies that in some instances, the DOJ may choose to participate in the settlement (and provide an FCA release) and in other instances, parties may request an FCA release (which will necessitate DOJ participation). In either case, if the DOJ participates in the settlement, the matter will be resolved as the DOJ determines is appropriate and in a manner consistent with its resolution of FCA cases. The outcome could thus differ from the terms of a settlement with the OIG only. Although the DOJ will determine the government’s approach in matters in which it is involved, the SDP states that the “OIG will advocate that the disclosing party receive a benefit from disclosure under the SDP and the matter be resolved consistent with OIG’s approach in similar cases.”

Although not mentioned in the OIG’s summary of changes, the OIG made noteworthy changes regarding the disclosure of criminal matters through the SDP. First, the OIG deleted a sentence that had encouraged parties to disclose criminal conduct through the SDP. In addition, the updated SDP no longer contains a commitment that the OIG will advocate for lenient treatment from the DOJ in criminal cases, as the OIG has deleted this sentence: “As in civil cases referred to DOJ, OIG will advocate that the disclosing parties receive a benefit from disclosure [of criminal conduct] under the SDP.” The significance of these changes regarding the treatment of voluntarily disclosed criminal matters remains to be seen.

Interaction with CIAs

The OIG also clarified that parties subject to a Corporate Integrity Agreement (CIA) may use the SDP to report a “Reportable Event” as defined in the CIA. When disclosing a Reportable Event, the party’s disclosure must mention that the party is subject to a CIA, and the party must send a copy of the disclosure to its OIG monitor. The previous update to the protocol did not expressly provide that Reportable Events could be disclosed through the SDP.  

Damages by Program

The OIG’s update clarifies that disclosures must include a damages calculation for each affected federal health care program, not merely the sum of all damages. Presumably, the OIG made this clarification because some disclosing parties in the past have failed to provide a program-by-program breakdown.  

Other OIG Disclosure Programs

The update also reiterates that the SDP is not the vehicle for disclosures related to the receipt of HHS grants or for federal contractors. Instead, the OIG’s Grant Self-Disclosure Program and the Contractor Self-Disclosure Program are available for such disclosures.

Timeline of Disclosure and Damages Calculation

A party considering submission to the SDP has a couple of options regarding the timing of the submission. First, the OIG reminds parties that, according to Section 1128J(d) of the Social Security Act, parties are required to report and return overpayments within 60 days of the date on which the overpayment was identified. CMS’s regulation implementing the 60-day rule clarifies that generally an overpayment is not “identified” until the provider has quantified the overpayment (assuming the provider has acted with due diligence). If a party waits until it has identified the overpayment, including quantifying the overpayment, and makes a submission to the SDP within 60 days of that date, it tolls the statutory duty to return the overpayment within 60 days.

In some cases, a party may want to make a submission to the SDP before it has finished determining the actual amount of the overpayment, or “damages.” In that case, the SDP requires the party to submit the damages calculation within 90 days from the date of the initial submission. In our experience, it may be possible to receive an extension if the audit to identify the damages is complex, but the OIG’s general expectation is that the damages calculation will be completed within 90 days of the initial submission. Regardless of the pathway pursued, the SDP update reiterates that following the SDP will toll the requirement that overpayments be refunded within 60 days.

What Hasn’t Changed?

Importantly, the OIG has emphasized that the benefits of disclosure through the SDP remain intact with the recent update. The OIG will continue to apply a presumption against requiring a CIA for any entity that self-discloses and will continue to apply a lower damages multiplier to self-disclosed conduct. The OIG’s general practice when entering settlements of SDP matters is to require a minimum multiplier of 1.5 times the single damages, although the OIG determines in each case whether it believes that a higher multiplier is warranted. The OIG continues to hold that self-disclosure typically results in a faster and less costly resolution while avoiding disruptions associated with a government-led investigation.  

Conclusion

The OIG has updated certain features of the SDP, but it remains the case that in many situations, disclosure through the SDP is the best way for entities to resolve potential instances of noncompliance involving potential false claims and potential violations of the Anti-Kickback Statute.