The Office of Inspector General of the Department of Health and Human Services (“OIG”) recently issued an update to its Provider Self-Disclosure Protocol (“SDP”). The updated SDP supersedes and replaces the OIG’s original 1998 SDP and subsequent Open Letters, and it provides the OIG’s most definitive and up-to-date guidance to health care providers and entities considering whether to voluntarily disclose potential instances of fraud and abuse.

By way of background, the OIG initially promulgated the SDP in 1998 “to establish a process for health care providers to voluntarily identify, disclose, and resolve instances of potential fraud involving Federal health care programs.” The original 1998 SDP required providers to provide a written submission to the OIG including basic information such as a description of the matter being disclosed, disclosure of whether the matter is currently being investigated by a government agency, and the reasons why the provider believes that a violation has occurred. The provider was also expected to provide a detailed report of the provider’s internal investigation and damages assessment. If a provider decided to disclose but did not act in good faith, the OIG would consider the provider’s conduct as an “aggravating factor when the OIG assesse[d] the appropriate resolution of the matter.” Moreover, a disclosing provider’s decision to submit “false or otherwise untruthful information, as well as the intentional omission of relevant information” could result in a referral to prosecuting agencies and independent sanctions and/or exclusion.

During the next 15 years, the OIG issued three Open Letters in 2006, 2008, and 2009 to provide more guidance on the requirements for self-disclosure. In 2012, the OIG solicited additional comments from the health care community on the viability of the SDP’s purpose and procedures. Based on that information and the OIG’s past experience in resolving over 800 self-disclosures, the OIG updated the SDP to include several new elements while maintaining many of the 1998 SDP’s original concepts:

to consider the changing legal landscape in this complex area and to recognize that for the moment, Caronia is only binding precedent in the Second Circuit. Thus, it would be premature and unwise for companies to become less vigilant in policing the off-label statements that may be made by sales representatives.

  • Highlighting the Benefits of Disclosure. The OIG now explicitly recognizes the significance of disclosing potential violations, and identifies four benefits that “should make [the] decision easier.” Notably, two of these benefits (e.g., suspension of benefits to return overpayments and streamlining the review process) require additional concessions from self-disclosing entities.
    • Suspend Obligation to Return Overpayments. Federal regulations require that providers report and return any Medicare or Medicaid overpayment within 60 days after the date on which the overpayment was identified. However, the OIG is now suspending a provider’s obligation to return overpayments “when OIG acknowledges receipt of a submission to the SDP so long as the submission is timely made.” The disclosing party must also agree to waive any statute of limitations or similar defenses to any administrative action filed by the OIG relating to the disclosed conduct.
    • Efforts to Streamline Review. As further evidence of its commitment to working in good faith with selfdisclosing providers, the OIG “streamlined its internal process to reduce the average time a case is pending to less than 12 months from acceptance into the SDP.” However, providers must now operate in a more condensed timeframe. Disclosing parties must now complete and submit their findings and damages calculations within 90 days of the initial submission to the OIG, rather than 90 days from when the OIG accepts the disclosure.
    • Settlement Amounts. The OIG continues to recognize that disclosing providers “deserve to pay a lower multiplier on single damages than would normally be required” through a government investigation. The OIG will also continue to follow its general practice of requiring a minimum multiple of 1.5 times the single damages amount (although the OIG will also continue to review disclosures on a case-specific basis and apply a higher multiplier if necessary). Notably, the updated SDP indicates that the 1.5 multiplier is lower than what would be required in a government-initiated investigation.
    • Integrity Agreements. The OIG reiterated the presumption against requiring providers to enter into Corporate Integrity Agreements as a condition for a release of the OIG’s permissive exclusion authority.
  • Explicitly Identify Violations. Disclosing parties can no longer rely on generic statements to explain misconduct. The OIG explains that it “has found that disclosing parties who avoid acknowledging that there is a potential violation are more likely to have unclear or incomplete submissions or unrealistic expectations about resolutions.” Instead, the disclosing party must specifically describe its conduct and expressly identify the laws that are potentially violated.
  • Conduct-Specific Disclosure Requirements. In addition to providing an updated checklist of items required for any type of disclosure, the OIG now requires additional information when disclosing conduct involving: (1) false billing; (2) excluded persons; and (3) potential Anti-Kickback Act violations. For example, parties disclosing conduct involving false billing must submit an estimate of damages based on either all of the claims affected by the matter or a random sample of at least 100 representative claims. The OIG also reiterates that the SDP is not available if the disclosed conduct involves only potential violations under the Physician Self-Referral (Stark) law or inadvertent billing or overpayment matters.
  • Minimum Settlement Amounts. The updated SDP now sets forth minimum settlement amounts for resolving violations. Disclosing parties must pay a minimum of $50,000 to settle anti-kickback related violations and a minimum of $10,000 to resolve any other matters.

In sum, the updated SDP adopts many procedures and policies that were informally implemented over the past 15 years. The updated SDP reiterates that the OIG is willing to work quickly and cooperatively with providers who selfdisclose, but only if those providers are “forthcoming, thorough, and transparent in their disclosures.” The OIG also acknowledges that the decision to disclose potential fraud to the OIG is a significant one, but it still does not specifically address the consequences of failing to make an initial self-disclosure or guarantee any favorable treatment. The decision to disclose therefore involves careful evaluation of a number of legal and practical factors. Health care providers should consider consulting with outside counsel before initiating the SDP to assess fully the legal benefits and drawbacks of disclosure.