Department of Health and Human Services: Office of Inspector General's Use of Agreements to Protect the Integrity of Federal Health Care Programs

HHS-OIG has the authority to exclude providers and other entities that have committed certain acts, such as submitting false or fraudulent claims, from participation in federal health care programs. However, HHS-OIG can enter into agreements—CIAs and IAs—with providers and other entities as an alternative to exclusion. HHS-OIG is responsible for negotiating such agreements—which it typically does at the same time the Department of Justice (DOJ) is negotiating a legal settlement to resolve related allegations—and then monitoring the entities' compliance with them.

GAO was asked to review HHS-OIG's use of these agreements. This report describes (1) the number of agreements and their general characteristics; (2) the circumstances that may lead to an agreement and the standard provisions of agreements; and (3) monitoring efforts and actions taken, if any, in response to noncompliance with the agreements.

GAO examined agreements entered into from July 2005 (when HHS-OIG created its database) through July 2017 (most current at the time of GAO's analyses) and used HHS-OIG data to describe agreements' characteristics and actions to address noncompliance. GAO reviewed HHS-OIG documentation, including agreement templates and a selection of agreements to identify standard provisions. GAO also interviewed HHS-OIG and DOJ officials.

GAO provided a draft of this report to HHS and DOJ. The agencies provided technical comments, which were incorporated as appropriate.

To help improve adherence to federal health care program requirements by entities that have allegedly engaged in certain acts, such as submitting false or fraudulent claims, the Department of Health and Human Services' Office of Inspector General (HHS-OIG) entered into 652 agreements with those entities from July 2005 to July 2017. Since 2010, two types of agreements have been used: Corporate Integrity Agreements (CIA) and Integrity Agreements (IA). The more commonly used CIAs apply to larger entities, compared to IAs, which apply to individual practitioners or small businesses. From July 2005 through July 2017, about half of all agreements were with 3 types of entities—individual or small group practices, hospitals, and skilled nursing facilities.

For new agreements since July 2005, the most common initial allegations that led to an entity entering into an agreement included billing for services not provided and providing medically unnecessary services. When negotiating agreements, HHS-OIG uses one of six templates that address the different types of entities or conduct involved. Across agreements the provisions are generally similar—for example, requirements to provide training on specified topics or to hire a compliance officer.

HHS-OIG uses multiple strategies to oversee agreements, such as requiring periodic reports from the entities that demonstrate compliance and assigning a monitor to review these reports and conduct site visits. HHS-OIG can also take certain actions to address noncompliance. For example, for new agreements from July 2005 through July 2017, HHS-OIG imposed monetary penalties 41 times, ranging from $1,000 to more than $3 million (median of $18,000), and excluded 4 entities from participation in federal health care programs.

For federal health care programs like Medicare and Medicaid to function  effectively, the many providers and other entities who participate must  comply with federal health care program requirements. If an entity is  found to have committed certain acts, such as submitting false or  fraudulent claims, the Department of Health and Human Services’ Office  of Inspector General (HHS-OIG) has the authority to exclude them from  future participation in Medicare, Medicaid, and other federal health care  programs. This permissive exclusion authority applies to certain acts,  such as those prohibited by the False Claims Act, Anti-Kickback statute,  and Stark law, among others.

As an alternative to exercising its authority to exclude an entity, HHS-OIG  often negotiates and enters into corporate integrity agreements (CIAs)  and integrity agreements (IAs) with health care providers and other  entities, such as pharmaceutical manufacturers. CIAs apply to larger  corporations, and IAs apply to individual practitioners, small physician  groups, or businesses with a small number of employees, a single  location, or a limited corporate structure. These agreements typically last  either three or five years, depending on the type of agreement, and  include provisions that focus on the entity’s implementation of compliance  measures or the development of a compliance program. For example, the  agreements generally require entities to implement training programs or  to hire outside reviewers to audit claims billed to Medicare and other  federal health care programs. Such measures are intended to help  promote adherence to applicable laws and program requirements and  protect the integrity of federal health care programs.

The Office of Counsel to the Inspector General within HHS-OIG is  responsible for negotiating the agreements. HHS-OIG officials often  negotiate the agreements at the same time that officials at the  Department of Justice (DOJ) are separately negotiating a settlement of  legal claims against the entity for related false claims allegations. The  Office of Counsel to the Inspector General is also responsible for  monitoring compliance with the terms of the agreements once they take  effect. If an entity fails to comply with the obligations specified in its  agreement, HHS-OIG can use the enforcement provisions in the  agreement, which range from the ability to impose monetary penalties— referred to as stipulated penalties—to potential exclusion from federal  health care programs for material breaches of a repeated or flagrant  nature.

Both CIAs and IAs are key tools in the government’s efforts to promote  compliance with applicable laws and program requirements and to ensure  the integrity of federal health care programs. Concerns have been raised  that there is limited information available to the public regarding HHS- OIG’s implementation of CIAs and IAs. You asked us to review issues  related to HHS-OIG’s use and oversight of these agreements. This report  examines  1.  the number of agreements HHS-OIG has entered into since July 2005  and their general characteristics;  2.  the circumstances that may lead HHS-OIG to seek an agreement with  an entity and the standard provisions of agreements; and  3.  how HHS-OIG monitors agreements and the actions HHS-OIG has  taken, if any, in response to any entity’s noncompliance with  agreement terms since July 2005.

To determine the number of agreements HHS-OIG has entered into since  July 2005 and their characteristics, we primarily relied on a database  created and maintained by HHS-OIG to track agreements. We examined  all agreements entered into by HHS-OIG from July 14, 2005—the date  the agency created its database—to July 26, 2017, the date we obtained  an electronic copy of the database. We analyzed data on the number of  agreements, type of agreements, and the type of entities involved. We  also analyzed features of any related legal settlements with DOJ that  were in HHS-OIG’s database, including settlement amounts and whether  cases were brought by DOJ, or by a private individual under the  whistleblower, or qui tam, provisions of the False Claims Act. We also  interviewed HHS-OIG officials with relevant policy and technical  expertise.

To determine the reliability of HHS-OIG’s agreement database, we  reviewed supporting documentation, and we discussed the accuracy of  the data, and the controls in place for entering and updating the data, with  knowledgeable HHS-OIG officials. We also reviewed the data to identify  any data fields that were blank or that had other anomalies and clarified  with HHS-OIG any corrections that were needed. On this basis, we  determined that the data were sufficiently reliable for the purposes of our  reporting objectives.

To examine the circumstances that may lead HHS-OIG to seek an  agreement with an entity, we analyzed HHS-OIG’s data for all  agreements entered into from July 2005 through July 2017 regarding the  initial allegations in the investigations associated with the HHS-OIG  agreements during that time. To describe the standard provisions of  agreements, we reviewed the different agreement templates that HHS- OIG officials use to guide development of the agreements. In addition, we  reviewed 32 agreements that HHS-OIG had entered into from January  2010 through July 2017—a 10 percent sample of all agreements during  this time. We selected agreements from January 2010 through July 2017,  because the purpose of our review was to identify current agreement  provisions, and prior to 2010 other agreement types were used that have  been phased out and are not currently used. We used this review to  identify examples of standard provisions and to gain a broad  understanding of how actual agreements compare to HHS-OIG’s  templates. Although our sample was not generalizable, we used  agreement type (e.g., CIA or IA) and type of entity (e.g., hospital or  individual practitioner) as selection criteria to ensure that we selected  agreements that were representative of the proportion that each  agreement type and entity type represented of total agreements. We  analyzed HHS-OIG’s data to understand the number and type of reviews,  such as reviews of Medicare claims, which have been required in  agreements from July 2005 through July 2017. We also interviewed HHS- OIG officials about the agency’s exclusion authority, the agency’s  negotiation of agreements, and the standard provisions included in  agreements. Finally, we interviewed DOJ officials regarding the DOJ legal  settlement process and how, if at all, it relates to HHS-OIG’s agreements.

To examine how HHS-OIG monitors agreements and addresses  noncompliance, we reviewed relevant documentation, including  agreement templates, which outline the conditions in which an entity  would be considered in breach or default of its agreement. We also  analyzed data from HHS-OIG’s database on the actions HHS-OIG has  taken for identified noncompliance, including the amounts of any  stipulated penalties that HHS-OIG demanded from entities and the  number of exclusion letters HHS-OIG issued, that were associated with  any agreements that HHS-OIG entered into from July 2005 through July  2017. Finally, we interviewed HHS-OIG officials about their process for  monitoring agreements and the potential actions that officials can take if  they find that an entity is not in compliance with the terms of its  agreement.

We conducted this performance audit from March 2017 to April 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

HHS-OIG has the authority to exclude providers and other entities that  have committed certain acts from participation in federal health care  programs. According to HHS-OIG guidance, exclusion is a remedial  measure designed to protect federal health care programs from any entity  whose participation constitutes a risk to the programs or to program  beneficiaries. Federal health care programs will not pay for any items or  services furnished, ordered, or prescribed by excluded entities.  Exclusions are mandatory under certain circumstances and permissive in  others. In particular, mandatory exclusion applies to offenses that result  in convictions relating to patient abuse or neglect and other crimes related  to federal health care programs. When these offenses occur, but there  is no criminal conviction, HHS-OIG may exercise its permissive exclusion  authority.

In certain circumstances where HHS-OIG can exercise its permissive  exclusion authority, it evaluates each situation and decides what action to  take based on its assessment of the future risk the entity poses to federal  health care programs. Actions that HHS-OIG can consider taking  include the following:

Exclusion. HHS-OIG will exclude the highest-risk entities from  participation in federal health care programs.

Require the entity to enter into an agreement. HHS-OIG can  require an entity to enter into a CIA or IA in exchange for a release of  HHS-OIG’s exclusion authority. According to HHS-OIG guidance, the  goals of these agreements are to strengthen an entity’s compliance  program and promote compliance so that any issues in the future can  be prevented or identified, reported and corrected.

Heightened scrutiny. According to HHS-OIG officials, heightened  scrutiny is reserved for situations in which the agency determined that  an agreement was warranted but the entity was uncooperative. In  such situations, HHS-OIG considers what other unilateral monitoring  steps it can take to impose greater scrutiny. For example, according  to HHS-OIG guidance, the agency has audited, evaluated, or  investigated entities after fraud settlements when the entity would not  enter into an agreement with HHS-OIG and it has made referrals to  the Centers for Medicare & Medicaid Services for claims reviews.

Reserve exclusion authority. For certain entities, HHS-OIG may  reserve its exclusion authority and take “no further action,” meaning  that HHS-OIG will not exclude the entity at that time and will not  require the entity to enter into an agreement.

Release of exclusion authority. In certain circumstances, HHS-OIG  will release its exclusion authority without imposing additional  requirements. Specifically, HHS-OIG may do this in situations in which  the entity has self-disclosed the fraudulent conduct to HHS-OIG or  has agreed to integrity obligations with a state or the DOJ that HHS- OIG has determined are sufficient.

In situations in which HHS-OIG is evaluating whether to exercise its  permissive exclusion authority, DOJ is often separately negotiating a  settlement of the civil and/or criminal case against the entity on behalf of  the federal government. Typically, such settlements resolve allegations  that the entity is liable under the False Claims Act for submitting false  claims to federal health care programs. According to both HHS-OIG and  DOJ officials, if there is a related DOJ civil or criminal case and HHS-OIG  officials are also negotiating an agreement with the entity in lieu of  exclusion, the DOJ and HHS-OIG negotiations often occur at the same  time or “on a parallel track.” However, according to these officials, while  HHS-OIG and DOJ officials share information as needed, each engage in  separate negotiations with the entity. According to HHS-OIG officials,  there are also situations in which HHS-OIG enters into an agreement  when there is not a related DOJ legal settlement.

The Office of Counsel to the Inspector General within HHS-OIG is  responsible for negotiating agreements and for monitoring them once  they take effect. All agreements include provisions that identify the  enforcement actions HHS-OIG can take when it finds that an entity has  not complied with the terms of its agreement. These enforcement  provisions outline the monetary penalties, referred to in the agreements  as stipulated penalties, which HHS-OIG will demand if it identifies that the  entity has failed to comply with certain agreement terms. The  enforcement provisions also outline what constitutes a material breach of  the agreement and indicate that exclusion can result if the entity is found  to have materially breached its agreement. Examples of a material breach  of the agreement include repeated violations of any of the agreement’s  obligations and the failure to respond to a demand letter from HHS-OIG  concerning the payment of stipulated penalties.

From 2005 through 2017, HHS-OIG Entered into Dozens of New Agreements Each Year, the Majority of Which Applied to Three Types of Entities

From July 2005 through July 2017, HHS-OIG entered into 652 new  agreements—an average of about 50 agreements per year—ranging from  a high of 83 to a low of 37. The agreements were almost exclusively  CIAs, which apply to larger corporations, and IAs, which apply to  individual practitioners and entities such as small physician groups. HHS- OIG has used CIAs and IAs exclusively since 2010. From 2010 to July  2017, 74 percent of agreements have been CIAs and 26 percent of  agreements have been IAs. See figure 1 for more information on the  number and types of agreements since July 2005.

HHS-OIG officials said that the agency transitioned away from other  agreement types because of certain limitations that made them less  useful than CIAs and IAs. For example, one historical agreement type— Certification of Compliance Agreements—did not provide sufficient  opportunities for oversight, yet it required significant resources to create,  officials said. Another discontinued agreement type—Settlement  Agreement with Integrity Provisions—was negotiated as part of the DOJ  settlement, such that HHS-OIG needed to work through DOJ if there was  a need to take action for noncompliance. Although HHS-OIG and DOJ  negotiate their agreements and settlements separately now, the majority  of CIAs and IAs, are still associated with a DOJ legal settlement. Of the  652 agreements from July 2005 through July 2017, 619 were paired with  a DOJ settlement, while 33 were the result of HHS-OIG independently  exercising its exclusion authority.

The total number of agreements in effect each year for the period we  reviewed, which includes new agreements and ongoing agreements from  past years, has decreased. Between 2006 and 2016 (the earliest and  latest full years included in HHS-OIG’s database), the number of  agreements in effect for any part of the calendar year decreased by 44  percent (see fig. 2). According to HHS-OIG officials, this is because, over  time, the agency has increasingly focused its resources on entities that  present the highest risk of potential fraud. Specifically, HHS-OIG officials  said that in 2006 they first imposed a monetary threshold for damages  caused to federal health care programs, above which the agency would  pursue an agreement. HHS-OIG officials told us that they initially set this  threshold at $100,000, but that in 2014 the agency increased it to  $500,000 for smaller entities (i.e., those eligible for IAs) and $1 million for  larger entities (i.e., those eligible for CIAs). HHS-OIG officials added that  the monetary threshold is one factor that triggers pursuit of an agreement,  and that risk of beneficiary harm may also cause the agency to seek an  agreement, even when damages are low. HHS-OIG, in using these  criteria, said that it is foregoing pursuing agreements with low-damage,  lower-risk entities, instead taking no further action but reserving its  exclusion authority.

HHS-OIG entered into agreements with a wide range of entities, but most  were concentrated among a few types of entities. Specifically, HHS-OIG  entered into agreements with 30 different types of entities from July 2005  through July 2017, though slightly more than half of the agreements were  with 3 types—individual/small group practices, hospitals, and skilled  nursing facilities. Another quarter of the agreements were with medical  group practices, pharmaceutical manufacturers, clinics, medical device  manufacturers, and ambulance companies. (See fig. 3.)

HHS-OIG officials stated that it is rare for the agency to enter into multiple  agreements with the same entity, adding that the few entities that have  had multiple agreements were generally large corporations with multiple  divisions or sites, and that the agreements applied to different areas of  the firms’ business. Our analysis of HHS-OIG data showed that 15  entities had more than one agreement from July 2005 through July 2017.  In other situations, HHS-OIG extended an ongoing agreement, rather  than entering a new agreement with the same entity, in light of new  allegations that arose during the time the agreement was in effect. From  July 2005 through July 2017, the time periods for five agreements were  extended beyond the standard five years to reflect new settlements with  DOJ.

Almost all of the agreements we reviewed were negotiated by HHS-OIG  at the same time DOJ was negotiating a legal settlement with the entity to  resolve related allegations under the False Claims Act. Many of these  allegations resulted from cases filed by a whistleblower under the False  Claims Act’s qui tam provisions—commonly referred to as qui tam  cases. Slightly more than half of HHS-OIG agreements are with entities  who settled qui tam cases. From July 2005 through July 2017,  agreements imposed by HHS-OIG as a result of claims alleged by a  whistleblower in a qui tam case increased in prevalence compared to  agreements that were not associated with a qui tam case. (See fig. 4.)

The DOJ-negotiated settlement amounts associated with qui tam cases,  among those entities that also entered into an agreement with HHS-OIG,  greatly exceeded the settlement amounts negotiated for non-qui tam  cases and make up most of the total settlement amounts. From July 2005  through July 2017, total settlement amounts, among those entities that  also entered into an agreement with HHS-OIG, were $16.1 billion for qui  tam cases and $3.1 billion for all others. A spike in settlement amounts in  2012 reflects two settlements, one of $2 billion and another of $800  million, with two pharmaceutical manufacturers. (See fig. 5.)

Although pharmaceutical manufacturers accounted for about 6 percent of  entities subject to an agreement with HHS-OIG from July 2005 through  July 2017, they represent a large share of the settlement amounts DOJ  negotiated with those entities: $11.8 billion out of $19.2 billion (62  percent). The next largest shares of settlement amounts DOJ negotiated  were with hospitals at $2.5 billion and medical device manufacturers at  almost $900 million. Most of the pharmaceutical settlements associated  with HHS-OIG agreements were qui tam cases (31 of 37 agreements),  and a third of all qui tam settlement amounts were associated with just 4  pharmaceutical qui tam cases.

HHS-OIG Considers Risk Factors, Such As an Entity’s Conduct, When Evaluating Whether to Exercise its Exclusion Authority and in Negotiating Agreements

HHS-OIG Has Criteria to Determine Whether to Pursue Exclusion or Enter into an Agreement; Certain Initial Allegations Were Common among Entities That Entered Into Agreements

HHS-OIG guidance includes the criteria that agency officials said they  follow to determine whether to exercise the agency’s permissive  exclusion authority, or take an alternate action, such as entering into an  agreement with an entity. According to HHS-OIG officials and agency  guidance, each situation is evaluated on a risk continuum and the course  of action chosen is based on the agency’s assessment of the future risk  the entity poses to federal health care programs. HHS-OIG has four  broad categories of criteria that it applies in deciding where an entity falls  on the risk continuum and which action to take. These four categories are  (1) the nature and circumstances of the conduct; (2) conduct during the  government’s investigation; 3) whether the entity has made efforts to  improve its conduct; and 4) the entity’s history of compliance. According  to HHS-OIG officials, the agency will exclude the highest-risk entities, and  since fiscal year 2011, under its permissive exclusion authority, HHS-OIG  has excluded 65 entities that were the subject of a related DOJ legal  settlement. However, HHS-OIG guidance states that HHS-OIG often  concludes that exclusion is not necessary, so long as the entity will enter  into an agreement with the agency.

For new agreements from July 2005 through July 2017, our review of  HHS-OIG data showed that there were four main types of initial  allegations that resulted in the entity entering into an agreement with  HHS-OIG. This included: billing for services not rendered - 194 agreements (about 30 percent); provision of medically unnecessary services - 136 agreements (about acts prohibited under the Anti-Kickback statute - 135 agreements  (about 21 percent); and misrepresentation of services and/or products – 131 agreements  (about 20 percent).

The majority of agreements (about 63 percent) were associated with one  initial allegation. However, some agreements were associated with more  than one initial allegation: about 23 percent of agreements from July 2005  through July 2017 were associated with two initial allegations and about  15 percent were associated with three or more initial allegations.

Agreements Included Standard Provisions with Some Variation to Address Risks Specific to the Entities

We compared the provisions required in selected agreements to those  outlined in HHS-OIG’s current agreement templates and found that the  provisions were generally similar. All of HHS-OIG’s templates and the  agreements we reviewed were organized into the same broad sections.  For example, all of the templates and agreements contained sections  detailing the information entities were required to submit to HHS-OIG in  an initial implementation report and in annual reports, and all agreements  had a section that outlined the enforcement provisions for the agreement.  In addition, there generally was a standard term for agreements of either  three or five years depending on the type of agreement. All 23 of the CIAs  we reviewed had a term of five years, and of the nine IAs we reviewed,  five had a 5-year term and four had a 3-year term. The IAs with a longer  5-year term generally were older agreements from 2010 or 2011.  According to HHS-OIG officials, the current practice is to negotiate 3-year  terms for IAs and 5-year terms for CIAs.

HHS-OIG has developed agreement templates that include standard  provisions to address the risks an entity’s noncompliance could pose to  federal health care programs. Additionally, in some templates, provisions  are included to address the specific types of conduct that gave rise to the  agreement. HHS-OIG has four templates for use in negotiating CIAs and  two for negotiating IAs, and HHS-OIG officials said that they will use one  of the six templates as a starting point when drafting an agreement.  HHS-OIG officials told us that the terms included in agreements are  similar across CIAs and IAs because certain provisions are non- negotiable. For example, officials said that they always include provisions  requiring an entity to hire a compliance officer, submit annual reports, and  provide HHS-OIG with access to the entity when requested. Across the  various types of templates, there are similar standard provisions, and our  review of selected agreements found many of the same provisions. For  example, among the 32 agreements we reviewed:

All 32 agreements required the entity to engage an independent  review organization to perform the agreement’s required reviews,  including claims reviews. Entities have retained a variety of individuals  and businesses as their independent review organization, ranging  from small regional consulting firms to large national consulting or  accounting firms. For agreements HHS-OIG has entered into from  July 2005 through July 2017, our review of the agency’s data found  that there were 173 unique associated independent review  organizations.

All 32 agreements had training and education requirements, although  the specifics of the required training, such as the number of hours or  the specific topics, varied across agreements.

28 of the 32 agreements reviewed required the entity to have a  compliance officer. The four agreements that did not require this were  two IAs for small group practices, one for a medical group practice,  and one for a clinic that named an individual practitioner as a party to  the agreement.

Although agreements shared many standard provisions, some provisions  were unique to either CIAs or IAs. Many of the CIAs that we reviewed  included provisions detailing specific responsibilities for the entity’s board  of directors (18 of 23 CIAs) and requirements for certain high-level  employees to annually certify that they were in compliance with federal  health care program requirements and the provisions of the agreement  (12 of 23 CIAs). None of the nine IA’s we reviewed included these  provisions. On the other hand, all nine IAs we reviewed (and one CIA)  had provisions regarding third-party billing. If the provider subject to the  agreement contracted with a third-party billing company to submit claims  on the provider’s behalf, these agreements required the provider to certify  that they did not have an ownership or controlling interest in the third- party billing company.

In addition to agreement type, provisions also varied due to the nature of  the conduct that led to the agreement or the type of entity entering into  the agreement. For example, some agreements included provisions  intended to ensure compliance with the Anti-Kickback statute and Stark  law (8 of 32). HHS-OIG officials told us that specific provisions related to  the Anti-Kickback statute and Stark law would only be present in  agreements when the conduct that had led to the agreement involved  acts prohibited under those statutes, such as prohibited kickbacks or  improper referral arrangements. Other agreements include provisions  specific to monitoring quality of care issues. For example, one of the  agreements we reviewed was a quality of care CIA that required the entity  to retain an independent monitor to examine, among other things, the  entity’s internal quality control systems and its response to quality of care  issues. In addition, 2 of the 32 agreements we reviewed were with  pharmaceutical manufacturers and contained provisions not in other  agreements because they would only be relevant to a pharmaceutical  manufacturer. For example, both agreements we reviewed had a  requirement that the manufacturers, within 30 days, provide HHS-OIG  with a copy of any written communication with the Food and Drug  Administration that materially discussed the actual or potential unlawful or  improper promotion of the manufacturer’s product.

According to HHS-OIG data, most of the 652 agreements entered into  from July 2005 through July 2017 (about 95 percent) required the entity to  perform at least one review as part of the agreement. The most common  types of required reviews captured in HHS-OIG’s database during this  time were reviews of health care claims, unallowable costs, and  arrangements. Slightly more than half of the agreements (19 of 32) we  reviewed required the entity to perform a claims review. Fifteen of these  were annual claims reviews and four were quarterly claims reviews. In  addition, slightly more than a quarter of agreements we reviewed (9 of 32)  required an unallowable costs review. Finally, a quarter of the  agreements (8 of 32) required the entity to perform an arrangements  review. The eight agreements requiring an arrangements review were the  same agreements that included a section with provisions related to  compliance with the Anti-Kickback statute and Stark law. A few  agreements had required reviews that were not common across the  agreements we reviewed and usually related to the types of services that  the entity provided. For example, three agreements we reviewed required the entity to conduct a cardiac catheterization procedures review,  described as an evaluation and analysis of the medical necessity and  appropriateness of interventions performed either in the entity’s cardiac  catheterization lab or by the provider.

HHS-OIG Uses Multiple Strategies to Ensure Compliance with Terms of Agreements and Imposes Certain Penalties When Noncompliance Is Identified

HHS-OIG Reviews Required Reports, Communicates with Entities, and Conducts Site Visits to Monitor Entities’ Compliance with Agreements

According to HHS-OIG officials, the agency assigns a monitor to each  agreement—an HHS-OIG staff attorney or program analyst—who, for the  duration of the agreement, oversees the entity’s compliance with the  terms of its agreement. Per officials and what is outlined in internal  agency documents that describe how to monitor agreements, the  monitors’ responsibilities include:

Reviewing the information that entities provide in their initial  implementation report, annual reports, and any other reports required  under the agreement within the time frames established by internal  HHS-OIG guidance.

Communicating with entities to provide assistance to those who need  help in understanding the requirements or to request additional  information when a required report has missing or incomplete  information.

Reviewing and responding to periodic correspondence received from  entities, including notifications required by the agreement, reportable  event disclosures, and other communications from the entity.

Drafting any letters that are sent to the entity, if noncompliance is  identified, including letters demanding the payment of penalties— referred to as stipulated penalty demand letters.

Conducting site visits to verify that the entities are complying with the  agreements properly. According to internal HHS-OIG guidance,  monitors are to select sites primarily based on concerns that they may  have with specific entities, as well as other factors, such as the type of  provider, the size or complexity of the entity, length of the agreement,  and the severity or complexity of the offenses that resulted in the  agreement.

According to internal HHS-OIG guidance regarding site visit protocol and  agency officials we spoke to, during site visits, HHS-OIG officials may  conduct document reviews of training records, policies and procedures, or  other documents; hold meetings with the compliance officer or board  members; or tour the facility, among other activities. Officials said that two  HHS-OIG officials typically conduct the site visit—the agreement’s  monitor and one other official—and the site visits typically last about one  day to a day-and-a-half. For agreements entered into from July 2005  through July 2017, we found that HHS-OIG officials conducted 211 site  visits that were associated with 155 agreements. Thirty of these  agreements were associated with more than one site visit ranging from 2  to 10 visits. The majority of the 211 site visits were for CIAs (about 87  percent). During the full calendar years from 2006 through 2016, HHS- OIG completed an average of 18 site visits each year.

HHS-OIG Works with Entities to Ensure Compliance but May Impose Monetary Penalties or Exclude Entities for Noncompliance in Some Cases

Although most entities comply with the provisions of their agreements,  according to HHS-OIG officials, when noncompliance occurs, the most  common issue is the late submission of required reports or reviews.  According to HHS-OIG officials, other types of noncompliance range from  falsely certifying the accuracy of reported information to submitting  reports that do not include the required elements. According to officials  and as outlined in agreements, HHS-OIG addresses noncompliance  through a series of escalating steps, which, in rare instances, may result  in the HHS-OIG imposing penalties on an entity as laid out in the  agreement (stipulated penalties) or even exclusion of an entity from  federal health care programs. Steps HHS-OIG takes to address  noncompliance may include:

Working with the entity before taking official action. For example,  officials told us that monitors typically request additional  documentation or information from providers when they identify  potential issues rather than imposing stipulated penalties immediately.

Demanding that the entity pay stipulated penalties. HHS-OIG will send  a stipulated penalties demand letter to an entity in accordance with  the breach and default terms of the agreement. The stipulated penalty  amounts for noncompliance with the different provisions are specified  in the agreement. According to officials, the stipulated penalty  amounts in agreements are non-negotiable and the amounts  associated with noncompliance with specific provisions do not change  across agreements. The stipulated penalties in agreements range  from $1,000 to $50,000 per violation. For example, for each day an  entity fails to submit a complete annual report to HHS-OIG by the  submission deadline, the stipulated penalty is $2,500 for CIAs and  $1,500 for IAs. In addition, for all agreements, each false certification  submitted by or on behalf of the entity results in a stipulated penalty of  $50,000.

For agreements entered into from July 2005 through July 2017, our  review of HHS-OIG data found that HHS-OIG issued 41 letters  demanding stipulated penalties (between 0 and 7 letters per year) for  actions such as the failure to submit annual reports and employing  individuals excluded from participation in federal health care  programs. In total, HHS-OIG collected about $5.4 million in  stipulated penalties during this time. Penalty amounts demanded in  each letter ranged from $1,000 to over $3 million, with a median of  $18,000. According to HHS-OIG, the stipulated penalty of over $3  million was a record penalty for failure to comply with an agreement.  This penalty, according to HHS-OIG, resulted from the entity’s failure  to correct improper billing processes and poor claims submission  practices that had led to error rates and overpayments to the  company by Medicare for hospice services. These issues were  uncovered through the claims reviews required under the agreement  and HHS-OIG’s site visits to the company’s facilities.

Determining that the entity is in material breach of the agreement. As  defined in agreements, this determination may result from repeated or  flagrant violations of agreement obligations; failure to notify HHS-OIG  of certain reportable events; failure to take corrective actions or make  appropriate refunds; failure to respond to a stipulated penalties  demand letter; or failure to engage an independent review  organization. From July 2005 through July 2017, HHS-OIG issued 10  material breach letters to entities informing them that HHS-OIG  intended to exclude them. However, the 10 material breach letters  were associated with only 6 agreements, and 5 of the 10 material  breach letters issued were to the same entity. These five letters were  issued to the entity between March 2012 and January 2014 for a  series of alleged material breaches of its agreement including, among  other things, a failure to report serious quality of care reportable  events or to perform training required under the terms of its  agreement. This entity, which was a national chain of clinics that  primarily provided dental services to children on Medicaid, was  ultimately excluded in September 2014 from participation in federal  health care programs, including Medicaid, for a period of five years.

Excluding an entity from participation in federal health care programs.

For agreements entered into from July 2005 through July 2017, we  found that HHS-OIG has issued five exclusion letters to entities for  failing to adhere to their agreements. These exclusion letters were  associated with four agreements—2 CIAs and 2 IAs. According to  HHS-OIG’s data, these exclusions occurred in 2007 (1), 2014 (1), and  2015 (2). The four entities that were excluded included a durable  medical equipment provider, a national chain of clinics, a practice  management company, and a medical group practice. An agreement  affords the entity the opportunity to respond to a material breach letter  prior to the issuance of a notice of exclusion. However, an HHS-OIG  official said that, given the multiple steps involved in the breach and  default process, it is unlikely that a breach would be addressed  satisfactorily by the entity at this stage in the process. Of the four  entities that HHS-OIG excluded, three had also previously received a  notice of material breach from HHS-OIG.

We provided a draft of this report to HHS and DOJ for review and  comment. These departments provided technical comments, which we  incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of HHS, the  Attorney General, and the Inspector General of HHS. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made key contributions to this report are  listed in appendix I.

Appendix I: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Karen Doran (Assistant Director),  Alison Goetsch (Analyst-in-Charge), and Perry Parsons made key  contributions to this report. Also contributing were Sam Amrhein, Muriel  Brown, Dan Ries, Jennifer Rudisill, and Merrile Sing.

What happens if a doctor bills Medicare or Medicaid for services that could be considered fraud—because they're medically unnecessary, or because the doctor didn't actually provide the services? Federal law prohibits these and other abuses of federal health care programs.

When health care providers break these laws, the Department of Health and Human Services can prevent them from billing federal programs. Or, it can negotiate agreements with them instead—for example, requiring them to have their billing records audited.

We reviewed HHS's use of the agreement option and found that it made 652 agreements between July 2005 and July 2017.