On November 8, 2021, the United States Department of Health and Human Services (HHS) Office of Inspector General (OIG) released an updated Self-Disclosure Protocol (SDP) (here). The revision of the SDP is an important development for all health care providers and suppliers across the health care delivery system spectrum that are subject to OIG’s civil monetary penalty (CMP) authority including, among others, hospitals, physicians, pharmaceutical and medical device manufacturers. The SDP notes that between 1998 and 2020, HHS OIG resolved more than 2,200 disclosures which resulted in recoveries of more than $870 million. SDP at 1.

What You Need To Know:

• The SDP summarizes the important potential benefits of self-disclosure (including with respect to potential damages multipliers and mitigation of liability).
• The SDP update coincides with recently updated policies on corporate cooperation in criminal investigations announced by the U.S. Department of Justice (DOJ).
• Under both the updated SDP and new DOJ policy, companies and executives will need to continue to consult experienced counsel to carefully weigh the costs and benefits of affirmative disclosure as well as the severe collateral consequences of any potential enforcement action.

Potential benefits of disclosure under the updated SDP

The SDP notes four benefits to disclosing potential fraud:

• First, cooperation with the OIG may help to demonstrate the existence of a robust and effective compliance program. Indeed, as the SDP notes, for persons [1] making disclosures under the SDP, HHS has adopted “a presumption against requiring integrity agreement obligations in exchange for a release of OIG’s permissive exclusion authorities in resolving an SDP matter.” SDP at 2. And, in fact, the SDP notes that “[b]etween 2016 and 2020, [HHS] resolved 330 SDP cases through settlements. In all of these cases, [HHS] released the disclosing parties from permissive exclusion without requiring any integrity measures.” Id.
• Second, HHS views “disclosing persons” who make disclosures under the SDP and cooperate with OIG as deserving of a lower multiplier for payment than would otherwise normally be required in a government-initiated investigation. Specifically—although the SDP notes that facts and circumstances may vary—as a general rule of thumb HHS takes the view that a minimum multiplier of 1.5 times damages is typically appropriate in SDP cases.
• Third, self-disclosure under the SDP may help to mitigate potential exposure under the statute mandating disclosure of overpayments under the Medicare and Medicaid programs. See 42 U.S.C. 1320a-7k(d). Specifically, per the SDP, liability may ordinarily arise under the Civil Monetary Penalty Law or False Claims Act (FCA) from a failure to return an overpayment from Medicare or Medicaid if the overpayment is not “reported and returned by the later of: (1) the date that is 60 days after the date on which the overpayment was identified or (2) the date any corresponding cost report is due, if applicable.” SDP at 2. However, “the Centers for Medicare & Medicaid Services (CMS) agreed to suspend the obligation to report overpayments . . . when OIG acknowledges receipt of a submission to the SDP so long as the submission is timely made.” Id.
• Fourth, for those who avail themselves of the SDP, HHS has stated its commitment to working with persons who use the SDP in good faith and cooperate with the review and resolution process. There is some reassurance that following the SDP will provide a measure of predictability to disclosing persons. Indeed, as the SDP notes, “OIG created the SDP to provide a specific and detailed process that can be relied upon by all participants in the health care industry as one that OIG will consistently follow.” SDP at 2.

Circumstances rendering persons ineligible for early disclosure benefits under the updated SDP

Importantly, the SDP notes four circumstances that would render a person ineligible for the benefits of early disclosure under the SDP:

• First, if the matter does not involve potential violations that would be covered by a CMP (such as overpayments, or errors);
• Second, if a person is requesting an OIG opinion regarding whether a violation occurred;
• Third, if the disclosure only involves a Stark Law violation (as opposed to an Anti-Kickback Statute (AKS) violation, or a combination of an AKS and Stark violation); or
• Fourth, if the alleged conduct is more appropriately disclosed through OIG’s Grant or Contractor self-disclosure programs.

Required elements of an SDP disclosure

Importantly, the SDP requires that the disclosing person “conduct an internal investigation and report its findings to OIG in its submission.” SDP at 5. However, if the investigation has not concluded by the time of the submission, the disclosing person “must certify in its submission that it will complete the internal investigation within 90 days of the date of its initial submission.” Id.

Additionally, when making a disclosure, “a disclosing party must explicitly identify the laws that were potentially violated” rather than offer a general statement that a violation of Federal law occurred. SDP at 3. Similarly, a disclosing person should not couch the disclosure in terms suggesting the disclosing person does not believe a violation occurred even though the Federal Government may disagree. Owning up to the
issue at hand is a fundamental premise of the SDP.

If a disclosure to OIG is made, the updated SDP lists items that must be included in the submission including a “concise statement of all details relevant to the conduct disclosed,” an estimate of the damages to each Federal health care program relevant to the disclosed conduct, and a description of the corrective action taken by the disclosing party once the conduct was discovered. SDP at 5-6.

The SDP provides specific requirements if the disclosure involved conduct regarding false billing, excluded persons, and actions involving the AKS and the Stark Law. Thus, for example, “[w]hen a disclosure involves the submission of improper claims to Federal health care programs, the disclosing party must conduct a review to estimate the improper amount paid by the Federal health care programs (referred to as ‘damages’) and prepare a report of its findings that follows the requirements in this section. OIG will verify a disclosing party’s calculation of damages.” SDP at 6.

The updated SDP is an important pronouncement given the Federal Government’s active prosecution of health care fraud. The SDP notes that, “[r]esolution of a matter in the SDP depends upon cooperation, realistic expectations and clear communication between OIG and the disclosing party.” SDP at 11. As to cooperation in particular, the SDP emphasizes that “[t]he benefits of self-disclosure, such as a speedy resolution, lower multiplier, and an exclusion release without integrity agreement obligations, depend on the disclosing party’s willingness to work cooperatively with OIG throughout the process.” Id. at 12. HHS views cooperation as “conducting a thorough investigation, submitting all necessary information, communicating through a consistent point of contact, being responsive to OIG requests for additional information, and being willing to pay a penalty or multiplier of damages for self-disclosed conduct.” Id.

Finally, the SDP addresses potential cooperation with the U.S. Department of Justice (DOJ, or Department), noting that in civil cases, “[i]f DOJ participates in the settlement, the matter will be resolved as DOJ determines is appropriate consistent with its resolution of FCA cases, which could include a calculation of damages resulting from violations of the AKS based on paid claims.” SDP at 12. Importantly, although “OIG will advocate that the disclosing party receive a benefit from disclosure under the SDP and the matter be resolved consistent with OIG’s approach in similar cases,” it is ultimately DOJ that “determines the approach in cases in which it is involved.” Id. As for criminal cases, “OIG also coordinates with DOJ on disclosures involving potential criminal conduct” and will make appropriate referrals to DOJ for criminal resolution. Id.

Implications of recently updated DOJ policy on cooperation by companies in criminal investigations

HHS’ new SDP coincides with an updated DOJ policy announced just weeks ago. Specifically, in her keynote address at the American Bar Association’s National Institute on White Collar Crime on October 28, 2021 (here), Deputy Attorney General Lisa O. Monaco announced three significant changes to DOJ policy relating to corporate disclosures of criminal conduct. First, “to be eligible for any cooperation credit, companies must provide the [D]epartment with all non-privileged information about individuals involved in or responsible for the misconduct at issue,” meaning that “a company must identify all individuals involved in the misconduct, regardless of their position, status or seniority.” As Ms. Monaco noted, this is a departure from prior Department policy, which permitted companies to cooperate with government investigations (with all the benefits such cooperation entailed) merely by disclosing the conduct of those “substantially involved.”

Second, Ms. Monaco announced that, “all prior misconduct needs to be evaluated when it comes to decisions about the proper resolution with a company, whether or not that misconduct is similar to the conduct at issue in a particular investigation.” In other words, “going forward, prosecutors will be directed to consider the full criminal, civil and regulatory record of any company when deciding what resolution is appropriate for a company that is the subject or target of a criminal investigation.”

Third, and finally, Ms. Monaco stated that Department policy on the appointment of independent monitors to oversee DOJ resolutions— typically in the context of Non-Prosecution Agreements (NPAs) or Deferred Prosecution Agreements (DPAs)—was rescinded, “to the extent that prior Justice Department guidance suggested that monitorships are disfavored or are the exception . . . .” Ms. Monaco made “clear that the [D]epartment is free to require the imposition of independent monitors whenever it is appropriate to do so in order to satisfy . . . prosecutors that a company is living up to its compliance and disclosure obligations under the DPA or NPA.” DOJ will presumably be mindful of the SDP’s language suggesting a presumption, in SDP cases, against the requirement of integrity agreements (which frequently also require the appointment of a monitor). And Ms. Monaco’s reservation of DOJ’s right to require a monitor’s appointment “whenever it is appropriate to do so” provides the flexibility to act consistently with the SDP. Nonetheless, the animating intent of the updated DOJ policy is potentially in tension with the stated presumption of the SDP.

Indeed, despite the desire of both DOJ and HHS to continue to encourage cooperation, the “Monaco Policy,” as others have observed, may be construed by some companies as disincentivizing corporate cooperation. This perception may indeed cut against the incentives the updated SDP offers. But what will not change under the Department's policy or the SDP is the need for companies and executives to consult experienced counsel to carefully weigh the costs and benefits of affirmative disclosure as well as the severe collateral consequences an enforcement action might otherwise bring. Of course, robust compliance policies and procedures capable of detecting and preventing fraud in the first instance are a business’ first line of defense. The SDP therefore serves as an important reminder of the need for effective compliance programs as well.

If you or your organization believe disclosure under the updated SDP may be an effective means to proactively resolve inappropriate conduct, you should work with counsel promptly to consider ways to limit your exposure and the resulting financial consequences. Undue delay or obfuscation could limit (if not entirely eliminate) the potential benefits of the disclosure.

^[1] The SDP incorporates by reference the statutory definition of “person” as “an individual, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” See 42 C.F.R. § 1003.110.