New Guidance from HHS-OIG Offers Insights for Health Care Compliance Programs

U.S. Department of Health and Human Services (“HHS”), Office of Inspector General (“OIG”) recently published its General Compliance Program Guidance (the “GCPG”),¹ non-binding guidance designed to assist health care industry participants in monitoring compliance with applicable health care statutes, regulations, and program requirements. The GCPG was published to the HHS-OIG website as part of HHS-OIG’s Modernization Initiative,² and aggregates into a single document the advice of past Compliance Program Guidances (“CPGs”) issued between 1998 and 2008.³

While OIG’s guidance is largely familiar, the GCPG reflects several additions and clarifications, including (i) topics not addressed previously in past CPGs, including Information Blocking, cybersecurity, and quality and patient safety; (ii) new recommendations for previous topics, such as policy accessibility, compliance officer roles, training, claims audits, and financial arrangements tracking; and (iii) considerations for entrants to the health care space, including technology and social services organizations and private investors.

HHS-OIG plans to publish industry segment-specific CPGs (“ICPGs”) in 2024 for specific types of providers, suppliers, and other participants in the health care industry. According to OIG, the additional guidance will focus on fraud and abuse risk areas specific to each industry subsector.⁴ Importantly, neither the GCPG nor the ICPGs set forth a one-size-fits-all compliance model, and HHS-OIG emphasizes that strict adherence to the guidelines is not expected.

HHS-OIG Continues to Focus on Traditional Fraud, Waste, and Abuse Compliance Considerations, While Emphasizing New Areas of Focus for Compliance Programs

• Substantive Health Care Laws Guidance. The GCPG includes substantive summaries of various health care laws, including the Anti-Kickback Statute, Stark Law, and False Claims Act. In addition, the GCPG addresses for the first time the Information Blocking Rule,⁵ under which HHS-OIG has the authority to investigate claims that certain “actors”—health IT developers of certified health IT, health information exchanges and networks, and health care providers—have engaged in “Information Blocking,”⁶ and to impose civil monetary penalties⁷ for noncompliance.
• HIPAA. Given the increasing number of cybersecurity attacks targeting health care entities,⁸ HHS-OIG emphasizes in the GCPG that compliance with HIPAA should be a top compliance priority and that such compliance measures should be evaluated through periodic risk assessments.
• Quality. The GCPG clearly recommends, for the first time, that compliance programs—particularly those of hospitals, long-term care facilities and other entities furnishing residential care services—include meaningful evaluation of quality and patient safety oversight.⁹ The GCPG suggests an entity’s corporate compliance committee (i) include members responsible for quality assurance and patient safety, (ii) receive regular reports from senior leadership on quality assurance and patient safety practices, and (iii) implement a program for performing quality audits and reviews. Additionally, the GCPG states that compliance officers should (i) develop productive working relationships with clinical and quality leadership, (ii) be informed about any internal quality audits and incident reviews, and (iii) have the resources to conduct the quality compliance audits.

OIG Expands upon Previous Guidance and Issues New Recommendations for Compliance Programs

• Accessibility. The GCPG advises that an organization’s code, policies, and procedures should be easily accessible and comprehensible by all relevant individuals (e.g., available at appropriate reading levels and translated into other languages). The GCPG links to a DOJ Evaluation of Corporate Compliance Programs questionnaire, which is intended to facilitate the creation and review of applicable compliance policies and procedures.
• Compliance Officer Roles and Responsibilities. The GCPG expresses HHS-OIG’s view that compliance officers should neither lead or report to an entity’s legal or financial functions, nor provide an entity with legal or financial advice or supervise anyone who does.¹⁰ Instead, HHS-OIG proposes that compliance officers should report directly to an entity’s CEO or board. Separately, the GCPG acknowledges that some compliance officers may also serve as an entity’s privacy officer but suggests the entity should ensure that it furnishes sufficient resources to support that individual’s dual role.
• Vendor Training. The GCPG suggests that, when contracting with a third party to perform health care-related functions, an entity may grant a training waiver to the contracting entities’ employees if the contracting entity demonstrates that the contracting entity’s own compliance training is sufficient. HHS-OIG emphasizes, however, that employees of the contractor should still be informed of the manner in which noncompliance may be reported directly to the entity.
• Claims Audits and Medical Necessity. The GCPG suggests that all claims audits should incorporate an assessment of medical necessity through clinician review. While medical necessity is commonly assessed in many internal audits, HHS-OIG’s expectation that every internal claims audit involve clinician input on medical necessity may exceed general industry practices, which often entail conducting at least a portion of audits with trained compliance personnel or professional coders, and may not consistently involve assessment of medical necessity by a clinician.
• Financial Arrangement Tracking. Historically, HHS-OIG has neither formally nor informally directed entities to track their financial arrangements as part of an effective compliance program, except as required as part of corporate integrity agreements (“CIAs”). The GCPG adopts a position reflecting CIA requirements, suggesting that entities implement a centralized tracking system to monitor and track compliance with the terms and conditions set forth in financial arrangements, particularly between referral sources and recipients. HHS-OIG recommends that such tracking systems be regularly audited and, with respect to the financial arrangement, that entities ensure that (i) the entity maintains proper supporting documentation; (ii) legal reviews are regularly conducted; (iii) services, activities, leases, and equipment rentals are consistent with contractual terms; and (iv) fair market value (“FMV”) assessments are routinely performed and updated.

OIG Notes Additional Areas Worthy of Consideration in Compliance Programs

• New Entrants. The GCPG suggests that new entrants to the health care industry (e.g., technology companies, social services organizations) take steps to ensure that they are educated on the federal fraud and abuse laws (and other applicable laws) and understand the importance of implementing an effective compliance program designed to comply with, prevent, detect, and address any violations of such laws.
• Investors. The GCPG suggests that an understanding of financial arrangements and incentives is integral to uncovering possible compliance issues. The GCPG indicates that HHS-OIG believes it is important for investors and boards to understand applicable laws, the role of effective compliance programs, as well as to evaluate the entity’s operations and investment structure to ensure compliance with such laws, particularly for those investors with a management services role.
• Small Versus Large Entities. Recognizing that compliance infrastructures and resources may differ substantially across small and large organizations, the GCPG sets forth specific recommendations for how compliance programs may be adapted for both small and large entities with respect to the designation and roles of compliance officers and committees, the implementation of policies and procedures and provision of training, disclosures of noncompliance, auditing and monitoring, corrective action, and board compliance oversight.

Concluding Thoughts

The GCPG is HHS-OIG’s first single, comprehensive compliance guide that unites much of the guidance it has issued over the last 25 years. While HHS-OIG’s guidance documents are non-binding, they provide important insights into what HHS-OIG and other enforcement agencies may consider in enforcement decisions and are thus helpful to reference when structuring, implementing, and monitoring effective health care compliance programs. Health care entities should take particular note of the new guidance and areas of emphasis, highlighted above, and remain apprised of the upcoming industry-specific CPGs, which will provide additional and more targeted insights.

If you have questions regarding the GCPG or navigating compliance programs, please do not hesitate to contact one of the authors or your Ropes & Gray advisor.