On Oct. 4, 2023, Deputy Attorney General (DAG) Lisa Monaco announced in a speech at the Society of Corporate Compliance and Ethics’ 22nd Annual Compliance & Ethics Institute that the Department of Justice (DOJ) adopted a new department-wide Mergers & Acquisitions Safe Harbor Policy (the Policy). While the speech focused mostly on, and highlighted, noncompliance matters in connection with non-health-care transactions, the announcement has generated great interest among companies involved in acquisition of health-care-related entities, especially where federal payors are part of the target business. DAG Monaco stated:

• The Policy was adopted “to incentivize [acquiring companies] to timely disclose misconduct uncovered during the M&A process.”
   
• The Policy builds upon recent efforts to encourage companies to self-report misconduct and promote investments in cultures of compliance.
   
• The Policy only applies to “criminal conduct discovered in bona-fide, arms-length M&A transactions.”

For qualifying self-disclosures, the Policy would grant a presumption of declination of prosecution to acquiring companies that:
.

The Baseline Safe Harbor periods will be:

• Six months from the date of closing to disclose criminal misconduct, regardless of whether the misconduct was discovered prior to the acquisition or post-acquisition; and
   
• One year from the date of closing to fully remediate the misconduct.

Extensions to the Baseline Safe Harbor periods are subject to a reasonableness analysis that considers deal complexity. However, companies that detect misconduct implicating national security or involving “ongoing or imminent harm” cannot wait until the deadline to self-report.

Applicability and Enforcement

• The Policy does not impact civil merger enforcement.
   
• Acquiring companies are still subject to potential successor liability for failure to perform effective due diligence or self-disclose misconduct at an acquired entity, as the Policy intends to incentivize self-disclosure, not reduce liability.
   
• The acquiring company’s ability to receive a declination will not be impacted by “aggravating factors” at the acquired company.
   
• Any misconduct disclosed under the safe harbor will not be factored into future recidivist analysis for the acquiring company.

Remaining Uncertainty

Because the Policy was announced in a speech and has yet to be published in writing, there are numerous unanswered questions about its implications for acquirors.

• While DAG Monaco expressed that a motivation for adoption of the Policy was to bring consistency across DOJ offices, it is unclear how DOJ and the Centers for Medicare & Medicaid Services’ Office of Inspector General (CMS OIG) requirements and self-disclosure frameworks will interact, or which agency requirements and rules will take precedence.
   
• The analysis of “risks vs. rewards” involved in a voluntary disclosure is complicated, as there are many collateral consequences involved in a disclosure. Accordingly, as the actual details of the “reward” have been neither memorialized nor determined through DOJ adherence to any written policy, and the attendant risks are significant, caution about this new Policy is prudent.
   
• The required level of investigation into the self-disclosed conduct when dealing with DOJ is often significant and costly. Accordingly, any attempt to fall within the safe harbor may be time-consuming and costly.
   
• As many health care issues can be tied to payments by Medicare or Medicaid, and overpayments are required to be returned, DOJ could take the position that such conduct is otherwise required to be disclosed and thus outside the safe harbor.
   
• As the Policy only applies to DOJ, it is unclear what impact such self-disclosure will have on state attorneys general, who often pair with DOJ in health care matters.
   
• Questions may arise on how the Policy will impact the decision to enter into an asset deal versus an equity deal, how to escrow monies for any required remediations, restitution, or disgorgement that could still be required under the Policy, or if any investigative costs will be necessary to qualify for the safe harbor.
   
• Notwithstanding DAG Monaco’s statement that any misconduct disclosed under the safe harbor will not be factored into future recidivist analysis for the acquiring company, that position could be modified by a future administration. In addition, another agency with oversight and/or enforcement jurisdiction over the acquiring company may choose to consider the disclosed misconduct in its future recidivist analysis.

In the Meantime

As we await DOJ’s written policies and guidance, potential buyers in the health care entity transaction space should consider:

• Reviewing and enhancing diligence protocols and procedures with particular attention to health care professional consulting and other financial arrangements, research investigator arrangements, etc.;
   
• Developing and implementing timely policies and procedures that would accelerate the proper integration of new acquisitions and include a budget for remediation of any improprieties identified;
   
• Reviewing risk-allocation arrangements and available financial resources of the post-closing entity to ensure that it would have the funds needed to fulfill disgorgement and restitution requirements that would still be required under the safe harbor.