On April 17, 2013, the Office of Inspector General (“OIG”) issued an updated Provider Self-Disclosure Protocol (“SDP”). The initial protocol was created in 1998 (“’98 version”) with the goal of having providers voluntarily identify and disclose potential federal health care program fraud and work with the OIG to resolve the identified abuses. Specifically, the SDP offered guidance to providers (both individuals and entities) on how to investigate conduct, quantify damages, mitigate potential penalties, and report to OIG.  Further guidance came in a series of OIG Open Letters to the health care industry in 2006, 2008, and 2009. The updated SDP provisions supersede both the original version and the subsequent Open Letters.

OIG boasts that, since its inception, the SDP has led to over 800 disclosures and a recovery of more than $280 million for the federal health care programs. Those numbers, while impressive when standing alone, are a drop in the bucket compared to the $25 billion the Department of Justice (“DOJ”) has recovered in prosecuting criminal and civil health care fraud during the same time frame. By human nature, self-disclosure of potential wrongdoing is not a popular practice, but it appears that the new OIG updates only add to the difficulty of having providers willingly come forth. In today’s post, I’ll provide a brief overview of the updated eligibility and disclosure requirements.

Eligibility for the SDP

As it was with the ‘98 version, providers are qualified for the SDP if they are subject to OIG’s Civil Monetary Penalty (“CMP”) authorities and the disclosure is of such a nature that it involves potential violations of federal criminal, civil, or administrative laws for which civil monetary penalties are applicable. For issues involving overpayment, errors, or violations of the Stark Law, the SDP is not available (but note violations involving both the Anti-Kickback Statute and the Stark Law can be resolved using the SDP).

In contrast to the ’98 version, a disclosing party must now specifically state which laws are potentially violated and acknowledge that their conduct is a potential violation. This is particularly worrisome because admission to the SDP is not a guarantee and it is unclear if these acknowledgments would be protected from discovery if SDP was denied and criminal and/or civil action was subsequently initiated. Additionally, a disclosing party must now agree to waive any statute of limitations, laches or similar defenses to be eligible (with an exception for the defenses that would have been available had an administrative action been initiated on the submission date). Waivers of legal rights should not be freely given without serious consideration. Third, a disclosing party is now required to end the conduct or terminate the arrangement within 90 days of submission to the SDP in order to maintain eligibility.

Disclosure Requirements

The updated SDP now outlines eleven categories of information that are required with every submission, including the following:

1. Biographical information of the provider and its relationship within a system or network, if any.
2. Information on the disclosing party’s designated representative and individuals authorized to settle the matter.
3. A statement about the details of the conduct.
4. A statement about the specific federal criminal, civil, or administrative laws that are potentially violated.
5. The federal health care programs affected.
6. An estimate or actual amount of damages.
7. A statement on whether the disclosing party knows that the matter is under investigation by another government agency or contractor.

In addition, the general disclosure requirements now require a disclosing party to certify in its submission that it will complete its investigation within 90 days of its initial submission. Previously, the time frame was 90 days from the date of acceptance. This shortened time frame will put the pressure on providers and may require considerable time and expense before acceptance into SDP is even certain.