The DIG's Self-Disclosure Protocol

Transcription

1 NOVEMBER 1999 HEALTH CARE LAW MONTHLY 17 The DIG's Self-Disclosure Protocol Jeff Rogers BACKGROUND The GIG's Provider Self-Disclosure Protocol is set forth in the Federal Register at 63 Fed. Reg. 58,399-58,403 (1998). The current protocol is an outgrowth of its predecessor demonstration program which was announced in The initial program was limited to five states and only four different types of providers. That program was concluded in Unlike its predecessor, the current protocol is not limited to any particular industry, specialty or service, and it is available to both individuals and entities. The announced principal purpose of the protocol is to "provide guidance to providers who decide to voluntarily disclose irregularities in their dealings with the Federal health care pro~s."1 The intent of the protocol is to facilimte resolution only of those matters which potentially violate federal criminal, civil or administrative laws. The protocol is not intended to address matters which exclusively involve overpayments or errors that do not implicate violations of law. These types of matters should be brought to the attention of the entities which process claims and issue payments. such as a carriers or intermediaries. However, these entities can refer the; matter to the GIG if issues of integrity arise. An important preliminary matter is identification by the provider of the nature of the particular irregularity. The protocol explicitly directs that if the provider has discovered a fraud which is ongoing, the provider should contact the GIG immediately and refrain from following the protocols steps for investigation of the circumstances and scope of the problem. The given reason for this admonition is that the provider's investigation could interfere with a subsequent government investigation of the same incidents. As a related matter, providers may be under an independent legal obligation to disclose certain discoveries. For example, 42 V.S.C. 1320a- 7b(a) (3) makes it a criminal offense to fail to disclose certain infonnation which may affect the provider's initial or continued right to a benefit or payment when the failure to disclose is done with an intent to fraudulently secure the benefits or payments. A provider may participate in the self-disclosure protocol even though it is ~ )EFFRoGERS is a partne;at Ross & Hardies in Chicago, Illinois. He ia a fom1~r '4ssiltant U.S. attorney. He focuses his practice on white-collar criminal defense effortli and on client intern\\l investi tions. A eat ercenta e of his rime is sent on behalf of health care (Dvidera.

2 already subject to a government inquiry, such as an investigation, audit or other routine oversight activity. The comments caution, however, that the disclosure to the government must be made in good faith, and that the GIG will not work with providers who attempt to circumvent an inquiry or fail to fully cooperate with the selfdisclosure process or otherwise interfere with the government's activities. THE COMPONENTSAND PROTOCOL MECHANICS OF THE SELF-DISCLOSURE As published, the protocol both describes its components and provides guidance regarding related matters. The discrete topics included in the protocol are: The Voluntarily Disclosure Submission; Internal Investigation Guidelines; Self-Assessment Guidelines; GIG Verification; Payments; and Cooperation and Removal from the Provider Self-Disclosure Protocol. This article summarizesome of the more significant parts of the protocol, and it discusses certain advantages and disadvantages of self-disclosure. Additional details may be gleaned from the protocol itself, and its text should be consulted in connection with any submission and/or internal investigation to ensure compliance with all requirements and guidelines. Voluntary Disclosure Submission The submission must be in writing and directed to GIG in Washington. D.C. It must contain such basic information as name. address. provider identification number and tax identification number. as well as certain information regarding the provider's ownership structure. The disclosure should inform as to whether there is a current government investigation and the nature of it. It must also include a full description of the matter being disclosed. including the types of claims. the questioned conduct and the identities of the entities and individuals involved. It should also describe the reasons for believing that a violation of federal criminal. civil or administrative law may have occurred. It must also contain a certification by the provider that the submission contains truthful information and is based on good faith. The protocol states that the provider Ilwill be expected to conduct an internal investig-lltion and self~asses$ment, and then report its findings to the OIG."z This internal investigation may t'i\ke place following the initial disclosure to the government. The protocol provides that, if the provider agrees to pursue an internal investigation

3 in accordance with the protocol's guidelines, in general, the GIG will usually agree to forego its own investigation for a reasonable time. Internal Investigation Guidelines According to the protocol, all disclosures to the GIG should include a report based upon an internal investigation. The GIG will not resolve the matter which has been disclosed until a comprehensive assessment is completed. The voluntary disclosure report should contain a written narrative that identifies, describes or delineates the following: The potential causes of the incident or practice; How the practice arose and continued; The division, department, branches or entities involved or affected; The impact on and risks to the health, safety, and quality of care; The relevant time period; The provider's officials, employees or agents who participated in the incident, had knowledge of it, and detected it; The identity of the officials, employees or agents who should have known about but failed to detect the incident; and An estimate of the monetary impact upon federal health care programs. Discovery and Response to the Matter The internal investigation report should describe how the matter was discovered and what steps were taken to address the problem and prevent others from arising in the future. Specifically, this portion of the report should include a description of: How the incident or practice was identified; What efforts were made to investigate it; What investigation was taken and when, including the individuals interviewed (with details regarding identity, positions, relevant time period, interview summaries and other matters), the files, documents and records reviewed, and a summary of any auditing activity and the documents relied upon to estimate loss; The actions taken to cease the conduct in question; The health care businesses affected by the conduct, and effort5 taken to prevent reoccurrence; Any disciplinary action which was taken as a re$ult of the discovery; (Inri

4 Any notices provided to any other agencies, such as the SEC or IRS. Finally, the report must include a certification that the "report contains truthful information and is based on a good faith effort to assist the GIG in its inquiry and verification of the disclosed matter,'" Self-Assessment Guidelines This portion of the report directs the provider to conduct an internal financial assessment and report its findings. This assessment may be undertaken simultaneously with the internal investigation, or it may be done after the scope of the problem has been identified. The protocol suggests that, at a minimum, the assessment be conducted in accordance with certain guidelines. The f1rst guideline considers which "approach" will be bken, and suggests that the review consist of either (1) a review of all claims affected during the relevant period, or (2) a statistically valid sample of the claims. In determining which approach to follow, the provider should consider the size of the population believed to be implicated. the variance of characteristics to be reviewed, the cost of the selfassessment, the available resources, the estimated duration of the review and other factors as appropriate. Prior to conducting the assessment, the provider should provide the OIG with a "work plan" describing the self-assessment process. The OIG will review the proposal and provide comments where appropriate. The OIG may also carry out additional activities to verify the correctness of the process and to validate its findings. The work plan should include a description of the rev~ew's objective and the population which will be examined, as well as an identification of the sources of data and the qualifications of the personnel conducting the review. The protocol sets forth a number of components for those plans which are based upon statistically valid samples rather than upon all of the claims affected. The protocol specifically describes various aspects of such plans, including a description of the sampling unit, the sampling frame, the sample size, and other such characteristics. As with the internal investigation report, the provider must submit a certificqtion to the DIG certifying that the information in the assessment is truthful and is based upon a good faith effort to assist the GIG.

5 NOVEMBER 1999 HRAJ.TH rarf ].AW MONTHI.Y 21 DIG's Verification The GIG will conduct its own investigation to verify the information disclosed in the internal investigcrtion and self-assessment reports. In the event the GIG uncovers matters which are outside the scope of the matter disclosed, they may be treated as "new matters" outside die provider self-disclosure protocol. While die protocol does not elaborate on diis latter point, diis language suggests that whatever benefits that may attach to the voluntary disclosure of a questionable matter, will not attach if die GIG discovers diat situation on its own, even if it is uncovered in the process of verifying other matters disclosed voluntarily. Significantly, the protocol provides that in order to facilitate the GIG's verification process, "the OIG must have access to all audit work papers and other supporting documents without the assertion of privileges or limitations on the information produced.". The issue of privilege is addressed in more detail below. Payments The protocol explicitly addresses the question of overpayments. According to the protocol, the GIG will not accept overpayments from the provider prior to completion of the GIG's inquiry. Rather, the provider is encouraged to create an interest bearing escrow account for the deposit of overpayments. This section goes on to provide that while the matter is under GIG inquiry, the provider may not make payments relating to the matter to the program or its contractors without the GIG's prior consent. This section also provides that if the GIG does consent to payments, the provider must agree in writing that acceptance of the payment does not affect the government's ability to independently determine the amount of the loss or to pursue criminal, civil or administrative remedies. Cooperation and Removal from the Provider Self-Disclosure Protocol This section simply reinforces the GIG's expectation that the provider act diligently, in good faith and truthfully throughout the process. If the GIG determines that false or untruthful information has been intentionally submitted, it will not only take into consideration the lack of cooperation but will also refer the matter to the Department of Justice or other appropriate agency for criminal sanctions, civil sanctions or exclusion. ADVANTAGES AND DISADVANTAGES OF VOLUNTARY SELF-DIsCLOSURE It is important to recognize early on that the protocol does not specifically guarantee any benefit to voluntary self-disclosure. In an apparent attempt to make this

6 clear, while at the same time endeavoring to encourage pursuit of the process, the protocol provides: Because a provider's disclosure can involve anything from a simple error to outright fraud, the GIG cannot reasonably make firm commitments as to how a particular disclosure will be resolved or the specific benefit that will enure to the disclosing entity. In our experience, however, opening lines of communication with, and making full disclosure to, the investigative agency at an early stage generally benefits the individual or company. In short, the Protocol can help a health care provider initiate with the GIG a dialogue directed at resolving its potentialliabilities.5 Generally. and historically speaking, voluntary self-disclosure is likely to have some mitigating affect on the government's decision to pursue criminal or civil penalties. For example. voluntary disclosure can be an important factor when attempting to convince the prosecuting authority not to pursue a criminal action. at least as against the individual or entity who submitted the disclosure. Likewise. voluntary disclosure will be taken into account with respect to multipliers under the False Claims Act. If a provider voluntarily disclosures an overpayment within thirty (30) days of its discovery. and fully cooperates. the court may assess not less than two (2) times the amount of damages rather than the three (3) which are othelwise allowed.' In addition, the Fedeial Sentencing Guidelines address voluntary disclosure in the context of the guidelines relating to the sentencing of organizations. One of the minimum steps of a corporate compliance program is the requirement that an organization take "all reasonable steps to respond appropriately to the offense... :'7 The sentencing benefits that apply to the existence of a corporate compliance program may be lost if an organization unreasonably delays reporting the offense to the government.' Even if not explicitly identified as a mitigating factor in other circumstances, voluntary disclosure is a factor a sentencing court should take into account when applying its discretion to sentence a violator within a given sentencing range. One of the primary disadvantages to self-disclosure the fact that a provider may bring to the government's attention a matter which the government may never have discovered in any event. In addition, once disclosed the provider has little or no control over the DIG's decision to inform other agencies. For example. the protocol expressly acknowledges the possibility that the DIG may decide that referral to the Department of Justice for civil or criminal action is appropriate. Because the protocol requires disclosure of both the matter in question and the identification of the specific persons involved. individuals as well as entities may be exposed to potential civil or criminal liability. On the other hand. the protocol acknowledges that there may be

7 NOVEMBER 1999 HEALTH CARE LAW MONTHLY - 21 circumstances where a provider itself requests participation of the Department of Justice or u.s. Attorneys' Office in settlement discussions under the False Claims Act or other laws. The protocol also implicates the potential waiver ofwork product and attorneyclient privileges by the submission of information which is obtained through investigation by counselor at counsel's direction. This possibility is recognized in the protocol. The protocol states in the section regarding GIG verification, that the GIG will not normally request written communications subject to the attorney-client privilege. However, the protocol goes on to note that certain materials critical to resolving the issue of disclosure may be covered by the work-product doctrine. The GIG will be prepared to discuss with provider's counsel a means of obtaining the information without implicating waiver issues. This would be done on a case-by-case basis, and it is not possible to predict with any certainty how the waiver issues would be implicated or resolved. In addition to triggering potential action by authorities, an internal investigation may prompt the filing of a lawsuit under the False Claims Act by a potential whistle blower, who may be an employee of the provider. Under the False Claims Act, a provider faces the possibility of treble damages, penalties of $5,000 to $10,000 per claim, costs and attorneys' fees. Jurisdictional issues regarding public disclosure and original source are often implicated in such whistle blower suits. The False Claims Act jurisprudence is beyond the scope of this article, but it can be said that many court decisions in this area are irreconcilable and even conflicting, and that the defense of a False Claims Act lawsuit can be very resource and time intensive for any provider. CONCLUSION In the current environment of continuous scrutiny and aggressive government prosecution, providers who believe that a problem will vanish if swept under the rug will likely find that they have done themselves a disservice. The decision whether to disclose under the Provider Self-Disclosure Protocol requires not only a careful analysis of the facts and law relevant to the underlying matter, but also a thorough assessment of the advantages and disadvantages of self-disclosure in the particular context at hand. This process starts with candid recognition of the problem, reasoned decision~making by the highest levels of ownership or management, and consultation with counsel where appropriate.