On November 6, 2023, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) released the updated “General Compliance Program Guidance” (GCPG).¹ The guidance document is applicable to all healthcare individuals and entities, such as investors, suppliers, manufacturers, and providers.² This Health Capital Topics article discusses the new guidance, reactions from healthcare industry stakeholders, and potential implications.

The OIG has updated or released numerous Compliance Program Guidances (CPGs) since 1998, with this update representing the first major update to the OIG’s CPGs in 15 years.³ CPGs focus on participants in the healthcare industry, including pharmaceutical managers, third-party medical billing companies, clinical laboratories, hospitals, home health agencies, hospices, and physician practices.⁴ This most recent iteration comes on the heels of the OIG’s April 2023 announcement that it would be overhauling its compliance guidance based on stakeholder feedback, with the goal of “modernizing the accessibility and usability of…publically available resources,” including the CPGs.⁵ This most recent guidance serves as a reference guide for healthcare entities creating and maintaining compliance programs and “discusses general compliance risks and compliance programs.”⁶

In discussing those risks and programs, the GCPG addresses applicable federal healthcare laws, including the Health Insurance Portability and Accountability Act (HIPAA), the False Claims Act, the Anti-Kickback Statute, and the Stark Law.⁷ In part, HIPAA regulates access to, and the privacy of, individually identifiable health information.⁸ The False Claims Act prohibits any person from knowingly submitting false claims to the government.⁹ The Anti-Kickback Statute and Stark Law are generally concerned with the same issue – the financial motivation behind patient referrals. The Anti-Kickback Statute makes it a felony for any person to “knowingly and willfully” solicit or receive, or to offer or pay, any “remuneration”, directly or indirectly, in exchange for the referral of a patient for a healthcare service paid for by a federal healthcare program.¹⁰ Similarly, the Stark Law prohibits physicians specifically from referring Medicare patients to entities with which the physician or their family members has a financial relationship for the provision of certain designated health services (DHS).¹¹

The GCPG identifies and discusses the seven elements of what the OIG believes comprises a successful and effective compliance program, which include:

1. Written procedures and policies;
2. Compliance oversight and leadership;
3. Education and training;
4. Effective communication with disclosure programs and compliance officers;
5. Enforcing standards;
6. Risk monitoring, auditing, and assessment; and
7. Responding to offenses and developing corrective actions.¹²

Other items addressed in the GCPG include:

1. A general background on the OIG’s current and previous compliance guides;
2. A summary of applicable regulations and laws over which the OIG has oversight;
3. Tips to ensure the healthcare industry understands the OIG’s general views on compliance priorities and structures;
4. Suggestions for adapting programs for compliance based on the size of the entity;
5. Discussion on compliance considerations, which indicates the OIG’s current focus; and
6. A list of OIG resources, including compliance toolkits; OIG reports and publications; advisory opinions; special fraud alerts, bulletins, and other guidance; corporate integrity agreements; and OIG self-disclosure information.¹³

In addition to the GCPG, the OIG is expected to publish industry compliance program guidance (ICPG) specific to various suppliers, providers, and participants of the subsectors in the healthcare industry or ancillary industry sectors that relate to federal healthcare programs.¹⁴ These industry-specific guidance documents will discuss fraud and abuse risks specific to the subsector and identify those measures the subsector can take to reduce risks of noncompliance.¹⁵ ICPGs are expected to be published starting in 2024 and be updated periodically thereafter.¹⁶ The first two ICPGs are anticipated to address nursing facilities and Medicare Advantage.¹⁷

Remaining consistent with previous approaches, the OIG reminded users that the GCPG is not binding on any entity or individual, and that the GCPG is voluntary guidance – not a directive – that discusses risks surrounding compliance and effective infrastructure for compliance programs.¹⁸ Nevertheless, the OIG explicitly recommended that healthcare entities incorporate patient safety and quality oversight into their compliance programs.¹⁹ The OIG specifically noted the interaction between quality concerns and False Claims Act compliance, stating that “besides patient harm, quality and patient safety concerns, such as excessive services and medically unnecessary services, can lead to overpayments and may cause False Claims Act liability.”²⁰ The OIG also specifically discussed financial arrangements in the healthcare industry, emphasizing that understanding how funds move within a business arrangement can be essential in identifying potential compliance issues.²¹ The OIG specifically called out private equity, stating that “the growing prominence of private equity and other forms of private investment in health care raises concerns about the impact of ownership incentives (e.g., return on investment) on the delivery of high quality, efficient health care.”²² The OIG recommends that healthcare entities “scrutinize their operations and incentive structures to ensure compliance with the Federal fraud and abuse laws and that they are delivering high quality, safe care for patients.”²³

The OIG also acknowledges in the GCPG that healthcare entities may manage “a significant volume of financial arrangements and transactional agreements, including those between referral sources and referral recipients,” which may implicate federal fraud and abuse laws, including the Anti-Kickback Statute and the Stark Law.²⁴ In tracking financial arrangements, the OIG stated that “entities should consider what type of centralized arrangements tracking system to establish, depending on the size of their organization, to ensure that proper supporting documentation is maintained, regular legal reviews are conducted, and fair market value assessments are performed and updated routinely as appropriate [emphasis added].”²⁵

While most of the established tenets of compliance remain the same from the previous CPG, the updated GCPG elaborates on how the government views the implementation of effective compliance.²⁶ The GCPG provides healthcare organizations with essential insight into the government’s priorities for enforcement, and signifies the increasing emphasis on compliance in the healthcare industry.²⁷