CMS has released its responses to eight frequently asked questions regarding its Self-Referral Disclosure Protocol (SRDP). The questions fall into three categories, listed below, and respond to issues that are often considered by providers contemplating voluntary disclosure of violations of the Physician Self-Referral (Stark) law. Such issues include, among other things, the proper party to a disclosure after a change of ownership, the scope of the release available to parties settling through the SRDP, and the supporting documentation required under the SRDP. Providers considering use of the SRDP to disclose an actual or potential violation of the Stark law should carefully review the SRDP itself, as well as all FAQs, to determine whether the SRDP is the appropriate path for resolving liability and, if so, to ensure the submission is complete to be accepted into the protocol.
Post-Disclosure Change of Ownership
Frequently, potential Stark violations are uncovered as a provider is reviewing its physician arrangements as part of the due diligence review prior to a potential merger or acquisition transaction. Parties often question whether the appropriate disclosing party would be the seller, who has the institutional knowledge of the conduct at issue, or the purchaser, who will be financial responsible for any issues if it accepts assignment of the Medicare provider number.
In FAQ 9088, CMS highlights that the liability of an overpayment stemming from potential noncompliance with the Stark law lies with the entity that is party to the relevant Medicare provider agreement, regardless of when the noncompliance occurred. Thus, only the current party to the provider agreement will receive the release from liability under the Stark law.1
In addition, in FAQ 9086, CMS responds to the question of whether a purchaser of a provider that previously disclosed an actual or potential violation of the Stark law under the SRDP must resolve the disclosure under the SRDP. Not surprisingly, CMS stated that, to the extent the purchaser accepts assignment of the Medicare provider agreement, the purchaser is liable for the overpayments related to the noncompliance under the Stark law as of the effective date of the change of ownership, including any noncompliance that occurred prior to the change of ownership. While participation in the SRDP is voluntary, the purchaser has two choices: (1) resolve the disclosure under the SRDP, or (2) withdraw the disclosure. If the purchaser elects to withdraw the disclosure, it must have made a determination that a violation of the Stark law did not occur, or, if a violation did occur, repay the full amount of the overpayment to Medicare. Thus, the purchaser would no longer have the benefit of any potential compromise under the SRDP. CMS notes that if the purchaser elects to continue under the SRDP, it will be required to certify to the truthfulness of the information included in the disclosure, to the best of the purchaser’s knowledge, and certify that the submission is a good faith effort to resolve liability. In addition, the purchaser must acknowledge that it took assignment of the relevant Medicare provider agreement and agree to substitute itself as the disclosing party under the SRDP.
Coordination with OIG/DOJ
FAQ 9090 responds to the question of whether a disclosing party must inform CMS of a contemporaneous disclosure to the Department of Health and Human Services’ Office of the Inspector General (OIG) of arrangements related to, or involving the same parties as, the SRDP disclosure. As discussed in the SRDP itself, CMS highlights that parties should not use the SRDP to disclose conduct that potentially violates both the Stark law and the antikickback statute, as such conduct should be disclosed only under the OIG’s Provider Self-Disclosure Protocol (SDP). CMS states, however, that disclosing parties must inform CMS of any contemporaneous disclosure under the OIG’s SDP that is related to, or involves the same parties as, the SRDP disclosure, as part of the SRDP requirement that the disclosing party identify whether it has any prior criminal, civil, or regulatory enforcement actions against it.2 In addition, to the extent that a party has a corporate integrity agreement (CIA) or certification of compliance agreement (CCA) with the OIG, the disclosing party should comply with any reporting obligations under the CIA or CCA, and also disclose this information in its submission to CMS under the SRDP. CMS clarifies in FAQ 9094 that to the extent the disclosing parties notify CMS of a disclosure of related conduct under the OIG’s SDP, including violations that involve the same parties but different arrangements covering the same time period, CMS will coordinate with the OIG to appropriately resolve the disclosed conduct.
Notably, CMS underscores in FAQ 9100 that any release it issues under the SRDP is limited to administrative liabilities and claims under section 1877(g)(1) of the Social Security Act3, which is the provision imposing a denial of payment for designated health services provided in violation of the Stark law. CMS states that settlements under the SRDP do not include a release of liability under the federal antikickback statute or False Claims Act, which are authorities belonging to the OIG and Department of Justice. Moreover, CMS states that it cannot issue a release from potential civil monetary penalties or exclusion for the knowing submission of claims for which payment is not permitted under the Stark law, or for circumvention schemes, as set forth in 42 U.S.C. § 1395nn(g)(3)-(4). CMS states that enforcement of the CMP and exclusion authorities lies with the OIG, which is not a signatory to the SRDP settlement. CMS advises that parties seeking a release of liability under other authorities should contact the appropriate law enforcement agency.
Format of Submission & Supporting Documentation
FAQ 9096 responds to the question of whether CMS has a preferred format for the initial submission to the SRDP. CMS states that there is no preferred format; however, electronic submissions must be in a readable format such as Microsoft Word, Microsoft Excel or PDF. Under the protocol, the disclosure must be submitted electronically by email to 1877SRDP@cms.hhs.gov. In addition, the original and one copy must be mailed to CMS headquarters. CMS states that it does not intend to provide examples or redacted copies of submissions to the public at this time.
In addition, in FAQ 9098, CMS responds to the question of how much information the disclosing party must include in its initial submission and whether CMS requires the submission of compliance program documents, valuation opinions and other supporting documents. CMS states that a disclosing party should include as much information as necessary to show the severity and extent of the actual or potential violation, and how such violations have been corrected. In addition, the disclosing party may provide other information that it believes CMS should be aware of for settlement purposes, including pending sale, financial hardship and rural provider status. CMS encourages a provider to include a brief explanation of its compliance program, institutional history, mission and compensation determinations that it believes CMS should be aware of and consider in determining the appropriate reduction of the total amount due and owing to Medicare, if any. However, CMS encourages parties to be brief in their explanations and include relevant supporting documents. To the extent a disclosing party submits complex financial or other information; it should include sufficient explanation of the relevance. CMS does not require submission of compliance program documentation or valuation opinions, but reserves the right to request additional documentation if necessary for its review.
Lastly, in FAQs 9098 and 9092, CMS states that disclosing parties should provide CMS with copies of contracts, formal documentation and any other information sufficient to demonstrate that the disclosed noncompliant arrangement was terminated or otherwise brought into compliance with the Stark law.
In sum, the FAQs provide some insight into issues that have arisen under the SRDP since its inception in 2010. Providers that discover potential violations of the Stark law and/or related authorities should carefully consider whether the SRDP is the appropriate avenue for redemption of any potential noncompliance, taking into account the scope of conduct and potential release. Review of the SRDP itself and associated FAQs is essential for ensuring that the provider submits a complete and accurate self-disclosure that strikes the right balance of providing a thorough explanation of the conduct, while presenting the issues in a concise manner for CMS.
1 42 U.S.C. § 1395nn(g)(1).
2 See Section IV.B.1.e of the SRDP.
3 42 U.S.C. § 1395nn(g)(1).