Skip to Main Content

OIG Finalizes CMP Regulations, Largely as Proposed [Ober|Kaler]

On December 7, 2016, the Department of Health and Human Services, Office of Inspector General (OIG) finalized [PDF] its proposal to update the civil monetary penalty (CMP) regulations – namely, incorporate new CMP authorities authorized by the Affordable Care Act (ACA), expand liability in connection with Medicare Advantage and Part D contracting organizations, and implement certain technical and organizational changes.1

Below, we provide a high-level summary of several major provisions in this final rule. For a more detailed discussion of the provisions as they were proposed, see our Health Law Alert article, “OIG Proposes Updates to Exclusion and CMP Authority.”

Affordable Care Act Expansion – New CMP Authorities & Expanded Contractor Liability 

With this final rule, the OIG codified the following new CMP, assessment, and exclusion authorities, as authorized by the ACA: 

  • Failure to grant the OIG timely access to records, upon reasonable request;

  • Ordering or prescribing while excluded when the excluded person knows or should know that the item or service may be paid for by a federal health care program;

  • Making false statements, omissions, or misrepresentations in an enrollment or similar bid or application to participate in a federal health care program; 

  • Failure to report and return an overpayment; and 

  • Making or using a false record or statement that is material to a false or fraudulent claim. 

In addition to the above, more general CMP authorities, the ACA also created new CMPs specifically targeted at Medicare Advantage (MA) and Part D contracting organizations, covering prohibited conduct such as enrolling an individual or transferring an enrollee from one plan to another without his or her prior consent, transferring an enrollee solely for the purpose of earning a commission, or failure to comply with certain marketing restrictions. 

The ACA further expanded the potential liability of MA and Part D organizations, as it applies to their contractors. MA and Medicare Part D contracting organizations currently face liability for the actions of their employees or agents; the ACA broadens such liability to further include the actions of MA and Part D organizations’ contracting providers and suppliers who may not otherwise qualify as agents. 

Application of the CMP Authority – Federal Health Care Programs

A commenter to the proposed rule asked of the OIG whether its CMP assessment and exclusion authority (as set forth in 42 C.F.R. § 1003, et seq.) applied to Qualified Health Plan (QHP) Issuers or state-based or federally facilitated exchanges (i.e., whether the OIG viewed such plans as “federal health care programs”). 

While the OIG declined to expressly respond, either in the affirmative or negative, the OIG referred readers to the October 30, 2013 letter from the HHS Secretary to Representative Jim McDermott. In it, the Secretary stated that she “does not consider QHPs [or] other programs related to the Federally-facilitated Marketplace . . . to be federal health care programs.” Such a response suggests that, and provided the Secretary’s interpretation remains unchanged, the OIG would likewise take a similar approach, and exclude QHPs and other state-based or federally facilitated exchanges from the definition of federal health care program.


In the final rule, the OIG revised several CMP-related definitions. Many of such changes were technical in nature, e.g., the OIG revised the definition of claim from “an application for payment for an item or service to a Federal health care program” to “an application for payment for an item or service under a Federal health care program” in order to clarify that a claim includes not only applications for payment directly to a federal health care program, but also applications for payment to federal health care contractors. 

In addition, the OIG finalized its proposal to create two new definitions: separately billable item or service (e.g., a physician office visit) and non-separately billable item or service (e.g., care covered by a skilled nursing facility per diem payment). The new definitions feed into the OIG’s decision to utilize a new, alternate methodology when calculating penalties and assessments for those that employed or contracted with an excluded person who provided no-separately billable items or services. In such circumstances, the penalties and assessments will be based on the “total costs (including salary, benefits, taxes, and other money or items of value) related to the excluded individual or entity incurred by the person that employs, contracts with, or otherwise arranges for an excluded individual or entity to provide, furnish, order, or prescribe a non-separately billable item or service.” (With the final rule, and in response to comments, the OIG withdrew its proposed per-day penalty for non-separately billable items or services). 

The “Primary List” 

As set forth in the proposed rule, the OIG has finalized a “primary list” of the most common factors the OIG considers in establishing the amount of penalties and assessments and the period of exclusion. The list includes the following: 

  • The nature and circumstances of the violation;

  • The degree of culpability of the person;

  • The history of prior offenses;

  • Other wrongful conduct; and

  • Other matters as justice may require. 

These factors would apply to all CMP violations, except as otherwise provided for in the subpart relating to the applicable subject matter (which may provide for fewer or more factors). Notably, and with respect to the “degree and culpability of the person,” the OIG clarified that it would be a mitigating factor if the person took “appropriate and timely corrective action in response to the violation.” However, and of note, “appropriate and timely corrective action,” must include disclosing the violation to the OIG through the Self-Disclosure Protocol, or in cases of physician self-referral law violations, disclosing the violation to the Centers for Medicare and Medicaid Services (CMS) through its Self-Referral Disclosure Protocol. 

Reorganization and Technical Changes 

With the intent of making the CMP regulations “more accessible to the public and to add clarity to the regulatory scheme,” the OIG reorganized the CMP authorities into subparts by subject matter. 

In addition to reorganizing the CMP authorities, the OIG incorporated the exclusion sections in the subparts in which the exclusion is available – False Claims, Anti-kickback and Physician Self-Referral, EMTALA, and Beneficiary Inducement. The change, the OIG stated, is intended to clarify that it may “impose a penalty for each individual violation of the applicable provision.” 

The OIG made additional technical changes throughout the CMP regulations, e.g., replacing references to Medicare and state health care programs with “federal health care programs,” clarifying that a principal’s liability for the acts of its agents may result in liability for both the agent and the principal, and that in the event multiple parties have liability for separate CMP provisions, each party may be held jointly and severally liable for the assessment. 

Ober|Kaler’s Comments

While the OIG’s final regulations do not dramatically overhaul its CMP authority, the regulations nonetheless provide meaningful insight and clarifications. Furthermore, and with respect to the OIG’s determination on the amount of penalties and assessments, it is clear that the OIG is placing greater weight and value to its own self-disclosure protocol, and that of CMS. 


1 81 Fed. Reg. 88,334 (Dec. 7, 2106).

Email Disclaimer

NOTICE: The mailing of this email is not intended to create, and receipt of it does not constitute an attorney-client relationship. Anything that you send to anyone at our Firm will not be confidential or privileged unless we have agreed to represent you. If you send this email, you confirm that you have read and understand this notice.
Cancel Accept