With the publication of a rule finalizing financial penalties for grant fraud and related violations of U.S. law, the HHS Office of Inspector General (OIG) has a renewed weapon at the ready. Federal awardees should see this as a reminder to ensure their compliance programs are in top shape.
The final rule published in the July 3 Federal Register is a broad civil money penalty (CMP) regulation that follows OIG’s April 2020 proposed rule, as called for under the 2016 Cures Act and related provisions in the 2018 Bipartisan Budget Act (BBA).[1] It is in effect as of Aug. 2.
In addition to describing “penalties, assessments and exclusions” related to HHS-funded awards, contracts and “other agreements,” the rule addresses OIG’s fines and enforcement approach to a regulation prohibiting information blocking in health care. However, the information blocking provisions in this rule are limited to information technology vendors; HHS is still developing a separate regulation for providers.
Health care attorney Mark Barnes told RRC the new regulation confirms OIG’s penalty authority and could increase the possibility of enforcement.
“The CMP portion of this rule as applied to grants would seem to make more direct the ability of HHS OIG to extract both funding amounts and penalties on institutions that OIG believes have made false claims or have understated amounts to be reimbursed to funding agencies,” said Barnes, a partner with Ropes & Gray LLP. “These powers have been implicit, but the rule simply gives those powers a firm and explicit regulatory basis.”
With the Cures Act, OIG gained the authority to enter into settlements or assess penalties without the involvement of the Department of Justice for actions that do not violate relevant federal criminal law—specifically activities not related to fraud, bribery or gratuity violations. Prior to the act, institutions and individuals were prosecuted or entered into settlements for these violations of the False Claims Act.
Four years ago, OIG issued grant-disclosure guidance to encourage organizations to contact OIG with misconduct by themselves or by “any recipient, sub-recipient, applicant, or anyone else who may have criminal, civil, or administrative liability related to any HHS grant, contract, or other agreement.”[2] Some violations must be reported, while others are voluntary. The 2019 guidance marked the first time OIG specifically addressed grantee self-disclosures, adding to its existing formal procedure for other health care entities, such as hospitals and providers.
