Written and maintained by CASRAI Editorial Board
Last updated
Healthcare compliance officers, academic medical center revenue-integrity directors, and sponsored research administrators monitoring the Office of Inspector General Work Plan use the federal enforcement roadmap to structure internal billing audits, clinical trial coverage analysis, and grant-accounting controls. Published and updated monthly by the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG), the Work Plan details active and planned audits, evaluations, and investigative priorities across Medicare Parts A, B, C, and D, Medicaid, National Institutes of Health (NIH) extramural research awards, and Food and Drug Administration (FDA) oversight programs.
What Is the Office of Inspector General Work Plan and How Is It Used in Healthcare and Clinical Research?
Established under the Inspector General Act of 1978 (5 U.S.C. App.), HHS-OIG is the independent oversight division charged with protecting the integrity of more than 100 HHS programs. Historically released as an annual publication and now maintained as a dynamic, monthly-updated online registry at oig.hhs.gov, the Office of Inspector General Work Plan categorizes active oversight projects performed by the Office of Audit Services (OAS) and the Office of Evaluation and Inspections (OEI).
In hospital operations and clinical research administration, compliance teams operationalize the OIG Work Plan across four recurring audit tracks:
- Professional Fee and Facility Billing Audits: Reviewing high-scrutiny CPT/HCPCS codes flagged on the Work Plan—such as critical care evaluation and management (E/M) upcoding, remote patient monitoring (RPM) utilization, telehealth modifier compliance, and two-midnight inpatient admission determinations.
- Clinical Trial Qualifying Coverage Analysis (QCA): Auditing research billing workflows to prevent “double billing” (billing Medicare under Medicare Clinical Trial Policy NCD 310.1 for items or services already paid for by an industry sponsor or NIH grant) and verifying proper issuance of an Advance Beneficiary Notice (ABN) in clinical trial billing.
- NIH and HHS Extramural Grant Stewardship: Auditing institutional time-and-effort reporting (2 CFR § 200.430), subrecipient monitoring, facilities and administrative (F&A) indirect cost rates, and foreign subaward disclosures—an area of sustained OIG Work Plan audit activity at research universities.
- Health IT, EHR Incentive, and Cybersecurity Reviews: Assessing compliance with ONC information-blocking prohibitions, HIPAA Security Rule risk analyses, and EHR vendor remuneration arrangements.
The False Claims Act in Healthcare (31 U.S.C. §§ 3729–3733)
When an OIG audit or internal compliance review uncovers systemic improper billing or grant cost-charging, primary civil enforcement exposure arises under the federal False Claims Act (FCA, 31 U.S.C. §§ 3729–3733). In false claims act healthcare enforcement, liability attaches to any person or institution that knowingly presents, or causes to be presented, a false or fraudulent claim for payment or approval to a federal healthcare program or federal grant agency.
- The “Knowing” (Scienter) Standard (31 U.S.C. § 3729(b)(1)): The FCA does not require proof of specific intent to defraud. “Knowing” and “knowingly” encompass three mental states: (1) actual knowledge of the information, (2) acting in deliberate ignorance of the truth or falsity of the information, or (3) acting in reckless disregard of the truth or falsity of the information.
- Treble Damages and Per-Claim Statutory Penalties: Violators are liable for three times the government’s actual damages (treble damages) plus mandatory civil penalties assessed per individual claim (adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act, where each separately billed CPT line item or grant draw-down voucher can constitute a separate claim).
- Qui Tam Whistleblower Actions (31 U.S.C. § 3730(b)): Private individuals (“relators”—frequently compliance personnel, billing coders, research coordinators, or physicians) may file suit under seal on behalf of the United States and receive between 15% and 30% of the recovered proceeds.
Stark Law vs. Anti-Kickback Statute: Statutory Comparison
Because claims tainted by illegal physician referrals or unlawful financial inducements automatically constitute false claims under the FCA, healthcare compliance officers must distinguish between the Physician Self-Referral Law (Stark Law) and the federal Anti-Kickback Statute in healthcare:
| Statutory Dimension | Stark Law (Physician Self-Referral Law) | Anti-Kickback Statute (AKS) |
|---|---|---|
| Statutory & Regulatory Citation | 42 U.S.C. § 1395nn; 42 CFR Part 411, Subpart J | 42 U.S.C. § 1320a-7b(b); safe harbors at 42 CFR § 1001.952 |
| Core Prohibition | Prohibits a physician from referring Medicare or Medicaid patients for Designated Health Services (DHS) to an entity with which the physician (or an immediate family member) has a financial relationship, unless an exception is fully satisfied. | Prohibits anyone from knowingly and willfully offering, paying, soliciting, or receiving any remuneration (in cash or in kind) to induce or reward referrals or generate business payable by any federal healthcare program. |
| Nature of Liability | Civil strict-liability statute (no criminal penalties; intent is irrelevant to a primary violation). | Criminal, civil, and administrative statute (felony conviction carries fines, imprisonment, and mandatory program exclusion; see Anti-Kickback Statute penalties). |
| Intent (Scienter) Requirement | None. Failing even one technical element of a required Stark exception (such as a missing signature or expired agreement) triggers strict liability. | Requires proof of “knowing and willful” conduct. Under the Affordable Care Act amendment (42 U.S.C. § 1320a-7b(h)), a person need not have actual knowledge of the AKS or specific intent to commit a violation. |
| Covered Parties & Services | Applies only to physicians (and immediate family members) and 11 statutory categories of Designated Health Services (DHS) payable by Medicare/Medicaid (e.g., clinical lab, PT/OT, radiology, DMEPOS, inpatient/outpatient hospital services). | Applies to any person or entity (physicians, hospitals, device/pharma sponsors, CROs, lay marketers) and all items or services payable by any federal healthcare program. |
| Exceptions vs. Safe Harbors | Mandatory Exceptions: An arrangement involving a physician financial relationship and DHS referral must fit squarely within a statutory or regulatory exception (e.g., bona fide employment, personal services, fair market value). | Voluntary Safe Harbors: Fitting within a safe harbor guarantees immunity, but failure to meet every element of a safe harbor does not make an arrangement per se illegal; instead, OIG evaluates the totality of facts and intent. |
Civil Monetary Penalties Law (42 U.S.C. § 1320a-7a) and the 60-Day Overpayment Rule (42 CFR § 401.305)
Two additional administrative enforcement statutes bridge internal audit findings and mandatory government reporting:
1. The Civil Monetary Penalties Law (CMPL, 42 U.S.C. § 1320a-7a)
The Civil Monetary Penalties Law authorizes HHS-OIG to impose administrative monetary assessments, treble damages, and exclusion from federal healthcare programs without requiring Department of Justice litigation in federal district court. Specific CMPL violations relevant to healthcare and clinical research institutions include:
- Presenting claims for services provided by an unlicensed physician or an individual listed on the OIG List of Excluded Individuals and Entities (LEIE).
- Offering remuneration to a Medicare or Medicaid beneficiary that the offeror knows or should know is likely to influence the beneficiary to select a particular provider, practitioner, or supplier (the Beneficiary Inducements CMP, 42 U.S.C. § 1320a-7a(a)(5)), requiring careful structuring of clinical trial participant stipends and transportation reimbursements.
- Making false statements, omissions, or misrepresentations of material fact in any application, bid, or contract to participate or enroll as a provider, supplier, or HHS grant recipient.
2. The Medicare 60-Day Overpayment Rule (42 U.S.C. § 1320a-7k(d); 42 CFR § 401.305)
Enacted by Section 6402(a) of the Affordable Care Act (42 U.S.C. § 1320a-7k(d)) and implemented by CMS at 42 CFR § 401.305, the 60-day overpayment rule Medicare requires any provider or supplier that has received an overpayment to report and return the overpayment to the appropriate Medicare Administrative Contractor (MAC)—along with a written reason for the overpayment—by the later of:
- 60 calendar days after the date on which the overpayment was identified; or
- The date any corresponding cost report is due, if applicable.
Under 42 CFR § 401.305(f), an institutional audit lookback period of 6 years from the date the overpayment was received applies when quantifying overpayments. Retaining an identified overpayment beyond the 60-day deadline converts the unreturned funds into an “obligation” to pay the government, triggering reverse False Claims Act liability under 31 U.S.C. § 3729(a)(1)(G) as well as CMPL penalties. When an internal audit reveals that an overpayment stems from potential Anti-Kickback Statute or Stark Law violations rather than routine coding error, institutions resolve the disclosure through the OIG Health Care Fraud Self-Disclosure Protocol (SDP) or the CMS Voluntary Self-Referral Disclosure Protocol (SRDP), which tolls the 60-day return deadline upon formal submission acceptance.
