Written and maintained by CASRAI Editorial Board
Last updated
Short answer
OIG compliance program guidance is voluntary, non-binding guidance from the HHS Office of Inspector General on how a health care business can build a compliance program. A medical supply business can read two documents: the General Compliance Program Guidance (GCPG, November 2023) and the older DMEPOS supplier guidance (June 1999). Both describe seven elements. Neither is law or a safe harbor.
This page is general information, not legal advice. It is for compliance leads, owners and staff at medical supply, DME and laboratory supply businesses who need to know which OIG document to start from and how the two documents line up.
Definition and scope
HHS-OIG publishes compliance program guidance (CPG) to help organizations that bill or take part in Federal health care programs prevent, detect and correct violations. In the GCPG, OIG states that the guidance is voluntary and not binding on any individual or entity, and that its use of the word “should” presents voluntary, nonbinding guidance. OIG also says its existing CPGs, the GCPG and its forthcoming industry-specific guidance (ICPGs) “do not constitute a model compliance program” and are not intended to be one-size-fits-all or all-inclusive.
OIG’s landing page lists existing CPGs for hospitals, home health agencies, clinical laboratories, third-party medical billing companies, the durable medical equipment, prosthetics, orthotics, and supply (DMEPOS) industry, hospices, Medicare Advantage organizations, nursing facilities, physicians, ambulance suppliers and pharmaceutical manufacturers. OIG also states that it will no longer publish new or updated CPGs in the Federal Register; they are available on its website, and existing CPGs will be archived but remain available.
Which OIG guidance applies to a medical supply business
Status on OIG’s compliance guidance page and in the documents themselves, checked 2026-10-31:
| Document | Date | Status on OIG’s site | How OIG describes it |
|---|---|---|---|
| General Compliance Program Guidance (GCPG) | November 2023 (listed 11-06-2023) | Current | Voluntary and nonbinding; not a model compliance program |
| Compliance Program Guidance for the DMEPOS Industry | June 1999 (64 FR 36368, 6 July 1999) | Listed among archived industry guidance | Adoption “strictly voluntary”; usable by suppliers regardless of size, locations, equipment type or corporate structure |
| Industry-specific guidance (ICPGs) currently listed | Medicare Advantage 02-03-2026; Nursing Facility 11-20-2024 | Current | No DMEPOS ICPG appears on the page |
In practice, that means the 1999 DMEPOS guide is the only OIG document written specifically for the supplier industry, while the GCPG is the newer general statement. The GCPG also addresses the laws that matter to suppliers, including the Federal Anti-Kickback Statute, the Physician Self-Referral Law, the False Claims Act, Civil Monetary Penalty authorities, exclusion authorities, the criminal health care fraud statute and the HIPAA Privacy and Security Rules.
The seven elements, 1999 versus 2023
Both documents organize a compliance program into seven elements. The names changed. The table lines up each 1999 DMEPOS element with the GCPG element that covers the same ground. The pairing is an editorial reading by CASRAI; the names are quoted from the documents.
| # | 1999 DMEPOS guide | 2023 GCPG element |
|---|---|---|
| 1 | Written standards of conduct and written policies and procedures | Written Policies and Procedures |
| 2 | Compliance officer and other bodies, such as a corporate compliance committee | Compliance Leadership and Oversight |
| 3 | Regular, effective education and training | Training and Education |
| 4 | Lines of communication, including a hotline, anonymity and protection from retaliation | Effective Lines of Communication with the Compliance Officer and Disclosure Programs |
| 5 | Audits and other risk evaluation techniques | Risk Assessment, Auditing, and Monitoring |
| 6 | Disciplinary mechanisms, including policies on employing sanctioned or excluded persons | Enforcing Standards: Consequences and Incentives |
| 7 | Response to detected offenses and corrective action | Responding to Detected Offenses and Developing Corrective Action Initiatives |
OIG’s stated belief in the GCPG is that an entity’s leadership should commit to implementing all seven elements to achieve a successful compliance program. The 1999 guide says its comprehensive programs “should include” its seven elements. Staff who already hold policies written to the 1999 headings can use the table to see where each policy sits under the 2023 names. For a research-institution view of the same seven elements, see the seven elements of an effective compliance program in research.
Anti-kickback statute and medical supplies
The GCPG describes the Federal Anti-Kickback Statute as an intent-based criminal statute that prohibits remuneration, whether monetary, in-kind or in other forms, in exchange for referrals of Federal health care program business. It adds that compliance with a safe harbor is voluntary, and that protection applies only to arrangements that squarely meet all of the safe harbor’s conditions.
The 1999 DMEPOS guide lists “Anti-Kickback and Self-Referral Concerns” among its risk areas. It says a supplier should have policies and procedures for compliance with Federal and State law, including the anti-kickback statute and the Stark physician self-referral law, and that contracts with referral sources should be reviewed by counsel. Its footnote examples of arrangements that may run afoul of the statute include paying a physician a fee for each certificate of medical necessity signed, giving free gifts to physicians for signing them, and providing items or services free or below fair market value to providers or beneficiaries. For the statute itself, see CASRAI’s Anti-Kickback Statute guide; for how fraud schemes in this sector are described, see DME fraud schemes. For billing overpayments and self-disclosure, see the OIG self-disclosure protocol for clinical research billing overpayments, and for safe-harbor context when selling to hospitals, see selling to hospitals.
Small suppliers
The 1999 guide says there is no all-inclusive definition of a small DMEPOS supplier and places small-supplier ideas at the end of its sections. The GCPG, in its section for small entities, says an entity that cannot support a compliance officer should consider designating one person as its compliance contact. That person should not supervise legal services and, whenever possible, should not be involved in billing, coding or claims submission. Where there is no board, the GCPG says to report at least quarterly to the owner or CEO.
Common misunderstandings
It is not law
OIG calls the GCPG voluntary and nonbinding, and the 1999 guide says adoption is strictly voluntary. The statutes it describes, such as the Anti-Kickback Statute, are separate and do bind.
Following it is not a safe harbor
The GCPG separates compliance programs from safe harbors: safe harbor compliance is voluntary and applies only to arrangements that meet all conditions. Nothing in the documents says that adopting the seven elements protects a particular arrangement.
It is not a model program
OIG says its guidance does not constitute a model compliance program and is not meant to be one-size-fits-all. A program has to be adapted to the entity.
Archived does not mean removed
OIG states that existing CPGs will be archived but still available on its website. On the compliance guidance page, the 1999 DMEPOS guide is listed in the CPG archive.
FAQ
What is OIG compliance guidance for DME suppliers?
It is the HHS-OIG Compliance Program Guidance for the DMEPOS industry, published June 1999 (64 FR 36368), plus the general guidance OIG issued in November 2023. Both are voluntary.
Is a medical supply compliance program mandatory?
The OIG documents themselves are voluntary. Whether another rule, contract or payer requires a program is outside what these documents state, so check with counsel.
Does the GCPG replace the 1999 DMEPOS guide?
OIG says existing CPGs stay available on its website as archived documents. The GCPG’s own text does not say it replaces them.
What does OIG say about the anti-kickback statute and medical supplies?
The 1999 guide tells suppliers to have anti-kickback policies and to have referral-source contracts reviewed by counsel, and names per-certificate fees, gifts and below-fair-market-value items as examples that may violate the statute.
Sources
- HHS-OIG, General Compliance Program Guidance (November 2023), checked 2026-10-31.
- HHS-OIG, Compliance Guidance landing page, checked 2026-10-31.
- HHS-OIG, Compliance Program Guidance for the Durable Medical Equipment, Prosthetics, Orthotics and Supply Industry, 64 FR 36368 (6 July 1999), checked 2026-10-31.
