Compliance Today - September 2021

Sanctions, exclusions, and termination

Enforced by the Office of Inspector General (OIG) at the U.S. Department of Health & Human Services^[2] or a state Medicaid program, a healthcare sanction is handed out when an individual or entity is found to be in violation of an administrative rule, civil law, or criminal offense. An exclusion is one of several possible results of an OIG sanction in a federal or state-funded healthcare program. The purpose of the OIG is to prevent and detect fraud, waste, and abuse.

Individuals or entities that are convicted of committing Medicare or Medicaid fraud, along with various other offenses related to the delivery of items or services under Medicare, Medicaid, State Children’s Health Insurance Program, or other state healthcare programs are excluded from participation in all federal healthcare programs by the OIG.

But even if an excluded individual can no longer participate in federally funded healthcare programs such as Medicare and Medicaid, they can still provide care for private practice organizations—and can continue to put patients at risk. Although organizations that do not receive federally funded healthcare dollars will not be held liable by the OIG when providers practice privately, they should still perform due diligence to ensure they are doing everything possible to protect patients. By using the exclusion database provided by the OIG, checking state Medicaid lists, and performing checks for any disciplinary actions against a potential provider, healthcare organizations can protect patients and themselves from potential negative exposure.

There are two different kinds of exclusions enforced by the OIG.^[3] Mandatory exclusions can occur if the entity or individual is convicted of patient abuse or neglect, or if they are convicted of a felony related to healthcare fraud. Permissive exclusions are imposed for incidents such as defaulting on student loans or a misdemeanor conviction related to healthcare fraud.

However, the most common kind of exclusion is a state-sanctioned revocation or suspension of a healthcare professional’s license. State Medicaid can also exclude for cause, not only for license actions. When this occurs in a single state, any excluded provider in one state should also be excluded in all states.^[4] It is important to note that reinstatement does not occur automatically at the end of a term of exclusion, however, but that an excluded party must apply for reinstatement.^[5] No national database exists to keep track of license revocations, so in some cases providers and practitioners who have had their licenses revoked in one state will “state hop” elsewhere and continue to practice.

Not all practitioners who have had their licenses suspended or revoked will be excluded by the OIG, since the OIG makes its own determination. Even if a provider is not excluded by the OIG but is excluded by state Medicaid, the healthcare organization is still at risk since providers who are excluded in one state are excluded in all states. This can lead to Department of Health & Human Services fines and penalties against the healthcare employer.

Figuring out why someone’s license was revoked or suspended isn’t always so simple, as the notes or minutes from the state licensing board responsible for the action don’t necessarily specify a reason, especially since the relinquishment could also have been voluntary. It is often necessary to dig deeper to ascertain the full picture, and even then, it may not be possible to gather all of the relevant details.

A closer look at all the relevant information requires access to a much more robust dataset than only the OIG and Systems for Award Management (SAM) exclusion lists.

Healthcare organizations can leverage a service provider to check not only these exclusions lists, but also state board actions, state abuse registries, the Centers for Medicare & Medicaid Services preclusion list (which is only available to certain organizations), and the Social Security Administration’s Death Master File. These additional datasets help provide healthcare organizations with the full picture.

The third category within the healthcare screening industry is termination, which is not, despite common misconceptions, the same thing as exclusion. According to a Centers for Medicare & Medicaid Services bulletin,^[6] “termination” occurs when the state terminates the participation of a Medicaid or Children’s Health Insurance Program provider from the program or when the Medicare program has revoked a Medicare provider’s or supplier’s billing privileges and they are ineligible to appeal the decision. This means a provider could be terminated by the state and continue working at a private healthcare organization, as long as they don’t provide services that are billable to Medicare.

Being excluded from a federal healthcare program, such as Medicare, Medicaid, Children’s Health Insurance Program, and TRICARE, is one example of a penalty imposed on providers by the OIG. Providers that are excluded by the OIG have a much harder time maintaining their practices, as there is the additional obstacle of being unable to see patients using any federal healthcare programs.

There are serious consequences unique to healthcare employers that fail to properly vet their employees: civil monetary penalties, corporate integrity agreements, and the exposure to medical malpractice lawsuits and litigation. On the financial side, healthcare organizations can not only be fined more than $10,000 in civil monetary penalties, but also treble (tripled) damages for each service rendered by an excluded individual or entity.^[7] In addition, medical malpractice liability costs the healthcare industry $55.6 billion dollars annually.^[8] Not only can high-quality healthcare screening improve the quality of a healthcare organization’s workforce, it can be used to demonstrate due diligence in the event of a lawsuit.

Healthcare organizations should also maintain a corporate compliance program, since the federal government has provided clear guidelines to that effect. This kind of program is a group of protocols laid out by an organization to ensure adherence to industry standards and a high quality of care. Similar to most industries, the healthcare industry comes with myriad regulations, standards, and laws on both the state and federal level that must be closely followed. Noncompliance can carry fines and penalties.

In 1991, the United States Sentencing Commission put into effect organizational sentencing guidelines, which, according to the deputy general counsel of the U.S. Sentencing Commission, were designed to engender both “just punishment” (a punishment that fits the crime) and “deterrence” (incentives for organizations to identify and root out crime in their workforces).^[9] While organizations can be held liable for criminal activity, the commission mitigated potential fines by as much as 95% if an organization can prove it was operating an effective compliance program—as long as offenses are reported promptly and high-level company personnel are not the offenders.

According to the OIG,^[10] the seven steps include: the implementation of written policies and procedures, the designation of a compliance officer and committee, effective employee training and education, effective communication to all employees, internal monitoring and auditing, the consistent enforcement of compliance standards, and reasonable steps to prevent similar offenses in the future.

Best practices

OIG maintains the List of Excluded Individuals/Entities (LEIE), a database of individuals and entities currently excluded from federally funded programs. Anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties and can be held liable for any bad outcomes. To avoid these issues, healthcare employers should routinely check the LEIE, along with the System for Award Management (SAM) list maintained by the General Services Administration, to ensure that new hires and current employees are in good standing.

Keeping close watch on individuals who are excluded for any reason is of utmost importance. But the most severe damage to company brand and reputation comes when well-educated and ostensibly experienced doctors, nurses, and surgeons abuse the system and their patients. This sort of abuse falls well within the bounds of exclusionary action from the OIG.

These instances of abuse—though much more rare than other kinds of exclusions—earn frequent attention from media outlets. In 2019, Arizona nurse Laura Lynn Bell was caught continuing to practice under an alias after having her license previously revoked.^[11] Bell pleaded guilty to fraud charges for using fake documents to acquire a medical license and was sentenced to three years of probation.

Without a license and with charges against her, Bell used five aliases and stolen identities of other nurses, forging documents and papers under her various aliases.^[12] This was a skill she honed while working for the U.S. Department of Veteran Affairs, when she stole the identities of nurse practitioners and former patients to bill for medical services.

The damage to an employer’s brand from a situation like this one can be significant, and it opens up the organization to penalties from the U.S. Department of Health & Human Services. Because the cost of noncompliance can be so high, healthcare organizations need to mitigate compliance risk by using technology and a comprehensive view of primary source data to prevent instances of hiring and employing excluded individuals. It is also necessary to monitor for changes at least once per month, as the LEIE database is updated on a monthly basis.^[13]

It is important, however, that healthcare employers are not blindly reliant on a simple search through the OIG database. While it remains the most comprehensive source in the industry, the database only includes the name known to the OIG at the time the individual was excluded. As a best practice, any former names used by the individual, including maiden names, previous married names, or other names, should be searched in addition to the provider’s current name.

Along the same lines, individuals with hyphenated names should be checked under each of the last names in the hyphenated name, and organizations should maintain documentation of the initial name search performed, as well as any additional searches, to ensure it is possible to validate the results of potential name matches.

After finding an individual or entity’s name in a search, healthcare employers would be well advised to take the final step of validating potential matches through a Social Security number or Employer Identification number for an entity, if available. Finding a name match is not sufficient, especially because common names will result in multiple search results, and there is always the possibility of misspelling and misidentification.

OIG recommends that healthcare employers review each job category or contractual relationship to determine whether the item or service being provided is directly or indirectly, in whole or in part, payable by a federal healthcare program. If it is, the best course of action is to screen any employee who performs under that contract or falls into that job category. Organizations should also screen, at minimum, all contractors and subcontractors, along with the owners of those organizations.

These screening practices are the best way to minimize the risk of hiring a sanctioned, excluded, or terminated employee or entity. Healthcare employers should screen any potential providers and their current roster against the LEIE, the SAM list, and the state Medicaid exclusions lists, along with screening all incoming employees for these exclusions. They should also keep track of practitioner licensure and monitor for any disciplinary actions taken against a practitioner by a state medical board.

Conclusion

When it comes to healthcare compliance, there is no such thing as an overabundance of caution. The screening and hiring processes for healthcare employees are stringent for a reason, and healthcare organizations benefit from maintaining a compliant workforce—or suffer the consequences of failing to do so. The shortage of healthcare workers will eventually ease, but until that happens—and even once it has—healthcare employers can leverage an understanding of healthcare sanctions, exclusions, and termination, along with these best practices, to keep their workforce compliant and keep patients safe.

Takeaways

• Understanding the difference between sanctions, exclusions, and termination is the key to maintaining Office of Inspector General compliance.

• Even if an excluded individual can no longer participate in federally funded healthcare programs, they can still put private practice patients at risk.

• The most common exclusion is a revoked license, but no national database exists to track licenses, so a provider could continue practicing in another state.

• Healthcare organizations can leverage a service provider to check exclusions lists, including state board actions and abuse registries, the Centers for Medicare & Medicaid Services preclusion list, and the Social Security Administration’s Death Master File.

• Following these best practices is the surest way for healthcare organizations to keep their workforces compliant, keep patients safe, and avoid monetary penalties and litigation.