David W. Ogden (david.ogden@wilmerhale.com) is Partner, Chair, Government and Regulatory Litigation, and Ericka Aiken (ericka.aiken@wilmerhale.com) is Counsel in the Washington, DC, office of Wilmer Cutler Pickering Hale and Dorr LLP. Shannon N. Sumner (ssumner@pyapc.com) is Principal and Chief Compliance Officer at PYA, PC, in Brentwood, TN.
As recent developments in corporate enforcement indicate, the United States Department of Justice (DOJ) continues to emphasize transparency, cooperation, and the importance of a strong compliance program. Enforcement trends indicate a continued focus on fraud in the healthcare industry. In fact, of the $3 billion in False Claims Act (FCA) recoveries in the 2019 fiscal year, $2.6 billion related to matters involving healthcare.[1] (DOJ’s strong emphasis on healthcare fraud is not unique to the current administration. Healthcare fraud was also a central focus of the Obama administration. For example, in 2009, a joint DOJ and Department of Health & Human Services task force known as the Health Care Fraud Prevention and Enforcement Action Team was created.) Further, the COVID-19 stimulus programs have paved the way for new types of healthcare fraud. This article explores recent governmental enforcement activity, including recent guidance documents, pronouncements, and memoranda. It discusses a powerful enforcement tool used by the DOJ in corporate enforcement—independent compliance monitors. Lastly, this article explores the evolution of corporate integrity agreements (CIAs), which provide a perspective on the Department of Health & Human Services Office of Inspector General’s priorities for healthcare compliance program structure and content.
Government perspectives on corporate compliance
Corporate compliance can play a significant role in the DOJ’s resolution of corporate investigations. This article focuses on several recent DOJ guidance documents that provide companies with increased transparency in corporate enforcement actions. DOJ’s guidance on cooperation credit in FCA investigations explains how the DOJ determines financial penalties and settlements in FCA actions, particularly where a company voluntarily discloses misconduct to DOJ. Another guidance document examines how a prosecutor can evaluate claims that a corporation is unable to pay a proposed fine or monetary penalty. A third describes the attributes of an effective compliance program, and a fourth details the circumstances in which, as a part of a resolution, DOJ may require a corporate monitor. These policies should serve as guideposts for companies to gauge the DOJ’s expectations on compliance, analyze strategic decisions, and conform their conduct to appropriate standards.[2]
Cooperation credit
The past year has witnessed several notable developments in corporate enforcement. For example, in May 2019, the DOJ released long-awaited guidance concerning cooperation credit in FCA investigations.[3] (The FCA is an important statute that protects the US government against fraud. It imposes liability on any person who knowingly submits a false claim seeking government funds. Both the DOJ and private citizens, known as “relators,” are allowed to bring actions on behalf of the United States asserting FCA violations.) The guidance identified factors the DOJ will consider when determining financial penalties and settlement amounts in corporate resolutions. Specifically, the guidance defines three types of conduct the DOJ will recognize as cooperation: (1) voluntary self-disclosure, (2) other forms of cooperation, and (3) remediation.
Voluntary disclosure
DOJ has referred to voluntary self-disclosure as “the most valuable form of cooperation.”[4] In simplest terms, voluntary self-disclosure is approaching the government to report a potential violation. The disclosure must be both proactive and timely.[5] A company may receive credit for voluntary disclosure, even if the government has already initiated an investigation, if the company apprises the DOJ of other misconduct outside the scope of the government’s existing investigation that is unknown to the DOJ.[6]
Other forms of cooperation
The new guidance includes a nonexhaustive list that includes 10 examples of cooperation that could “meaningfully assist” DOJ in its FCA investigation.[7] These actions include:
-
“Identifying all individuals substantially involved in or responsible for the misconduct”;
-
“Preserving … and disclosing relevant documents and information … beyond existing business practices or legal requirements”;
-
“Making available for meetings, interviews, examinations, or depositions … officers and employees who possess relevant information”;
-
“Disclosing facts relevant to the government’s investigation gathered during the entity’s independent investigation” (i.e., attributing facts to specific sources and providing updates on any internal investigation); and
-
“Providing facts relevant to potential misconduct” by third parties.
Remediation
Under the new guidance, the DOJ will also consider whether appropriate remedial actions have occurred. Such measures include:
-
Undertaking “a thorough analysis of the cause of the underlying conduct” and remediating the root cause;
-
“Implementing or improving an effective compliance program” to prevent future misconduct;
-
Appropriately disciplining or replacing the individuals directly involved in the misconduct, including “those with supervisory authority over the area where the misconduct occurred”; and
-
“Any additional steps demonstrating recognition of the seriousness of the entity’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct.”
Historically, FCA settlements rarely included a formal cooperation credit component. Accordingly, this guidance signifies a shift in the DOJ’s approach, perhaps signaling the DOJ’s desire to incentivize increased cooperation—even in civil cases.
Inability to pay
In October 2019, the then-Assistant Attorney General for the DOJ Brian A. Benczkowski announced new guidance on how to evaluate a company’s claim that it is unable to pay a criminal fine or monetary penalty as part of its corporate misconduct settlement.[8] Benczkowski’s corresponding guidance memo includes an 11-prong questionnaire that companies may use to assess financial hardship. These questions focus on the company’s current assets, liabilities, cash flows, financial statements, and tax returns. In determining whether to reduce a penalty amount, the DOJ may recommend an adjustment “only to the extent necessary to avoid (1) threatening the continued viability of the organization, and/or (2) impairing the organization’s ability to make restitution to victims.” While enforcing the FCA reportedly remains a “top priority” for the DOJ,[9] it has taken the stance that, in some instances, corporate defendants may require a reduction in fines and penalties based on an inability to pay.[10]
Evaluating corporate compliance programs
Most recently, in June 2020, Benczkowski announced changes to the DOJ’s guidance on Evaluation of Corporate Compliance Programs (2020 guidance).[11] The 2020 guidance serves as an update to two prior versions of this document originally issued in February 2017 and updated in April 2019. The 2020 guidance, like the 2019 update that preceded it, is focused on three fundamental questions prosecutors should ask when evaluating a compliance program:
-
“‘Is the corporation’s compliance program well designed?’” The DOJ’s guidance under this section discusses hallmarks of a well-designed compliance program with respect to risk assessment, company policies and procedures, training and communications, confidential reporting structures, and investigation processes.
-
“‘Is the program being applied earnestly and in good faith?’” The April 2019 update previously directed prosecutors to assess whether a company’s compliance program was “being implemented effectively.” The June 2020 guidance reframes the inquiry here, encouraging prosecutors to focus instead on whether the program is “adequately resourced and empowered to function effectively.”
-
“‘Does the corporation’s compliance program work’ in practice?” Under this prong, the guidance provides prosecutors with guideposts for assessing whether a compliance program is operating effectively, including evaluation of a program’s capacity for continuous improvement through periodic testing and review.
The 2020 guidance reinforces that there is no one-size-fits-all compliance program and signals that flexibility is a hallmark of a strong compliance program. In other words, the compliance program must be able to evolve and respond to changes in the company, the business or industry, and the company’s geographic footprint.[12] The 2020 guidance also places greater emphasis on a particularly high-risk and challenging aspect of compliance programs—third-party risk management.[13] Third-party risk management is particularly challenging for companies with a global footprint. The more a company expands, the harder it is to maintain adequate oversight and controls over local employees in remote areas; maintaining adequate oversight of the plethora of third-parties local employees engage adds another layer of complexity. The 2020 guidance focuses on whether companies engage in risk management through the lifespan of the relationship with third parties and not solely on onboarding. The guidance also identifies the critical need for companies to have access to data resources to ensure timely and effective monitoring and testing of the compliance program.[14]
Further, the 2020 guidance encourages prosecutors to focus on the why as much as the what. In other words, rather than merely assessing a company’s compliance program in the abstract, prosecutors are encouraged to assess “why the company has chosen to set up the compliance program the way that it has, and why and how the company’s compliance program has evolved over time” (emphasis added).[15] Similarly, the 2020 guidance emphasizes the importance of assessing the “lessons learned” from the misconduct. It instructs prosecutors to investigate whether a company has processes in place to track and incorporate risk assessment lessons learned—not only lessons from the company’s own prior issues but also from those of other companies operating in the same industry or geographic location.[16]
Implications for DOJ’s current enforcement priorities
In a speech before the U.S. Chamber of Commerce in June 2020, Ethan Davis, then-principal deputy assistant attorney general for the DOJ’s Civil Division, described how DOJ is using the FCA to respond to corporate enforcement during a pandemic, noting that the DOJ continues to focus on a number of prior and new priorities.[17] Davis stated that the DOJ “will deploy the [FCA] against those who commit fraud related to the various COVID-19 stimulus programs,” such as the Paycheck Protection Program and the Main Street credit facility. At the same time, he stated that the DOJ will be “careful not to discourage businesses, health care providers, and other companies from accessing in good faith the important resources that Congress made available in the CARES Act.” Similarly, the DOJ reportedly will not pursue companies that make “immaterial or inadvertent technical mistakes” in the paperwork process, or that just simply misunderstood the rules, terms and conditions, or certification requirements. Davis expressed that the DOJ will continue to pursue other types of healthcare-related fraud, such as fraud resulting from the opioid crisis, electronic health records, and Medicare Part C. Companies should expect that the DOJ’s published guidance, enforcement trends, and recent pronouncements will guide how it responds to companies suspected of committing misconduct.
Monitorships: A key element of corporate enforcement
During the past decade, government enforcement authorities have increasingly relied on corporate monitors to promote compliance. Prosecutors examining a company’s compliance program often assess whether a company has complied with the terms of a corporate criminal resolution (i.e., deferred prosecution agreement, nonprosecution agreement, or plea agreement) with the goal of preventing the recurrence of future misconduct. This section addresses the DOJ’s recent guidance on corporate monitors and the life cycle of a monitorship—how monitors are selected, the investigation and reporting process, and the final certification. This section also highlights DOJ’s efforts at greater transparency and accountability in the monitorship process.
Spotlight on monitors
Corporate monitors have been a resourceful tool for the DOJ for many years. In October 2018, Benczkowski announced a new guidance memorandum regarding monitorship selection: “Selection of Monitors in Criminal Division Matters” (2018 monitor memorandum).[18]
The 2018 monitor memorandum expands on and supersedes the March 2008 Morford memorandum by then-Acting Deputy Attorney General Craig S. Morford, “Selection and Use of Monitors in Deferred Prosecution Agreements and Non-Prosecution Agreements with Corporations” (Morford memorandum).[19] The Morford memorandum identified priorities for selecting corporate monitors and provided for supervisory review within the DOJ, but it did not address when a monitor should be appointed. It instead advised that “prosecutors should be mindful of both: (1) the potential benefits that employing a monitor may have for the corporation and the public, and (2) the cost of a monitor and its impact on the operations of a corporation.” The 2018 monitor memorandum noted that the Morford memorandum’s two broad considerations should guide prosecutors when assessing the need for a monitor.[20]
The 2018 monitor memorandum elaborated on the first consideration by adding the following four factors for consideration:
-
“Whether the underlying misconduct involved the manipulation of corporate books and records or the exploitation of an inadequate compliance program or internal control systems”;
-
“Whether the misconduct at issue was pervasive across the business organization or approved or facilitated by senior management”;
-
“Whether the corporation has made significant investments in, and improvements to, its corporate compliance program and internal control systems”; and
-
“Whether remedial improvements to the compliance program and internal controls have been tested to demonstrate that they would prevent or detect similar misconduct in the future.”
When weighing the potential costs of a monitor as identified in the second prong, the DOJ will consider the projected monetary costs to the company and whether the proposed scope of the monitor’s role is appropriately tailored to avoid unnecessary burdens on the company.
The life cycle of a monitorship
A monitorship proceeds in four key phases:
-
Selection of a monitor,
-
Observations and assessments,
-
Findings and reporting, and
-
Certification.
First, the process for selecting a monitor is multifaceted and involves the company proposing multiple qualified monitor candidates to the DOJ. The fairly new Standing Committee on the Selection of Monitors is an integral part of the monitor selection process. Formed in late 2018, this committee reviews all recommended monitor candidates.
Second, a monitorship involves intense observations and detailed assessments. Essentially, the monitor must engage in an extensive internal review of a company. The monitor’s responsibilities usually include conducting document reviews, interviewing witnesses, reviewing company policies and procedures, analyzing internal compliance controls and systems, sampling and testing data within key business functions, and establishing and overseeing remediation plans.[21]
A third element of a monitor’s responsibilities is drafting a series of interim reports and a final report the government will use to determine whether the monitorship was effective. These reports usually address a number of issues, including the state of the company at the start of the monitorship; the methodology the monitor used to review the company’s compliance program; an assessment of underlying compliance concerns and potential violations, including long-term issues that require remediation at the close of the monitorship; and an assessment of the aspects of the compliance program that were implemented effectively and work in practice.
Finally, as part of each monitorship, the monitor has one final and critically important task—certifying whether a company has successfully mitigated the risks that required the monitor’s appointment in the first place. In making a certification decision, a monitor will consider a number of issues, including “the company’s plans for the future, whether it has a strong compliance ‘tone at the top’, whether its remediation measures are well designed, sustainable and effective, and how fully the company has addressed the monitor’s concerns.”[22]
A monitorship is a resource-intensive task that often requires a large team to complete the compliance review. Attorneys, auditors, consultants, and subject matter experts are often engaged in the monitor selection process, and attorneys and a company’s internal legal and compliance personnel often remain engaged throughout the life cycle of the monitorship. Monitorships can place a significant strain on a company’s resources that would normally be used to run the business. Monitors often employ forensic firms and other third parties to provide additional expertise and resources to alleviate pressures on the business.
Transparency and accountability in the monitorship program
In April 2020, the DOJ published a list of all corporate monitors retained on behalf of companies actively engaged in criminal resolutions with the DOJ.[23] The list includes the name of the monitor, the monitored company, the year appointed, and the relevant DOJ unit involved with the resolution. The DOJ Fraud Section’s decision to publish this list aligns with the DOJ’s goal of increased transparency, and it signals that the use of corporate monitorships is a mainstay of the DOJ’s corporate enforcement practices.
Lessons learned from CIAs
CIAs between the government and a healthcare provider/entity are typically entered into as a result of a civil settlement agreement; however, the decision to enter into a CIA is based solely on the discretion of the Office of Inspector General. While not every settlement will result in a CIA, entities should review existing CIAs for insight not only into the government’s current enforcement efforts, but also as a means to implement a best practice compliance program. As noted above, the DOJ’s most recent update to their Evaluation of Corporate Compliance Programs illustrates a key question that prosecutors should ask: “Does the company have a process for tracking and incorporating into its periodic risk assessment lessons learned either from the company’s own prior issues or from those of other companies operating in the same industry and/or geographical region?”[24]
Healthcare entities should take notice of the types of providers that are subject to CIAs and review the CIAs for opportunities to strengthen their existing compliance programs. Historically, while the early CIAs were entered into mainly by hospitals and health systems, the types of providers continue to expand to include physician practices, long-term care facilities, life science companies, pharmaceutical companies, and rehab and therapy providers, such as wound care..
Leading practice compliance program elements, as illustrated in CIA requirements, include board and management certifications that attest to appropriate board oversight of the compliance officer and compliance committee and affirmation that risk-based training has occurred for high-risk processes such as billing, coding, and even physician recruiting. Entities should assess whether their existing training programs are robust enough in high-risk areas and whether their employees would be able to complete similar certifications if called upon to do so.
Recent trends in settlement agreements have also included clawbacks and financial recoupment for annual performance or incentive programs. Notable CIAs with executive financial recoupment programs include the DaVita HealthCare Partners[25] and GlaxoSmithKline[26] ones. Additionally, entities have used compliance modifiers in the annual performance evaluations of all employees, including employed providers. For example, an employee, department, or business unit can either receive additional compensation for activities that demonstrate sound compliance principles or may be subject to reductions in compensation for compliance violations. Some health systems have also reevaluated their strategic plans and related performance metrics to include compliance goals and objectives further demonstrating a culture of compliance.
CIAs also provide a great road map for a compliance program’s compliance work plan. Independent review organizations (IROs) are required under the CIA to audit the organization’s compliance with specific terms of the agreement.[27] The scope of an IRO’s work varies depending on the nature of the enforcement action. IRO activities may include the auditing and monitoring of referral source relationships, quality of care, marketing and sales activities, drug-restocking practices, research and grant funding, real estate, and inpatient medical necessity. Compliance departments should review the scope and coverage of the IRO’s audit steps, outlined in the various CIAs, to conduct “mock audits” (using the audit criteria noted in the CIAs) as applicable.
Conclusion
DOJ continues its trend of providing companies and the broader legal community with guidance regarding key governmental enforcement activity. This guidance, including the DOJ’s commentary on cooperation credit, effective compliance programs, and the use of monitorships, will help companies ensure that they appropriately detect and respond to risks of misconduct. Ideally, effective compliance programs will afford a strong defense against any governmental inquiry or enforcement actions. Becoming and remaining familiar with both the government’s perspective and response to these areas, as well as areas the government may add in future CIAs, will also allow entities to develop robust compliance programs that effectively provide proper risk assessment, prevention, and mitigation.
This article would not have been possible without the excellent work of Cadene Russell Brooks, a senior associate at WilmerHale. The authors are very grateful for her efforts.
Takeaways
-
Good compliance programs remain a steadfast consideration in the U.S. Department of Justice’s resolutions. Healthcare entities should conduct an internal review to address issues before it comes knocking.
-
Self-reporting remains important, so much so that the Department of Justice expanded the concept from the Foreign Corrupt Practices Act/criminal context to civil False Claims Act resolutions.
-
Corporate integrity agreements offer excellent insights into the content of best-practice compliance programs.
-
Independent review organizations’ audit work steps can be used to formulate a compliance work plan.
-
Detailed risk assessments and root cause analyses are integral components of a good compliance program.