Internal Investigations: A Challenge for In-House Council
To effectively evaluate allegations of wrongdoing that may be generated by external or internal sources, health care providers and their vendors often will need to conduct internal investigations. In-house legal counsel often may be ill equipped and ill-prepared to conduct such an internal investigation. However, with some forethought and planning, health care providers and vendors can develop the team needed to conduct an effective internal investigation.
This Executive Summary discusses: (1) the limitations many in-house legal counsel must deal with when faced with the need to conduct an internal investigation; (2) the motivations for conducting an internal investigation; (3) the goals and expectations of providers and vendors conducting such investigations; and (4) the parties who should be involved in conducting an internal investigation, including the role of outside legal counsel and how to plan such an investigation. Because every internal investigation is unique, no "one size fits all" investigation plan exists. However, this Executive Summary attempts to provide general guidance applicable to most, if not all, situations in which an internal investigation may be appropriate.
On a day-to-day basis, the role of the in-house counsel is challenging. In a small organization, such as a physician-owned group practice or an accountable care organization, the "legal department" may consist of one or two attorneys, a secretary and, perhaps, a paralegal. Despite limited resources, in-house counsel frequently must fill numerous roles.
In many of these organizations, the in-house counsel's responsibilities include not only legal services but also operational duties.1 At one moment, the in-house counsel's focus may be negotiating the terms of a space lease agreement. Next, the in-house counsel may be determining how best to terminate a problematic
1 For example, heading up the organization's compliance program and providing guidance in shaping strategy.
employee. After that, there may be a meeting to attend regarding overall business strategy or raising capital for a planned expansion of the business.
By necessity, the in-house counsel in these organizations must be a "Jack of all trades." Often, the in-house counsel staff is not large, and the demands are not consistent enough to justify the type of legal specialization that is common in law firms or larger health care organizations. Thus, it is not surprising that many in house counsel do not have the staff or expertise to develop and implement effective internal investigation policies and procedures.
Developing the expertise to conduct an internal investigation is not readily embraced by most businesses. The need to conduct an internal investigation typically is viewed as a negative, an indication that something may be "wrong." Thus, the management of most health care organizations, already under constant scrutiny by both government and private agencies, do not want to contemplate the need to conduct an internal investigation. With tight operating margins and staff members who are stretched thin, a provider's management often is hesitant to invest the time and resources needed to plan and prepare for an internal investigation-an event they hope never will materialize.
Nevertheless, in the current legal environment, it is reasonable to anticipate that a health care organization or vendor will have reason to conduct an internal investigation in the foreseeable future, if it has not already had to do so. Like disaster planning, understanding what is needed to conduct an effective internal investigation and planning for that probability should be part of every provider's and vendor's prudent business plan.
(1) What Triggers an Internal Investigation?
A myriad of events and parties, both external and internal, may trigger an internal investigation.
External Triggers
In addition to the Centers for Medicare & Medicaid Services (CMS) and the U.S. Department of Health and Human Services Office of Inspector General (OIG), other federal agencies, including (but certainly not limited to) the Internal Revenue Service, the U.S. Department of Justice (DOJ), the Federal Bureau of Investigation, the U.S. Drug Enforcement Administration, the U.S. Food and Drug Administration, and the Federal Trade Commission, may scrutinize the activities of providers and vendors.2 Providers that participate in the Medicare and Medicaid programs also may be subject to investigations by the local Medicare Administrative Contractor, Recovery Audit Contractor, Zone Program Integrity Contractor, any applicable state agency, and the state's Medicaid Fraud Control Unit. Additionally, the U.S. Department of Defense, which is responsible for administering the TRICARE health program and the Veterans Health Administration, with the recent focus on its delivery system, also may initiate investigations of applicable providers and vendors.
Similarly, private payers are increasing their pre- and post-payment scrutiny of the claims they are asked to pay, as well as bundled payments and other alternate reimbursement arrangements. These efforts include more-thoroughly investigating the complaints and allegations of their insureds. There also has been a greater focus on the compensation arrangements between providers that involve the insureds/enrollees of non-governmental payers. Equally important, private payers are increasing their efforts to engage in joint investigations with some of the government agencies identified above, and those agencies increasingly are receptive to the payers' efforts.
2 Many of these investigations begin as so-called "desk audits," about which the subject provider may not become aware, if the agency concludes that nothing merits further scrutiny and are not likely to result in an internal investigation.
Internal Triggers
Often, there also are internal reasons for a health care provider to conduct an internal investigation. A primary area of provider concern is an allegation from an employee, independent contractor, or vendor. A provider's failure to adequately address such allegations could lead to additional challenges, including a whistleblower lawsuit. Such employees, independent contractors, and vendors often learn about actual or potential violations of policy and law that need to be addressed long before the matter comes to the attention of the provider's management. It is essential to take seriously the reporter's concern, investigate it thoroughly and confidentially, provide feedback to that reporter (to the extent it is appropriate), and take appropriate corrective action. An effective internal investigation process minimizes not only the likelihood of a reporter becoming a whistleblower, but also the discovery of the matter by a government agency or private payer and any potential consequences associated with resolving/correcting the issue.
A health care provider that participates in the Medicare program also has an independent duty to conduct an internal investigation. In particular, a provider has a statutory obligation to repay promptly a "known overpayment."3 The process of determining whether a suspected overpayment (a frequent topic or outcome of a reporter's allegation), in fact, is a "known overpayment" and the amount to be repaid is best resolved by means of an internal investigation. This especially is true if the suspected overpayment involves (for example) an extended number of claims, claims that were not isolated incidents of erroneous billing, or alleged violations of the federal Anti-Kickback Statute4 and/or the Physician Self-Referral Law (Stark Law).5 Once a provider is aware of a potential overpayment or other compliance issue, the provider has an obligation to investigate the circumstances
3 42 U.S.C. § 1320a-7B(3).
4 42 U.S.C. § 1320(a)-7b(b).
5 42 U.S.C. § 1395nn.
and, if necessary, voluntarily disclose the matter to a government agency,6 and repay any amount received in error plus a penalty.7
(2) Providers Are Expected to Conduct Internal Investigations
OIG has been clear that it expects every provider that participates in the Medicare or Medicaid program to adopt, implement, and maintain an effective corporate compliance plan.8 Granted, OIG has recognized that there are limitations related to the size of a provider's organization and its resources:
... unlike other guidelines issued by the OIG, this guidance for physicians does not suggest that physician practices implement all seven components of a full scale compliance program. Instead, the guidance emphasizes a step by step approach to follow in developing and implementing a voluntary compliance program. This change is in recognition of the financial and staffing resource constraints faced by physician practices.9
This concession should not, however, be interpreted as OIG tacitly waiving a small health care organization's obligation to maintain a compliance plan. To demonstrate that it has adopted an effective compliance plan, every provider that participates in a federal health care program, regardless of size or sophistication,
6 Whether that disclosure should be made to CMS under CMS' Voluntary Self-Reporting Disclosure Protocol, OIG's Voluntary Disclosure Protocol, or, informally, to DOJ is a topic that is beyond the scope of this Executive Summary.
7 Although the federal False Claims Act, 31 U.S.C. § 3729, permits the imposition of treble
damages plus a penalty of between $5,500 and $11,000 per claim, the actual settlement amount frequently is much less when the provider discloses the matter.
8 See, e.g., Compliance Program Guidelines for Hospitals, 63 Fed. Reg. 8987 (Feb. 23, 1998);
Supplemental Compliance Guidance for Hospitals, 70 Fed. Reg. 4858 (Jan. 31, 2005). Although OIG continues to characterize these programs as "voluntary," in multiple enforcement action settlement agreements and elsewhere OIG has made clear that the adoption of an effective corporate compliance program is expected of every provider that participates in a federal health care program.
9 OIG Compliance Program for Individual and Small Group Physician Practices, 65 Fed. Reg.
59434 (Oct. 5,2000) (hereinafter referred to as the "Small Group Guidance") at 59434 - 59435.
must be able to demonstrate that it has the capability of performing all seven components:
(1) Conducting internal monitoring and auditing through the performance of periodic audits;
(2) Developing written compliance and practice standards and procedures;
(3) Designating a compliance officer to monitor and enforce practice standards;
(4) Training and educating staff on those practice standards and procedures;
(5) Responding appropriately to detected violations through the investigation of allegations and the disclosure of incidents to appropriate government entities;
(6) Developing open lines of communication within the organization; and
(7) Enforcing disciplinary standards.10
To satisfy two of the elements of an effective compliance plan (internal monitoring and auditing and responding appropriately to detected violations, (1) and (5) above), a health care provider needs to be able to conduct an effective internal investigation. In addition, both training and education and enforcing disciplinary standards ((4) and (7) above) also are dependent on the organization's ability to conduct effective internal investigations. Otherwise, a provider can be seriously hampered in its ability to either adequately educate its staff or fairly discipline those staff members who fail to comply with the organization's expectations.
The urgency with which an internal investigation is initiated may depend on whether the investigation is the result of an internal or external trigger. For example, an internal investigation beginning after the execution of a search warrant (an external trigger) likely will be initiated much more quickly than one resulting from an employee's allegation that the provider's billing practices are noncompliant (an internal trigger). However, the impetus to initiate an
10 Small Group Guidance, at 59436 (col. 2-3).
investigation should not determine the resources or seriousness with which it should be approached. Each internal investigation is unique and requires that it be treated as such.
(3) Goals of an Effective Internal Investigation
Whether the initiating trigger is internal or external, every internal investigation should seek to achieve certain goals:
Determine the Facts
No matter the allegation or issue, an internal investigation's first goal should be to establish the facts. The facts rarely are simple and straightforward, and, often cannot be readily understood simply by looking at documents. Thus, interviewing the individuals involved to obtain the "back story" is an important part of an internal investigation. Until the provider can understand the "who, what, where, when, why, and how" of the allegation, the provider cannot adequately evaluate either the organization's vulnerability or the appropriate corrective actions.
Establish Accountability
One of the elements of an effective compliance plan is the fair enforcement of disciplinary standards. To achieve this objective, an internal investigation needs to identify both what happened and who made the decision(s) that led to that result. Equally important is determining who should have made the decision and what that decision should have been, both to understand what happened and to reduce, if not avoid, the likelihood of the same result in the future. With that information, a determination can be made as to whether the provider's disciplinary standards were adequate but ignored, or inadequate and require further modification. Assigning accountability also is important for determining what, if any, disciplinary action or training may be needed.
Provide Management with the Information Needed to Evaluate the Allegation, Develop a Response, and Mitigate Any Risk
The findings learned from an internal investigation should be relied on as management's primary source of information for evaluating the seriousness of the allegation. In some instances, the evidence will lead to a conclusion that an allegation is not supported by the facts; for example, the reporter may have misunderstood a Medicare coverage policy. In other cases, however, the internal investigation will result in a finding that the allegation is supported by credible evidence.
(4) Who Should Be Involved in Conducting an Internal Investigation?
Each internal investigation involves a unique set of facts, relevant parties, and evidence. As such, each internal investigation requires a determination as to who should be involved in gathering and evaluating the evidence needed to reach a conclusion in a particular instance.
Even for organizations that have a substantial number of staff assigned to compliance/internal investigations, selecting the right individuals to conduct any given internal investigation is critical. In addition to individuals with the right skill sets (for example, coders, auditors, utilization review/quality assurance, clinical line managers, etc.), the temperament of each individual assigned to investigate an allegation needs to be considered if the investigation will be conducted fairly, impartially, and without preconceived notions of what the evidence will or will not support. Without gathering the appropriate team to investigate a particular matter, it is unlikely an internal investigation will succeed in thoroughly and impartially uncovering and evaluating all of the relevant evidence and information.
One of the critical internal investigation staffing decisions involves the role of legal counsel. If an internal investigation includes allegations or suspicions that may
lead to significant financial or any criminal liability, it is important to bring in (outside) legal counsel as early in the process as possible and have counsel conduct/manage the matter. There are several important reasons for doing so, including: (1) legal counsel likely will have a better understanding of the relevant statutes and regulations; (2) counsel is in a better position to evaluate the legal risks of an internal investigation's findings; and (3) management of the investigation by legal counsel is necessary to try to protect the confidentiality of the findings under the attorney-client communications and work product privileges.
There are other advantages and disadvantages in having outside legal counsel, rather than in-house counsel, manage an internal investigation. One of the advantages of bringing in outside legal counsel is the increased probability that outside counsel will not have a bias (whether recognized or not), and will have the ability to evaluate the evidence more objectively than an organization's internal legal counsel. Outside counsel also is more likely to have experience with other providers' internal investigations that involved similar allegations or statutes. Also, outside counsel is less likely to be concerned with maintaining the interpersonal relationships that are so critical for the effective functioning of a provider's internal compliance and in-house legal staffs, thereby freeing outside counsel to view more critically the roles played by a provider's most influential staff members, senior management, and governing board members.
Increased cost can be an important disincentive associated with retaining outside legal counsel to conduct an internal investigation. Bringing in an unfamiliar party also can lead to some disruption in the organization's normal operating routines and lead to unnecessary speculation on the part of staff members. In addition, outside counsel may be less familiar with the provider's organization and culture.
Despite these disadvantages, one consideration is frequently decisive in a decision to retain outside counsel to manage or conduct an internal investigation-preserving the attorney-client communications and work product privileges. A substantial amount of case law holds that, because of the numerous
roles an in-house counsel often must fill, in-house counsel's responsibilities frequently blur the line between providing legal and business advice, thereby negating these important privileges. In addition, communications involving actual or potential litigation matters within the organization frequently are not limited to those who "need to know." As a consequence, communications between in-house counsel and other members of the provider's staff are less likely to be protected by the attorney-client communications or work product privileges from discovery than communications between outside legal counsel and the provider's senior staff, including in-house counsel; provided, that those communications are not then disseminated to other individuals within or outside of the organization.
(5) Planning and Conducting an Internal Investigation
Whether or not outside legal counsel is retained, an important step at the outset of every internal investigation is to develop a planned approach. Note that even with a plan, there is a distinct probability that as new information is elicited, that plan will need to be revised. Without a plan, however, there is a greater likelihood that the investigation will miss, ignore, and/or downplay important information or otherwise be a nonproductive exercise that leaves the provider vulnerable to even greater risk than before.11
The plan for every internal investigation should address at least the following questions:
What Are the Allegations and Potential Issues?
While this may seem obvious, unless the allegations and reasonably anticipated potential issues are identified at the outset, it is very difficult to plan the rest of the steps needed for any internal investigation.
11 For example, an incorrect billing practice will not be detected and corrected for a longer period of time, or a compensation arrangement that fails to comply with the Stark Law will not be detected, corrected, and possibly voluntarily disclosed, appropriately.
Who Are the Individuals, Both Within and Outside the Organization, Who Are Likely to Have Knowledge About the Allegations?
To accurately evaluate the allegations and risks to the provider, each and every one of these individuals (including senior managers and board members, if relevant) should be interviewed. It is very unlikely that documents alone will enable the investigation team to fully understand and appreciate all of the issues and dynamics that either support or contradict an allegation. Thus, it is important to identify and interview those individuals who may have relevant information.
What Documents, Whether They Reside Within or Outside the Organization, Need to Be Reviewed and Preserved?
Reviewing relevant documents, along with interviewing relevant personnel, is critical for evaluating an allegation. If appropriate, a "document hold" should be issued to ensure critical documents are not destroyed or altered. Otherwise, the provider may not only: (1) fail to have the benefit of critical information, but also
(2) compound its risk by creating a negative inference by any governmental agency or private payer that investigates the allegation; and (3) open itself up to allegations of obstruction of justice.
Assuming All of the Documents Can Be Reviewed in Advance, in What Order Should Individuals Be Interviewed?
In addition to the individual who may have reported the allegation, which other members of the organization or outside vendors may have relevant information? In planning an internal investigation, the participants should anticipate that some of these individuals may be interviewed numerous times, as additional information is obtained. While repeated interviews of the same individual may be necessary,
the initial interview often is the most critical because the subject has not had an opportunity to prepare/rehearse her responses.
How Frequently and with What Level of Detail Should Interim Progress Reports Be Provided to Members of the Provider's Senior Management or Governing Board Members?
A timetable for interim reporting can have the advantage of ensuring that progress is made in resolving the allegations as quickly as possible. Interim reporting also has several drawbacks, including: (1) the time needed to prepare and present an interim report takes time away from the actual investigation and can delay its finalization; (2) interim reporting requirements can add to the cost of the investigation, particularly when done formally by outside legal counsel; and (3) the likelihood that details of the investigation's findings will be "leaked" increase with an increasing number of written or oral presentations. In addition, if any of these individuals are a subject or target of the internal investigation, they should not be included in any discussion or communication regarding the investigation.12 The involvement or briefing of such an individual may taint the findings and give the appearance of undue influence concerning both the direction and findings and ultimate conclusions of the internal investigation.
(6) Once an Internal Investigation Is Completed, What Will Be Done with the Findings?
Although it is typical to have a written report of the findings prepared and submitted to senior management or the governing body for further action, that is not always as simple as it seems.
The elements of an effective corporate compliance plan include enforcing disciplinary standards and taking other corrective action. If allegations involving a senior manager/director, major supporter of the organization, significant vendor,
12 Other than being interviewed as part of the investigative process.
etc., are confirmed, what will be the consequences? Is the provider prepared to take disciplinary action, perhaps severing its relationship with that individual or organization and even reporting the individual or organization to law enforcement authorities, even if it has a substantial impact on the bottom line?
In addition, a provider that has a "known overpayment" has a statutory obligation to repay those funds to the federal health care program within 60 days. One part of an internal investigation report will likely address the question of whether the organization received monies to which it was not entitled and should include a reasonable estimate of the amount of money involved. Inasmuch as the amount of a "known overpayment" may be substantial, "voluntarily" assuming this obligation by undertaking an internal investigation may seem like a self-destructive step for many health care organizations to take.
Conclusion
In the current health care legal environment, every health care provider, as well as vendors who do a meaningful amount of business with providers, will have occasion to conduct an internal investigation. The organization does not need to have the staff and expertise in place before that time arrives. However, consideration and preliminarily planning for how an organization will conduct an internal investigation may save the organization a substantial amount of time and money, as well as help to avoid damage to its reputation.