Auditing a Referral Arrangement and Answering an Overpayment Demand: A Practical Checklist

Healthcare > Fraud, Abuse, and Compliance | Published 26 March 2025 - Updated 18 March 2026 | UpLaw - uplaw.us

How to Use This Checklist

For a routine audit, work Parts 1 through 4 and 9 through 11. If an overpayment has surfaced, go to Part 5 today and record the date. If an investigation has begun, go to Part 8 first. Doctrine is in the comprehensive guide; the orientation piece is the referral that became a felony; the templates are in the toolkit.

⚠️ Two clocks. Sixty days from identification to report and return an overpayment under 42 U.S.C. § 1320a-7k. And the moment any inquiry is foreseeable, the obligation not to alter or destroy records under 18 U.S.C. § 1519.

Part 1 — Build the Arrangement Inventory

☐ List every financial relationship with a referral source or recipient, direct and indirect.

☐ Include: employment and professional services agreements; medical directorships; call coverage and administrative stipends; space leases; equipment leases; recruitment and income guarantees; joint ventures; management and billing services; laboratory and pharmacy arrangements; marketing and lead generation; and any arrangement with an immediate family member of a referring physician.

☐ Include arrangements you provide and arrangements you receive.

☐ Capture for each: parties, effective date, expiration, compensation, methodology, signature status, and the exception and safe harbor relied upon.

☐ Set tickler dates ninety days before each expiration.

☐ Identify the owner of each arrangement inside the organization.

☐ Flag any arrangement with no written agreement, an expired agreement, or a missing signature.

☐ Flag any compensation formula that varies with anything other than personally performed services.

Part 2 — Test Against the Stark Law

☐ Is there a financial relationship — ownership, investment, or compensation — direct or indirect?

☐ Are designated health services referred? Laboratory; physical, occupational, and speech therapy; imaging; radiation therapy; durable medical equipment; parenteral and enteral nutrition; prosthetics and orthotics; home health; outpatient prescription drugs; and inpatient and outpatient hospital services.

☐ Identify the exception you rely on, by name, from 42 U.S.C. § 1395nn and 42 C.F.R. part 411.

☐ Check each element of that exception, one at a time: ☐ Writing signed by the parties ☐ Covers all items and services ☐ Term of at least one year where required ☐ Compensation set in advance ☐ Fair market value ☐ Commercially reasonable even absent referrals ☐ Not determined in a manner taking into account volume or value of referrals or other business generated

☐ Remember: Stark is strict liability. Missing any element is a violation regardless of intent.

☐ Check holdover conditions if the term has expired.

☐ Check the aggregate limits on non-monetary compensation and medical staff incidental benefits across the whole organization.

Part 3 — Test Against the Anti-Kickback Statute

☐ Identify any remuneration flowing in either direction — cash, space, staff, equipment, services, meals, travel, forgiveness, or equity.

☐ Identify the safe harbor you rely on, from 42 C.F.R. part 1001.

☐ Check each element. Safe harbors are all-or-nothing.

☐ If no safe harbor fits, analyze intent under the one purpose test: is any purpose of the remuneration to induce or reward referrals?

☐ Look for the document that decides it: any model, presentation, memo, or email connecting the payment to referral volume or downstream revenue.

☐ Consider an advisory opinion under 42 C.F.R. part 1008 for a novel, significant arrangement.

☐ Check state law, which frequently reaches all payers and may be criminal where federal law is civil.

☐ Check beneficiary inducement exposure under 42 U.S.C. § 1320a-7a for anything of value provided to patients.

Part 4 — Fair Market Value and Commercial Reasonableness

☐ Obtain a valuation before the arrangement begins, not after.

☐ Use survey data correctly: right specialty, right geography, and a documented reason for any percentile above the median.

☐ Exclude comparables generated by referral relationships.

☐ Document the duties actually performed, with hours, deliverables, and evidence.

☐ Require time logs where compensation is hourly or the role is a directorship.

☐ Write the commercial reasonableness rationale: why the organization needs this service, from this many people, at this level.

☐ Confirm the number of similar arrangements — three medical directors where one is needed fails commercial reasonableness even at fair market value.

☐ Confirm no formula varies with referrals, and search the file for any document that does.

☐ Retain the whole file: agreement, valuation, rationale, approvals, deliverables, and time records.

Part 5 — The Sixty-Day Process: Days 0 to 7

☐ Record the trigger date and source. Any credible information suggesting an overpayment.

☐ Assign an owner and notify counsel.

☐ Decide the privilege posture in writing.

☐ Issue a preservation instruction and suspend routine deletion.

☐ Scope it: which service, code, period, payers, and approximate claim volume.

☐ Stop the conduct if it is continuing.

☐ Do not refund anything yet until the characterization in Part 6 is complete.

☐ Do not discipline the reporter. Retaliation is separately actionable under 31 U.S.C. § 3730(h).

Part 6 — Days 7 to 45: Diligence and Characterization

☐ Sample and expand. Use a defensible methodology and document it.

☐ Determine whether an overpayment occurred, why, and over what period.

☐ Quantify, with extrapolation where volume requires it and the method documented.

☐ Characterize the conduct. This determines everything that follows: ☐ Ordinary billing or coding error, no fraud dimension → refund to the contractor ☐ Stark technical violation, no kickback dimension → self-referral disclosure protocol ☐ Kickback or civil monetary penalty conduct → OIG self-disclosure protocol ☐ Possible criminal exposure → counsel-directed evaluation before any submission

☐ Do not refund kickback-tainted amounts as a simple billing error. It does not resolve the exposure and creates an admission.

☐ Document the analysis, including why the chosen route fits.

☐ Identify the responsible process failure and begin remediation in parallel.

Part 7 — Days 45 to 60: Report and Return

☐ Submit through the chosen route with the required content: the conduct, the legal analysis, the affected period, the damages estimate and methodology, and the corrective action.

☐ Note that a pending disclosure suspends the sixty-day obligation under the applicable protocol.

☐ Preserve the submission and all supporting work.

☐ Calendar the follow-up and respond promptly to any request for additional information.

☐ Complete the remediation and document it.

☐ Re-audit the same area in ninety days to confirm the fix held.

☐ Report to the compliance committee and the governing body, with minutes reflecting the discussion.

Part 8 — When an Investigation Begins

☐ Recognize the signals: a civil investigative demand under 31 U.S.C. § 3733; an Inspector General subpoena; an unusually large contractor records request; agents contacting employees at home; or an abrupt departure after concerns were raised.

☐ Preserve immediately. Litigation hold, suspend deletion, touch nothing. See the litigation hold checklist.

☐ Never alter, delete, or back-date anything. 18 U.S.C. § 1519.

☐ Retain experienced counsel and decide the privilege posture before any internal investigation.

☐ Advise employees of their rights: they may speak with agents or decline; they may have their own counsel; there will be no retaliation. Do not instruct anyone not to cooperate.

☐ Warn against false statements to investigators, which are separately criminal under 18 U.S.C. § 1001.

☐ Treat a civil investigative demand as evidence of a sealed qui tam case, not a routine audit.

☐ Quantify exposure early at treble damages plus per-claim penalties.

☐ Evaluate whether disclosure remains available and whether it is advantageous.

☐ Assess parallel exposure: criminal, exclusion, licensing, payer audit, and private litigation.

☐ Assess individual exposure and whether separate counsel is needed for individuals.

☐ Confirm indemnification and D&O coverage, including tail. See the tender checklist.

Part 9 — Exclusion Screening

☐ Screen everyone: employees, contractors, vendors, volunteers, medical staff, and governing body members.

☐ Screen at engagement and monthly thereafter.

☐ Screen against the federal exclusion database and every applicable state Medicaid exclusion list.

☐ Retain the results with dates.

☐ Investigate any hit and confirm identity before acting.

☐ If an excluded person was employed or contracted, quantify every claim involving their services and run the Part 5 process.

☐ Confirm reinstatement is not automatic at the end of an exclusion period; it requires application and determination.

☐ Include screening in vendor onboarding and in the contract as an ongoing obligation.

Part 10 — Coding and Documentation Audits

☐ Audit prospectively for new providers and high-risk services.

☐ Audit retrospectively by provider, code, and service line on a defined schedule.

☐ Use statistically valid sampling and document the methodology.

☐ Set an error-rate threshold that triggers expansion, education, and the Part 5 process.

☐ Examine: evaluation and management level distribution against peers; modifier usage; incident-to and supervision compliance; time-based codes; therapy minutes; cloned documentation; signature timing; and services billed on dates the provider was absent.

☐ Run the data analytics enforcement runs: hours per day, volume per provider, high-to-low level ratios, and sudden pattern changes.

☐ Re-audit ninety days after remediation.

☐ Report results to the compliance committee.

Part 11 — Program Elements

☐ Written standards covering coding, documentation, arrangements, non-retaliation, and the overpayment process ☐ A compliance officer and committee with authority, resources, and independence from the revenue cycle ☐ Role-specific training with documented attendance ☐ An anonymous reporting channel people actually use, and a documented non-retaliatory response ☐ Auditing and monitoring, including the arrangements database and monthly exclusion screening ☐ Published disciplinary standards applied consistently ☐ Prompt response to detected offenses with documented correction ☐ Periodic board reporting with minutes

Part 12 — Mistakes That Produce Enforcement

☐ A lapsed lease or professional services agreement, never renewed. ☐ A medical directorship with no time log and no deliverables. ☐ A financial model projecting downstream revenue used to justify compensation. ☐ A valuation obtained after the arrangement began. ☐ Three medical directors where one is needed. ☐ Routine waiver of copayments as a marketing practice. ☐ Payment per lead, per patient, or per test to a marketing company. ☐ An excluded employee, never screened. ☐ A credible overpayment report investigated eight months later. ☐ Refunding kickback-tainted amounts as an ordinary billing error. ☐ Disclosing through the wrong protocol. ☐ Cloned documentation and orders signed after the service. ☐ Retaliating against the person who reported it. ☐ Altering or deleting records after learning of an inquiry.

Part 13 — The Authority Behind Each Step

☐ Kickback prohibition and its elements. 42 U.S.C. § 1320a-7b; safe harbors at 42 C.F.R. part 1001; advisory opinions at 42 C.F.R. part 1008.

☐ Physician self-referral. 42 U.S.C. § 1395nn; exceptions at 42 C.F.R. part 411.

☐ False claims liability. 31 U.S.C. § 3729; qui tam procedure and retaliation at § 3730; limitations and burdens at § 3731; venue at § 3732; civil investigative demands at § 3733.

☐ Materiality and scienter. Escobar; SuperValu; Allison Engine.

☐ Government dismissal, public disclosure, and original source. Polansky; Graham County; Rockwell.

☐ Overpayments. 42 U.S.C. § 1320a-7k; Medicare recovery at 42 U.S.C. § 1395ddd.

☐ Exclusion. 42 U.S.C. § 1320a-7; procedures at 42 C.F.R. part 1001.

☐ Civil monetary penalties. 42 U.S.C. § 1320a-7a; procedures at 42 C.F.R. part 1003.

☐ Criminal exposure. 18 U.S.C. § 1347; § 1035; § 669; § 1341; § 1343; § 1001; § 1519.

☐ Prescribing and drug offenses. 21 U.S.C. § 331; § 353; Ruan.

Part 14 — Decision Trees

Does this arrangement need an exception?

1. Is the counterparty a physician, or an immediate family member of one, who refers to us? → Stark applies if designated health services are involved.
2. Is anything of value moving in either direction between us and any source of federal program business? → The Anti-Kickback Statute applies.
3. If Stark applies, name the exception and check every element. Missing one is a violation regardless of intent.
4. If the kickback statute applies, name the safe harbor and check every element. Missing one is not automatically a violation, but requires an intent analysis under the one purpose test.
5. Both analyses must be completed. Satisfying one does not satisfy the other.

Is this compensation defensible?

1. Is there a signed writing covering all services, currently in effect?
2. Is compensation set in advance, by a methodology that does not vary with referrals?
3. Is there a contemporaneous fair market value analysis?
4. Is the arrangement commercially reasonable — do we need this service, from this many people, at this level?
5. Can we prove the services were performed — time logs, minutes, deliverables?
6. Does any document anywhere connect the payment to referral volume or downstream revenue?

If item 6 is yes, no answer to items 1 through 5 saves the arrangement.

Which disclosure route?

1. Ordinary coding or billing error, no fraud, kickback, or Stark dimension → refund to the contractor.
2. Stark technical noncompliance, no kickback dimension → self-referral disclosure protocol.
3. Kickback conduct, excluded persons, or civil monetary penalty conduct → OIG self-disclosure protocol.
4. Possible criminal exposure → counsel-directed evaluation before anything is submitted.
5. Unsure? Do not default to a refund. The characterization is the decision, and the wrong route forfeits the benefit.

Has the sixty-day clock started?

1. Has credible information suggesting an overpayment reached anyone in the organization? → Yes, diligence is required.
2. Does "credible" mean proven? → No. It means information a reasonable person would investigate.
3. Does the clock run from the report or from quantification? → From identification, which is when reasonable diligence would have determined the overpayment existed and quantified it — which means a timely investigation is itself the protection.
4. Are we still investigating in good faith and documenting it? → That is what the standard asks for. Stalling is not diligence.

Should we self-report a suspected kickback?

1. Is the conduct ongoing? Stop it first.
2. Quantify the exposure at treble damages plus per-claim penalties.
3. Is a qui tam case likely already filed — has anyone left, complained, or been asked for documents?
4. Is disclosure still available, and what multiplier is realistic under the protocol compared to litigation?
5. What are the exclusion and corporate integrity agreement consequences of each path?
6. Decide with counsel, and decide quickly. The option narrows as the investigation advances.

Part 15 — Arrangement-Specific Checks

☐ Physician employment. Compensation methodology reviewed for anything varying with referrals; productivity based on personally performed services only; annual fair market value review; documented duties; and no downstream-revenue analysis anywhere in the file.

☐ Medical directorship. Time log required and actually maintained; hours consistent with the stipend; deliverables produced and retained; one director per function unless the need for more is documented; and a term of at least one year.

☐ Call coverage. Rate supported by market data for the specialty and burden; documented actual coverage; and no payment for call that is not provided.

☐ Space lease. Square footage matches actual use; rate at fair market value; term of at least one year; exclusive use during the leased period where required; no per-use payments where prohibited; and a current signed document.

☐ Equipment lease. Same elements; watch per-click arrangements, which are restricted.

☐ Recruitment and income guarantee. Physician new to the geographic area; the practice does not benefit beyond permitted amounts; costs documented; and the repayment or forgiveness terms conform to the exception.

☐ Joint venture or ancillary service. Ownership analysis under Stark; investment interest safe harbor elements; in-office ancillary services requirements if relied upon; and supervision and billing structure.

☐ Laboratory and pathology. Processing and handling fees; specimen collection payments; placement of personnel in referring offices; standing orders; and client billing arrangements.

☐ Marketing and lead generation. No payment per lead, per patient, per test, or per order; personal services safe harbor elements if the vendor is compensated at a fixed fee set in advance; and documented deliverables.

☐ Patient inducements. No routine copayment or deductible waiver; individualized financial hardship determinations documented; transportation within permitted limits; and items of nominal value only.

☐ Electronic health record and cybersecurity donations. Conditions of the applicable exception and safe harbor satisfied, including any required contribution and the prohibition on conditioning on referrals.

☐ Value-based arrangements. Governing document; defined target patient population set in advance on legitimate criteria; value-based purposes; objective, measurable outcome measures with benchmarks; monitoring; and six-year retention.

☐ Group practice arrangements. If relying on in-office ancillary services or physician services exceptions, confirm the entity qualifies as a group practice, including the requirements governing distribution of profits and productivity bonuses.

Part 16 — Annual Compliance Calendar

☐ January. Confirm the arrangements database is complete and current; identify every agreement expiring in the coming year; confirm the compliance work plan and budget are approved.

☐ Monthly, all year. Exclusion screening of every employee, contractor, vendor, volunteer, medical staff member, and board member, with results retained.

☐ Quarterly. Retrospective coding audits by provider and service line; hotline metrics; open-issue tracking; and a report to the compliance committee.

☐ Quarterly. Review the ninety-day tickler list and confirm each expiring arrangement is being renewed before it lapses.

☐ Semiannually. Data analytics run on the organization's own billing: hours per day, volume against peers, level distribution, and pattern changes.

☐ Annually. Arrangement audit — every agreement checked for a current signature, matching duties, time records, and deliverables; fair market value refresh where compensation has changed or the market has moved; non-monetary compensation and incidental benefit totals reconciled across all departments.

☐ Annually. Training refresh, role-specific, with attendance documented.

☐ Annually. Policy review against regulatory changes, including any new exceptions, safe harbors, or reporting obligations.

☐ Annually. Board reporting on the program's operation, audit results, disclosures made, and open risks, with minutes.

☐ Ninety days after any remediation. Re-audit the corrected area to confirm the fix held.

☐ Continuously. The sixty-day process, triggered by credible information rather than by the calendar.

⭐ A closing discipline. Once a year, pick the three arrangements that would look worst on the front page and assemble their complete files as if a civil investigative demand had arrived. Whatever you cannot find in an afternoon is the gap — and it is far cheaper to close it now than to explain it later.

Related Documents

• Health Care Fraud and Abuse: A Comprehensive Guide to the Anti-Kickback Statute, Stark Law, and Overpayments
• The Referral That Became a Felony: How Health Care Fraud Law Actually Works
• The Health Care Compliance and Self-Disclosure Toolkit
• False Claims and Qui Tam: A Comprehensive Guide to Relators, Seals, and Recoveries
• Whistleblower and Retaliation Claims: A Comprehensive Guide to Protected Activity, Causation, and Remedies
• Issuing a Litigation Hold and Running an ESI Production: A Practical Checklist
• Responding to a HIPAA Request, Breach, or Complaint: A Practical Checklist
• Health Information Privacy: A Comprehensive Guide to HIPAA, Access Rights, and Breach Notification
• Responding to a Licensing Board Complaint or Investigation: A Practical Checklist
• Professional Licensing and Occupational Discipline: A Comprehensive Guide to Boards, Hearings, and Judicial Review
• Tendering a Claim and Contesting a Coverage Denial: A Practical Checklist
• Medical Billing and Collections: A Comprehensive Guide to Statements, Disputes, and Surprise Bills