Toolkit · Healthcare

The Health Care Compliance and Self-Disclosure Toolkit

42 U.S.C. § 1395

Type
Toolkit
Jurisdiction
National
Date
2024-10-25
Topic
Healthcare

This toolkit contains the working documents of a health care compliance function. It supplies an arrangements database schema with the fields that matter, element-by-element worksheets for Stark exceptions and Anti-Kickback safe harbors, and fair market value and commercial reasonableness memoranda. It contains a medical director time log, an overpayment analysis workpaper with the sixty-day timeline, and outlines for both self-disclosure protocols. It supplies an exclusion screening log, a civil investigative demand response plan, an employee rights notice, a coding audit workpaper, a compliance work plan, and a board reporting template. Each item notes the failure it prevents. All must be adapted to the organization and to the current text of the regulations, and none substitutes for counsel where disclosure or investigation is involved.

The Health Care Compliance and Self-Disclosure Toolkit

Healthcare > Fraud, Abuse, and Compliance | Published 25 October 2024 - Updated 21 October 2025 | UpLaw - uplaw.us

What Is In This Toolkit

Fifteen documents. Use them with the checklist for sequence, the guide for the standards, and the article for orientation.

⚠️ Do not use the disclosure outlines without counsel. The characterization decision determines the outcome, and a submission cannot be unsent.

Tool 1 — Arrangements Database

The single highest-value control in the field. Every field earns its place.

Field Why it matters
Arrangement ID Cross-reference for audits and disclosures
Counterparty; is the counterparty a referral source? Triggers the analysis
Immediate family member of a referring physician? Stark reaches these
Type (employment, PSA, directorship, lease, call, recruitment, JV, marketing) Determines the applicable exception
Effective date; expiration date; tickler at −90 days Prevents the lapsed-agreement violation
Signed by all parties? Date signed? Element of nearly every exception
Covers all services between the parties? Prevents side arrangements
Compensation amount and methodology The volume-or-value question
Set in advance? Element
FMV analysis: source, author, date Must predate the arrangement
Commercial reasonableness memo: date Separate requirement
Stark exception relied upon Mandatory
AKS safe harbor relied upon, or intent analysis Voluntary but decisive
Time log required? Maintained? Directorships and hourly work
Deliverables required? Received? Proof of performance
Non-monetary compensation counted toward the annual limit Aggregates across departments
Owner (internal) Accountability
Last audited; findings; remediation The audit trail

⭐ Run one report monthly: every arrangement expiring within ninety days, and every arrangement with no current signature. That single report prevents the most common Stark violation.

Tool 2 — Stark Exception Worksheet

Complete one per arrangement. Strict liability means every box must be checked.

Arrangement: [] Exception relied upon: [] (42 U.S.C. § 1395nn; 42 C.F.R. part 411)

☐ Financial relationship identified (ownership / compensation; direct / indirect) ☐ Designated health services referred? Which? ☐ Writing signed by the parties — date signed: [] ☐ Writing covers all items and services between the parties ☐ Term of at least one year, or the exception does not require it ☐ Compensation set in advance ☐ Compensation at fair market value — analysis dated [], predating the arrangement ☐ Arrangement commercially reasonable even if no referrals were made — memo dated [] ☐ Compensation does not take into account the volume or value of referrals or other business generated ☐ Services do not involve counseling or promoting an unlawful arrangement ☐ Any exception-specific conditions: [] ☐ Holdover conditions satisfied, if the stated term has expired

Any unchecked box is a violation. Escalate to counsel.

Tool 3 — Anti-Kickback Safe Harbor Worksheet

Arrangement: [] Safe harbor: [] (42 C.F.R. part 1001)

☐ Remuneration identified — describe everything of value moving in each direction ☐ Every element of the safe harbor satisfied (list and check individually) ☐ If any element fails, the safe harbor does not apply — proceed to the intent analysis

Intent analysis (one purpose test): ☐ Is any purpose of the remuneration to induce or reward referrals? ☐ Was the counterparty selected because of referral volume? ☐ Does compensation exceed what would be paid to a non-referral source for the same work? ☐ Does any document — model, presentation, memo, email, board material — connect the payment to referral volume or downstream revenue? ☐ Would we do this deal on these terms if the counterparty referred nothing?

Conclusion: ☐ Safe harbor satisfied ☐ No safe harbor; low risk with documented rationale ☐ Escalate ☐ Consider an advisory opinion under 42 C.F.R. part 1008 ☐ Restructure or decline

Tool 4 — Fair Market Value Memorandum

Arrangement: [] Date: [] — prepared before execution Author: [__]

1. The services. [Describe the duties, scope, and expected time commitment. Attach the position description.] 2. The provider. [Specialty, credentials, and any factors bearing on rate.] 3. Methodology. [Market approach using survey data; cost approach; income approach. State which and why.] 4. Survey data used. [Source, year, specialty, region, and the percentile selected.] Justification for any percentile above the median: [__]. 5. Comparables excluded. [Any data reflecting arrangements between referral sources and recipients, and why excluded.] 6. Hours. [Expected annual hours, and the basis for the estimate.] 7. Conclusion. [Rate or annual amount, stated as a range with the selected point and the reason.] 8. Limitations. [Assumptions, data limitations, and the date through which the conclusion is valid.]

☐ Independent valuation obtained for arrangements above $[threshold] ☐ Refreshed on [frequency] or upon any change in duties or compensation

Tool 5 — Commercial Reasonableness Memorandum

A separate requirement. Fair market value does not establish it.

1. The need. Why does the organization require this service? [Clinical, operational, or regulatory basis.] 2. Sizing. How many people are needed to perform it, and why is that the right number? [If more than one director, medical staff leader, or coverage physician is engaged for the same function, explain.] 3. Alternatives considered. [Internal staffing, existing personnel, contracting differently, not doing it at all.] 4. Sensibility absent referrals. Would a prudent organization enter this arrangement on these terms with a party who referred nothing? [Explain.] 5. Financial context. [The arrangement need not be profitable, but the rationale should be coherent. Do not cite downstream revenue.] 6. Approval. [Who approved, on what date, and what materials were before them.]

⚠️ Never include a downstream-revenue analysis in this memo, or anywhere in the file. That document is the single most damaging item in a kickback case.

Tool 6 — Medical Director Time Log

Date Hours Activity (specific) Deliverable produced Attendees / reference
Chaired joint replacement quality committee Minutes attached Drs. __, __
Revised perioperative protocol Protocol v2.1 —

☐ Submitted monthly as a condition of payment ☐ Reconciled annually against the stipend and the expected hours ☐ Retained with the arrangement file

⭐ An unpaid-attention directorship with no log is the most common enforcement fact pattern in the field, and the log costs five minutes a month.

Tool 7 — Overpayment Analysis Workpaper

Matter: [] Trigger date: [] Source of information: [] Owner: [] Counsel notified: [] Privilege posture: []

Sixty-day timeline | Day | Milestone | Target date | Completed | |---|---|---|---| | 0 | Trigger recorded; preservation issued; owner assigned | | | | 7 | Scope defined: service, code, period, payers, claim volume | | | | 30 | Sampling complete; methodology documented | | | | 45 | Amount quantified; characterization decided | | | | 60 | Report and return, or protocol submission filed | | | | 90+ | Remediation complete; re-audit scheduled | | |

Scope: [service, codes, date range, payers] Sampling: [universe size, sample size, selection method, error rate, extrapolation method and confidence] Root cause: [] Amount: principal $[]; interest $[]; total $[] Characterization: ☐ Ordinary error ☐ Stark technical ☐ Kickback / CMP conduct ☐ Possible criminal — basis: [] Route: ☐ Contractor refund ☐ Self-referral disclosure protocol ☐ OIG self-disclosure protocol ☐ Counsel-directed evaluation Remediation: [process change, training, system fix, personnel action] Re-audit date: []

Tool 8 — Self-Disclosure Submission Outline

I. Identification. Entity, addresses, tax identification and provider numbers, ownership, and any prior government actions or existing compliance obligations. II. Discovery. How the conduct was discovered, by whom, and on what date; whether through the compliance program. III. The conduct. A clear factual narrative: who, what, when, where, and how. Include the arrangements or claims at issue and the individuals involved and their status. IV. Legal analysis. The statutes and regulations potentially violated, and why — 42 U.S.C. § 1320a-7b, 42 U.S.C. § 1395nn, 31 U.S.C. § 3729, 42 U.S.C. § 1320a-7a — stated candidly. V. Period and scope. Dates, federal programs affected, and the states involved. VI. Damages estimate. The amount, the methodology, the sampling and extrapolation approach, and the workpapers. VII. Corrective action. What was stopped, when; the process change; training; personnel action; and the systems fix. VIII. Certification. By an authorized officer, that the submission is truthful and based on a good faith effort to resolve the matter. IX. Cooperation. A statement of willingness to provide additional information.

☐ Confirm whether the pending disclosure suspends the obligation under 42 U.S.C. § 1320a-7k ☐ Confirm the correct protocol for the characterization ☐ Preserve all workpapers supporting every number

Tool 9 — Exclusion Screening Log

Screening date Population screened (employees / contractors / vendors / medical staff / board) Count Databases (federal; state Medicaid lists) Hits Resolution Screened by Evidence retained

☐ At engagement and monthly thereafter ☐ Every applicable state list, not only the federal database ☐ Identity confirmed before any adverse action on a hit ☐ If an excluded person was engaged: quantify every claim involving their services and run the Tool 7 workpaper ☐ Screening obligation written into vendor contracts as an ongoing requirement ☐ Results retained for six years

Authority: 42 U.S.C. § 1320a-7; penalties at 42 U.S.C. § 1320a-7a; procedures at 42 C.F.R. part 1001 and part 1003.

Tool 10 — Civil Investigative Demand Response Plan

A demand under 31 U.S.C. § 3733 means a qui tam case exists under seal. Treat it accordingly.

Day 0. Log receipt and the return date. Notify the general counsel, the compliance officer, and the chief executive. Retain outside counsel with health care enforcement experience. Day 0. Issue a litigation hold immediately and suspend all automatic deletion. Confirm with information technology in writing. Nothing may be altered or deleted — 18 U.S.C. § 1519. Day 1–3. Identify what the demand is about from the definitions and the document requests. Map the conduct. Determine whether it is continuing and, if so, stop it. Day 3–7. Identify custodians and data sources; scope the collection. See the ESI checklist. Day 3–10. Contact the government to discuss scope, format, and an extension if needed. Extensions are commonly granted and are far better than a late or incomplete production. Week 2–4. Begin a privileged internal assessment. Quantify exposure at treble damages plus per-claim penalties. Identify individuals whose conduct is implicated and evaluate separate counsel. Week 2–4. Circulate the employee rights notice (Tool 11). Do not instruct anyone not to cooperate. Week 4+. Produce on a rolling basis with a privilege log. Evaluate whether disclosure remains available and advantageous. Assess parallel exposure: criminal, exclusion, licensing, payer audits, and private litigation. Throughout. Confirm indemnification, advancement, and directors-and-officers coverage, including tail. Notify the insurer.

Tool 11 — Employee Rights Notice

"A notice to all employees

[Organization] has received a request for information from the government relating to [general subject]. We are cooperating fully.

Government agents may contact you, at work or at home. If they do:

  • You may speak with them, or you may decline. The choice is entirely yours, and [Organization] will not treat you differently either way.
  • You may have a lawyer present. [Organization] can help you obtain counsel separate from the company's if you wish; ask [name].
  • If you speak with them, tell the truth. Making a false statement to a federal investigator is a separate crime.
  • You may ask for the agent's name, agency, and contact information, and you may ask to schedule the conversation for another time.
  • Please let [name] know if you are contacted, so that we can track the inquiry — but you are not required to tell us what you discussed.

You must not destroy, alter, delete, or back-date any document, email, message, or record relating to this matter. This includes text messages and messages in any application. If you are unsure whether something is covered, do not delete it and ask [name].

Retaliation is prohibited. No one will be disciplined for cooperating, for reporting a concern, or for declining to speak with investigators.

Questions: [Name, title, phone, email]."

Tool 12 — Coding Audit Workpaper

Audit: [] Period: [] Auditor: [__] Type: ☐ Prospective ☐ Retrospective ☐ Focused ☐ Follow-up

Universe: [claims, providers, codes] Sample size and method: [] Confidence and precision: []

# Claim Provider Code billed Code supported Error type Overpayment Notes

Error rate: []% Threshold triggering expansion: []% Extrapolated exposure: $[] Root causes: ☐ Documentation ☐ Code selection ☐ Medical necessity ☐ Supervision / incident-to ☐ Time-based coding ☐ Modifier use ☐ System configuration Actions: ☐ Education ☐ Expanded audit ☐ Tool 7 overpayment workpaper opened ☐ System change ☐ Personnel action Re-audit scheduled: []

Tool 13 — Compliance Work Plan

# Risk area Basis (regulatory, prior finding, data outlier, industry enforcement) Activity Owner Quarter Status Findings Remediation

Standing items every year: monthly exclusion screening; quarterly coding audits; annual arrangement audit; annual fair market value refresh; annual training; annual policy review; semiannual self-analytics; ninety-day re-audits after remediation.

Tool 14 — Board Reporting Template

Compliance report to the [Board / Audit and Compliance Committee] — [period]

  1. Program status. Staffing, budget, and independence of the compliance function.
  2. Work plan execution. Completed, in progress, and deferred, with reasons.
  3. Audit results. Error rates by area, trends, and remediation status.
  4. Arrangements. Total under management; lapsed or unsigned; corrected; escalated.
  5. Exclusion screening. Completed monthly; hits and resolution.
  6. Reports received. Volume, categories, substantiation rate, time to closure, retaliation checks.
  7. Overpayments. Identified, quantified, refunded or disclosed, with dates against the sixty-day obligation.
  8. Disclosures and government contacts. Status and exposure assessment.
  9. Open risks. Ranked, with owners and dates.
  10. Resources requested.

☐ Minutes reflect the discussion and any board direction.

Tool 15 — Authority Quick Card

Kickbacks: 42 U.S.C. § 1320a-7b · 42 C.F.R. part 1001 · 42 C.F.R. part 1008 Self-referral: 42 U.S.C. § 1395nn · 42 C.F.R. part 411 False claims: 31 U.S.C. § 3729 · § 3730 · § 3731 · § 3732 · § 3733 Overpayments and penalties: 42 U.S.C. § 1320a-7k · § 1320a-7a · § 1320a-7 · § 1395ddd · 42 C.F.R. part 1003 Criminal: 18 U.S.C. § 1347 · § 1035 · § 669 · § 1001 · § 1519 · 21 U.S.C. § 331 Cases: Escobar · SuperValu · Polansky · Allison Engine · Rockwell · Graham County · Ruan

Tool 16 — Arrangement Approval Form

Nothing that touches a referral source should be signed without this page completed.

Proposed arrangement: [] Requesting department: [] Date: [__]

1. Counterparty. Name; is the counterparty a physician, an immediate family member of one, or an entity in a position to refer or to receive referrals? [] 2. Business rationale. Why does the organization need this? [] 3. Services and deliverables. Specifically what will be provided, by whom, and how will performance be evidenced? [] 4. Hours or scope. Expected annual hours or volume, and the basis for the estimate. [] 5. Compensation and methodology. Amount; how calculated; what it varies with. [] 6. Does the compensation vary with anything other than personally performed services? ☐ No ☐ Yes — stop and escalate 7. Stark exception relied upon. [] — worksheet attached (Tool 2) 8. Anti-Kickback safe harbor relied upon, or intent analysis. [] — worksheet attached (Tool 3) 9. Fair market value support. Analysis dated [], attached (Tool 4) 10. Commercial reasonableness. Memo dated [], attached (Tool 5) 11. Any document connecting this payment to referral volume or downstream revenue? ☐ No ☐ Yes — stop and escalate 12. Non-monetary compensation impact. Amount counted toward the annual limit this year: $[]; organization-wide total to date: $[] 13. Term and renewal. Effective date; expiration; tickler set for −90 days ☐ 14. Owner. []

Approvals: Department ☐ Finance ☐ Compliance ☐ Legal ☐ [Board committee, if above threshold] ☐

⚠️ No signature without a completed form and a database entry. The entire arrangements control depends on this gate holding.

Tool 17 — Hotline Intake and Triage

Field Entry
Report number and date received
Channel (hotline, email, in person, anonymous)
Reporter (or anonymous); contact permitted?
Allegation summary, in the reporter's words
Category (coding, medical necessity, arrangement, privacy, quality, HR, other)
Federal program implicated?
Potential overpayment? → open Tool 7 today
Assigned to
Counsel notified; privilege posture
Preservation issued
Interim measures
Investigation completed
Substantiated?
Corrective action
Reporter informed of closure
Retaliation check at 30 and 90 days

⭐ The row that matters most is the potential-overpayment row. A hotline report describing billing for services not rendered is credible information, and the sixty-day clock under 42 U.S.C. § 1320a-7k begins to run against the organization from that moment.

Related Documents