Corrective Action Plans and Integrity Agreements
Paying to resolve a matter is usually the cheaper half of the resolution. What follows is a supervised period with reporting duties, outside review and stipulated penalties, and the obligations bind an organization long after the people who negotiated them have moved on.
The rule in short
Health care enforcement rarely ends with money alone. A plan of correction answers a survey citation. A corrective action plan attached to a settlement imposes policy, training and reporting duties for a defined period. An integrity agreement runs longer, adds independent review and screening obligations, and is the consideration for an agency's agreement not to seek exclusion. Missing an obligation triggers stipulated penalties, and a material breach restores the exclusion avoided.
Four instruments appear at the end of health care enforcement matters, and they are routinely confused because all four are described as corrective action. They differ in who imposes them, how long they run, what they cost to operate and what happens when one is breached. Identifying which instrument is on the table changes how a negotiation should be conducted.
The lightest instrument: answering a citation
A plan of correction responds to a survey finding. It states what was done for the individuals affected, how others potentially affected will be identified, what systemic change prevents recurrence, how the change will be monitored, and when correction is complete. It is submitted on the same form that carried the citation, and it closes when a revisit verifies compliance.
Nothing about it is negotiated and nothing about it releases anything. It is an operational document with a short life, and it is described in more detail in the treatment of the facility survey and deficiency process. Its significance is indirect: a rejected or repeatedly failed plan escalates the enforcement remedy, and the escalation is what produces the heavier instruments.
Corrective action attached to a settlement
Where a privacy or security investigation resolves informally, the resolution commonly pairs a payment with a corrective action plan running for a defined term. The obligations are specific: revise named policies within a stated number of days, submit them for approval, distribute them to the workforce, deliver training and certify completion, conduct an enterprise-wide risk analysis, implement a risk management plan, and report on progress at set intervals.
The reporting is the part organizations underestimate. A plan generates recurring internal deadlines for the whole term, each with an external submission attached, and the agency reviews and returns documents rather than accepting them. Failing to meet the plan reopens the underlying matter rather than creating a new one.
The heaviest instrument, and what it buys
An integrity agreement is a bargain. The organization accepts a long term of supervised compliance, and in exchange the agency agrees not to exercise its permissive authority to exclude the organization from federal health care programs. Exclusion would be fatal for most providers, so the agreement is usually the price of remaining in business rather than an optional add-on.
The obligations are extensive and recurring. A compliance officer reporting to the chief executive and a compliance committee. Board oversight with periodic resolutions and executive certifications. Written standards and a code of conduct. Training with tracked completion. A disclosure program with a confidential channel. Screening of employees, contractors and vendors against the exclusion databases on a recurring cycle. And engagement of an independent review organization to examine claims, financial arrangements, or both.
The obligation to screen employees, contractors, vendors and their principals against the exclusion databases has to run on a schedule and be documented. Organizations put the process in place at signature and then let hiring, staffing agencies and acquisitions outrun it. An excluded person on the payroll is both a reportable event and a source of overpayment liability for everything that person touched, and the failure is discovered during the annual report when nothing can be undone.
| Instrument | Imposed by | Typical term | Core obligation | Consequence of failure |
|---|---|---|---|---|
| Plan of correction | The survey agency | Until a revisit verifies compliance | Systemic correction of a cited deficiency | Escalating enforcement remedies and termination |
| Settlement corrective action plan | The investigating agency, by agreement | A defined term of a small number of years | Policy revision, training, risk analysis and reporting | The underlying matter is reopened |
| Integrity agreement | The inspector general, by agreement | Several years, fixed in the agreement | Compliance infrastructure plus independent review | Stipulated penalties, then exclusion for material breach |
| Systems improvement agreement | The program agency, in lieu of termination | A defined improvement period | Root cause analysis and independent quality monitoring | The deferred termination proceeds |
| Unilateral obligations | Imposed without agreement | Set by the imposing authority | Whatever the instrument specifies | Enforcement on the original authority |
Stipulated penalties and the exclusion trigger
Integrity agreements price their own breaches. Stipulated penalties accrue per day for defined failures: missing a report, failing to engage the reviewer, failing to implement a required policy, failing to screen. The amounts are set in the agreement and are payable on demand, which removes the argument about whether the failure caused harm.
Material breach is the separate and serious category. It typically covers a failure to engage the independent reviewer, a failure to submit an annual report, a failure to respond to a demand for stipulated penalties, and repeated or flagrant violations. The agency issues a notice of material breach, the organization has a short cure period, and exclusion follows if the breach is not cured. That is the whole leverage of the instrument.
The terms worth fighting for
Three terms determine what the agreement actually costs. The scope of the independent review, because a claims review across every service line is an order of magnitude more expensive than one confined to the conduct at issue. The definition of a reportable event, because a broad definition converts routine billing corrections into disclosure obligations. And the term itself, since every obligation repeats annually.
Voluntary disclosure changes this calculation more than anything argued later. An organization that self-reports through the routes described in the sixty-day refund obligation frequently resolves without an integrity agreement at all. Where the underlying conduct involves the arrangements covered by the remuneration prohibitions and their safe harbors, the review obligation usually extends to financial arrangements as well as claims.
Two collateral consequences deserve planning. An agreement is a reportable adverse action under provider enrollment rules, and it must be disclosed on licensure and credentialing applications for years afterward. And where the matter began with a records incident, the risk analysis obligations sit directly on top of the duties described in the breach reporting framework, so the two workstreams should be run by the same people.
Points to carry away
- A plan of correction answers a survey citation and closes when compliance is verified.
- A corrective action plan attached to a settlement typically runs for a defined term with reporting duties.
- An integrity agreement is the consideration for an agency's forbearance from seeking exclusion.
- Independent review by an outside organization is the costliest recurring obligation.
- Reportable events must be disclosed within a short window fixed by the agreement.
- Stipulated penalties accrue per day, and a material breach can trigger exclusion.
Questions readers ask
Who chooses the independent reviewer, and how independent is it?
The organization selects and pays the reviewer, and the agency reviews the selection against independence and objectivity criteria set out in the agreement. The reviewer reports on defined engagements, usually a claims review and a review of financial arrangements, on a schedule the agreement fixes. Because the organization pays, the incentive problem is obvious, which is why the agreements specify the reviewer's qualifications, the methodology, the sample design and the agency's right to reject the engagement.
What is a reportable event and how quickly must it be disclosed?
Agreements define it, and the definition typically covers a substantial overpayment, a probable violation of the criminal, civil or administrative laws applicable to federal health care programs, and the employment or contracting of an ineligible person. Disclosure is due within a short window measured from the date the organization determines the event exists, commonly thirty days. The window is short because the point is to surface problems during the term rather than after it, and late disclosure is itself a breach.
Do these obligations survive a sale of the business?
Usually in some form. Agreements commonly require notice of a proposed sale, closure or purchase of a new location, and they address whether the obligations transfer to a successor. A buyer that inherits the agreement inherits the reporting duties and the exposure to stipulated penalties. Diligence should establish not only whether an agreement exists but how much of the term remains, what obligations are outstanding, and whether any breach notice has been issued.
Sources
- Office of Inspector General — Corporate Integrity AgreementsThe agency's published agreements and its description of the obligations they impose.
- Cornell Legal Information Institute — 42 U.S.C. 1320a-7, Exclusion of Certain Individuals and EntitiesThe mandatory and permissive exclusion authorities an integrity agreement holds in reserve.
- eCFR — 42 CFR Part 1001, Program Integrity: Medicare and State Health Care ProgramsThe exclusion regulations, including reinstatement and the effect of exclusion on payment.
- eCFR — 42 CFR 488.402, General Provisions on EnforcementThe enforcement framework within which a plan of correction operates.
- eCFR — 45 CFR 160.312, Secretarial Action Regarding Complaints and Compliance ReviewsThe informal resolution route that produces a privacy corrective action plan.
- Office of Inspector General — Exclusions ProgramThe exclusion list organizations must screen against and the effect of a listing.
- Office of Inspector General — Self-Disclosure InformationThe disclosure route that often determines whether an integrity agreement is required at all.
Lawwise is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Healthcare Regulation
Using Health Information Without Written Authorization
A covered entity may use or disclose protected health information without authorization to the individual, for treatment, payment and health care operations, under an opportunity to agree or object, and for an enumerated set of public interest purposes. Everything outside that list requires a written authorization, and psychotherapy notes, marketing and any sale of information require one regardless. Permitted disclosures are separately limited to the minimum necessary to accomplish the purpose.
The Self-Referral Prohibition and the Exceptions to It
Where a physician or an immediate family member holds an ownership interest in or a compensation arrangement with an entity, the physician may not refer designated health services to that entity for federal payment and the entity may not present a claim for them, unless the arrangement satisfies an exception in full. Liability does not depend on intent. Amounts collected on prohibited referrals must be refunded, and knowing violations carry additional penalties.
Provider Enrollment, Revalidation and Revocation
Enrollment establishes the effective date from which claims may be paid, and certain practitioner types may bill retrospectively for up to thirty days before it. Enrollment must be revalidated every five years, or every three for equipment suppliers, and a revalidation request must be answered within sixty calendar days. Revocation carries a reenrollment bar of one to ten years, extended to twenty for a second revocation, and it takes effect thirty days after the notice is mailed.