Healthcare providers and vendors who provide items and services to providers have many reasons to carefully evaluate their legal and financial risk. One reason might involve learning that the organization is being investigated by the federal government (for example, the OIG, CMS, or FBI). Alternatively, a staff member or vendor may tell the owner about questions regarding the documentation supporting the business' billings. The provider/vendor needs to investigate the allegations, evaluate the legal and financial risk and take appropriate corrective action; otherwise, the risk of facing significant administrative, civil, or criminal sanctions can become very real.

Many organizations do not see a value in or have the resources to conduct an internal investigation and resist doing so. Conducting an internal investigation is sometimes viewed as an admission that something "wrong" and there is a "problem." The obligation to and cost of fixing the "problem," both financial and reputational to the organization and senior management, is another concern. Frequently, it also is difficult to demonstrate how internal investigations contribute to the "bottom line."

Every Medicare or Medicaid provider is expected to implement and maintain a compliance program that satisfies all 7 elements set out in the Federal Sentencing Guidelines. How sophisticated a practice's compliance plan needs to be and the resources devoted to it should be a reflection of the size of the organization. Significantly, in order to satisfy at least 4 of the elements, a provider/vendor needs to be able to conduct effective internal investigations.

Although every internal investigation is different, there are common elements. Specifically, determining (i) the facts and identifying the associated risks; (ii) what happened and who was involved; and (iii) what needs to be done to rectify the situation.

In many situations there is no realistic alternative to conducting an internal investigation. Healthcare providers and vendors cannot safely disregard allegations involving, for example, receipt of incorrect payments from Medicare, or involvement in an arrangement that violates the Stark Law. There is an obligation to institute an internal investigation in order to determine the truth of the matter, and take appropriate corrective action, including repaying Medicare. To make that obligation clear, a provider must repay any "known overpayment" to Medicare, usually within 60 days of discovery. Otherwise, the organization may become a defendant in a lawsuit brought by either the government or a "Whistleblower" under the Federal False Claims Act, where penalties are as much as treble damages plus $11,000 per claim, and possible exclusion from the Federal health care programs.

An effective internal investigation requires identifying the individuals (staff and/or outsiders), who have the needed expertise. Whether to bring in outside legal counsel, thereby potentially having the ability to conduct the investigation under the attorney-client communications privilege, is an important issue that should be addressed at the planning stage. The ability to assert this privilege may become critical in the event of future litigation or settlement negotiations.

After determining the facts and establishing responsibility, an internal investigation's findings should provide the business' senior managers information the information needed to understand and weigh the risks, decide further actions, and oversee the development and implementation of appropriate corrective actions. For example, the organization my develop and implement new policies and procedures, terminate/add/retrain personnel, implement or expand staff training, engage consultants, and/or taking advantage of the government's various voluntary disclosure protocols.

Today, every healthcare provider and vendor should anticipate that it will need to conduct multiple internal investigations. If the business does not have the resources internally (and many do not), it should be prepared to look for the expertise outside. While the internal investigation process is not desirable, pleasant, or inexpensive, in the long run a provider or vendor that finds and fixes its problems itself is going to be better off than one that ignores the problem and acts like an ostrich, until forced to do so by either a Whistleblower and/or the government.