Form CMS-10328 Medicare Self-Referral Disclosure Protocol

OMB CONTROL NUMBER: 0938-1106

CMS Voluntary Self-Referral Disclosure Protocol
I. Introduction
The Affordable Care Act (ACA), enacted on March 23, 2010, provides for the establishment of a
voluntary self-disclosure protocol, under which providers of services and suppliers may selfdisclose actual or potential violations of the physicians self-referral statute (section 1877 of the
Social Security Act). The physician self-referral statute prohibits a physician from making
referrals for certain designated health services (DHS) payable by Medicare to an entity with
which he or she (or an immediate family member) has a financial relationship (ownership,
investment, or compensation), unless an exception applies; prohibits the entity from presenting
or causing to be presented claims to Medicare (or billing another individual, entity, or third-party
payer) for those referred services; and establishes a number of specific exceptions and grants the
Secretary of Health and Human Services (HHS) the authority to create regulatory exceptions for
financial relationships that do not pose a risk of program or patient abuse.
Specifically, section 6409 of the ACA requires the Secretary of HHS, in cooperation with the
Inspector General of HHS to establish a Medicare self-referral disclosure protocol (SRDP) that
sets forth a process for providers of services and suppliers to self-disclose actual or potential
violations of the physician self-referral statute. Section 6409 of the ACA requires the Secretary
of HHS to inform providers of services and suppliers of how to disclose an actual or potential
violation pursuant to the protocol through publication on the CMS website. Furthermore, section
6409 of the ACA mandates that the SRDP include direction to health care providers of services
and suppliers on the specific person, official, or office to whom such disclosures shall be made
and instruction on the implication of the SRDP on corporate integrity agreements and corporate
compliance agreements. Section 6409(b) of the ACA grants the Secretary of HHS the authority
to reduce the amount due and owing for all violations of the physician self-referral statute. In
establishing the amount by which an overpayment resulting from a violation(s) may be reduced,
the Secretary may consider: the nature and extent of the improper or illegal practice; the
timeliness of such disclosure; the cooperation in providing additional information related to the
disclosure; and such other factors as the Secretary considers appropriate. Section 6409(a)(3) of
the ACA explicitly states that the SRDP is separate from the advisory opinion process related to
physician referrals set forth in 42 C.F.R. §§ 411.370 through 411.389. Thus, a provider of
services or supplier may not disclose an actual or potential violation(s) through the SRDP and
request an advisory opinion for conduct underlying the same arrangement(s) concurrently.
Section 6402 of the ACA establishes a deadline for reporting and returning overpayments by the
later of: (1) the date which is 60 days after the date on which the overpayment was identified; or
(2) the date any corresponding cost report is due, if applicable. At the time the provider of
services or supplier electronically submits a disclosure under the SRDP (and receives email
confirmation from CMS that the disclosure has been received), the obligation under section 6402
of the ACA to return any potential overpayment within 60 days will be suspended until a
settlement agreement is entered, the provider of services or supplier withdraws from the SRDP,
or CMS removes the provider of services or supplier from the SRDP.

1

OMB CONTROL NUMBER: 0938-1106

II. The SRDP
The SRDP is open to all health care providers of services and suppliers, whether individuals or
entities, and is not limited to any particular industry, medical specialty, or type of service. For
purposes of the SRDP, “providers of services” and “suppliers” will be referred to as “disclosing
parties.” The fact that a disclosing party is already subject to Government inquiry (including
investigations, audits or routine oversight activities) will not automatically preclude acceptance
of a disclosure. The disclosure, however, must be made in good faith. A disclosing party that
attempts to circumvent an ongoing inquiry or fails to fully cooperate during the self-disclosure
process will be removed from the SRDP.
The SRDP cannot be used to obtain a CMS determination as to whether an actual or potential
violation of the physician self-referral law occurred. As stated above and in section 6409(a)(3)
of the ACA, the SRDP is separate from the CMS physician self-referral advisory opinion
process. The SRDP is intended to facilitate the resolution of only matters that, in the disclosing
party’s reasonable assessment, are actual or potential violations of the physician self-referral law.
Thus, a disclosing party should make a submission to the SRDP with the intention of resolving
its overpayment liability exposure for the conduct it identified.
CMS will review the circumstances surrounding the matter disclosed to determine an appropriate
resolution. In some instances, Medicare contractors may be responsible for processing any
identified overpayment. CMS is not bound by any conclusions made by the disclosing party
under the SRDP and is not obligated to resolve the matter in any particular manner.
Nevertheless, CMS will work closely with a disclosing party that structures its disclosure in
accordance with the SRDP to reach an effective and appropriate resolution. As a condition of
disclosing a matter pursuant to the SRDP, the disclosing party agrees that no appeal rights attach
to claims relating to the conduct disclosed if resolved through a settlement agreement. If the
disclosing party withdraws or is removed from the SRDP, the disclosing party may appeal any
overpayment demand letter in accordance with applicable regulations. Furthermore, as a
condition of entering the SRDP, providers of services and suppliers agree that if they are denied
acceptance into the SRDP, withdraw from the SRDP, or are removed from the SRDP by CMS,
the reopening rules at 42 C.F.R. §§ 405.980 through 405.986 shall apply from the date of the
initial disclosure to CMS.
III. Cooperation with OIG and the Department of Justice (DOJ)
Participation in the SRDP is limited to actual or potential violations of the physician self-referral
statute. The OIG’s Self-Disclosure Protocol is available for disclosing conduct that raises
potential liabilities under other federal criminal, civil, or administrative laws. See 63 Fed. Reg.
58399 (Oct. 30, 1998); OIG’s Open Letter to Health Care Providers, March 24, 2009. For
example, conduct that raises liability risks under the physician self-referral statute may also raise
liability risks under the OIG’s civil monetary penalty authorities regarding the federal antikickback statute and should be disclosed through the OIG’s Self-Disclosure Protocol. Disclosing
parties should not disclose the same conduct under both the SRDP and OIG’s Self-Disclosure
Protocol.

2

OMB CONTROL NUMBER: 0938-1106

Upon review of the disclosing party’s disclosure submission(s), CMS will coordinate with the
OIG and DOJ. CMS may conclude that the disclosed matter warrants a referral to law
enforcement for consideration under its civil and/or criminal authorities. When appropriate,
CMS may use a disclosing party’s submission(s) to prepare a recommendation to OIG and DOJ
for resolution of False Claims Act, civil monetary penalty, or other liability. Accordingly, the
disclosing party’s initial decision of where to disclose a matter involving non-compliance with
section 1877 of the Social Security Act should be made carefully.
Disclosing parties who currently have corporate integrity agreements (CIAs) or certification of
compliance agreements (CCAs) with the OIG should also comply with any disclosure or
reportable event requirements under such agreements. Effective September 23, 2010, a
reportable event solely related to a Stark issue should be disclosed to CMS using the
requirements set forth in this self-disclosure protocol with a copy to the disclosing party’s OIG
monitor. Any further questions about any applicable CIA or CCA requirements should be
directed to the disclosing party’s OIG monitor.
IV. Instructions Regarding the Voluntary Disclosure Submission
The disclosing party will be expected to make a submission as follows.
A. Disclosure
The disclosure must be submitted electronically to [email protected]. In addition, the
disclosing party must submit an original and 1 copy by mail to the Division of Technical
Payment Policy, ATTN: Provider and Supplier Self-Disclosure, Centers for Medicare and
Medicaid Services, 7500 Security Boulevard, Mailstop C4-25-02, Baltimore, MD 21244-1850.
Submissions by facsimile will not be accepted. When the disclosing party submits a disclosure
electronically, CMS will immediately send a response email acknowledging receipt of the
submission. After reviewing the submission, CMS will send a letter to the disclosing party or its
representative either accepting or rejecting the disclosure.
B. Required Information Related to the Matter Disclosed
1. Description of Actual or Potential Violation(s)
The submission should include the following—
a. The name, address, national provider identification numbers (NPIs), CMS Certification
Number(s) (CCN), and tax identification number(s) of the disclosing party. If the disclosing
party is an entity that is owned, controlled, or is otherwise part of a system or network, include a
description or diagram that explains the pertinent relationships and the names and addresses of
any related entities, as well as any affected corporate divisions, departments, or branches.
Additionally, provide the name and address of the disclosing party’s designated representative
for purposes of the voluntary disclosure.

3

OMB CONTROL NUMBER: 0938-1106

b. A description of the nature of the matter being disclosed, including the type of financial
relationship(s), the parties involved, the specific time periods the disclosing party may have been
out of compliance (and, if applicable, the dates or a range of dates whereby the conduct was
cured), and type of designated health service claims at issue. In addition, the description must
include the type of transaction or other conduct giving rise to the matter, and the names of
entities and individuals believed to be implicated and an explanation of their roles in the matter.
c. A statement from the disclosing party regarding why it believes a violation of the physician
self-referral law may have occurred, including a complete legal analysis of the application of the
physician self-referral law to the conduct and any physician self-referral exception that applies
to the conduct and/or that the disclosing party attempted to use. This analysis must identify and
explain which element(s) of the applicable exception(s) were met and which element(s) were
not met. In addition, the submission should include a description of the potential causes of the
incident or practice (e.g., intentional conduct, lack of internal controls, circumvention of
corporate procedures or Government regulations).
d. The circumstances under which the disclosed matter was discovered and the measures taken
upon discovery to address the actual or potential violation and prevent future instances of
noncompliance.
e. A statement identifying whether the disclosing party has a history of similar conduct, or has
any prior criminal, civil, and regulatory enforcement actions (including payment suspensions)
against it.
f. A description of the existence and adequacy of a pre-existing compliance program that the
disclosing party had, and all efforts by the disclosing party to prevent a recurrence of the incident
or practice in the affected division as well as in any related health care entities (e.g., new
accounting or internal control procedures, new training programs, increased internal audit efforts,
increased supervision by higher management). Further describe the measures or actions taken by
the disclosing party to restructure the arrangement or non-compliant relationship.
g. A description of appropriate notices, if applicable, provided to other Government agencies,
(e.g., Securities and Exchange Commission, Internal Revenue Service) in connection with the
disclosed matter.
h. An indication of whether the disclosing party has knowledge that the matter is under current
inquiry by a Government agency or contractor. If the disclosing party has knowledge of a
pending inquiry, identify any such Government agency or contractor, and the individual
representatives involved, if known. The disclosing party must also disclose whether it is under
investigation or other inquiry for other matters relating to a Federal health care program,
including any matters it has disclosed to other Government entities, and provide similar
information relating to those other matters.

4

OMB CONTROL NUMBER: 0938-1106

2. Financial Analysis
As part of its initial disclosure submission, the disclosing party must conduct a financial
analysis relating to the actual or potential violation(s) of the physician self-referral law, and
report its findings to CMS. A disclosing party should demonstrate that a full examination of the
disclosed conduct has occurred. The financial analysis should—
a. Set forth the total amount, itemized by year, that is actually or potentially due and owing based
upon the applicable “look back” period. The “look back” period is the time during which the
disclosing party may not have been in compliance with the physician self-referral law.
b. Describe the methodology used to set forth the amount that is actually or potentially due and
owing. Indicate whether estimates were used, and, if so, how they were calculated.
c. Set forth the total amount of remuneration a physician(s) received as a result of an actual or
potential violation(s) based upon the applicable “look back” period.
d. Provide a summary of any auditing activity undertaken and a summary of the documents the
disclosing party has relied upon relating to the actual or potential violation(s) disclosed.
C. Certification
The disclosing party, or in the case of an entity its Chief Executive Officer, Chief Financial
Officer, or other authorized representative, must submit to CMS, along with all submissions, a
signed certification stating that, to the best of the individual’s knowledge, the information
provided contains truthful information and is based on a good faith effort to bring the matter to
CMS’ attention for the purpose of resolving the disclosed potential liabilities relating to the
physician self-referral law.
V. CMS’ Verification
Upon receipt of a disclosing party’s disclosure submission, CMS will begin its verification of the
disclosed information. The extent of CMS’ verification effort will depend, in large part, upon
the quality and thoroughness of the submissions received. Matters uncovered during the
verification process, which are outside of the scope of the matter disclosed to CMS, may be
treated as new matters outside the SRDP.
To facilitate CMS’ verification and validation processes, CMS must have access to all financial
statements, notes, disclosures, and other supporting documents without the assertion of privileges
or limitations on the information produced. In the normal course of verification, CMS will not
request production of written communications subject to the attorney-client privilege. However,
there may be documents or other materials, which CMS believes are critical to resolving the
disclosure, that may be covered by the work product doctrine. CMS is prepared to discuss with a
disclosing party’s counsel ways to gain access to the underlying information without waiver of
protections provided by an appropriately asserted claim of privilege.

5

OMB CONTROL NUMBER: 0938-1106

CMS may request additional information, such as financial statements, income tax returns, and
other documents, if needed. If additional information is requested, a disclosing party will be
given at least 30 days to furnish the information.
VI. Payments
Because of the need to verify the information provided by a disclosing party, CMS will not
accept payments of presumed overpayments determined by the disclosing party prior to the
completion of CMS’ inquiry. However, the disclosing party is encouraged to place the funds in
an interest-bearing escrow account to ensure adequate resources have been set aside to repay
amounts owed. While the matter is under CMS inquiry, the disclosing party must refrain from
making payment relating to the disclosed matter to the Federal health care programs or their
contractors without CMS’ prior consent. If CMS consents, the disclosing party will be required
to acknowledge in writing that the acceptance of the payment does not constitute the
Government’s agreement as to the amount of losses suffered by the programs as a result of the
disclosed matter, and does not relieve the disclosing party of any criminal, civil, or civil
monetary penalty liability, nor does it offer a defense to any further administrative, civil, or
criminal actions against the disclosing party. We remind disclosing parties, pursuant to section
1877(g)(2) of the Act, that any amounts collected from individuals that were billed in violation
of the physician self-referral law must be refunded to the individuals on a timely basis.
VII. Cooperation and Removal from the SRDP and Timeliness of Disclosure
The disclosing party’s diligent and good faith cooperation throughout the entire process is
essential. Accordingly, CMS expects to receive documents and information from the disclosing
party that relate to the disclosed matter without the need to resort to compulsory methods. If a
disclosing party fails to work in good faith with CMS to resolve the disclosed matter, that lack of
cooperation will be considered when CMS assesses the appropriate resolution of the matter.
Similarly, the intentional submission of false or otherwise untruthful information, as well as the
intentional omission of relevant information, will be referred to DOJ or other Federal agencies
and could, in itself, result in criminal and/or civil sanctions, as well as exclusion from
participation in the Federal health care programs. Furthermore, it is imperative for disclosing
parties to disclose matters in a timely fashion once identified. As stated above, section 6402 of
the ACA establishes a deadline for reporting and returning overpayments by the later of: (1) the
date which is 60 days after the date on which the overpayment was identified; or (2) the date any
corresponding cost report is due, if applicable.
VIII. Factors Considered in Reducing the Amounts Owed
The factors CMS may consider in reducing the amounts otherwise owed include: (1) the nature
and extent of the improper or illegal practice; (2) the timeliness of the self-disclosure; (3) the
cooperation in providing additional information related to the disclosure; (4) the litigation risk
associated with the matter disclosed; and (5) the financial position of the disclosing party. While
CMS may consider these factors in determining whether reduction in any amounts owed is
appropriate, CMS is not obligated to reduce any amounts due and owing. CMS will make an
6

OMB CONTROL NUMBER: 0938-1106

individual determination as to whether a reduction is appropriate based on the facts and
circumstances of each disclosed actual or potential violation. The nature and circumstances
concerning a physician self-referral violation can vary given the scope of the physician selfreferral law and the health care industry. Given this variability, CMS needs to evaluate each
matter in order to determine the severity of the physician self-referral law violation and an
appropriate resolution for the conduct.
PRA Disclosure Statement
According to the Paperwork Reduction Act of 1995, no persons are required to respond to a
collection of information unless it displays a valid OMB control number. The valid OMB
control number for this information collection is 0938-1106. The time required to complete this
information collection is estimated to average 50 hours per response, including the time to
review instructions, search existing data resources, gather the data needed, and complete and
review the information collection. If you have comments concerning the accuracy of the time
estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security
Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, MD 212441850.

7