The OIG is the primary enforcement agency for healthcare fraud and abuse, and its reach extends to every organization that participates in Medicare, Medicaid, or other federal healthcare programs. The OIG's enforcement actions have resulted in billions of dollars in recoveries, thousands of criminal convictions, and tens of thousands of exclusions from federal healthcare programs. No healthcare organization — regardless of size or specialty — is immune from OIG scrutiny.

The OIG Exclusion Database is particularly important for healthcare operators. Employing or contracting with an excluded individual is one of the most common — and most costly — compliance failures in healthcare. The penalties are severe, the obligation to screen is clear, and the OIG has made clear that it will pursue organizations that fail to screen. A single excluded employee can expose an organization to millions of dollars in civil money penalties.

The OIG Work Plan is an annual publication that identifies the OIG's audit and investigation priorities for the coming year. Healthcare organizations should review the Work Plan to understand where the OIG is focusing its enforcement resources and to assess their own compliance risk in those areas. The Work Plan has historically focused on areas such as opioid prescribing, telehealth billing, laboratory billing, and home health fraud.

The OIG was established by the Inspector General Act of 1978, which created independent inspector general offices in major federal agencies to detect and prevent fraud, waste, and abuse. The HHS OIG was one of the first IGs established under the Act. The OIG's healthcare enforcement role expanded significantly with the passage of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which created the Health Care Fraud and Abuse Control (HCFAC) program and provided dedicated funding for healthcare fraud enforcement.

The False Claims Act, originally enacted during the Civil War, was significantly strengthened by the False Claims Amendments Act of 1986, which increased penalties and expanded the qui tam (whistleblower) provisions that allow private individuals to file False Claims Act lawsuits on behalf of the government and share in any recovery. The qui tam provisions have been a powerful enforcement tool — the majority of False Claims Act recoveries in healthcare have been initiated by whistleblowers, often current or former employees of the defendant organization.

The OIG's primary enforcement authorities include:

Anti-Kickback Statute: 42 U.S.C. § 1320a-7b. Prohibits the knowing and willful offer, payment, solicitation, or receipt of anything of value to induce or reward referrals of items or services covered by federal healthcare programs.

Civil Monetary Penalties Law: 42 U.S.C. § 1320a-7a. Authorizes the OIG to impose civil money penalties for false claims, kickbacks, and employment of excluded individuals.

Exclusion Statute: 42 U.S.C. § 1320a-7. Authorizes the OIG to exclude individuals and entities from participation in federal healthcare programs.

Stark Law: 42 U.S.C. § 1395nn. Prohibits physician self-referral for designated health services billed to Medicare.

False Claims Act: 31 U.S.C. § 3729 et seq. Imposes liability on individuals and entities that submit false or fraudulent claims to the federal government.

Anti-Kickback Statute Safe Harbors: 42 CFR § 1001.952. Establishes safe harbors that protect certain arrangements from AKS liability.

Many states have enacted state-level analogs to the federal Anti-Kickback Statute and False Claims Act that apply to state Medicaid programs and commercial insurance. California's Insurance Fraud Prevention Act, Texas's Medicaid Fraud Prevention Act, and New York's False Claims Act impose additional liability for fraud and abuse in state healthcare programs. Healthcare organizations operating in multiple states must comply with both federal and state fraud and abuse laws.

State Medicaid fraud control units (MFCUs) work with the OIG and DOJ to investigate and prosecute Medicaid fraud. MFCUs have authority to investigate fraud by Medicaid providers and to prosecute cases under state law. Healthcare organizations that participate in Medicaid must be prepared for MFCU investigations as well as federal OIG investigations.