25% off all training courses Offer ends May 29, 2026
View HIPAA Courses
25% off all training courses
View HIPAA Courses
Offer ends May 29, 2026

The HIPAA Journal is the leading provider of HIPAA training, news, regulatory updates, and independent compliance advice.

What is an HHS OIG Investigation?

An HHS OIG investigation is a criminal, civil, or administrative investigation into fraud or misconduct in a program run by the Department of Health and Human Services which affects the program, its operation, or its beneficiaries. HHS OIG investigations can result in criminal convictions, financial recoveries, civil monetary penalties, or exclusions from participation in Federal healthcare programs.

Software For Compliance OfficersThe Department of Health and Human Services (HHS) consists of twelve operating divisions which, between them, administer more than 100 programs. Since 1976, the HHS Office of Inspector General (OIG) has been responsible for protecting the integrity of the $2.4 trillion portfolio of programs and the well-being of program beneficiaries.

Within the HHS OIG is an Office of Investigations. The Office of Investigations can be alerted to potential fraud or misconduct by another Office within HHS OIG – for example, the Office of Audit Services – or via the OIG Hotline, which receives allegations of fraud, waste, and abuse in HHS programs from whistleblowers, the public, and HHS employees.

The HHS OIG receives thousands of allegations each year and cannot investigate them all. The Office of Investigations prioritizes allegations according to the nature and scope of the allegation, and the evidence provided to support the allegation. The Office then analyzes the allegation to determine whether it warrants a formal investigation or can be resolved informally.

HHS OIG Exclusions List
What You Need To Know

Get The 6 Essentials Checklist For Compliance Officers

A link to your download will be sent to your email address

Your Privacy Respected

HIPAA Journal Privacy Policy

The Formal HHS OIG Investigation Process

To start a formal HHS OIG investigation, the Office of Investigations issues subpoenas requiring a “target” individual or business to produce documents, conducts witness interviews with the targets, their employees, and/or patients, and visit the target’s offices to conduct inspections. Inspections are rarely announced so that investigators have the best chance of identifying fraud or misconduct.

Once all the relevant evidence has been collected, investigators review the documents, witness statements, and inspection reports to determine whether an unlawful event has taken place (such as a violation of the Stark Law or False Claims Act) or whether the target has violated healthcare regulations (such as issued under the No Surprises Act) to the detriment of a program beneficiary.

At this stage, there are three possible outcomes. The first is that the HHS OIG investigation finds insufficient evidence to support the allegation – in which case the investigation is dropped. The second is that the Office continues the investigation with the help of ancillary agents (i.e., cybersecurity or data analytics experts), and the third is that the Office pursues an enforcement action.

How Long Does an HHS OIG Investigation Take?

An HHS OIG investigation can take several years to complete from being alerted to potential fraud or misconduct, or from receiving a tip via the OIG Hotline. Initial factors that can affect how long an HHS OIG investigation takes include the priority given to the allegation, the amount of evidence provided to support the allegation, and the resources available to investigate the evidence.

Thereafter, the length of the investigation process can depend on the number of documents that have to be produced, the number of witnesses that have to be interviewed, and the cooperation of the target(s) accused of fraud or misconduct. The length of the investigation process might also be extended if ancillary agents are not available when required.

The final factor that can affect how long an HHS OIG investigation takes is the willingness of the target(s) to settle the allegations without formal proceedings. Although this may not be an option in serious cases of fraud or misconduct likely to result in a jail sentence, HHS OIG has the authority to settle allegations without an admission of liability from the target(s).

Office of Investigations Enforcement Actions

Software For Compliance OfficersWhen the Office of Investigations pursues an enforcement action, the penalty can depend on factors such as the nature and scope of the offence, the amount of harm caused, the target’s cooperation during the formal HHS OIG investigation, and any campaign HHS is running to raise awareness of specific regulations (i.e., violations of the Emergency Medical Treatment and Labor Act).

At one end of the scale, an individual or the director/owner of a business can be sent to jail if an HHS OIG investigations uncovers violations of the Social Security Act §1177. At the other end of the scale, an individual can avoid a civil monetary penalty or addition to the HHS OIG Exclusion List by entering into a Corporate Integrity Agreement. Alternatively, agreeing to a Corporate Integrity Agreement can reduce the amount of a civil monetary penalty. For example:

  • In February 2019, Greenway Health LLC settled allegations it had violated the False Claims Act for $57.25 million and agreed to a five year Corporate Integrity Agreement.
  • In December 2017, 21st Century Oncology settled a self-reported violation of the Stark Law for $26 million and entered into a five year Corporate Integrity Agreement.
  • In September 2011, Hill-Rom Company Inc. settled allegations it had violated the False Claims Act for $41.8 million and agreed to a five year Corporate Integrity Agreement.

Author: Steve Alder is the editor-in-chief of The HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist