Though far from common, OIG subpoenas are increasingly appearing in DMEPOS locations
by Edward Vishnevetsky

It’s a typical Wednesday morning at your DMEPOS storefront location. All of a sudden, two men enter your store and identify themselves as agents of Office of Inspector General (OIG). They hand you a subpoena which requests documents related to one or more types of DMEPOS items you have sold to any patient in the past five years. The subpoena references numerous civil and criminal statutes. The agents then tell you to submit all responsive documents within 30 days. While this scenario may seem unlikely, it is being played out around the country. There are a few things the DME provider should know if served with a subpoena.

Background

An administrative subpoena is evidence that the government is investigating a supplier for potential civil or criminal prosecution. The subpoena may result from observations made during an on-site survey, a prepayment or postpayment audit, billing history or allegations made by a current or former employee. Inspector Generals have two separate means by which to collect evidence. The first is the general and broad administrative subpoena power Congress granted to each Inspector General under HIPAA. This allows the OIG to investigate fraud “relating to the delivery of any payment for health care in the United States,” including fraud against private insurers. The second is authority granted by the Affordable Care Act (ACA) to obtain data and documentation from any Medicare provider. Specifically, the ACA provided the OIG the power “to obtain from any individual” that (1) is a “provider of medical or other items or services, supplier, grant recipient, contractor, or subcontractor” or (2) “directly or indirectly provides, orders, manufactures, distributes, arranges for, prescribes, supplies, or receives medical or other items or services” paid for by Medicare, claims and payment data and any supporting documentation. Unlike a grand jury subpoena, which is only issued when criminal liability is sought, an administrative subpoena may be issued by criminal or civil investigators. These civil and criminal investigators often work in parallel proceedings, sharing information with each other.

What To Do if You Are Served with an Administrative Subpoena

  1. Review the subpoena—First and foremost, the DMEPOS supplier must read and review the subpoena to understand what type of information and documentation is being sought. This may help the supplier identify the reason for the investigation.
  2. Issue a hold notice to employees—The supplier must not move, edit, or delete any documents that may be responsive to the subpoena, lest the supplier be charged with “obstruction of justice.” This is particularly important for electronically stored information (ESI), such as emails, because the OIG can, and most likely will, review metadata related to ESI. As such, a hold notice memorandum should be issued to employees explaining that, among other things, all ESI and physical evidence must be preserved and retained (in current form) until further written notice.
  3. Establish communication with the government—Legal counsel should reach out to the OIG investigator(s) or Assistant U.S. Attorney, if one is assigned to the case, to determine the facts underlying rationale for the subpoena. Sometimes, counsel may be able to discern if the Government has identified the supplier as a “target”, a “subject,” a “person of interest” or a “witness.” Each term has a distinctive meaning and effect on the posture of the investigation. If the supplier reaches out to the OIG investigator(s) or U.S. Attorney without counsel (which I do not suggest), it needs to be cognizant how the information it volunteers to the government can be used against it. Communication with the government is more about listening than it is talking.
  4. Produce responsive documents—Develop a strategy on how to collect and produce responsive documents in accordance with the requirements put forth in the subpoena. Often this is done through third-party forensic collection; in certain circumstances, however, self-collection may be appropriate.