Federal Contractors Subject to Stricter Disclosure and Compliance Requirements

Federal government contractors are now subject to heightened disclosure and compliance requirements. Effective December 12, 2008, the Federal Acquisition Regulations (FAR) was amended to: (i) require government contractors to disclose certain violations of the civil False Claims Act or criminal law whenever the contractor has "credible evidence" of such violations; (ii) allow for suspension or disbarment of a contractor who knowingly fails to disclose possible violations or significant overpayments; and (iii) impose additional requirements on contractor compliance programs and internal controls.¹

In issuing the new rule, the Civilian Agency Acquisition Council and the Defense Acquisition Council acknowledged that the mandatory disclosure requirements present a "sea change" and "major departure" from voluntary disclosure programs, which have largely been ignored by government contractors for the past 10 years.²

The Applicability of FAR

The FAR applies to contracts for the acquisitions of supplies or services by federal agencies,³ including the purchase of health care items and services through the TRICARE/CHAMPUS program.

Notably, the FAR does not apply to health care providers merely because they have entered into a Medicare provider agreement. Although Medicare is subsidized by the federal government, a Medicare provider agreement is not an acquisition for health care services. Accordingly, Medicare providers will not be subject to the FAR's requirements unless the provider has separately entered into a contract with a federal agency to provide specific health care items (e.g., pharmaceuticals) or services (e.g., medical services delivered through a government-sponsored health plan).

The FAR's New Mandatory Disclosure and Compliance Requirements

Mandatory Disclosure of Violations and Significant Overpayments. The new FAR rules require a contractor to disclose violations of federal criminal law, the federal civil False Claims Act and significant overpayments occurring in connection with a covered contract whenever there is "credible evidence" that the violation or overpayment has occurred. These disclosure obligations apply to violations and overpayments committed on existing and future contracts, as well as contracts for which final payment was received within the last three years. The knowing failure of a principal to timely disclose any such violation or overpayment could subject the contractor to suspension and disbarment.

A "principal" means "an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity."⁴ While the regulations do not define what constitutes "credible evidence," the phrase implies that the contractor may take the time to preliminarily examine the evidence relating to a possible violation of federal criminal law in connection with a contract, the federal False Claims Act or a significant overpayment to determine the credibility of the evidence before deciding to make a disclosure.⁵ Until a contractor has determined the evidence to be credible, there can be no "knowing failure to timely disclose."⁶

Any disclosure mandated under the new rule is to be made to the Office of Inspector General of the agency that awarded the contract and to the contracting officer. When making such disclosure, the contractor should generally include information regarding the nature and extent of the violation or overpayment and the responsible individuals.

Development of Compliance Code and Internal Controls Systems. The FAR also now requires all contractors participating in government contracts for an amount exceeding $5 million and 120 days (excluding small business and commercial item contractors) to establish a written code of business ethics and conduct. Federal contractors are also required to implement internal controls systems to detect, investigate and assess potential violations to determine whether there is credible evidence requiring disclosure. These internal controls must provide for, among other things, mandatory disclosure procedures, monitoring and auditing, employee training and an internal reporting system to detect violations. The mandatory internal controls, which were previously only recommended, must be in place within 90 days of being awarded a government contract, unless the contractor allows for a longer period.

Action Items

For federal contractors who do not provide health care services, the new rule presents a major departure from current practices and policies. However, many health care providers have already developed and implemented internal controls and reporting procedures similar to those required under the FAR through existing compliance plans. Thus, the FAR's new rule may not present significant changes for many health care providers. Any health care provider subject to the FAR should ensure they have implemented sufficient policies and procedures to comply with the new rule.

To ensure compliance, government health care contractors should identify all contracts subject to the mandatory disclosure requirements by developing an inventory of current and prior contracts that have been closed out in the past three years. In addition, contractors should identify the "principals" within their organization and ensure that these individuals, as well as employees, agents and subcontractors, are educated on the new disclosure obligations. It will also be important for contractors to review and, as necessary, revise ethics and compliance programs and internal control systems to ensure the new requirements are satisfied.

For health care providers that have not entered into a federal contract covered by the FAR, no action is required. However, the new FAR regulations serve as a reminder of the government's increasing focus on and scrutiny of compliance programs. All providers are encouraged to review and update existing compliance programs to ensure they incorporate the latest compliance guidance published by the OIG and the U.S. Sentencing Guidelines, with particular focus on risk areas identified by the provider or in the OIG's work plan for 2009.

If you have any questions about the FAR's new mandatory disclosure or compliance requirements, or if you would like assistance in developing or reviewing your compliance program, please contact one of Reinhart's health care attorneys in our Milwaukee office by calling 414-298-1000 or in our Madison office by calling 608-229-2200.

---

¹ 73 Fed. Reg. 67067-67093 (Nov. 12, 2008).
² Id. at 67069.
³ 48 C.F.R. § 2.101.
⁴ Id.
⁵ Id. at 67074.
⁶ Id.