OIG’s Annual Work Plan Targets Data Protection and Reporting

This week, the Department of Health and Human Services Office of Inspector General (OIG) released its Work Plan for fiscal year 2016. The audits and investigations identified in the Work Plan provide the medical device industry with insight into OIG’s objectives for the coming year. This year’s Work Plan covers a number of new and ongoing initiatives that relate to medical device manufacturers.

We highlight some of these key objectives for 2016 below:

• Payments for Replaced Medical Devices: In light of prior OIG reviews concluding that Medicare administrative contractors (MACs) have made improper payments to hospitals for claims involving replaced implantable medical devices, OIG plans to continue its work to determine whether payments for replacement devices that have been recalled or found to be defective were made in accordance with Medicare requirements. 
• Analysis of Open Payments Data: OIG had previously started a review of the financial interests reported by manufacturers under the Open Payments program to determine whether the reported data were fully and accurately displayed on the Centers for Medicare & Medicaid Services (CMS) website. Now OIG intends to analyze the validity of the data submitted. 
• Validation of Quality Reporting Data: OIG plans to conduct a study to determine the extent to which CMS has validated quality reporting data used in the inpatient hospital value-based purchasing program and the impact of that validation work. 
• Review of Networked Medical Devices: Providers have increasingly leveraged networked medical devices (e.g., dialysis machines and medication dispensing systems) to transmit electronic protected health information (ePHI). As OIG notes, this uptake of networked medical devices has heightened the risk of data breaches. OIG plans to examine whether the Food and Drug Administration’s oversight of hospitals’ networked medical devices is sufficient to effectively protect ePHI. 
• Protection of ePHI: OIG states that the Office of Civil Rights (OCR) has not implemented adequate controls in the past to ensure the protection of ePHI and plans to analyze the adequacy of OCR’s current oversight over the security of ePHI.
• Human Research Subjects Protection: OIG plans to review the process that the Office for Human Research Protections uses to exercise oversight over compliance with, and potential violations of, federal regulations protecting human research subjects. 

If you have any questions regarding this Sidley Update, please contact the Sidley lawyer with whom you usually work, or