Ethics Toolkit

Civil law exists, among many other reasons, to define the nature and boundaries of relationships (e.g., landlord-tenant, employer-employee, property owner-trespasser, and hundreds of other relationships) as well as to allow for compensation (typically financial) when negligence has been determined by a court or jury. Civil law recognizes “torts,” which are wrongs that can be actionable in a court of law. Examples of torts include, but are not limited to, breach of contract, slander, defamation, negligence, civil battery, products liability, intentional (or unintentional) infliction of emotional distress, invasion of privacy, nuisance, wrongful death, wrongful life, and tortious interference with business opportunity. Civil law can result in sanctions such as fines or licensure actions. The primary purpose of tort law is to compensate or “make whole” a plaintiff who has been harmed by a wrongful act or omission. It is frequently used to test the validity of a contract or portions thereof. While civil law is adjudicated in courts designed to hear such legal issues, a form of civil law is administrative law, which must be handled through the administrative process before entering into the federal or state court systems, as described in detail below.

As the name implies, criminal law deals with the criminal codes of state and federal government. A defendant in a criminal case who is convicted of a crime may be imprisoned, fined, and even put to death in some jurisdictions. As it pertains to healthcare, there is, unfortunately, no shortage of criminal actions against healthcare providers that violate various laws such as the federal Anti-kickback Statute (AKS), the Stark Law, and the False Claims Act (FCA). A conviction for one of the myriad healthcare statutes may result in a fine, imprisonment, and exclusion from participating in a federal health program. Those enforcement actions are not mutually exclusive and more often than not, a convicted defendant will not only be excluded from participation in any federal health program but may be subject to imprisonment, fines, and restitution.

A recent example (one of literally thousands) was announced by the U.S. Department of Justice (DOJ) on January 15, 2025. The DOJ issued a press release stating that the former chief executive officer (CEO) of a Texas hospital was sentenced to 36 months in a federal prison for conspiracy to violate the federal AKS. According to the DOJ’s press release, Jeffrey Paul Madison, the former CEO, also agreed to pay over $5.3 million to settle the FCA claims. The DOJ indicted other co-conspirators who were potentially facing imprisonment and fines. Of note, the FCA provides for both criminal and civil sanctions, which are not necessarily mutually exclusive.

In another DOJ press release just days after the example above, on January 23, 2025, the operator of a home health company was sentenced to 12 years in prison in addition to three years of supervised release for an alleged multimillion-dollar healthcare fraud scheme. According to the DOJ, the former operator “siphoned over $100 million from a program designed to support our most vulnerable residents.” Criminal indictments and convictions for healthcare fraud and related matters occur with alarming frequency.

Claims under both criminal and civil statutes for the same defendant(s) are not mutually exclusive. For example, the Ronald Reagan Atrium I Nursing & Rehabilitation Center in Pennsylvania was cited by surveyors for an elopement that resulted in a resident’s death. An investigation uncovered an alleged massive $7 million Medicare and Medicaid fraud scheme. Martha Bell, the former founder and administrator, was convicted of healthcare fraud and sentenced to up to five years in a federal prison along with a $50,000 fine. Meanwhile, the civil monetary penalty imposed by the Centers for Medicare & Medicaid Services (CMS) seemed almost insignificant compared to sentencing to a federal prison.

Federal and state statutes on the same topic often mirror one another. A recent example of a case where a skilled nursing facility challenged allegations of regulatory violations was Life Care Center – Kirkland v. CMS (Life Care). Life Care was the “index facility” for COVID-19 and the very first time that a nursing facility was alleged to have violated both federal and state regulations regarding infection control that led to residents and staff succumbing to COVID-19. Life Care Center – Kirkland v. CMS, DAB No. CR5975 (2021). Life Care appealed the enforcement actions imposed by both the state of Washington and CMS. It prevailed at the state level. When arguing that its actions did not constitute “immediate jeopardy” before a federal Administrative Law Judge (ALJ), Life Care asserted that the issue(s) were already decided by a court of competent jurisdiction at the state level. (There is a legal doctrine known as “collateral estoppel” that essentially prevents an individual or entity from having to defend the same issues that another judicial forum adjudicated.) Nonetheless, in the federal case, the ALJ, while describing Life Care’s staff as “heroic,” refused to follow what a state forum had already determined.

Sometimes what starts out in state court may end up in a federal court. One such ethical/legal issue was the highly publicized case of Terri Schiavo. The legal (and ethical) issue was whether the husband of a woman who was in a persistent vegetative state (PVS) could have her feeding tube removed and be allowed to die. Although that case began in the Sixth Circuit Court of Florida, it ended up before the U.S. Supreme Court. (The Supreme Court refused a petition to review the decision of the Florida Supreme Court and upheld the right to refuse and/or withdraw medical treatment.)

Another case dealing with legal and ethical issues had a similar trajectory. In the landmark case of Cruzan v. Director, Missouri Dept. of Health (Cruzan), 497 U.S. 261 (1990), a case involving the withdrawal of life-prolonging measures, the case began in Missouri’s state courts and worked its way to the U.S. Supreme Court. In situations involving constitutional issues, such as those involving patient autonomy and the right to refuse medical treatment or have life-sustaining treatment withdrawn, both state and federal courts have jurisdiction.

The area of law that skilled nursing facilities and all other Medicare providers are perhaps most familiar with is administrative law. Of note, the Supreme Court in its 2024 term made the most sweeping changes regarding administrative law in the last 40 years, as explained below.

The Medicare statute mandates that all claims arising under it must first be “channeled” through the administrative process. In other words, before a skilled nursing facility or other Medicare provider can get into federal court to dispute or challenge the government’s allegations of violations, it must first “exhaust” its administrative remedies. The practical impact of the statute is that if a SNF received a civil monetary penalty, a denial of payment for new admissions, termination, or any other CMS enforcement action, it must first appeal to an ALJ within the HHS Departmental Appeals Board (DAB or Board). After the ALJ renders a decision, whichever side did not prevail can appeal to the Board, where a panel of three judges will hear the challenge to the ALJ’s decision. Only after the Board issues a decision can a provider appeal to federal courts. (CMS is not permitted to appeal an adverse decision from the Board as it is considered the secretary’s final determination.)

The problem with the administrative process is that it can take years for a provider to reach federal court. Most ALJs take two years or more to decide a case and the Board takes another two or three years to decide an appeal of an ALJ decision. Since a provider can only get into federal court after there is “exhaustion of administrative remedies,” a provider appealing a CMS enforcement action will typically have to wait more than six years before being able to argue its case in front of a federal court of appeals or district court. A section on administrative law would be incomplete without mention of a landmark case the U.S. Supreme Court recently decided. In the case of Loper Bright Enterprises v. Raimondo, S.Ct. 2244 (2024), the Court struck down the 40-year-old doctrine known as “Chevron deference.” See, e.g., Chevron v. NRD, 467 U.S. 837 (1984). Since 1984, federal courts typically deferred to an agency’s interpretation of its regulations. The reasoning at the time Chevron was decided was that agencies have more experience than the courts regarding complex issues involving the nuances of the Medicare statute, the tax code, or highly technical environmental regulations.

After rescinding the “Chevron deference” doctrine, judges must now determine if an agency’s interpretation of an ambiguous statute is reasonable. As the Court in Loper Bright noted, the Administrative Procedures Act requires courts to use their independent judgement when deciding on the appropriate interpretation of a statute. It may not simply defer to an agency’s interpretation of the statute. Moreover, the Court stated that since the seminal case of Marbury v. Madison, decided in 1803, “[i]t is emphatically the province and duty of the judicial department to say what the law is.”

There is a hierarchy of laws. For example, when Congress passes a statute subsequently signed by the president, that is known as “black-letter law.” Under our constitutional system, once Congress enacts legislation, each agency is responsible for promulgating regulations that explain how the agency intends to carry out the intent of Congress.

Section 6102 of the Patient Protection and Affordable Care Act (PPACA or ACA) amended Section 11281 of the Social Security Act so that all nursing facilities that participate in the Medicare and/or Medicaid programs must have an “effective compliance and ethics program by March 23, 2013.” (The deadline for nursing facilities to be in compliance with the new regulation was extended to November 28, 2019.) The ACA mandated that the HHS Office of the Inspector General (OIG) promulgate regulations regarding the design and implementation of a compliance and ethics program. The CMS regulation requiring an effective compliance and ethics program is found at 42 C.F.R. § 483.85 (see link below).
 

CMS has promulgated regulations at 42 C.F.R. part 483 that describe the Requirements of Participation that all SNFs must follow. Failure to be in “substantial compliance” with any of the sections or subsections in part 483 could result in enforcement actions ranging from a civil money penalty (CMP) to a denial of payment for new admissions (DPNA) and even termination from the Medicare program, in addition to other enforcement actions. The regulation regarding compliance and ethics programs articulates eight critical elements - “at a minimum” - for an effective compliance and ethics program. Those eight elements are noted below:

1. Established written compliance and ethics standards, policies, and procedures to follow that are reasonably capable of reducing the prospect of criminal, civil, and administrative violations under the Act and promote quality of care, which include, but are not limited to, the designation of an appropriate compliance and ethics program contact to which individuals may report suspected violations, as well as an alternate method of reporting suspected violations anonymously without fear of retribution; and disciplinary standards that set out the consequences for committing violations for the operating organization's entire staff; individuals providing services under a contractual arrangement; and volunteers, consistent with the volunteers' expected roles.
2. Assignment of specific individuals within the high-level personnel of the operating organization with the overall responsibility to oversee compliance with the operating organization's compliance and ethics program's standards, policies, and procedures, such as, but not limited to, the chief executive officer (CEO), members of the board of directors, or directors of major divisions in the operating organization.
3. Sufficient resources and authority to the specific individuals designated in paragraph (c)(2) of this section to reasonably assure compliance with such standards, policies, and procedures.
4. Due care not to delegate substantial discretionary authority to individuals who the operating organization knew or should have known through the exercise of due diligence, had a propensity to engage in criminal, civil, and administrative violations under the Social Security Act.
5. The facility takes steps to effectively communicate the standards, policies, and procedures in the operating organization's compliance and ethics program to the operating organization's entire staff; individuals providing services under a contractual arrangement; and volunteers, consistent with the volunteers' expected roles. Requirements include, but are not limited to, mandatory participation in training as set forth at § 483.95(f) or orientation programs or disseminating information that explains in a practical manner what is required under the program.
6. The facility takes reasonable steps to achieve compliance with the program's standards, policies, and procedures. Such steps include, but are not limited to, utilizing monitoring and auditing systems reasonably designed to detect criminal, civil, and administrative violations under the Act by any of the operating organization's staff, individuals providing services under a contractual arrangement, or volunteers, having in place and publicizing a reporting system whereby any of these individuals could report violations by others anonymously within the operating organization without fear of retribution, and having a process for ensuring the integrity of any reported data.
7. Consistent enforcement of the operating organization's standards, policies, and procedures through appropriate disciplinary mechanisms, including, as appropriate, discipline of individuals responsible for the failure to detect and report a violation to the compliance and ethics program contact identified in the operating organization's compliance and ethics program.
8. After a violation is detected, the operating organization must ensure that all reasonable steps identified in its program are taken to respond appropriately to the violation and to prevent further similar violations, including any necessary modification to the operating organization's program to prevent and detect criminal, civil, and administrative violations under the Act.

A copy of the entire text of the regulation at 42 C.F.R. §483.85 can be found at https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-483/subpart-B/section-483.85. CMS also promulgated a related regulation at 42 C.F.R. §483.95(f) that requires the operating organization for each facility to include as part of its compliance and ethics program, as outlined in §483.85:

1. An effective way to communicate that program's standards, policies, and procedures through a training program or in another practical manner which explains the requirements under the program
2. Annual training if the operating organization operates five or more facilities

As with all aspects of complying with the requirements of participation, adequate documentation that demonstrates compliance with the regulations’ mandates is essential.

The regulation defines “operating organizations” as, “the individual(s) or entity that operates a facility.” There are additional requirements for organizations that operate five or more SNFs. For example, those entities must also include, at a minimum, the following elements in their compliance and ethics program:

1. A mandatory annual training program on the operating organization's compliance and ethics program that meets the requirements set forth in § 483.95(f)
2. A designated compliance officer for whom the operating organization's compliance and ethics program is a major responsibility. This individual must report directly to the operating organization's governing body and not be subordinate to the general counsel, chief financial officer or chief operating officer
3. Designated compliance liaisons located at each of the operating organization's facilities.”

The “compliance liaison” is not the same as the “compliance officer.” In spite of the specific requirements, the regulation at 42 C.F.R. § 483.85 is limited in its level of detail and guidance concerning clinical ethical decision-making. However, since it is a requirement it is incumbent on providers to know what the regulation requires in order to achieve and remain in substantial compliance with its mandates.

CMS published a comprehensive Final Rule on October 4, 2016, Medicare and Medicaid Programs; Reform of Requirements for Long-Term Care Facilities. That Final Rule significantly expanded the Requirements for Participation for all Medicare and Medicaid participating SNFs (81 Fed. Reg. 192 (October 4, 2016)). In the Final Rule, CMS addressed many comments and provided insight into the regulation concerning a SNF’s compliance and ethics program. Note that both the ACA, which mandates ethics programs, as well as the regulation at 42 C.F.R. § 483.85, use the phrase, “compliance and ethics programs.” The two concepts are distinct; the former relates to mandatory actions while the latter relates to voluntary actions. Nonetheless, an “ethics program” with the discrete elements noted above, is required for all SNFs that participate in Medicare and/or Medicaid.

In addition to the regulation, the preamble to the Final Rule lists actual questions and comments the agency received while the Final Rule was pending. For example, in response to a comment about data collection, CMS responded, “Our requirements, including QAPI, Compliance and Ethics, and Infection Control, as well as requirements for policies and procedures, are intended to protect the health and safety of residents, prevent harm and support quality of life for residents.”  Elsewhere, the preamble noted, “We are requiring the operating organization for each facility to have in effect a compliance and ethics program that has established written compliance and ethics standards, policies and procedures that are capable of reducing the prospect of criminal, civil, and administrative violations in accordance with section 1128I(b) of the Act.” The “administrative violations” deal with quality of care, quality of life, and resident rights issues as articulated in 42 C.F.R. part 483.      

In short, the Final Rule not only describes all of the regulatory mandates, but the comments and responses shed light on CMS’ reasons for each section and subsection of the regulation.

CMS has published the State Operations Manual, Appendix PP – Guidance to Surveyors in Long Term Care Facilities (SOM), last revised on August 8, 2024. Note: A revised Advance Copy of the SOM, Appendix PP, was published as an attachment to a QSO memorandum sent to all state survey agency directors on January 15, 2025. See, QSO – 25-12-NH (January 15, 2025). It is available at: https://www.cms.gov/files/document/qso-25-12-nh.pdf.

The SOM provides “guidance” to surveyors regarding assessing a SNF’s compliance with the Requirements of Participation. CMS has included significant guidance which may be helpful as facilities design, review, and revise their ethics program. The SOM’s section on ethics programs illustrates the types of “probes” and questions surveyors might ask during a survey. For example, the SOM directs surveyors to ask a facility’s staff, “if they are aware of the facility’s compliance and ethics programs.” The F-tag associated with ethics programs is F895. Appendix PP also outlines responsibilities for training staff members regarding compliance and ethics programs and corresponds to the regulation at 42 C.F.R. § 483.95(f), with a designated F-tag at F946. As of this writing, a search of the HHS Departmental Appeals Board does not reveal any appeals of CMS enforcement actions regarding either 42 C.F.R. §§483.85 or 483.95.

Sub-regulatory guidance as a basis for CMS enforcement actions is frequently misunderstood by surveyors and occasionally, even administrative law judges who decide appeals of CMS enforcement actions. Sub-regulatory guidance, such as the SOM and CMS policy memoranda, does not have the weight of law. They are neither statutory nor regulatory requirements but rather serve as guidance. Therefore, when considering the guidance in the SOM, it is essential to recognize that an enforcement action cannot be predicated solely on guidance.

CMS inappropriately based an immediate jeopardy level deficiency and a CMP on “guidance” from the SOM and a letter from CMS in the case of Elgin Nursing & Rehabilitation Ctr. v. U.S. Dep’t of Health and Human Services, 718 F.3d 488 (5th Cir. 2013). In Elgin, surveyors cited a SNF with immediate jeopardy when they observed five residents eating their breakfast which consisted of eggs over- easy – as requested by the residents. CMS cited a regulation that deals with “sanitary conditions” for food preparation and relied on the SOM’s guidance regarding the temperature that eggs should be cooked and served at. Moreover, at the hearing, CMS introduced into evidence a letter from the CMS Dallas Regional Office that attempted to clarify what the SOM stated. Although an ALJ and the Board upheld the deficiency and the CMP, the Fifth Circuit Court of Appeals reversed and remanded the Board’s decision. The Court held that allowing the deficiency to stand would be allowing an interpretation of an interpretation (relying on a letter explaining the SOM, which explained the regulation, which in turn explained the statutory requirement regarding sanitary food preparation). The Court agreed with Elgin and vacated the Board’s decision.

In refusing to uphold the immediate jeopardy and CMP, the Court noted that the SOM was “inherently ambiguous” regarding how to prepare eggs. Moreover, the Court reasoned that accepting CMS’ position “would make it possible for agencies not only to issue regulations, but also to write and enforce ambiguous interpretations of them [which would] require courts to interpret not only interpretations, but interpretations of interpretations.” Further, the Court held that “affording deference to agency interpretations of ever more ambiguous regulations would allow the agency to function not only as judge, jury, and executioner, but to do so while crafting new rules.” Id.
 

In November 2024, the HHS OIG issued its Nursing Facility Industry Segment-Specific Compliance Program Guidance, available at: https://oig.hhs.gov/compliance/nursing-facility-icpg/. The OIG guidance deals with 1) quality of life and quality of care issues, 2) Medicare and Medicaid billing issues, 3) the federal Antikickback statute, and 4) other risk areas. It does not delve into the many nuances of an ethics committee and how ethical concerns are addressed, even though the regulation requires an ethics program. Nonetheless, since 2000, the OIG has provided guidance for compliance and ethics programs. See e.g., Compliance Program Guidance for Nursing Facilities, 65 Fed. Reg. 14289 (March 16, 2000); Supplemental Compliance Program for Nursing Facilities, 73, Fed. Reg. 56832 (September 30, 2008); and Nursing Facility Industry Segment -Specific Compliance Program Guidance, (November 2024). The OIG’s guidance and recommendations above are geared more toward regulatory compliance than clinical ethics and have largely left it to CMS to explain what an ethics program should consist of, as well as related requirements such as training staff and volunteers and establishing written policies and procedures.

Several years ago, CMS issued a directive to all state agency directors reminding them that a deficiency may not be based solely on the SOM. A deficiency must be predicated on a specific regulatory violation. This section, which provides an overview of the law, would be remiss if it did not mention the often-misused and legally flawed application of sub-regulatory guidance in lieu of established law. It should be noted that CMS’ actions were challenged in the Elgin case described above.