Summary. Nearly every arrangement that gets a healthcare organization in trouble was reviewed by someone who concluded it was fine and failed on a detail — an expired agreement under which payments continued, a missing signature, per-click rent, compensation stacked across four agreements, or services nobody documented. This checklist works arrangement by arrangement: build a complete inventory of every financial relationship with a referral source, apply the Stark exception and Anti-Kickback safe harbor analysis to each, test fair market value and commercial reasonableness, and check the operational controls. Later phases cover monitoring, exclusion screening, and the disclosure decision.

What this checklist is for. An arrangement-level compliance review for a provider, health system, or supplier. Run it under counsel. For the doctrine, see Healthcare Fraud and Abuse: The Anti-Kickback Statute, the Stark Law, and the False Claims Act.

Phase 1 — Build the arrangement inventory

  • Identify every referral source: physicians and their immediate family members, physician-owned entities, other providers who refer, and anyone in a position to generate federal health care program business.
  • Inventory every financial relationship with each — employment, independent contractor, medical directorship, call coverage, co-management, recruitment, leases of space or equipment, purchases, loans, joint ventures, ownership interests, professional services agreements, and grants.
  • Include indirect relationships that run through another entity, because the Stark indirect compensation analysis reaches them.
  • Include non-monetary benefits: meals, gifts, entertainment, continuing education, subsidized staff or equipment, free use of space, and marketing support.
  • Reconcile the inventory to accounts payable and payroll. Payments made outside any written agreement are the classic finding, and they only surface this way.
  • Record for each arrangement: the parties, the effective date, the term, the expiration, the compensation, the signature status, the location of the executed original, and the business owner responsible.
  • Flag every arrangement that is expired, unsigned, undocumented, or not in the inventory but paid.

Phase 2 — Apply the Stark analysis

For each arrangement involving a physician (or immediate family member) and an entity furnishing designated health services:

  • Confirm whether the entity furnishes designated health services — for a hospital, essentially all inpatient and outpatient services.
  • Identify the financial relationship: ownership or investment interest, or compensation arrangement, direct or indirect.
  • Identify the exception relied on, by citation, and confirm every element:
    • A writing, signed by the parties, describing the arrangement (with the 90-day signature accommodation where applicable).
    • A term meeting the exception's requirement.
    • Compensation set in advance.
    • Compensation at fair market value.
    • Compensation not determined in a manner that takes into account the volume or value of referrals or other business generated.
    • Commercial reasonableness, evaluated as of the time of the arrangement.
    • Any exception-specific requirements.
  • Confirm the arrangement does not include per-click or percentage-of-revenue compensation where the exception prohibits it, particularly in space and equipment leases.
  • For a group practice relying on in-office ancillary services, confirm the entity meets the group practice definition, including the profit distribution rules, which prohibit distributing designated health services profits based on the physician's own referrals.
  • Record the analysis in writing, with the exception cited.

Why this matters. Stark is strict liability. There is no intent element and no good-faith defense; if no exception fits exactly, the referral is prohibited, the claim is not payable, and every claim submitted becomes a False Claims Act exposure.

Phase 3 — Apply the Anti-Kickback analysis

  • Ask the operative question: could one purpose of this arrangement be to induce or reward referrals? Under the one-purpose test, that is sufficient even where the compensation is fair and the services are real.
  • Identify any safe harbor relied on, and confirm every element — partial compliance is no compliance.
  • Where no safe harbor fits, document a facts-and-circumstances analysis: the parties, the business rationale, how the counterparty was selected, whether referral volume influenced selection or compensation, and the risk factors OIG has identified.
  • Check the arrangement against OIG Special Fraud Alerts and advisory opinions addressing similar structures — speaker programs, telemedicine arrangements, physician-owned distributorships, and laboratory arrangements have each been the subject of guidance.
  • For laboratories, recovery homes, and clinical treatment facilities, apply EKRA, 18 U.S.C. § 220, separately — it reaches all payors and its employee exception is narrower than the AKS safe harbor, so commission-based sales compensation lawful under the AKS may violate it.
  • Consider requesting an OIG advisory opinion for a novel arrangement with meaningful exposure.

Phase 4 — Test fair market value and commercial reasonableness

  • Obtain an independent valuation for anything unusual, before signing — not after a subpoena.
  • Confirm the valuation methodology and that the appraiser was given accurate facts.
  • Treat survey benchmarks as evidence, not a safe harbor; paying at the 90th percentile requires a documented reason.
  • Test commercial reasonableness in plain language: why the organization needs these services, why this person, why this quantity, and what it would do if there were no referrals.
  • Test for stacking. Aggregate every payment stream to each physician — salary, directorship, call coverage, co-management, lease, and any other — and confirm the total is defensible and that the same hours are not paid twice.
  • Confirm compensation is set in advance and does not vary with referrals, including through any bonus or incentive formula.
  • Confirm any productivity bonus is based on services personally performed.

Phase 5 — Operational controls

  • Confirm services are actually delivered and documented — time logs, meeting minutes, deliverables, reports. This is the single most common failure in an otherwise compliant arrangement.
  • Confirm payment is contingent on documentation, so non-performance suspends payment automatically.
  • Calendar every term and renewal, with alerts at 120, 90, and 30 days, and a hard rule that payments stop when an agreement expires.
  • Route every new or amended arrangement with a referral source through a single approval function with authority to decline.
  • Maintain a central repository of executed agreements, with amendments.
  • Screen every employee, contractor, vendor, and physician against the OIG List of Excluded Individuals/Entities and the System for Award Management, at hire and monthly, and retain the results.
  • Confirm non-monetary compensation to physicians is tracked against the annual limit, and that any excess is repaid within the permitted window.
  • Confirm medical staff incidental benefits and other de minimis provisions are tracked.
  • Train the people who create arrangements — service line leaders, physician recruiters, and business development — because they are where non-compliant arrangements originate.

Phase 6 — Monitor, and respond to findings

  • Audit a sample of arrangements annually against the inventory and against the documentation requirements.
  • Reconcile payments to agreements quarterly.
  • Track the hotline and complaint log for arrangement-related reports, and respond promptly and without retaliation.
  • When a problem is found, investigate promptly — the 60-day overpayment clock under 42 U.S.C. § 1320a-7k(d) runs from identification, and CMS expects reasonable diligence generally within six months.
  • Stop the conduct, and document the correction.
  • Quantify the affected claims, using sampling and extrapolation where necessary.
  • Choose the disclosure path deliberately: the OIG Self-Disclosure Protocol for conduct implicating the AKS; the CMS Voluntary Self-Referral Disclosure Protocol for Stark-only violations, where the settlement history is materially more favorable; or a simple refund for billing errors with no fraud dimension. Disclosing to the wrong body forfeits the benefit.
  • Fix the underlying control, and document the fix.

Common mistakes

  • No arrangement inventory, so nobody can answer what relationships exist.
  • Payments outside any agreement, discovered only by reconciling to accounts payable.
  • Expired agreements under which payments continued.
  • Missing signatures.
  • Per-click or percentage rent in space and equipment leases.
  • Stacked compensation across multiple agreements, individually defensible and collectively not.
  • No documentation of services delivered — the most common way a defensible arrangement becomes indefensible.
  • Valuations obtained after signing, or not at all.
  • Treating a failed safe harbor as automatically unlawful, or a failed Stark exception as merely risky — the two work in opposite directions.
  • Delaying the investigation after a problem is identified, which converts a repayment obligation into a knowing one.

Primary authority

Related

This checklist is educational and not legal advice. Fraud and abuse analysis is fact-specific, safe harbors and exceptions contain requirements not fully described here, and state analogues vary. Conduct any review under the direction of qualified healthcare regulatory counsel.