The CMS Self-Referral Disclosure Protocol for Stark Violations

A practice or hospital that discovers a noncompliant physician financial relationship has a formal channel for fixing it before the government finds it. The CMS Self-Referral Disclosure Protocol (SRDP) lets providers and suppliers voluntarily disclose actual or potential violations of the physician self-referral law, commonly called the Stark Law, directly to the Centers for Medicare & Medicaid Services (CMS). A completed submission pauses the clock on returning the overpayment. It carries no promise of a discount, and it resolves only one category of exposure in an arrangement that can create several at once.

What the SRDP Covers

Congress created the SRDP under Section 6409 of the Affordable Care Act, directing HHS to build a process for disclosing violations of Section 1877 of the Social Security Act, the statute underlying the Stark Law. That statute bars a physician from referring Medicare patients for certain designated health services to an entity the physician, or an immediate family member, has a financial relationship with, unless an exception applies, and bars the entity from billing Medicare for the referral. Section 6409(b) separately gives the HHS Secretary authority to reduce the amount a provider owes over a disclosed violation, available only through the SRDP.

Why a Stark-Only Problem Goes to CMS, Not OIG

Participation in the SRDP is limited to violations of the physician self-referral law. The Office of Inspector General (OIG) runs a separate Health Care Fraud Self-Disclosure Protocol for conduct that raises liability under other federal laws, including the Anti-Kickback Statute, a pattern covered in Anti-Kickback Violations as FCA Predicates. CMS directs a provider whose conduct implicates the Anti-Kickback Statute to OIG instead. The same conduct should never go to both agencies; CMS has said it will coordinate with OIG and the Department of Justice once a disclosure is filed, including referring a matter for False Claims Act liability.

What an SRDP Submission Must Contain

A complete disclosure follows the forms in CMS's current OMB-approved collection, CMS-10328: the SRDP Disclosure Form, one or more Physician Information Forms, a Financial Analysis Worksheet, and a signed certification. A practice disclosing that it failed to qualify as a group practice files a Group Practice Information Form instead of the Physician Information Forms. The financial analysis must quantify the overpayment tied to the disclosed conduct, and the certification must state, to the signer's own knowledge, that the disclosure is truthful and made in good faith. CMS will not accept a submission built on outdated forms. A provider already under a corporate integrity agreement with OIG still has to notify its OIG monitor of a Stark-only disclosure, even though the disclosure itself goes to CMS.

How CMS Resolves a Disclosure

CMS reviews a submission to decide how to resolve it and has said plainly that it is not bound by the disclosing party's own conclusions about the violation or the amount owed.

CMS may consider the nature and extent of the violation, how promptly the provider disclosed it, and how fully the provider cooperated with CMS's verification, but CMS is not obligated to reduce any amount due and owing.

Verification can include requests for financial statements and tax returns, and CMS will not accept payment of a disclosing party's own overpayment estimate before its verification is complete. A provider may escrow funds while the matter is pending, but CMS's consent is required before any repayment during that period. A disclosure that settles ends the provider's appeal rights over the disclosed conduct; a withdrawn disclosure, or one CMS removes from the protocol, leaves ordinary appeal and overpayment reopening rules in place.

A Stark disclosure resolves exposure under Section 1877 only. It does not resolve a qui tam suit a relator may have already filed over the same referrals, a posture covered in Asking DOJ to Dismiss a Qui Tam Under Section 3730(c)(2)(A). A provider under a corporate integrity agreement that mishandles a required disclosure can also face stipulated penalties and OIG exclusion under that agreement, covered in Breaching a Corporate Integrity Agreement: Stipulated Penalties and Exclusion.

Why Early Legal Counsel Is Critical

It is critical that healthcare providers promptly retain experienced healthcare defense counsel before submitting any disclosure to CMS or OIG. Early legal intervention protects the provider's rights, keeps the financial analysis and certification structured correctly under the current SRDP forms, avoids inadvertent admissions beyond the conduct actually disclosed, and lets counsel communicate with CMS, OIG, and DOJ on the provider's behalf. Delaying representation, or filing a disclosure built on an incomplete financial analysis, can affect the outcome of the matter.

How Health Law Alliance Can Help

Health Law Alliance's False Claims Act defense practice represents providers and suppliers through every stage of a Stark Law self-disclosure, from the financial analysis an SRDP submission requires to the verification process CMS conducts afterward. If your practice or hospital has identified a noncompliant physician arrangement, contact us for a free, confidential consultation before you submit anything to CMS or OIG.