Corporate Integrity Agreements Run Five Years. Here's What They Actually Obligate.

Corporate Integrity Agreements Run Five Years. Here's What They Actually Obligate.

A corporate integrity agreement is a settlement document, not a penalty. HHS OIG describes it as an agreement that outlines the obligations to which an entity agrees as part of a civil settlement, in exchange for which OIG agrees not to seek the entity's exclusion from Medicare, Medicaid, and other federal health care programs. The trade is explicit: you accept five years of structured oversight, and you keep your billing privileges.

Most summaries of corporate integrity agreement requirements stop at the list of headings. The headings are not the hard part. The hard part is that each one carries a deadline, a named accountable person, and a dollar amount attached to missing it.

First, which document you are under

OIG distinguishes two instruments. A corporate integrity agreement applies to an entity. An integrity agreement covers, in OIG's words, an individual practitioner, small group practice, or small provider. The OIG's CIA FAQ is the authority on the distinction. The obligations rhyme but are not identical, and a small agency negotiating a settlement should know which one is on the table.

The standing obligations, in OIG's own words

OIG lists what a CIA typically requires. The entity agrees to:

• hire a compliance officer and appoint a compliance committee;
• develop written standards and policies;
• implement a comprehensive employee training program;
• retain an independent review organization to conduct reviews;
• restrict employment of ineligible persons;
• report overpayments, reportable events, and ongoing investigations and legal proceedings; and
• provide an implementation report and annual reports to OIG on the status of the entity's compliance activities.

OIG states plainly that a CIA lasts 5 years. Breach and default provisions are also included, and they allow OIG to impose monetary penalties. A material breach constitutes an independent basis for the entity's exclusion.

What the calendar actually looks like

Generic lists hide the schedule. CIA terms are negotiated and vary materially between agreements, so there is no universal timetable — but reading one real agreement is more instructive than reading ten summaries. Below is the structure of the 2020 CIA with Hope Hospice and Community Services. Treat it as one worked example from the post-acute space, not as a template.

Obligation	Deadline in that agreement
Compliance officer appointed	Within 90 days of the effective date
Compliance committee appointed	Within 90 days; meets at least quarterly
Written policies developed and implemented	Within 90 days; reviewed at least annually
Training plan in place	Within 90 days; covered persons trained at least annually
Disclosure program established	Within 90 days; disclosures logged within 2 business days
Independent review organization engaged	Within 90 days
Screening of current covered persons against the exclusion list	Within 90 days, then monthly
Reportable events reported to OIG	Within 30 days of determining one exists
Identified overpayments repaid	Within 60 days of identification
Implementation report	Within 120 days of the effective date
First annual report	Within 60 days after the end of the first reporting period

Several structural details in that agreement are worth noting because they constrain who can hold the job. The compliance officer is senior management, reports directly to the CEO, and cannot be subordinate to the general counsel or the chief financial officer. The officer reports to the board in person at least quarterly. A change in who holds the role must be reported to OIG within five business days. Named certifying employees — the CEO, CFO, billing manager, chief human resources officer, chief medical officer, and chief operating officer — each certify annually for their own department.

The board carries its own obligations. It must include independent members, meet at least quarterly, describe to OIG the materials it reviewed, and adopt a resolution signed by every member. Note that board resolutions do not appear on OIG's general overview page at all; they appear in the agreement. That gap between the summary and the instrument is the reason to read your own document rather than a blog post about documents.

The IRO review is designed around your risk, not off a shelf

In the Hope Hospice agreement, the independent review organization conducts two reviews per reporting period: a random sample of 30 beneficiaries whose stays exceeded 240 uninterrupted days, and a random sample of 30 beneficiaries receiving continuous care, inpatient respite, or general inpatient care. Those samples map directly onto the conduct at issue in the settlement. A home health agency's review would be built around different claim characteristics.

Two mechanics matter operationally. Missing documentation counts as an overpayment, and replacement sampling is not permitted — you cannot swap out a record you cannot find. And OIG does not endorse or maintain a list of IROs; per the FAQ, it is up to the provider to determine the appropriate firm, though OIG may object to the selection within 30 days.

The breach ladder

Stipulated penalties are per-day amounts specified in the agreement. In the Hope Hospice CIA they run $2,500 per day for most core failures — compliance officer, committee, board duties, policies, training, screening, disclosure program, reportable event reporting, failure to engage and use an IRO, and late or incomplete implementation or annual reports. Failure to grant OIG access accrues at $1,500 per day. A catch-all of $1,000 per day applies to other obligations, beginning ten business days after OIG's notice. A false certification carries $50,000.

Above penalties sits exclusion. OIG's FAQ identifies failure to engage and use an IRO, and repeated violations of CIA obligations, as material breaches. In the Hope Hospice agreement the entity has 30 days after a notice of material breach to cure or to show it has begun curing with due diligence and a timetable, and exclusion is at OIG's discretion for not more than five years per material breach.

One small mercy worth calendaring: the FAQ notes that missed deadlines may be excused only if the provider submits a written extension request at least five days before the deadline, and OIG retains discretion to deny it. Five days before, not five days after.

What these agreements do not require

They do not require you to record calls. Nothing in OIG's description of standard CIA obligations, and nothing in the hospice agreement cited above, mandates audio capture of patient, family, or referral-source conversations. What they do require is documentary: logs, policies, certifications, screening records, training records, and reports produced on deadline.

That is the honest version, and it is also why the operational pressure lands where it does. When an IRO pulls a sample and missing documentation counts as an overpayment, the question is not whether you had the conversation. It is whether anything in your records proves what was said and what you did about it. We laid out that evidentiary gap in why a compliance program needs an audit trail built from conversations, and the conduct underlying post-acute settlements is frequently conversational in origin — see the hospice kickback scheme in the 2026 takedown.

What to do this week

1. If you are under an agreement, extract every deadline from your own document into a shared calendar with a named owner. Do not work from a summary.
2. Confirm your compliance officer's reporting line satisfies the agreement's independence language. This is a common, easily-fixed structural defect.
3. Verify your exclusion-list screening is actually running monthly, with retained evidence of each run.
4. Run a dry pull: pick ten claims matching your IRO's sampling criteria and try to assemble the complete documentation. Count how many you cannot.
5. Walk your disclosure log. If entries are not being recorded within the agreement's window, that is a per-day exposure today.

If you are not under an agreement, the same checklist is a reasonable self-audit — the obligations OIG imposes after a settlement are a fair description of what it considers adequate. Our audit-ready contact center compliance checklist covers the interaction side of that work.

Where conversation data fits

Interaction intelligence platforms, SurfacerIQ among them, address one narrow part of this: making the conversation layer of an operation reviewable and countable instead of sitting as unopened audio. That is a category of capability, not a substitute for a compliance program or an IRO.

This post is general information, not legal advice. Corporate integrity agreements are negotiated instruments, and the only authoritative statement of your obligations is your own executed agreement read with your counsel. To discuss the interaction evidence side of compliance work, talk to us.