One question that is regularly asked by Exclusion Screening clients is whether a health care provider or supplier is required to screen its employees, vendors, and agents against the Office of Foreign Assets Control (OFAC) Sanction List. In this article, we look at the OFAC sanction list and discuss why it does (or doesn’t) make sense for your organization to add this list to your monthly screening obligations.
I. What are Your Exclusion Screening Obligations?
At the outset, it is important to point out that there isn’t a federal statute that REQUIRES you to screen your employees, vendors, and agents against available Medicare and Medicaid databases of excluded individuals and entities. Instead of making exclusion screening a statutory obligation, Congress has chosen to address this issue from a “consequences” perspective. If a Medicare- or Medicaid-participating provider fails to screen and inadvertently hires or enters into a business relationship with an excluded party, the provider may be assessed significant Civil Monetary Penalties (CMPs). Depending on the facts, the wrongful employment of an excluded individual can also lead to criminal prosecution or civil liability under the False Claims Act.
In contrast to the federal side, under state law, a provider’s statutory obligation to screen varies from jurisdiction to jurisdiction. Exclusion screening requirements and obligations are scattered throughout state regulations and are sometimes incorporated into a State’s Medicaid Participation Agreement.
Screening guidance issued by the Department of Health and Human Services, Office of Inspector General (OIG) doesn’t fully answer the question of which databases should be checked in order for a provider to avoid possible CMP liability. The OIG has formally stated that the “List of Excluded Individuals and Entities” (LEIE) is the primary database that should be screened for current and potential employees, vendors, contractors, and agents.[1] The OIG also notes that providers should check other government exclusion and debarment lists to ensure that an excluded or debarred individual has not been hired or otherwise engaged in a business relationship. These additional databases include State Medicaid exclusion databases and the General Services Administration’s (GSA) “System for Award Management” (SAM) list of individuals and entities debarred from doing business with the government.
II. What is the Role of the OFAC Sanction List with Respect to Sanction or Exclusion Screening?
To date, the OIG has not addressed whether Medicare and Medicaid providers should be screening their employees, vendors, contractors, and agents against the OFAC Sanction List. [2] Nevertheless, that should not be taken as a “pass.” Should you do business with an individual or entity that has been placed on the OFAC Sanction List, you may face significant civil penalties that are completely unrelated to your status as a Medicare or Medicaid provider/supplier. An overview of the OFAC Sanction List is set out below:
A. What is the OFAC Sanction List?
The imposition of sanctions against designated foreign countries, individuals, and entities associated with these countries has a long and storied history here in America. In fact, Article I, Section 8 of the Constitution expressly grants Congress the authority to authorize the seizure of foreign countries’ assets. Over the last 250 years, the government has steadily expanded its authority to impose sanctions on designated foreign countries and on certain individuals and entities associated with them. Today, the United States has been referred to as a “sanctioning state.” As one authoritative source has stated:
“Since 1945, the United States has been the world’s leading user of sanctions, imposing them—often unilaterally—against nations and individuals that have expropriated the property of U.S. nationals, violated human rights norms, or challenged American visions of proper conduct in other ways.” [3] (Emphasis added).
OFAC sanctions are merely the latest iteration of our government’s imposition of penalties against American companies that enter into a “prohibited transaction” [4] with individuals, business entities and foreign countries that have been placed on one or more of the primary sanction lists which comprise the OFAC Sanction List.
In the past, most of the enforcement actions for OFAC regulatory violations were brought against banks and other financial institutions. Over the past six years, the government’s focus has changed. Today, OFAC’s enforcement focus is on agricultural, technology, defense, insurance, medical equipment and other non-financial business sectors.
B. What is the SDN List?
The primary sanction list maintained by OFAC is its “Specially Designated Nationals and Blocked Persons” (SDN). [5] The scope of the SDN is quite broad and primarily includes:
- Foreign Country Related Parties. These entries on the SDN list include individuals and entities owned, controlled by, or acting on the behalf of a targeted country that is subject to sanctions. The reasons a foreign country has been designated may vary widely. For example, if you facilitate the efforts of the Government of Iran to acquire or develop “Weapons of Mass Destruction” (WMDs), your conduct is sanctionable by OFAC.
- Terrorist Groups. The SDN list includes non-country specific individuals and entities that are associated with, owned by, controlled by or acting on behalf of terrorist groups and organizations.
- Narcotics Traffickers. The SDN list includes non-country specific individuals and entities that are associated with, owned by, controlled by or acting on behalf of narcotics trafficking groups and organizations.
C. What is the Non-SDN List?
Importantly, OFAC’s responsibilities are not limited to merely maintaining the SDN. Other sanction lists maintained by OFAC include the following:
- Foreign Sanctions Evaders List.
- Sectoral Sanctions Identifications List.
- Non-SDN Palestinian Legislative Council List.
- List of Foreign Financial Institutions Subject to Correspondent Account or Payable-Through Account Sanctions (CAPTA List).
- Non-SDN Menu-Based Sanctions List (NS-MBS List).
- Non-SDN Chinese Military-Industrial Complex Companies List (NS-CMIC List).
To simplify the review of non-SDN sanction lists and comply with OFAC’s sanction regulations, OFAC has combined the six non-SDN sanction lists above into a “Consolidated Sanctions List.”
D. Who Must Comply with OFAC Regulations and Screening Requirements?
By statute, all “U.S. Persons” must comply with OFAC’s regulations. Under 31 C.F.R. §560.314, the term “U.S. Person” means any United States citizen, permanent resident alien, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States. In other words, it likely means you, regardless of whether you live in the United States or whether you work for a foreign subsidiary of a U.S. company.
E. What Fines May be Assessed if My Company Violates OFAC’s Regulations?
If you enter into a business relationship with a sanctioned individual or entity, you may be subject to substantial fines, possibly exceeding millions of dollars. Depending on the facts of the case, the government may also pursue criminal charges against you. Civil penalties assessed vary with each sanctions program. For the current list of penalty amounts, see section V.B.2.a of Appendix A to OFAC’s Economic Sanctions Enforcement Guidelines at 31 C.F.R Part 501. [6]
F. Why Would a Health Care Provider / Supplier Screen the OFAC Sanction List?
Realistically, most sole-practitioner physicians and small medical practices would have little risk of violating OFAC’s sanctions regulations. Unfortunately, that isn’t the case when you are talking about larger medical organizations, multi-national pharmaceutical manufacturers, or medical device companies. Several cases brought against healthcare-related entities illustrate the risks your organization may face.
Medical Device Company #1: In this case, a sole employee working for a medical device company was alleged to be responsible for 56 violations of the Iranian Transactions and Sanction Regulations (ITSR), 31 C.F.R. Part 560. OFAC Iranian sanctions. This occurred when the company shipped medical imaging equipment to a company in the UAE (not even directly to Iran), even though he knew (or should have known) that the equipment was destined for Iran. The medical device company was assessed fines of more than $500,000 for engaging in these business transactions. Lessons to be learned from this matter include:
- Exercise Proper Due Diligence. This case illustrates the importance of due diligence. Although the imaging equipment was sold and shipped to the UAE (a foreign country that is NOT on the OFAC Sanctions List), the government alleged that the defendant should have known the equipment was destined for Iran, a foreign country subject to sanctions.
- It Only Takes One Bad Apple. A single individual can expose your company to significant sanctions. There is no requirement that OFAC needs to show that there was a “systemic pattern of company-wide conduct.”
- Compliance, Compliance, Compliance. OFAC found that the medical device company failed to maintain an effective compliance program. Is your regulatory compliance program current and subject to recurring review?
- Get Experienced Help. More than likely, the company engaged competent regulatory and legal counsel to assist in resolving the government’s claims. In this case, the medical device company cooperated with the OFAC in its investigation.
Medical Device Company #2: In this case, a medical device company was alleged to be responsible for 7 violations of the Iranian Transaction Sanctions Regulations (ITSR). This occurred when the company shipped orthodontic devices to Germany, the UAE, and/or Lebanon that it knew (or should have known) were intended for re-export to Iran, in violation of §§ 560.204 and 560.206 of the ITSR. The medical device company was assessed fines of more than $40,000 for engaging in these business transactions. Lessons to be learned from this matter include:
- Compliance, Compliance, Compliance. Once again, OFAC found that the company had no OFAC compliance program in place at the time of the violations.
- Management had Knowledge of the Violations. The government found that management had actual knowledge (or reason to know) that the orthodontic devices were ultimately going to be re-exported to Iran.
Dental Supply Company #1. In this case, a dental supply company was alleged to have exported 37 shipments of dental equipment and supplies from the United States to distributors in other foreign countries that the company knew or should have known would ultimately be re-exporting the equipment to Iran. These sales were made in violation of § 560.204 of the ITSR. Ultimately, the company agreed to settle the case with the Treasury Department and paid more than $1.2 million in fines. Lessons to be learned from this matter include:
- No Voluntary Disclosure was Initially Made. According to the Treasury Department, the company did not voluntarily disclose these violations, despite the government’s allegation that several members of management and supervisory staff had actual knowledge of improper conduct. If the company had voluntarily disclosed conduct before the government commenced an investigation, the fines imposed would presumably have been lower.
- Previous History of Non-Compliance. Unfortunately, this wasn’t the first time that the company had violated OFAC regulations. This fact served as an aggravating factor when the government assessed fines against the defendant.
G. Is it Easy to Screen the OFAC Sanction List?
Unfortunately, there is nothing easy about verifying whether an individual or entity is on the OFAC Sanctions List. Problems you are likely to encounter include:
- Verification of a Match Can be Difficult. As you have already learned, if you have tried to screen employees against the LEIE and State Medicaid exclusion lists, it can be quite difficult to weed through numerous false positives to determine if an individual has been excluded from participation in Federal health care programs. Imagine trying to screen an individual or entity on a worldwide scale, where there are countless variations of names, holding companies, and business entities. It’s tough to verify if an individual or entity is on the OFAC Sanction List.
- The Scope of Sanctions Can Vary. There is no “universal” set of financial sanctions imposed by Congress or regulators. Even though a foreign country may be designated on the OFAC Sanction List, business trade in select goods may be permitted. Every set of sanctions imposed by the government is different.
- Designated Nationals and Companies are Often Mobile. Not surprisingly, once an individual or entity is placed on the OFAC Sanction List, these designated parties tend to take steps to disguise their identity (along with the fact that you are prohibited from doing business with them). As the Treasury Department has clearly stated: “U.S. persons are prohibited from dealing with SDNs wherever they are located, and all SDN assets are blocked.”
- Checking the OFAC Sanctions List Can Be Costly. For the reasons previously discussed (and many more), it is typically very costly for an organization to handle OFAC sanctions screening internally. An organization is far better off contracting with a qualified screening company to handle these searches.
III. Conclusion
All health care-related organizations (regardless of whether they participated in Federal health care benefit programs) engaging in international business transactions, either directly or indirectly, must take steps to ensure that their products or services are not directly sold or re-exported to individuals, entities, or foreign countries that have been designated on the OFAC Sanction List. Examples of industry sectors with significant exposure in this regard include pharmaceutical companies, medical device manufacturers, medical supply companies, insurance companies, charitable medical organizations, software, and technology companies. What can you do to address this risk? Contact the sanctions professionals at Exclusion Screening for help understanding your obligations regarding the OFAC Sanctions List. The process is easy, and the cost is reasonable. We can be reached at: 1 (800) 561-0798.
The staff members at Exclusion Screening have extensive knowledge of the sanctions screening process and can advise you on your company’s risks regarding the OFAC Sanctions List. Should you have questions about your obligation to screen the OFAC Sanction List, give us a call. Exclusion Screening can be reached at: 1 (800) 561-0798.
[1] The OIG has twice published guidance on the effect of an OIG Exclusion. A Special Advisory Bulletin on the Effects of Exclusion from Federal Health Care Programs” was issued September 2, 1999, and an “Updated Special Advisory Bulletin on the Effect of Exclusions from Participation in Federal Health Care Programs” was issued May 8, 2013.
[2] A number of articles have suggested that OFAC was first established in December 1950, in an effort to manage the assets of China and North Korea that were frozen during the Korean War. That is incorrect. At that time (December 1950), President Truman established the Division of Foreign Assets Controls. It wasn’t until October 1962 that the Treasury Department administratively replaced the Division of Foreign Assets Control with a new Office of Foreign Assets Control (OFAC). See National Archives. 265.2 Records of Foreign Funds Control.
[3] Coates, Benjamin J., “The Secret Life of Statutes: A Century of the Trading with the Enemies Act.” Cambridge University Press (May 16, 2018) (Citing, Morgan, Bapat, and Kobayashi, “Threat and Imposition of Economic Sanctions,” 548; Hufbauer et al., Economic Sanctions Reconsidered, 5).
[4] The U.S. Department of the Treasury defines “prohibited transactions” as:
“. . . trade or financial transactions or other dealings in which U.S. persons may not engage unless authorized by OFAC or expressly exempted by statute. Because each program is based on different foreign policy and national security goals, prohibitions may vary between programs.”
