Healthcare Private Equity: Managing Increased Regulatory Scrutiny

Echoing this, the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) suggested in its new published guidance that "healthcare entities, including their investors and governing bodies, should carefully scrutinize their operations and incentive structures” and “[a]n understanding of the laws applicable to the healthcare industry and the role of an effective compliance program is particularly important for investors that provide management services or a significant amount of operational oversight for and control in a healthcare entity."³

The DOJ, Federal Trade Commission (FTC), and HHS recently launched a cross-government inquiry into the effects of PE ownership in healthcare. The initiative seeks to gather information on transactions that may not typically undergo antitrust scrutiny but—in the government’s view—could still potentially adversely impact patient health, worker safety, and the overall quality of care.⁴ The DOJ, FTC, and HHS also launched an online portal for the public to report “potentially unfair and anticompetitive healthcare practices.”⁵

Further, many states are adopting legislation to impose additional regulatory oversight of PE transactions in healthcare. For example, in May 2024, California proposed a bill requiring PE groups and hedge funds to obtain consent from the California attorney general prior to transacting with healthcare facilities or provider groups. The bill also places limitations on certain management services arrangements between PE groups/hedge funds, and physician practices.⁶

Once the government opens an inquiry, its focus may also shift to theories regarding coding and billing practices; overpayments; and healthcare fraud, waste, and abuse (FWA), all of which may implicate the False Claims Act (FCA).

To mitigate the risks described above, PE firms should be prepared to conduct rigorous diligence using data analysis, benchmarking, chart audits, and compliance program infrastructure reviews to identify potential compliance risks. Likewise, PE firms should be aware of the DOJ’s recent M&A Safe Harbor Policy, which incentivizes acquiring companies in M&A transactions to voluntarily disclose misconduct they discover through the acquisition of a target, either during pre-deal diligence or for a period post-deal.

Next, PE firms need to anticipate likely government reactions to deals and operating models and adopt a proactive and comprehensive approach to compliance, risk management, and patient care that is within their risk appetite. Doing so mitigates investment risk and contributes positively to the healthcare ecosystem.

Proactive Risk Management Measures

The U.S. healthcare industry has a rich history of delivering high-quality, innovative patient care. Market forces such as aging populations, shrinking physician bases, and rising costs are pressuring the industry like never before. Some healthcare providers navigating these headwinds would benefit from PE partnerships. In these situations, PE firms and the target asset must have a clear path to value creation that benefits the consumer, clinical quality, and the healthcare ecosystem itself. This cannot be done without assessing and addressing compliance and reputational risks.

PE firms considering mergers, acquisitions, and other material investments in healthcare entities must formulate a compliance and reputational risk appetite as part of their pre-deal due diligence process.  Upon completion of pre-deal due diligence, this will provide a framework for PE firms to determine which, if any, compliance and reputational risks must be mitigated and, ultimately, whether to commence with the deal. 

Pre-deal due diligence should consider clinical quality, antitrust, technology, and healthcare FWA risks by conducting the following:

• Clinical quality data analysis and benchmarking: Generate retrospective and predictive analytics to identify historical quality of care issues and predict future ones. Data from clinical operations and incident-reporting systems provide a wealth of information on clinical outcomes, patient satisfaction, and patient safety trends. Moreover, publicly available industry benchmarking data can compare the target entity’s clinical performance and quality metrics against industry standards and peer groups to assess alignment with best practices. These analyses should fortify a PE firm's position against clinical quality risks and directly inform value creation and the process for the organization and its patients.
• Antitrust analysis: Develop market concentration and competitive dynamics analyses to anticipate potential antitrust and market competition concerns that regulators, such as the FTC and state attorneys general, may raise. These quantitative and qualitative market theories can inform the investment council go/no-go decision process regarding potential regulatory friction, speed to execution, and investment thesis alignment.
• Healthcare FWA assessments: Increasingly, data analytics and artificial intelligence (AI) are deployed against vast quantities of data, enabling a more comprehensive and automated review to detect anomalies in billing and coding practices that could be indicative of FWA. PE firms should commission thorough pre-acquisition audits of the target entity’s financial transactions and documentation, coding, and billing practices to evaluate compliance practices and detect existing possible FWA issues. For example, data analytics and benchmarking using claims data is an effective approach to identifying atypical coding, billing patterns and outliers, which may be indicative of FCA risks. Forensic analysis of banking data and funds flows can also be leveraged to identify potential Anti-Kickback Statute (AKS) risks. Similarly, integration of public records information in claims data analysis can help to identify networks of “bad actors” who may be submitting false claims.
• Healthcare technology risk management diligence: Evaluate the target entity’s technology infrastructure to identify vulnerabilities related to cybersecurity; post-acquisition technology integration risk with a focus on interoperability and data migration challenges; and the entity’s AI governance, oversight, monitoring, and risk management controls in cases where AI has been deployed. As evidenced by numerous high-profile cyberattacks, financial fraud risk and the potential for patient data breaches are escalating. As the healthcare industry deploys new AI technology in operations, clinical decision-making, and the revenue cycle, the government is promulgating new laws, rules, and regulations related to AI governance, guardrails, and use. PE firms need to confirm their due diligence to consider whether investments are needed to bring the target in line with a growing body of AI-related government expectations and rules.

Post-acquisition measures should include:

• Effective compliance programs: A portfolio company should have an effective compliance program to withstand any amount of regulator scrutiny. PE firms should consider, based on their risk appetite, expectations of their portfolio firms’ compliance programs and how to document those expectations. The ROI on an effective compliance function is clear. Healthcare entities and their PE owners can face significant penalties and damages under the FCA and AKS if the government identifies overpayments, compliance violations, and/or FWA.
• Invest in quality and safety: Prioritize investments that enhance patient care quality and safety. This may involve hiring additional staff, investing in new technologies, and improving service offerings. In its updated 2023 healthcare entity Compliance Program Guidance documents, the OIG communicated the new expectation that the compliance function should have an increasing auditing and monitoring role over quality care and patient safety.
• Leverage data analytics and AI: Use data analytics and AI to measure, monitor, and enhance compliance, operational efficiency, staffing ratios, and clinical quality. These technologies can help identify potential risks early and provide insights for proactive management and mitigation of risks.

With increased regulatory scrutiny, especially as it pertains to post-acquisition business practices, PE firms and their portfolio companies should start addressing risks now. Guidehouse helps providers, payers, private equity firms, and healthcare law firms navigate this complex regulatory landscape. We can help PE firms, and their portfolio companies not only mitigate risk but also operate within regulatory bounds while accelerating value creation.