Selecting an Independent Review Organization for Your CIA

Faced with a Corporate Integrity Agreement, it is crucial to select the right Independent Review Organization promptly. The wrong choice can jeopardize your…

Read More

Jim Hook, MPH

By Jim Hook, MPH | June 16, 2026

Man in blue suit selecting a checkbox. In the background text reads "Your Choice Can Make All The Difference ".

Faced with a Corporate Integrity Agreement, it is crucial to select the right Independent Review Organization promptly. The wrong choice can jeopardize your compliance and put your organization at risk. With over 15 years of IRO experience, we’ll guide you through the critical qualifications that separate competent providers from costly mistakes.

Executive Summary – Key Takeaways

  • IRO qualifications must match the CIA’s required review.
  • Independence concerns can disqualify an otherwise capable IRO.
  • Specialized expertise determines whether findings withstand OIG scrutiny.
  • Inadequate staffing can delay reviews and jeopardize CIA compliance.
  • Begin selection early; claims reviews may start within 90 days.

Understanding Corporate Integrity Agreements and Their Specific Requirements for an IRO

Scales of justice.

Healthcare organizations facing investigation by the Office of Inspector General (OIG) of the Department of Health and Human Services (HHS) soon discover a critical reality. Avoiding exclusion from federal health care programs typically requires the healthcare entity to agree to a Corporate Integrity Agreement (CIA). CIAs come in a few different varieties, depending on the type of service provided by the healthcare organization and the alleged violations by the entity.

CIA compliance also requires a long list of activities to be undertaken by healthcare organizations. CIA obligations encompass key factors, including implementing a comprehensive compliance program, establishing written policies, and providing staff members with effective communication about reporting compliance gaps. And another of these CIA requirements includes retaining the services of an Independent Review Organization, or IRO. What constitutes an experienced IRO is, in part, a function of the type of review listed in your CIA obligations: a Claims review, an Arrangements Review, or a Clinical Quality Review.

General qualifications for all Independent Review Organizations

Badge with checkmark.

Some qualifications apply to any independent review organization you may be considering:

  • The review organization must be independent. The OIG has refined the language used in most CIAs to address the issue. This occurred after one healthcare entity retained an outside organization with family member connections to the healthcare organization. Most CIAs now require the prospective review organization to assess its professional independence and objectivity in relation to the reviews mandated by the CIA. It must conclude that it is, in fact, independent and objective, and
    • That it does not currently represent or is currently employed or engaged by the healthcare organization; and
    • It does not have a current or prior relationship to the healthcare organization or its owners, officers, or directors that would cause a reasonable person to question the IRO’s objectivity.
  • The IRO certification must provide a summary of all current and prior relationships with the healthcare organization, its owners, officers, or directors.

The OIG can reject the entity’s selection of a particular IRO. If the OIG does not object within 30 days after the entity proposes the IRO, then the entity may proceed with the services of the selected IRO.

  • IROs are also subject to the provisions of the Government Auditing Standards, issued by the U.S. Government Accountability Office, informally known as the Yellow Book. One of the applicable provisions addresses objectivity: “Objectivity includes independence of mind and appearance when conducting engagements, maintaining an attitude of impartiality, having intellectual honesty and being free of conflicts of interest.”
  • IROs are required to retain and make available to the OIG, upon request, all work papers, supporting documentation, correspondence, and draft reports (exchanged between the IRO and the entity) related to the reviews.

Independent Review Organizations performing Claims Reviews

Clipboard with medical cross.

Claims reviews are supposed to determine whether the items and services furnished were medically necessary and appropriately documented, and whether the claims were correctly coded, submitted, and reimbursed for each reporting period of the CIA. Claims reviews are typically documented in an Integrity Agreement and must be conducted every quarter.

IRO Staffing Requirements for Annual Claims Reviews:

  • Assigning individuals who have expertise in federal program requirements applicable to the claims being reviewed.
  • Assign individuals to design and select the claims review sample who are knowledgeable about the appropriate statistical sampling techniques. Certain aspects of this element are usually specified in the CIA. These include elements such as the sample size of the quarterly or annual review sample, the statistical software used to generate the sample (e.g., Rat Stats), and the requirement to generate a mean point estimate of the overpayments, if any.
  • Assigning individuals to conduct the coding review portions of the Claims Review who have a nationally recognized coding certification. Certified coders must also maintain their certification, for instance, by completing the continuing education requirements set by the certification organization.
  • Assigning licensed nurses, physicians, or other licensed healthcare professionals with relevant education, training, and specialized expertise to make medical necessity determinations. In many cases, that means a physician who is Board Certified or Board Eligible in the specialty of the physician(s) whose claims are under review.
  • And, of course, the IRO must have sufficient staff and resources to conduct the claims review promptly.

Independent Review Organizations performing Arrangements Reviews

Paper and pen icon.

CIAs requiring Focused Arrangement Reviews are usually imposed on healthcare organizations that have been found to be violating Federal healthcare laws such as the Federal False Claims Act, the Anti-Kickback statute, or the Stark Law. Focus arrangements include any arrangement, transaction, or other financial relationship between a healthcare organization and any actual or potential source of business or referrals for designated healthcare services, to the healthcare organization.

IRO Staffing Requirements for Arrangements Reviews:

  • Attorneys or consultants (thank goodness!) who are knowledgeable in the requirements of the Anti-Kickback statute and the Stark Law regulations and other guidance related to these laws.
  • Individuals who possess expertise in fair market valuation issues or have the ability to associate with a valuation firm to assist in conducting the transactions review component of the Arrangements Review.
  • Have sufficient staff and resources to conduct the reviews required by the CIA on a timely basis.

Independent Review Organizations performing Clinical Quality Reviews

Clipboard, heart, pulse icon.

Corporate Integrity Agreements, including clinical quality reviews, focus on healthcare organizations that have experienced serious quality of care issues affecting federal healthcare programs, which can also overlap with claims review issues. These CIAs are customized based on the circumstances of the problems being dealt with by the OIG. The scope of a review may include the effectiveness, reliability, and thoroughness of the healthcare organization’s quality of care and patient safety, as well as its credentialing, privileging, and peer review processes. It may also include a review to determine if systems in place to promote quality of care and address quality of care issues are operating in a timely and effective manner.

In some cases, the OIG selects a monitor to assess the healthcare organization’s practical management of clinical services or programs. Since a claims review is often included with other review activities, the qualifications noted above for Claims Reviews are also required.

Why Experience Matters in IRO Selection

Trophy icon.

In any healthcare organization, regardless of size, healthcare compliance is a significant responsibility. Federal regulations are constantly being updated, so regulatory knowledge on the part of the Compliance Officer is critical. And meeting CIA obligations is even more daunting. As we often told Boards of Directors of our hospital compliance clients: “A corporate integrity agreement is like a corporate compliance program on steroids. You have to do most of the same work, and you have to do annual reporting to the OIG each year, too.”

Our experience with corporate integrity agreements as an IRO spans over 15 years, providing us with valuable insights into the process. We have served healthcare organizations that needed arrangements reviews as well as claims reviews. We have even corresponded directly with the OIG when we felt the results of a specific claims review did not merit the potential penalties the OIG could impose. Keep in mind that quarterly claims reviews start ninety days after the CIA is fully executed. So look in advance for a competent IRO as soon as you suspect a CIA is in your future. And feel free to download our free guide on how to select an IRO to help you through the selection process.


Frequently Asked Questions About Selecting an Independent Review Organization for a CIA

When should an organization begin selecting an IRO for a Corporate Integrity Agreement?

An organization should begin evaluating potential IROs as soon as a Corporate Integrity Agreement appears reasonably likely.

The selection, independence review, contracting process, and OIG notification can take time. The organization must also prepare data, documents, and personnel for the first required review.

The exact deadline and review schedule are established by the specific CIA. Early preparation reduces the risk of rushed decisions or missed reporting obligations.

Can the OIG reject an organization’s choice of Independent Review Organization?

Yes, the OIG may object to an IRO that lacks sufficient qualifications, independence, resources, or relevant experience.

OIG may also raise concerns later if the quality of the IRO’s work becomes inadequate. In that situation, the organization may be required to terminate the engagement and retain another IRO.

Before making a selection, the organization should verify that the proposed IRO can satisfy every qualification stated in its particular CIA.

What does independence mean when selecting an IRO?

An IRO must be free from relationships or conflicts that could reasonably call its objectivity into question.

The evaluation should cover current and prior relationships involving the organization, its owners, officers, directors, and other relevant parties. Independence includes both actual impartiality and the appearance of impartiality.

Government Auditing Standards also emphasize integrity, objectivity, and independence when conducting audit work and reaching conclusions.

How should an organization determine whether an IRO has the right expertise?

The IRO’s professionals should have qualifications specifically matched to every review required by the organization’s CIA.

Claims reviews may require certified coders, sampling expertise, and licensed clinicians who can evaluate medical necessity. Arrangements reviews may require Stark Law, Anti-Kickback Statute, and fair market value expertise.

Clinical quality reviews may require professionals experienced in patient safety, credentialing, privileging, peer review, and quality-of-care systems.

What operational capabilities should an organization evaluate before hiring an IRO?

The organization should confirm that the IRO has enough qualified personnel, secure processes, and capacity to complete each review on time.

The evaluation should address project leadership, staffing availability, data collection, sampling, document exchange, quality control, reporting, and communication with management.

The IRO must also be prepared to retain and produce relevant work papers, supporting documentation, correspondence, and draft reports when required under the CIA.