Safe harbors under the federal Anti-Kickback Statute are regulatory exceptions that protect specific healthcare payment arrangements from prosecution, even when those payments could otherwise look like illegal kickbacks. The Office of Inspector General created them at 42 C.F.R. § 1001.952, and each one lists exact conditions an arrangement must satisfy.1Office of Inspector General. Safe Harbor Regulations Missing even one requirement removes the protection entirely, so the structure of each safe harbor matters far more than the fact that one exists.
Why the Safe Harbors Exist
The Anti-Kickback Statute makes it a felony to knowingly offer, pay, solicit, or receive anything of value to induce or reward referrals for services covered by Medicare, Medicaid, or any other federal healthcare program. It reaches both sides of the transaction.2Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs A claim submitted for services resulting from a kickback also counts as a false claim, opening the door to treble damages and whistleblower suits under the False Claims Act.
Courts apply what is known as the one-purpose test: if even one purpose of a payment is to induce referrals, the arrangement violates the statute, no matter how many legitimate purposes also existed. That breadth is why safe harbors are load-bearing. Without them, ordinary business deals between healthcare entities could trigger liability whenever referrals happen to flow between the parties.
Investment Interests
Large Publicly Traded Entities
Investments in large public healthcare companies qualify when the company holds more than $50 million in undepreciated net tangible healthcare-related assets. The equity security must be registered with the Securities and Exchange Commission, and the investment must be available to the general public on the same terms offered to potential referral sources.3eCFR. 42 CFR 1001.952 – Exceptions At that scale, any single investor’s referrals are too small to distort the stock.
Small Entities and the 60/40 Rule
Smaller or privately held ventures face much tighter limits. No more than 40 percent of any class of investment interest may be held by investors in a position to refer patients or generate business for the entity, and no more than 40 percent of the entity’s gross revenue may come from referrals or business generated by its investors.3eCFR. 42 CFR 1001.952 – Exceptions Returns must track the amount of capital each investor contributed, not the volume of business the investor refers. Separate share classes designed to steer larger returns to high-referring investors do not qualify. This is where most physician-owned ventures either fit or fail.
Space and Equipment Rentals
Lease safe harbors sit at 42 C.F.R. § 1001.952(b) for space and (c) for equipment, with essentially identical requirements. The lease must be in writing, signed by both parties, and run at least one year. It must identify the exact space or equipment covered. Part-time or periodic access requires the agreement to spell out the schedule, the length of each interval, and the rent for each interval.3eCFR. 42 CFR 1001.952 – Exceptions
What is leased cannot exceed what is reasonably necessary for a legitimate business purpose. Rent must be set in advance and reflect fair market value in an arm’s-length transaction, meaning what the property would rent for between parties with no referral relationship, without any premium for the value of being near a referral source. Total compensation tied to referral volume or calculated as a percentage of revenue generated between the parties defeats the safe harbor. Independent appraisals and comparable market data are the standard documentation.
Personal Services and Management Contracts
Healthcare providers regularly retain independent contractors for billing, consulting, marketing, or management work. The safe harbor at 42 C.F.R. § 1001.952(d) protects those arrangements when they follow rules that closely mirror the lease safe harbors.
A signed written agreement must cover all the services the contractor will provide, with a term of at least one year. Part-time or periodic services require the contract to detail the schedule, the length of each service interval, and the charge for each interval. Aggregate services cannot exceed what is reasonably necessary for a commercially reasonable business purpose.4eCFR. 42 CFR 1001.952 – Exceptions
Compensation must be set in advance, consistent with fair market value, and disconnected from the volume or value of referrals between the parties. Consulting contracts that scale with referred patients, or marketing fees that rise with new patient volume, will not qualify. The services must also be legitimate rather than a vehicle for steering patients.
Outcomes-Based Payment Arrangements
A carve-out within the personal services safe harbor allows compensation tied to specific, measurable outcomes rather than fixed in advance, provided the payment methodology is set in writing before services begin and is commercially reasonable. Payment still cannot be based on referral volume or value.4eCFR. 42 CFR 1001.952 – Exceptions
Bona Fide Employment
The bona fide employment safe harbor at 42 C.F.R. § 1001.952(i) is one of the broadest. It protects any amount an employer pays a W-2 employee for services related to items covered by a federal healthcare program.3eCFR. 42 CFR 1001.952 – Exceptions
Unlike independent contractor arrangements, employers can pay productivity bonuses tied to the volume of services the employee personally provides. A hospital can pay a surgeon more for performing more surgeries. The safe harbor does not extend to independent contractors, which is why the personal services safe harbor imposes so many more conditions.
Group Purchasing Organizations
Group purchasing organizations pool the buying power of healthcare providers to negotiate better prices. The GPO safe harbor at 42 C.F.R. § 1001.952(j) allows a GPO to collect administrative fees from vendors, payments that would otherwise resemble kickbacks for steering purchases.
The GPO must have a written agreement with each member disclosing the fees it receives from vendors. If the fee exceeds three percent of the purchase price, the agreement must state the maximum amount the GPO could receive. The GPO must also notify its provider members at least once a year of the amounts received from each vendor on their behalf.3eCFR. 42 CFR 1001.952 – Exceptions Transparency is the entire mechanism.
Discounts and Warranties
Price reductions on healthcare items or services fall under 42 C.F.R. § 1001.952(h). The discount must be given at the point of sale or set at the time of sale, even if applied later, and buyers must report the discount on cost reports or claims to federal programs so the government receives the benefit of the lower price. Sellers must report the discount on the invoice or statement provided to the buyer and inform the buyer of its reporting duties.3eCFR. 42 CFR 1001.952 – Exceptions
Warranties on healthcare items are handled similarly. The manufacturer must disclose any price reduction on the invoice and tell the buyer to report it. If the exact value is unknown at the time of sale, the manufacturer must note the warranty and later document the reduction once it can be calculated. Buyers must report warranty-related price reductions on their claims or cost reports.4eCFR. 42 CFR 1001.952 – Exceptions
Waiving Patient Cost-Sharing
Waiving a patient’s copayment, coinsurance, or deductible can function as an inducement to choose one provider over another. The safe harbor at 42 C.F.R. § 1001.952(k) allows waivers only in narrow circumstances: the provider must determine in good faith that the patient is in financial need, or must have made reasonable collection efforts that failed.4eCFR. 42 CFR 1001.952 – Exceptions
The financial need determination has to be individualized. Routinely waiving copays for every patient, or advertising free services as a way to attract business, sits outside the safe harbor. Certain federally qualified health centers and entities operating under federal grant programs have additional flexibility, but the general rule is strict.
Local Transportation
Free rides to patients can easily resemble payment for referrals, so the local transportation safe harbor at 42 C.F.R. § 1001.952(bb) protects only modest ground transportation that meets every one of the following conditions:
- A written policy applied uniformly and consistently to all eligible patients.
- Eligibility not tied to the volume or value of federal healthcare program business.
- Ground transportation only. Air, luxury, and ambulance-level transportation are excluded.
- No public advertising of the service, no marketing of healthcare services during the ride, and no per-patient payment to drivers.
- An established patient, or at least someone who has contacted the provider to schedule an appointment.
- Within 25 miles of the provider, or 75 miles for rural patients. Distance limits do not apply when transporting a patient home after an inpatient stay or observation of at least 24 hours.
- For obtaining medically necessary items or services.
Fixed-route shuttle services qualify under a related provision, provided they follow similar marketing restrictions and do not limit service to federal healthcare program beneficiaries.4eCFR. 42 CFR 1001.952 – Exceptions
Practitioner Recruitment in Shortage Areas
Entities in Health Professional Shortage Areas can offer signing bonuses, relocation assistance, or income guarantees to recruit practitioners under 42 C.F.R. § 1001.952(n). A written agreement must specify the benefits, their terms, and each party’s obligations. Benefits cannot last longer than three years and the terms cannot be renegotiated during that period.
If the practitioner is leaving an established practice, at least 75 percent of the new practice’s revenue must come from patients not previously seen at the old practice, and at least 75 percent of the new practice’s revenue must come from patients living in a HPSA or medically underserved area.4eCFR. 42 CFR 1001.952 – Exceptions The recruiting entity cannot require referrals as a condition of receiving benefits, though it can require the practitioner to maintain staff privileges. The practitioner must agree to treat federal healthcare program patients on a nondiscriminatory basis, and the amount of the benefits cannot be adjusted based on referral volume.
EHR and Cybersecurity Donations
The EHR donation safe harbor at 42 C.F.R. § 1001.952(y) allows hospitals and other entities to donate electronic health records software, hardware, and related training to physicians and other providers. The recipient must pay at least 15 percent of the donor’s cost for the items and services before receiving them, and the donor cannot finance that contribution or loan the recipient the money.4eCFR. 42 CFR 1001.952 – Exceptions
The cybersecurity safe harbor at 42 C.F.R. § 1001.952(jj), added in 2020, protects donations of cybersecurity technology and related services. The technology must be necessary and used predominantly to implement, maintain, or reestablish effective cybersecurity. There is no mandatory cost-sharing requirement, but the donor cannot base eligibility or the scope of the donation on referral volume or condition the donation on future referrals. The recipient cannot make accepting the donation a condition of doing business with the donor. Both parties must document the arrangement in a signed writing describing the technology and any recipient contribution, and the donor cannot shift the costs onto any federal healthcare program.3eCFR. 42 CFR 1001.952 – Exceptions
Value-Based Arrangements
Three safe harbors added in 2021 protect arrangements in which healthcare entities coordinate care and share financial risk. They form a ladder: the more downside risk the parties accept, the broader the protection.
Care Coordination Arrangements
The care coordination safe harbor at 42 C.F.R. § 1001.952(ee) is the most restrictive. It protects only in-kind remuneration used to coordinate and manage care for a defined patient population. Cash payments do not qualify. The recipient must pay at least 15 percent of the cost or fair market value of what is provided.
A signed writing must specify the value-based purpose, the target patient population, the term, and the outcome or process measures the parties will track. Those measures must rest on clinical evidence rather than patient satisfaction. Parties must monitor quality at least annually and either correct deficiencies within 120 days or terminate the arrangement.3eCFR. 42 CFR 1001.952 – Exceptions Pharmaceutical manufacturers, pharmacy benefit managers, laboratory companies, and most medical device manufacturers are excluded.
Substantial Downside Financial Risk
The substantial downside risk safe harbor at 42 C.F.R. § 1001.952(ff) allows both cash and in-kind remuneration, but the value-based enterprise must take on meaningful financial exposure. Substantial downside risk means assuming at least 30 percent of losses against a benchmark for total patient care costs, or at least 20 percent of losses on a clinical-episode basis across multiple care settings. Each participant must also take a meaningful share of that risk: two-sided risk for at least 5 percent of the enterprise’s losses and savings. The risk-sharing must run at least one year on a prospective basis.4eCFR. 42 CFR 1001.952 – Exceptions
Full Financial Risk
The broadest of the three, at 42 C.F.R. § 1001.952(gg), applies when the value-based enterprise has assumed full financial risk from a payor for all healthcare items and services for the target patient population, prospectively, for at least one year. This is essentially capitated payment. Both monetary and in-kind remuneration are permitted with fewer restrictions than the other two tiers. The enterprise must still maintain a quality assurance program that protects against underutilization, and all remuneration must connect to the enterprise’s value-based purposes. The same exclusions of pharmaceutical companies, PBMs, laboratories, and most device manufacturers apply.4eCFR. 42 CFR 1001.952 – Exceptions
When No Safe Harbor Fits
Not every arrangement maps onto one of these categories. When an arrangement sits in a gray area, the OIG offers a formal advisory opinion process. The requestor submits a detailed description of the proposed arrangement, and the OIG issues a written opinion on whether it would face enforcement action.
Requests go to the OIG by email in PDF format, and the OIG encourages using its advisory opinion request template. Within 10 business days, the OIG will accept the request, reject it, or ask for additional information.5Office of Inspector General. Advisory Opinion Process There is no flat fee. The requestor pays the OIG’s actual review costs, including staff salaries, benefits, and any outside expert consultations. A cost estimate and dollar cap can be requested up front, which triggers a pause in review until the requestor confirms whether to continue.6eCFR. 42 CFR Part 1008, Subpart C – Advisory Opinion Fees
An advisory opinion protects only the specific parties and the specific arrangement described in the request. It does not create a safe harbor for anyone else, and the OIG can modify or revoke opinions if the underlying facts change.