Health care providers, employer and union sponsored health plans,  health insurers, healthcare clearinghouses (Covered Entities) and their business associates should brace for audits and enforcement of the Privacy, Security, and Breach Notification rules by the Department of Health & Human Service Office of Civil Rights (OCR) follow OCR’s 2016 audit program on the heels of its announcement last week of two large HIPAA settlements last week.

OCR confirmed today it is sending emails notifying Covered Entities and their business associates identified as part of the kickoff of its next phase of audits of Covered Entities. In light of the HIPAA verification rules and the notorius spread of opportunistic identity theft and other fraud by opportunistic cybercrimals following these types of announcements, Covered Entities and business associates should carefully verify the requests validity and manage the response to avoid violating HIPAA in responding and position for defensibility against potential penalties. 

2016 Audit Program 

In its 2016 Phase 2 HIPAA Audit Program, OCR will review the policies and procedures adopted and employed by Covered Entities and their business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules. These audits will primarily be desk audits, although some on-site audits will be conducted.

According to today’s announcement, the 2016 audit process begins with verification of an entity’s address and contact information. OCR is sending emails to Covered Entities and business associates requesting that contact information be provided to OCR in a timely manner. OCR will then transmit a pre-audit questionnaire to gather data about the size, type, and operations of potential auditees; this data will be used with other information to create potential audit subject pools. Recipients should contact qualified legal counsel immediately for advice and assistance about proper procedures to verify the email is in fact from OCR and for assistance in responding. 

If an entity does not respond to OCR’s request to verify its contact information or pre-audit questionnaire, OCR will use publically available information about the entity to create its audit subject pool. Therefore an entity that does not respond to OCR may still be selected for an audit or subject to a compliance review. Communications from OCR will be sent via email and may be incorrectly classified as spam. If your entity’s spam filtering and virus protection are automatically enabled, OCR expects entities to check their junk or spam email folder for emails from OCR.

 The announcement also reflects that OCR is still developing other aspects of the audit program. OCR will post updated audit protocols on its website closer to conducting the 2016 audits. The audit protocol will be updated to reflect the HIPAA Omnibus Rulemaking and can be used as a tool by organizations to conduct their own internal self-audits as part of their HIPAA compliance activities.
OCR says its audits will enhance industry awareness of compliance obligations and enable OCR to better target technical assistance regarding problems identified through the audits. Through the information gleaned from the audits, OCR will develop tools and guidance to assist the industry in compliance self-evaluation and in preventing breaches. OCR plans to use results and procedures used in the phase 2 audits to develop its permanent HIPAA audit program.

OCR Settlements Show Enforcement Risk

The audit program announcement comes less than a week after OCR announced millions of dollars of new penalties under settlements with two Covered Entities:

• A $1,555,000 settlement with North Memorial Health Care of Minnesota;
• A $3.9 million settlement with Feinstein Institute for Medical Research.

The two settlements drive home again the substantial liability that Covered Entities and their business associates risk for violating HIPAA.

Feinstein Settlement

Feinstein is a biomedical research institute that is organized as a New York not-for-profit corporation and is sponsored by Northwell Health, Inc., formerly known as North Shore Long Island Jewish Health System, a large health system headquartered in Manhasset, New York that is comprised of twenty one hospitals and over 450 patient facilities and physician practices.

OCR’s investigation began after Feinstein filed a breach report indicating that on September 2, 2012, a laptop computer containing the electronic protected health information (ePHI) of approximately 13,000 patients and research participants was stolen from an employee’s car. The ePHI stored in the laptop included the names of research participants, dates of birth, addresses, social security numbers, diagnoses, laboratory results, medications, and medical information relating to potential participation in a research study.

OCR’s investigation discovered that Feinstein’s security management process was limited in scope, incomplete, and insufficient to address potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the entity. Further, Feinstein lacked policies and procedures for authorizing access to ePHI by its workforce members, failed to implement safeguards to restrict access to unauthorized users, and lacked policies and procedures to govern the receipt and removal of laptops that contained ePHI into and out of its facilities. For electronic equipment procured outside of Feinstein’s standard acquisition process, Feinstein failed to implement proper mechanisms for safeguarding ePHI as required by the Security Rule.

“Research institutions subject to HIPAA must be held to the same compliance standards as all other HIPAA-covered entities,” said OCR Director Jocelyn Samuels. “For individuals to trust in the research process and for patients to trust in those institutions, they must have some assurance that their information is kept private and secure.”

The resolution agreement and corrective action plan may be found on the OCR website at http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/Feinstein/index.html.

North Memorial

The Feinstein settlement announcement foll OCR’s announcement of a $1.5 million plus settlement with North Memorial to resolve HIPAA charges that it failed to implement a business associate agreement with a major contractor and failed to institute an organization-wide risk analysis to address the risks and vulnerabilities to its patient information. North Memorial is a comprehensive, not-for-profit health care system in Minnesota that serves the Twin Cities and surrounding communities. The settlement highlights the importance for Covered Entities and their business associates to comply with HIPAA’s business associate agreement and other HIPAA organizational, risk assessment, privacy and security, and other requirements.

OCR’s announcement emphasizes the importance of meeting these requirements. “Two major cornerstones of the HIPAA Rules were overlooked by this entity,” said Jocelyn Samuels, Director of OCR. “Organizations must have in place compliant business associate agreements as well as an accurate and thorough risk analysis that addresses their enterprise-wide IT infrastructure.”

The settlement comes from charges filed after OCR initiated its investigation of North Memorial following receipt of a breach report on September 27, 2011, which indicated that an unencrypted, password-protected laptop was stolen from a business associate’s workforce member’s locked vehicle, impacting the electronic protected health information (ePHI) of 9,497 individuals.

OCR’s investigation indicated that North Memorial failed to have in place a business associate agreement, as required under the HIPAA Privacy and Security Rules, so that its business associate could perform certain payment and health care operations activities on its behalf. North Memorial gave its business associate, Accretive, access to North Memorial’s hospital database, which stored the ePHI of 289,904 patients. Accretive also received access to non-electronic protected health information as it performed services on-site at North Memorial.

The investigation further determined that North Memorial failed to complete a risk analysis to address all of the potential risks and vulnerabilities to the ePHI that it maintained, accessed, or transmitted across its entire IT infrastructure — including but not limited to all applications, software, databases, servers, workstations, mobile devices and electronic media, network administration and security devices, and associated business processes.

In addition to the $1,550,000 payment, North Memorial is required to develop an organization-wide risk analysis and risk management plan, as required under the Security Rule. North Memorial will also train appropriate workforce members on all policies and procedures newly developed or revised pursuant to this corrective action plan.

The Resolution Agreement and Corrective Action Plan can be found on the HHS website at: http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/north-memorial-health-care/index.html.

Settlements Latest Reminder To Manage HIPAA Risks

Following up on OCR’s imposition of its second-ever HIPAA Civil Monetary Penalty (CMP) and the latest in an ever-growing list of settlements by Covered Entities under HIPAA, the North Memorial settlement is another example of the substantial liability that Covered Entities face for violating HIPAA. To avoid these liabilities, Covered Entities must constantly be diligent to comply with the latest guidance of OCR concerning their obligations under HIPAA. As OCR continues to issue additional guidance as well as supplement this guidance through information shared in settlement agreements like the North Memorial settlement, even if Covered Entities reviewed their practices in the last 12-months, most will want to update this review in response to new OCR guidance and enforcement actions, including new guidance on obligations to provide plan members or other subjects of protected health information with access to or copies of their records and other guidance, as well as the ever expanding list of enforcement actions by OCR.

Since the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) amended HIPAA, Covered Entities face growing responsibilities and liability for maintaining the security of ePHI. In response to HITECH, OCR continues to use a carrot and stick approach to encouraging and enforcing compliance. As demonstrated by OCR’s imposition of the second-ever HIPAA Civil Monetary Penalty (CMP) of $239,000 against Lincare and the ever-growing list of Resolution Agreements OCR announces with other Covered Entities, OCR continues to step up enforcement against Covered Entities that breach the Privacy and Security Rules. See OCR’s 2nd-Ever HIPAA CMP Nails Lincare For $239,000.

On the other hand, OCR also continues to encourage voluntary compliance by Covered Entities by sharing guidance and tools to aid Covered Entities to understand fulfill their HIPAA responsibilities such as the HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework (Crosswalk) unveiled by OCR on February 24, 2016.The crosswalk that maps the HIPAA Security Rule to the standards of the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (the Cybersecurity Framework) as well as mappings to certain other commonly used security frameworks.

While stating that the HIPAA Security Rule does not require use of the NIST Cybersecurity Framework, OCR says it hopes the Crosswalk will provide “a helpful roadmap” for HIPAA Covered Entities and their business associates to understand the overlap between the NIST Cybersecurity Framework, the HIPAA Security Rule, and other security frameworks that can help Covered Entities safeguard health data in a time of increasing risks and help them to identify potential gaps in their programs. At the same time, OCR’s announcement of its release of the Crosswalk also cautions users that “use of the Framework does not guarantee HIPAA compliance.” Rather, OCR says “the crosswalk provides an informative tool for entities to use to help them more comprehensively manage security risks in their environments.

With a USA Today report attributing more than 40 percent of data breaches to the healthcare industry over the last three years 91 percent of all health organizations having reporting breaches over the last two years, OCR has made clear that it intends to zealously investigate and enforce the Security Rules against Covered Entities that violate the Security Rules against Covered Entities that fail to take suitable steps to safeguard the security of PHI as required by the HIPAA Security Rule. To meet these requirements, the HIPAA Security Rule requires that Covered Entities conduct and be prepared to product documentation of their audit and other efforts to comply with the Security Rule Most Covered Entities will want to consider including an assessment of the adequacy of their existing practices under the Crosswalk and other requirements disclosed by OCR in these assessments to help position the Covered Entity to defend or mitigate HIPAA CMP and other liabilities in the event of a HIPAA breach or audit.

Latest Guidance Clarifies Patient Rights To Access PHI & Allowable Charges

In addition to maintaining adequate security, HIPAA also requires Covered Entities to provide individuals with the right to access and receive a copy of their health information from their providers, hospitals, and health insurance plans in accordance with the HIPAA Privacy Rule. In response to recurrent difficulties experienced by individuals in exercising these rights, OCR recently published supplemental guidance to clarify and promote better understanding and compliance with these rules by Covered Entities.

OCR started this process in January, 2015 by releasing a comprehensive fact sheet (Access fact sheet) and the first in a series of topical frequently asked questions (FAQs) addressing patients’ right to access their medical records, which set forth requirements providers must follow in sharing medical records with patients, including that they must do so in a timely manner and in a format that works for the patient.

Earlier this month, OCR followed up by publishing on March 1, 2016 a second set of FAQs addresses additional issues, including the fees individuals may be charged for copies of their health information and the right of individuals to have their health information sent directly to a third party if they so choose.

Covered entities and their business associates should move quickly to review and update their business associate agreements and other practices to comply with this new guidance as well as watch for further guidance and enforcement about these practices from OCR.

Other Key HIPAA Regulatory & Enforcement Changes Raise Responsibilities & Risks

OCR’s new guidance on access to PHI follows a host of other regulatory and enforcement activities. While the particulars of each of these new actions and guidance vary, all send a very clear message: OCR expects Covered Entities and their business associates to comply with HIPAA and is offering tools and other guidance to aid them in that process.. In the event of a breach or audit, Covered Entities and their business associates need to be prepared to demonstrate their efforts to comply. Those that cannot show adequate compliance efforts should be prepared for potentially substantial CMP or Resolution Agreement payments and other sanctions.

Register For 3/30 Webex Briefing

Solutions Law Press, Inc.™ invites to catch up on the latest guidance on the Covered Entities’ responsibility under HIPAA to provide access to patients to PHI by registering here to participate in the “HIPAA Update: The Latest On Security, Patient Access & Other HIPAA Developments” Webex briefing by attorney Cynthia Marcotte Stamer that Solutions Law Press, Inc.™ will host beginning at Noon Central Time on Wednesday, March 30, 2016. Get additional information or register here.T 

About The Speaker

CYNTHIA Marcotte Stamer is a practicing attorney and management consultant, author, public policy advocate and lecturer widely recognized for her extensive work and pragmatic thought leadership, experience, publications and training on HIPAA and other privacy, medical records and data and other health care and health plan concerns.

Recognized as “LEGAL LEADER™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble and as among the “Best Lawyers In Dallas” in employee benefits 2015 by D Magazine; Ms. Stamer has more than 28 years of extensive proven, pragmatic knowledge and experience representing and advising health industry clients and others on operational, regulatory and other compliance, risk management, product and process development, public policy and other key concerns.

As a core component of her work as the Managing Shareholder of Cynthia Marcotte Stamer, PC, the Co-Managing Member of Stamer Chadwick Soefje PLLC, Ms. Stamer has worked extensively throughout her nearly 30 year career with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, their technology and other vendors and service providers, and others on legal and operational risk management and compliance with HIPAA, FACTA, PCI, trade secret, physician and other medical confidentiality and privacy, federal and state data security and data breach and other information privacy and data security rules and concerns; prevention, investigation, response, mitigation and resolution of known or suspected data or privacy breaches or other incidents; defending investigations or other actions by plaintiffs, OCR, FTC, state attorneys’ general and other federal or state agencies; reporting and redressing known or suspected breaches or other violations; business associate and other contracting; insurance or other liability management and allocation; process and product development, contracting, deployment and defense; evaluation, commenting or seeking modification of regulatory guidance, and other regulatory and public policy advocacy; training and discipline; enforcement, and a host of other related concerns for public and private health care providers, health insurers, health plans, technology and other vendors, employers, and others.

Beyond her extensive involvement advising and defending clients on these matters, Ms. Stamer also has served for several years as the scrivener for the ABA JCEB’s meeting with OCR for many years. She returns as Chair of the Southern California ISSA Health Care Privacy & Security Summit for the third year in 2016, as well as speaks and serves on the steering committee of a multitude of other programs.

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, Ms. Stamer also shares shared her thought leadership, experience and advocacy on HIPAA and other concerns by her service in the leadership of a broad range of other professional and civic organization including her involvement as the Vice Chair of the North Texas Healthcare Compliance Association, Executive Director of the Coalition on Responsible Health Policy and its PROJECT COPE; Coalition on Patient Empowerment, a founding Board Member and past President of the Alliance for Healthcare Excellence, past Board Member and Board Compliance Committee Chair for the National Kidney Foundation of North Texas; former Board President of the early childhood development intervention agency, The Richardson Development Center for Children; former Board Compliance Chair and Board member of the National Kidney Foundation of North Texas, current Vice Chair of the ABA Tort & Insurance Practice Section Employee Benefits Committee, current Vice Chair of Policy for the Life Sciences Committee of the ABA International Section, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, a current Defined Contribution Plan Committee Co-Chair, former Group Chair and Co-Chair of the ABA RPTE Section Employee Benefits Group, immediate past RPTE Representative to ABA Joint Committee on Employee Benefits Council Representative and current RPTE Representative to the ABA Health Law Coordinating Counsel, former Coordinator and a Vice-Chair of the Gulf Coast TEGE Council TE Division, past Chair of the Dallas Bar Association Employee Benefits & Executive Compensation Committee, a former member of the Board of Directors of the Southwest Benefits Association and others.

Ms. Stamer also is a highly popular lecturer, symposia chair and author, who publishes and speaks extensively on health and managed care industry, human resources, employment and other privacy, data security and other technology, regulatory and operational risk management. Examples of her many highly regarded publications on these matters include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security: Beyond HIPAA,” as well as thousands of other publications, programs and workshops these and other concerns for the American Bar Association, ALI-ABA, American Health Lawyers, Society of Human Resources Professionals, the Southwest Benefits Association, the Society of Employee Benefits Administrators, the American Law Institute, Lexis-Nexis, Atlantic Information Services, The Bureau of National Affairs (BNA), InsuranceThoughtLeaders.com, Benefits Magazine, Employee Benefit News, Texas CEO Magazine, HealthLeaders, the HCCA, ISSA, HIMSS, Modern Healthcare, Managed Healthcare, Institute of Internal Auditors, Society of CPAs, Business Insurance, Employee Benefits News, World At Work, Benefits Magazine, the Wall Street Journal, the Dallas Morning News, the Dallas Business Journal, the Houston Business Journal, and many other symposia and publications. She also has served as an Editorial Advisory Board Member for human resources, employee benefit and other management focused publications of BNA, HR.com, Employee Benefit News, InsuranceThoughtLeadership.com and many other prominent publications and speaks and conducts training for a broad range of professional organizations and for clientson the Advisory Boards of InsuranceThoughtLeadership.com, HR.com, Employee Benefit News, and many other publications. For additional information about Ms. Stamer, see CynthiaStamer.com or the Stamer│Chadwick │Soefje PLLC or contact Ms. Stamer via email to here or via telephone to (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources at http://www.solutionslawpress.com such as:

New CDC Guidance on Opioid Prescribing
Update Privacy Practices For New OCR HIPAA Enforcement, Security & Records Access Guidance
3/30 Webex Shares Latest On Security, Patient Access & Other HIPAA Developments
OIG Opinion Lets Med Center Pay Some Transport & Short-Term Lodging Costs For Pregnant Medicaid Patients Near Delivery
Compliance Defects Fuel Record Record $646M Antikickback Penalty
OCR’s 2nd-Ever HIPAA CMP Nails Lincare For $239,000
Redesigned OCR Website Launched
Providers Get More Flexibility To Report Mental Health Patients To Gun Data Base Under New Privacy Rule
OIG Modifies Past Ruling, Blesses Two New Medicare Co-Pay Financial Programs
IRS Stops Asserting Foreign Reinsurance Tax On Premiums Between Reinsurers
Lehey Pays $850K After Unencrypted Laptop Stolen
Health Care Fraud Prosecutions Target Owners, Operators & Other Leaders
Excluded Nurse, Husband Face Decades Imprisonment on $80M Home Health Fraud Convictions
Practitioners Act Now To Request Review of 2016 Value Modifiers Now

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating or updating your profile.
©2016 Cynthia Marcotte Stamer.

Non-exclusive right to republish granted to Solutions Law Press, Inc.™ All other rights reserved.

The Department of Health & Human Services has issued an opinion approving an academic medicine center’s proposed arrangement under which the facility would pay for certain transportation costs to and from the hospital and costs for short-term lodging near the facility prior to delivery.  See  http://ow.ly/YXcc9.  While the opinion provides helpful insights for other facilities interested in offering similar arrangements without violating the Medicare Statute, health care organizations are cautioned that the OIG opinion only provides protection for the specific academic medical center to which it was issued, and then only to the extent that all requirements and assumptions of the opinion are met.  Other organizations interested in adopting a similar practice should consult with qualified legal counsel about pursuing an OIG opinion approving their specific proposed arrangement.

Tardiness in implementation of a meaningful compliance program is a key reason why the United States’ largest distributor of endoscopes and related equipment, Olympus Corp. of the Americas (OCA), will be required to pay a record $623.2 million in criminal and civil penalties and implement other reforms to resolve criminal charges under the Antikickback Statute and related civil claims brought by a whistleblower under the False Claims Act (FCA) for paying kickbacks to doctors and hospitals in the United States and Latin America under the three-year deferred prosecution agreement (DPA) the Justice Department announced March 1, 2016. The combined criminal and civil penalties will be the largest total amount paid in U.S. history for violations involving the AKS by a medical device company.

In addition to the resolution of the AKS criminal charges and FCA civil lawsuit against OCA, an OCA subsidiary, Olympus Latin America (OLA), also agreed to pay $22.8 million to resolve criminal charges relating to the Foreign Corrupt Practices Act (FCPA) in Latin America.

OCA Anti-Kickback Violation Charges & Settlement

OCA agreed to the March 1, 2016 DPA imposing the record $623.2 million in criminal and civil penalties and requiring OCA to implement other reforms resolve criminal charges filed March 1, 2016 against OCA in the Newark, New Jersey District Court charging OCA with conspiracy to violate the Anti-Kickback Statute (AKS) prohibition against health care organizations making payments to induce purchases paid for by federal health care programs.

The criminal complaint against OCA, which OCA agrees in the DPA is true, charges that OCA won more than $600 million in new sales and realized gross profits of more than $230 million by improperly by giving doctors and hospitals kickbacks, including consulting payments, foreign travel, lavish meals, millions of dollars in grants and free endoscopes.  For example, the Justice Department says:

• OCA gave a hospital a $5,000 grant to facilitate a $750,000 sale;
• OCA held up a $50,000 research grant until a second hospital signed a deal to purchase Olympus equipment;
• OCA paid for a trip for three doctors to travel to Japan in 2007 as a quid pro quo for their hospital’s decision to switch from a competitor to Olympus; and
• A doctor with a major role in a New York medical center’s buying decisions received free use of $400,000 in equipment for his private practice.

The criminal complaint alleges that the improper payments happened while Olympus lacked training and compliance programs.  Unlike other medical and surgical products companies, Olympus did not create the position of compliance officer until 2009 and did not hire an experienced compliance professional until August 2010.

To resolve the AKS criminal charges, the Justice Department reports that OCA agreed to enter into a three-year DPA that will allow OCA to avoid conviction under the complaint if it complies with the reform and compliance requirements outlined in the agreement.   To meet the conditions of the DPA, OCA must pay a $312.4 million criminal penalty and an additional $310.8 million to settle civil claims under the federal and various state False Claims Acts, as well as remedy its compliance problems by adopting several compliance measures. The required compliance measures include:

• OCA must enhance its compliance training and maintain an effective compliance program;
• OCA must maintain a confidential hotline and website for OCA employees and customers to report wrongdoing;
• OCA’s chief executive officer and board of directors must certify annually that the program is effective; and
• OCA must adopt an executive financial recoupment program requiring executives who engage in misconduct or fail to promote compliance to forfeit up to three years of performance pay.

Larry Mackey, a former federal prosecutor best known for trying the Oklahoma City bombing cases, is the independent monitor selected by the Justice Department to evaluate and oversee Olympus’ compliance with the DPA.  The DPA and monitor will remain in place for three years and can be extended for another two years if Olympus violates the DPA.

Related OCA FCA Whistleblower Suit Settlement

In addition to resolving the criminal charges brought by the Justice Department, OCA and the Justice Department also entered into a related civil settlement that resolves a whistleblower lawsuit originally filed by John Slowik, the former chief compliance officer of OCA, in the District of New Jersey, under the federal and various state False Claims Acts.  Under the civil settlement, Olympus agrees to pay $310.8 million to the federal government and the states to resolve claims that OCA’s payment of kickbacks caused false claims to be submitted to federal health care programs Medicare, Medicaid and TRICARE, and thus violated not only the AKS but also the federal and various state False Claims Acts.  The federal share of the civil settlement is $267,288,323, and Olympus will pay $43,512,053 million to participating states that contributed to the falsely claimed Medicaid payments at issue.   Since the FCA allows whistleblowers to file suit for false claims against the government entities and to share in any recovery, Mr. Slowik will receive $44,102, 573 million from the federal share and $7 million from the state share of the civil settlement amount.

OLA FCPA Violations & Settlement

Separately, OCA’s Miami-based subsidiary, OLA, entered into a separate three-year DPA with the Justice Department to resolve a separate criminal complaint also filed today in Newark federal court that charged OLA with FCPA violations in connection with improper payments to health officials in Central and South America.  According to court documents, from 2006 until August 2011, OLA implemented a plan to increase medical equipment sales in Central and South America by providing payments to health care practitioners at government-owned health care facilities.  These payments included cash, money transfers, personal grants, personal travel and free or heavily discounted equipment.  The primary method to deliver these illicit benefits was through “training centers,” nominally set up to educate and train doctors, but which OLA used to provide benefits to pre-selected practitioners.  OLA and its conspirators paid nearly $3 million to practitioners to induce the purchase of Olympus products and recognized more than $7.5 million in profits as a result.

According to the Justice Department, OLA entered into a separate DPA with the Criminal Division’s Fraud Section and the U.S. Attorney’s Office of the District of New Jersey to settle these FCPA charges.  The DPA requires OLA to pay a criminal penalty of $22.8 million, retain the same compliance monitor as for OLA (Mr. Mackey) for a period of three years and implement a number of compliance measures.   The Justice Department’s announcement of the charges and settlement indicates that the amount of the required criminal penalty was influenced by a number of factors, including that OLA did not voluntarily disclose the misconduct in a timely manner, but OLA did receive credit of a 20 percent reduction on its penalty for its cooperation, including its extensive internal investigation, translation of numerous foreign language documents and collecting, analyzing and organizing voluminous evidence.

Corporate Integrity Agreement

In addition to the criminal and civil resolutions, OCA executed a corporate integrity agreement (CIA) with the Department of Health and Human Services-Office of Inspector General (HHS-OIG).  The CIA details the compliance program OCA must maintain, which must include:

• compliance responsibilities for OCA management and the board of directors;
• a health care compliance code of conduct that includes certain standards;
• training and education that includes specified standards;
• requirements for consulting arrangements, grants and charitable contributions, management of field assets and review of travel expenses;
• risk assessment and mitigation process; and
• review procedures for testing the compliance program.

Penalties Send Message: Implement Meaningful Compliance Programs

Comments of U.S. Attorney Paul J. Fishman of the District of New Jersey in the Justice Department’s announcement of the OCA DPA send a clear warning to health care providers and suppliers about the their own risks of failing to maintain and the potential benefits of maintaining demonstrably meaningful compliance programs to both prevent violations and to position their organization to resolve or mitigate their liability in the event a violation occurs despite their administration of a robust AKS, FCA or other violation of federal or state health care fraud or other law.

“For years, Olympus Corporation of the Americas and Olympus Latin America dropped the compliance ball and failed to have in place policies and practices that would have prevented the substantial kickbacks and bribes they paid,” said U.S. Attorney Fishman. “It is appropriate that they be punished for that. At the same time, the deferred prosecution agreement takes into account the companies’ cooperation and commitment to fully functional corporate compliance.”

Attorney Fishman’s warning comes amid ever growing success by the Justice Department, the OIG and other federal and state law enforcement and health care regulators in their efforts to uncover and prosecute violations of federal and state health care fraud and other laws through the Health Care Fraud Prevention and Enforcement Action Team (HEAT) initiative announced in May 2009 by the Attorney General and the Secretary of Health and Human Services.  Since January 2009, the Justice Department has recovered a total of more than $27.4 billion through False Claims Act cases, with more than $17.4 billion of that amount recovered in cases involving fraud against federal health care programs. In response to this rigorous enforcement, health care providers and suppliers should remain ever diligent in their efforts to prevent AKS, FCA and other violations of federal and state health care laws.

About The Author

Recognized as “LEGAL LEADER™ Texas Top Rated Lawyer” in both Health Care Law and Labor and Employment Law, a “Texas Top Lawyer,” an “AV-Preeminent” and “Top Rated Lawyer” by Martindale-Hubble; as among the “Best Lawyers In Dallas 2015 by D Magazine; and a Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, the author of this update, attorney Cynthia Marcotte Stamer, more than 28 years of extensive experience representing and advising health industry clients and others on these and other regulatory, risk management, public policy and operations matters.

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer’s experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications. You can get more information about her health industry experience here. If you need assistance responding to concerns about the matters discussed in this publication or other health care concerns, wish to obtain information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

About Solutions Law Press

Solutions Law Press, Inc.™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns.

Other Helpful Resources & Other Information

Solutions Law Press, Inc.™ hopes that this information is useful to you. If you found these updates of interest, you also be interested in  other recent Solutions Law Press, Inc. training, articles and resources.  You can see more articles from this Health Care Update electronic publication, the Coalition for Responsible Health Care Reform electronic publication, our electronic HR & Benefits Update and other publications like the following and get information about training and other resources at www.Solutionslawpress.com:

• OCR’s 2nd-Ever HIPAA CMP Nails Lincare For$239,000
• Redesigned OCR Website Launched
• Providers Get More Flexibility To Report Mental Health Patients To Gun Data Base Under New Privacy Rule
• OIG Modifies Past Ruling, Blesses Two New Medicare Co-Pay Financial Programs
• IRS Stops Asserting Foreign Reinsurance Tax On Premiums Between Reinsurers
• Lehey Pays $850K After Unencrypted Laptop Stolen
• Health Care Fraud Prosecutions Target Owners, Operators & Other Leaders
• Excluded Nurse, Husband Face Decades Imprisonment on $80M Home Health Fraud Convictions
• Practitioners Act Now To Request Review of 2016 Value Modifiers Now
• Civil Rights Settlement Highlights Health Industry Discrimination Risks As OCR Prepares To Broaden Requirements
• Use Free Cyber Security Awareness Month Resources To Boost HIPAA & Other Cyber Security Training & Skills
• NLRB 29 Unfair Labor Practice Charges Against Community Health Systems, Inc. Shows Industry Labor Risks
• OCR’s Proposed Sex & Other Discrimination Rules Spell Headaches & New Risks For Health Care Providers, Insurers & Others

You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can access other recent updates and other informative publications and resources here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2016 Cynthia Marcotte Stamer, P.C. Non-exclusive license to republish granted to Solutions Law Press, Inc. All other rights reserved.