Healthcare Fraud Exposures Significant & Rising For Owners, Execs & Other Leaders

October 17, 2016

Owners, operators, and leaders of health care organizations face an ever-growing imperative to lock down compliance by the organization and its employees and agents both to protect their organizations and its investors and themselves personally against the criminal, civil and administrative sanctions that result when health care organizations or their people break the rules.

The Departmnet of Health and Human Services Office of Inspector General (OIG) and the Department of Justice (DOJ) increasingly are going after owners, operators and other leaders of healthcare organizations for participating in, failing to act to prevent or inadequately investigating and redressing fraud or other illegal conduct in their organizations or by members of their organization’s team. Leaders and owners need to learn the rules and what to do to manage their risk. Owners and leaders must get informed about their expectations and exposures and learn and take the right steps to adopt compliance plans, monitor and enforce compliance, investigate and redress concerns and deal with these responsibilities and risk

The latest slew of federal health care fraud prosecutions reported by DOJ and OIG during the first two weeks of October illustrate some of the risks owners and executives face when they, their organization or employees or agents violate these rules.  DOJ and federal regulators like OIG have made clear that they construe these rules to require leaders both to abstain from violating these laws and to adopt and administer effective compliance plans, oversight and other actions to train and prevent their employees and agents from violating these rules.  See, e.g., Practical Guidance for Health Care Governing Boards on Compliance Oversight.

Of course, owners and management leaders inevitably face significant financial loss and other fallout if their organizations or members of their teams are found to have violated federal or state health care fraud laws.  Over the past decade, however, owners and leaders increasingly also face growing risks of personal prosecution when their organization or someone on their team breaks the rules.

Owners, executives or other leaders who may be tempted to underesktimate the significance of these warnings should note DOJ’s increasingly aggressive and heavy handed prosecution of owners, executives and other leaders who either directly participate in, or by failing to adopt or administer meaningful compliance and investigation practices, are perceived to have allowed, encouraged or facilitated employees or agents to engage in actions hat DOJ, OIG or other federal regulators consider fraudulent.

DOJ’s growing emphasis on holding health care executives accountable for health care fraud or other violations of federal health care and other laws is clearly reflected in the prosecutions and convictions it announced during the first two weeks of October clearly demonstrate the critical need for health care organization owners, officers and other leaders (executives) to safeguard themselves personally, as well as their organizations against becoming targeted or convicted of health care fraud or other violations of federal health care laws by ensuring their organization adopts and administers effective compliance programs and taking other meaningful, well-documented steps , efforts to ensure the effectiveness of these compliance efforts.

Federal criminal and civil health care fraud laws both prohibit owners, operators and executives from participating in or conspiring to violate federal anti-kickback, anti-referral, false claims and other health care fraud laws, as well as provide various mechanisms that impose liability against owners and executives that fail to adopt and administer appropriate compliance, audit and other oversight and enforcement processes and procedures.  Since October 1, 2016, for instance, DOJ has announced the following healthcare charges, convictions and settlements involving owners and executives.

Of course, the costs and liabilities of federal criminal or civil investigations and prosecutions are only part of the challenges an organization and its leaders generally face when their healthcare organization or its actions are questioned under federal health care fraud or other laws.  Whistleblower or other claims of employees and agents claiming to have been penalized for questioning practices, shareholder or other investor lawsuits, federal program disqualification, loss of position or reputation, the financial and other burdens of responding to and defending investigations and charges and a parade of other horribles that typically attend investigations and prosecutions also often exact a heavy toll on health care organization owners and leaders caught up in federal fraud investigations or prosecutions.

In the face of these growing risks, healthcare owners, executives and other leaders need a clear and up to date understanding of health care fraud laws and the obligations and expectations that these rules create not only for their organizations, but also increasingly them personally.  Owners and other leaders need to understand the health care fraud rules, the ways that liability can attach not only to their organization but also themselves and their leaders under these rules, the burdens of proof and assumptions that create special challenges in responding to challenges or defending charges and actions and strategies they should take before, during, and after compliance issue or prosecution arises to strengthen their ability to defend or mitigate their and their organization’s liability exposures.  As part of these efforts, owners and leaders not only should ensure that their organization adopt, train staff and others on and meaningfully administer up-to-date compliance programs in a manner that clearly documents the commitment of their organization and its leaders to compliance. Owners, executives and leaders also should become educated about the expectations of DOJ, HHS and other agencies and whistleblowers are likely to expect concerning their role and actions as owners and leaders both in establishing a clear expectation of compliance, as well as adopting, overseeing and enforcing practices and policies to maintain compliance, investigate and redress potential wrongdoing and otherwise maintain the compliance and culture expected and required under federal law.  Owners and leaders should ensure that they and others in their organization are trained to recognize potential compliance issues, understand the steps they and their organization need to take when a potential compliance concern arises, and how to conduct and document investigations and other actions to strengthen their and their organization’s ability to defend against potential charges or other claims..

Owners, executives and other leaders also should anticipate, and prepare in advance for the likelihood that they and their organizations will need to respond investigations, suspected violations, whistleblower claims and other events that could create substantial exposure for their organizations and themselves personally.  Leaders need to understand that the nature and risks associated with these potential health care fraud liabilities may make ill-advised commonly used settlement or other practices for resolving quickly disputes or other concerns.   Owners and leaders bearing these responsibilities should seek specific advice and training about their responsibilities, as well as recommended strategies for investigating and responding to concerns that may carry or give rise to these risks.  Most leaders also will want to ensure that their employment, shareholder and other agreements include sufficient flexibility and protections to protect the executive or other leader for termination, retaliation or other loss or injury for taking appropriate steps to investigate and respond to a compliance concern as well as plan in advance by arranging for their organization to provide indemnification, insurance or other coverage, and/or securing personally coverage to provide coverage needed to fund what often may be substantial legal fees arising out of investigation and defense of investigations, charges, or other actions and the corporate, employment and other fallout that often accompanies such events.


About The Author

A Fellow in the American College of Employee Benefit Counsel, the American Bar Foundation and the Texas Bar Foundation, current American Bar Association (ABA) International Section Life Sciences Committee Vice Chair, former scribe for the ABA Joint Committee on Employee Benefits (JCEB) Annual OCR Agency Meeting and JCEB Council Representative, former Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section,  the former Board President and Treasurer of the Richardson Development Center for Children Early Childhood Intervention Agency, and past  Board Compliance Chair of the National Kidney Foundation of North Texas, and Board Certified in Labor & Employment Law by the Texas Board of Legal Specialization, the author of this update, attorney Cynthia Marcotte Stamer, is AV-Preeminent (the highest) rated attorney repeatedly recognized for her nearly 30 years of experience and knowledge representing and advising healthcare, health plan and other health industry and others on these and other regulatory, workforce, risk management, technology, public policy and operations matters as a Martindale-Hubble as a “LEGAL LEADER™” and “Texas Top Rated Lawyer” in Health Care Law, Labor and Employment Law, and Business & Commercial Law and among the “Best Lawyers In Dallas” by D Magazine.

Ms. Stamer’s health industry experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

Ms. Stamer also is known for her experience in HIPAA and other privacy and data security and breach concerns.  The scribe for ABA JCEB annual agency meeting with OCR for many years, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers and other plan sponsors, banks and other financial institutions, and others on risk management and compliance with HIPAA, FACTA, trade secret and other information privacy and data security rules, including the establishment, documentation, implementation, audit and enforcement of policies, procedures, systems and safeguards, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical  staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.

You can get more information about her health industry experience here or contact Ms. Stamer via telephone at (469) 767-8872 or via e-mail here.

About Solutions Law Press Inc.™

Solutions Law Press, Inc.™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns.

If you found these updates of interest, you may be interested in other recent Solutions Law Press, Inc. updates like the following:

Go here to register to receive other Solutions Law Press, Inc. updates and announcements about other upcoming briefings, training or other programs, products, services, and activities or to learn more about Solutions Law Press, Inc., its publications, programs and training, PROJECT COPE: Coalition on Patient Empowerment community service and education projects, event management and other resources and services.

For important information concerning this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2016 Cynthia Marcotte Stamer, P.C. Non-exclusive license to republish granted to Solutions Law Press, Inc. All other rights reserved.


New HIPAA Settlement Highlights Internet Applications Safeguards, Whistleblower & Management Oversight Compliance Risks

July 10, 2015

Health care providers, health insurers, group health plans and health care clearinghouses (Covered Entities), their business associates and their leaders need to ensure the adequacy of the security of internet portals and applications used to create, use, access or disclose protected health information (PHI) and should establish and administer ongoing procedures to monitor and maintain adequate PHI security on an ongoing basis in light of a new Health Insurance Portability & Accountability Act (HIPAA) Privacy, Security and Breach Notification Rule (“HIPAA Rules”) Resolution Agreement with St. Elizabeth’s Medical Center (SEMC) announced today (July 10, 2015) by the Department of Health & Human Services Office of Civil Rights (OCR). Concurrently, the Resolution Agreement also reaffirms the growing involvement of employees and other workforce members as HIPAA “whistleblowers” as well as the need for Covered Entities, business associates and their leaders to ensure that they include and administer documented requirements for board reporting and oversight in their HIPAA compliance and risk management activities.

To settle OCR charges that the Brighton, Massachusetts’s based hospital system violated the HIPAA Rules resulting from OCR’s investigation of a November 16, 2012 complaint made to OCR by SEMC workforce members, SEMC has agreed to pay $218,400 and to implement a “robust corrective action plan” to correct deficiencies in its HIPAA security and other compliance revealed in the investigation.

According to OCR, OCR opened the investigation after employees complained to OCR  that SEMC violated  HIPAA by allowing workforce members to use an internet-based document sharing application to share and store documents containing electronic protected health information (ePHI) of at least 498 individuals without having analyzed the risks associated with such a practice. According to OCR, its investigation of the complaint revealed among other things that:

  • SEMC improperly disclosed the PHI of at least 1,093 individuals;
  • SEMC failed to implement sufficient security measures regarding the transmission of and storage of ePHI to reduce risks and vulnerabilities to a reasonable and appropriate level; and
  • SEMC failed to timely identify and respond to a known security incident, mitigate the harmful effects of the security incident, and document the security incident and its outcome. Separately, on August 25, 2014, SEMC submitted notification to HHS OCR regarding a breach of unsecured ePHI stored on a former SEMC workforce member’s personal laptop and USB flash drive, affecting 595 individuals. A review of detailed corrective action plan imposed under the Resolution Agreement provides helpful insights about some of the steps that OCR is likely to expect Covered Entities and business associates to take to meet its security expectations for internet applications and portals. Beyond imposing a $218,400 penalty (“Resolution Amount”) against SEMC, the Resolution Agreement requires among other things that SEMC in accordance with the Resolution Agreement and to OCR satisfaction.

In announcing the Resolution Agreement, OCR Director Jocelyn Samuels sent a clear message to Covered Entities and their business associates to confirm and maintain the adequacy of security of internet portals and applications used in connection with PHI. “Organizations must pay particular attention to HIPAA’s requirements when using internet-based document sharing applications,” said OCR Director Jocelyn Samuels. “In order to reduce potential risks and vulnerabilities, all workforce members must follow all policies and procedures, and entities must ensure that incidents are reported and mitigated in a timely manner.”

  • To self-assess the adequacy of its policies and workforce and operations compliance with HIPAA including conducting unannounced audits of SEMC workforce members’ familiarity and compliance with SEMC policies and procedures on transmitting ePHI using unauthorized networks; storing ePHI on unauthorized information systems, including unsecured networks and devices; removal of ePHI from SEMC; prohibition on sharing accounts and passwords for ePHI access or storage; encryption of portable devices that access or store ePHI; security incident reporting related to ePHI;
  • The adequacy of workforce compliance with these policies by conducting unannounced site visits to various SEMC departments, inspections of certain laptops, smartphones, storage media and other portable devices as well as on workstations and other devices containing ePHI;
  • To identify and report to OCR any material compliance issues with the policies and recommendations for improving these policies and procedures, oversight and supervision, or training;
  • Develop and implement to OCR satisfaction corrections to policies, practice and training along with oversight mechanisms reasonably tailored to ensure that all SEMC workforce members follow such policies and procedures, and only use and disclose ePHI appropriately;
  • Collect and retain for OCR review and approval certain documentation of compliance; and
  • Conduct documented investigations of potential violations, redress and report to OCR about investigations and violations.

First, management should take special note that members of the SEMC workforce made the complaint to OCR that prompted OCR’s investigation.

As in other health care compliance areas, required workforce training coupled with HIPAA’s anti-retaliation and whistleblower protections provide encouragement if not incentives for disgruntled or well-meaning employees or other workforce members and business partners of covered entities or business associates make complaints about suspected HIPAA or other compliance concerns internally or to OCR. Management needs to take appropriate steps to ensure that its policies and processes include appropriate privacy and human resources procedures to manage both its HIPAA compliance obligations and potential retaliation and other human resources exposures that can result if these concerns are mishandled.   Employee & Other Whistleblower Complaints Common Source of HIPAA Privacy & Other Complaints.  Effective health plan and employer HIPAA and human resources compliance, reporting internal investigation and risk management policies and practices are critical to manage both HIPAA and other compliance exposures and the retaliation and other human resources risks that inevitably arise when employees or other workforce members or business partners raise compliance concerns or participate in compliance investigations internally or externally.

Second, the Resolution Agreement also reflects the clear expectation that management of Covered Entities and business associates make compliance with HIPAA a priority. Consistent with its recent practice, the Resolution Agreement requires management oversight and accountability for ensuring compliance with the Resolution Agreement and HIPAA by requiring an officer to attest to the fulfillment of the requirements of the Resolution Agreement. This emphasis upon requiring leadership oversight and prioritization of HIPAA compliance tracks the broader general expectations regarding responsibilities for management and boards concerning compliance with HIPAA and other federal health care increasingly articulated by HHS and other federal agencies enforcing laws subject to the Federal Sentencing Guidelines like HIPAA, See e.g. Practical Guidance for Health Care Governing Boards on Compliance Oversight. While OCR officials have indicated that the need for officer attestation like that required by the Resolution Agreement may not be required in all cases, the inclusion of these requirements coupled with these other developments sends a strong message that Boards and other management should ensure that their processes include appropriate evidence and document retention of management oversight.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section, Board Certified in Labor & Employment Law, and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 27 years’ experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, Department of Labor, IRS, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. The scribe for the American Bar Association (ABA) Joint Committee on Employee Benefits annual agency meeting with the Department of Health & Human Services Office of Civil Rights, Ms. Stamer has worked extensively with health care providers, health plans, health care clearinghouses, their business associates, employers, banks and other financial institutions, and others on risk management and compliance with HIPAA and other information privacy and data security rules, investigating and responding to known or suspected breaches, defending investigations or other actions by plaintiffs, OCR and other federal or state agencies, reporting known or suspected violations, business associate and other contracting, commenting or obtaining other clarification of guidance, training and enforcement, and a host of other related concerns. Her clients include public and private health care providers, health insurers, health plans, technology and other vendors, and others. In addition to representing and advising these organizations, she also has conducted training on Privacy & The Pandemic for the Association of State & Territorial Health Plans, as well as HIPAA, FACTA, PCI, medical confidentiality, insurance confidentiality and other privacy and data security compliance and risk management for Los Angeles County Health Department, ISSA, HIMMS, the ABA, SHRM, schools, medical societies, government and private health care and health plan organizations, their business associates, trade associations and others.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications. You can get more information about her health industry experience here. If you need assistance responding to concerns about the matters discussed in this publication or other health care concerns, wish to obtain information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns.

Other Helpful Resources & Other Information

We hope that this information is useful to you. If you found these updates of interest, you also be interested in one or more of the following other recent articles published on the Coalition for Responsible Health Care Reform electronic publication available here, our electronic Solutions Law Press Health Care Update publication available here, or our HR & Benefits Update electronic publication available here. You also can get access to information about how you can arrange for training on “Building Your Family’s Health Care Toolkit,” using the “PlayForLife” resources to organize low-cost wellness programs in your workplace, school, church or other communities, and other process improvement, compliance and other training and other resources for health care providers, employers, health plans, community leaders and others here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail by creating or updating your profile here. You can reach other recent updates and other informative publications and resources. Examples of some of these recent health care related publications include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication see here. THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS. ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2015 Cynthia Marcotte Stamer, P.C. Non-exclusive license to republish granted to Solutions Law Press, Inc. All other rights reserved.


Doc Caught Submitting Conflicting Patient Records to Private Payer Versus Medicare Criminally Sentence, Pays Civil Settlement

July 23, 2013

The  recent criminal sentencing and civil settlement of Illinois physician Dr. Mahmoud Yassin highlights the growing- but too often appreciated exposure of physicians and other health care providers and their billing or other management who submit conflicting claims data to private and government claims or otherwise permit in false  falsely bill or participate in the cover-up of fraudulent or other improper billings to payers.  The Yassin sentencing is notable both because Yassin incurred criminal liability for obstruction based on his presentation of altered patient records to a private payer and and civil liability for  making false claims to Medicare and others.

Yassin was sentenced July 22, 2013 to serve 30 days in prison and 3 years of probation and to pay  a fine of $10,000, a special assessment of $100, and restitution to Blue Cross Blue Shield of Illinois in the amount of $19,615.17 in federal district court in Benton, Illinois for Obstructing a Criminal Health Care Fraud Investigator.  The felony obstruction conviction stemmed from charges that on March 2, 2012, when a FBI agent, having served a subpoena for patient records on Dr. Yassin, gave an altered patient progress note  that showed an in-office examination previously claimed to an insurance carrier, but which had not taken place.

In a separate civil settlement with the United States Attorney’s Office regarding false claims to Medicare, Dr. Yassin also previously has paid double damages for $87,348.64. The restitution and civil false claims settlement were based on claims for in person office visits in which the patient either failed to show up for an appointment or only was spoken to by telephone.

The Yassin prosecution demonstrates the importance of providers getting their records and billings straight when billing both private payers and government payers.  While most  health care providers recognize  the significant exposure they incur from overbilling Medicare or other federal programs as a result of the highly publicized, heavy-handed audit and enforcement activities of the Centers for Medicare & Medicaid Services (CMS), the Department of Health & Human Services Office of Inspector General (OIG) and Department of Justice (DOJ), many  don’t recognize their exposure from private payer billings or the potential interaction between private and government claims investigations  Amendments enacted as part of the anti-fraud provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) added private health plans to the list of plans protected by federal prohibitions against fraudulent billing by providers.  Furthermore, federal fraud investigators and private payers increasingly are working together on the investigation and redress of false billing and other aggressive practices.  These and other risks mean that providers cannot afford to be unprepared when asked to respond to investigations like one that lead to the Yassin conviction, recoupment or other audit and enforcement actions  See,  Secondary Payers Hit Physician Group With Recoupment After Medicare Audit Findings.   Rather, physicians and other health care clinics must be ready to prove and defend their billings to public and private payers.  In both cases, these preparations should ensure that records accurately and completely document the care provided, that the coding and billing applied is reflective of actual care and consistent with existing reimbursement, and otherwise defensible.  As demonstrated by Yassin, inconsistencies between records presented to different payers should be avoided.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her presentations and programs include a wide range of compliance, risk management and other workshops, programs and publications.

Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance responding to concerns about the matters discussed in this publication or other health care concerns, wish to obtain information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see  here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information about this communication click here. 

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2013 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press.  All other rights reserved.


Improper Billing Of Private Payers Increasing Source Of Liability & Risk For Providers

July 8, 2013

Physicians or other health care providers now have even more to worry about when a Medicare or other federal program audit reveals overpayments – repayment demands from commercial insurers and self-insured health plans, who are secondary payers.  Federal officials and private payers alike increasingly are coming after providers to recover overpayments or other inappropriate billings identified through audits or other investigations.  In the face of these actions, providers should use care to ensure that their billing and compliance programs appropriately manage and monitor the defensibility of claims billed to private payers as well as those to Medicare or other government programs.

Most  health care providers recognize  the significant exposure they incur from overbilling Medicare or other federal programs as a result of the highly publicized, heavy-handed audit and enforcement activities of the Centers for Medicare & Medicaid Services (CMS), the Department of Health & Human Services Office of Inspector General (OIG) and Department of Justice (DOJ).

Unfortunately, many health care providers don’t recognize that overbilling private payers can carry similar risks and liabilities.  Amendments enacted as part of the anti-fraud provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) added private health plans to the list of plans protected by federal prohibitions against fraudulent billing by providers.

While CMS, OIG and DOJ tend to emphasize Medicare and other federal program recoveries in media releases about their overbilling and health care fraud enforcement efforts, careful review of these actions increasingly shows that these enforcement actions often also cover overbilling of private health plans uncovered in connection with the underlying  Medicare or other federal program overpayment audit or investigation.   For instance, upcoding and other false billing of claims was the basis of the federal criminal health care fraud prosecution of the Chief Executive Officer of a small, rural Texas health care clinic.  Texas Clinic CEO Sentence Highlights Risks Of Upcoding. See, also Pharmas Face New Pressure To Put Patients Before Profits After GlaxoSmithKline Record $3 Billion Health Care Fraud & FDCA Settlement.

Unfortunately, many providers have failed to recognize and adequately respond to these and other clear indicators of their exposure to fraud, recoupment and other enforcement actions from sloppy or otherwise improper billings to private insurers and self insured plans.  With health care reform increasingly focusing on reducing health care expenditures in the private as well as public arena, already existing federal and state enforcement against providers for improper billing of private payers will inevitably grown.

Taking into account these and other trends toward stepped up enforcement against aggressive billing by providers of private insurance or self-insured plans, physicians and other providers should not be surprised or unprepared to respond to recoupment or other audit and enforcement actions like that recently reported by Nina Youngstrom in AIS Health about the recoupment demands by commercial insurers against a Kansas health care clinic based on the Medicare audit findings of overpayments. See,  Secondary Payers Hit Physician Group With Recoupment After Medicare Audit Findings.   Rather, physicians and other health care clinics must be ready to prove and defend their billings to private payers as well as Medicare and other government payers.

For More Information Or Assistance

If you need assistance reviewing or responding to these or other health care related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer, may be able to help. Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her presentations and programs include a wide range of compliance, risk management and other workshops, programs and publications.

Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need assistance responding to concerns about the matters discussed in this publication or other health care concerns, wish to obtain information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see  here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information about this communication click here. 

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2013 Cynthia Marcotte Stamer, P.C.  Non-exclusive license to republish granted to Solutions Law Press.  All other rights reserved.


Amgen Settlement Highlights Anti-Kickback Exposures From Whistleblowers, Need For Effective Compliance & Risk Management

April 22, 2013

California-based biotechnology giant Amgen, Inc. has agreed to pay $24,9 Million to resolve Justice Department False Claims Act charges that the biotechnology giant violated the False Claims Act by paying illegal kickbacks to long-term care pharmacy providers to promote the sale of its Aranesp and other products.  The settlement announced by the Justice Department on April 16, 2013 is the latest in a series of settlements resulting from efforts by Federal officials to target pharmaceutical and other providers for violating federal anti-kickback and other health care fraud laws brought by the Justice Department. See Amgen to Pay U.S. $24.9 Million to Resolve False Claims Act Allegations.  It highlights the growing risk of civil prosecution that pharmaceutical companies face for offering or providing prohibited kickbacks, as well as the growing role of whistleblowers in civil prosecutions under the anti-kickback law.

Amgen Settlement Highlights

The Amgen Settlement Agreement resolves Federal allegations that Amgen paid illegal kickbacks to long-term care pharmacy providers Omnicare Inc., PharMerica Corporation and Kindred Healthcare Inc. in return for implementing “therapeutic interchange” programs designed to switch Medicare and Medicaid beneficiaries from a competitor drug to Aranesp, which Amgen manufactures.    

The government alleged that the kickbacks took the form of performance-based rebates tied to market-share or volume thresholds.   The government also charged that, as part of the therapeutic interchange program, Amgen distributed materials to consultant pharmacists and nursing home staff encouraging the use of Aranesp for patients who did not have anemia associated with chronic renal failure.

The Amgen Settlement Agreement resolves a civil lawsuit filed under the qui tam, or whistleblower, provision of the False Claims Act, which allows private citizens with knowledge of false claims to bring civil actions on behalf of the United States and share in any recovery.   The False Claims Act suit in the U.S. District Court for the District of South Carolina is captioned United States ex rel. Kurnik v. Amgen Inc., et al.

When announcing the settlement, Justice Department officials emphasized federal officials’ commitment to pursuing pharmaceutical companies for paying illegal kickbacks to secure drug sales.  “We will continue to pursue pharmaceutical companies that pay kickbacks to long-term care pharmacy providers to influence drug prescribing decisions,” said Stuart F. Delery, Acting Assistant Attorney General for the Justice Department’s Civil Division.   “Patients in skilled nursing facilities deserve care that is free of improper financial influences.”

The Settlement Agreement and lawsuit that it resolves also show the key role that whistleblowers can play in these types of prosecutions.  Qui tam and other fraud reports made by employees or other business partners have become a significant tool in the Federal government’s war against health care fraud.   The Amgen Settlement and other recent prosecutions and settlement show that Federal officials are acting on this promise and that whistleblowers increasingly are helping them to do so.

As this trend continues, pharmaceutical companies and other health care providers subject to the anti-kickback and other health care fraud laws will need to review their existing and former practices to identify pre-existing and ongoing exposures, and decide what steps to take, if any, to mitigate these risks.  In addition to considering what corrective actions, if any are needed generally, these organizations also should consider the workforce management and other internal controls that will help promote compliance with these policies and manage potential whistleblower and other liabilities.

In addition to working to promote compliance with the False Claims Act and other health care laws, pharmaceutical companies and health care providers need to implement strong internal investigation, audit, and employee and contractor management procedures to help self-discover and address potential compliance or other liability concerns.  These processes and policies should involve but not be limited to hotlines and other processes for reporting suspected fraud or other misconduct.  Most companies also should consider adopting and enforcing strong policies that require employees, contractors and other business partners to timely report and coöperate in the investigation and redress of potential health care fraud or other legal violations, should promptly investigate and redress as needed alleged noncompliance, and should retaliation against individuals making these reports in good faith. 

For More Information Or Assistance

For help  reviewing and updating your Stark Law, Anti-Kickback Statute, or other health care compliance, workforce, internal controls and risk management policies, practices or programs; assessing the strength of your organizations existing risk management and compliance controls under these laws or other healthcare laws and regulations; or in addressing other compliance or health care concerns, please contact Cynthia Marcotte Stamer via e-mail here or via telephone at 469.767.8872.   To review  and register to receive other helpful updates or for more information about Ms. Stamer and her experience, see here.

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need help responding to concerns about the matters discussed in this publication or other health care concerns, wish to get information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here. 

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2012 Cynthia Marcotte Stamer, P.C. All rights reserved.


7 Arrested, Charged In Detroit-Area Home Health Care Fraud Takedown

January 18, 2013

January 17, 2013; U.S. Department of Justice

Seven Arrested, Charged with $22 Million Detroit-area Home Health Care Fraud Scheme

Six Detroit-area residents and one Chicago-area resident were arrested on January 17, 2012 by federal agents on charges arising from the ongoing investigation into an alleged $22 million home health care fraud scheme that the indictment charges operated out of four Oakland County, Michigan home health agencies claiming to provide in-home health service, Royal Home Health Care Inc., Prestige Home Health Services Inc., Platinum Home Health Services Inc. and Empirical Home Health Care Inc. (the “Agencies”).  The defendants arrested are Detroit-area residents Muhammad Aamir, Usman Butt, Hemal Bhagat, Syed Shah, Tariq Tahir, and Raquel Ellington, and Chicago-area resident Tayyab Aziz (the “Defendants”).

According to the Justice Department, the arrests and Medicare payment suspensions stem from charges brought in an 18-count indictment returned January 15, 2013, which alleges that the Defendants participated in a Medicare fraud scheme operating out of the Agencies. The indictment alleges Medicare paid the agencies approximately $22 million for fraudulently reported services since August 2008. See Aamir, Muhammed et al. (Prestige) Indictment.  In addition to the arrests, law enforcement agents suspended Medicare payments to the Agencies associated with the alleged scheme.

According to the indictment, Aamir and Butt owned and operated Prestige; Butt, Bhagat and Shah owned and operated Royal; and Aamir owned and operated Platinum and Empirical.  The indictment alleges that of the Agencies allegedly claimed to provide home health therapy services to Medicare beneficiaries that were unnecessary and/or were never performed.  The indictment also alleges that Tahir and Ellington recruited Medicare beneficiaries, paying them kickbacks for their Medicare information and signatures on documents that detailed physical therapy and/or skilled nursing services that were either never rendered or not medically necessary.  The indictment also charges Aamir, Butt, Bhagat, Shah, Tahir and Ellington with conspiring to pay kickbacks to Tahir and Ellington for their recruiting work and Butt, Bhagat, Shah and Aziz with allegedly conspiring to launder the proceeds of the scheme.

Based on the alleged conduct, the indictment charges each of the Defendants with conspiracy to commit health care fraud.  All but Aziz are also charged with health care fraud and with conspiracy to violate the Anti-Kickback Statute.  Butt, Bhagat, Shah and Aziz are additionally charged with conspiracy to commit money laundering.

A conviction on the charges is likely to carry heavy penalities.  The charges of health care fraud conspiracy and health care fraud each carry a maximum potential penalty of 10 years in prison and a $250,000 fine.  The charge of conspiracy to violate the Anti-Kickback Statute carries a maximum potential penalty of five years in prison and a $25,000 fine.  The charge of conspiracy to commit money laundering carries a maximum potential penalty of 20 years in prison and a $500,000 fine.
 
The arrests and indictments reflect the continuing and growing government commitment to, coordination and sophistication in the investigation and prosecution of health care crimes by health care providers in the federal war on what officials view as health care fraud.  The Obama Administration has made investigation and prosecution of health care fraud laws a key element of its strategy to manage U.S. health care program costs. Recently enacted changes in the False Claims Act and other laws are making it easier for federal prosecutors to successfully prosecute these and other health care fraud cases.

Since their inception in March 2007, the the HEAT health care fraud task force operations in nine locations have lead to charges against more than 1,480 defendants who Federal officals claim collectively have falsely billed the Medicare program for more than $4.8 billion.  In addition, the HHS Centers for Medicare and Medicaid Services, working in conjunction with the HHS-OIG, are taking steps to exclude and impose other remedies against health care providers that it perceives engage in fraud or other aggressive billing or other practices.These and other stepped up oversight and enforcement activities make it critical that all health industry organizations strengthen their internal controls, compliance and audit activities as well as be prepared to defend their actions against the rising tide of federal and state oversight and enforcement.

For Help With Compliance, Risk Management, Investigations, Policy Updates Or Other Needs

If you need help with HIPAA or other health industry, regulatory policy or enforcement developments, or to review or respond to these or other health care or health IT related risk management, compliance, enforcement or management concerns, the author of this update, attorney Cynthia Marcotte Stamer may be able to help.

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Ms. Stamer has extensive experience advising and assisting health care providers, health plans, their business associates and other health industry clients to establish and administer medical privacy and other compliance and risk management policies, to health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns. She regularly designs and presents HIPAA and other risk management, compliance and other training for health plans, employers, health care providers, professional associations and others.

Scheduled to serve as the scribe for the ABA Joint Committee on Employee Benefits agency meeting with OCR, Ms. Stamer also regularly works with OCR and other agencies, publishes and speaks extensively on medical and other privacy and data security, health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns.  Her publications and insights appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.   For instance, Ms. Stamer for the second year will serve as the appointed scribe for the ABA Joint Committee on Employee Benefits Agency meeting with OCR.  Her insights on HIPAA risk management and compliance often appear in medical privacy related publications of a broad range of health care, health plan and other industry publications Among others, she has conducted privacy training for the Association of State & Territorial Health Plans (ASTHO), the Los Angeles Health Department, the American Bar Association, the Health Care Compliance Association, a multitude of health industry, health plan, insurance and financial services, education, employer employee benefit and other clients, trade and professional associations and others.  You can get more information about her HIPAA and other experience here.

If you need help with these or other compliance concerns, wish to ask about arranging for compliance audit or training, or need legal representation on other matters please contact Ms. Stamer at (469) 767-8872 or via e-mail here.

You can review other recent publications and resources and additional information about the other experience of Ms. Stamer hereExamples of some recent publications that may be of interest include:

If you need help investigating or responding to a known or suspected compliance, litigation or enforcement or other risk management concern, assistance with reviewing, updating, administering or defending a current or proposed employment, employee benefit, compensation or other management practice, wish to inquire about federal or state regulatory compliance audits, risk management or training, or need legal representation on other matters please contact Ms Stamer here or at (469) 767-8872.

About Solutions Law Press, Inc.™

Solutions Law Press, Inc.™ provides business and management information, tools and solutions, training and education, services and support to help organizations and their leaders promote effective management of legal and operational performance, regulatory compliance and risk management, data and information protection and risk management and other key management objectives.  Solutions Law Press, Inc.™ also conducts and assist businesses and associations to design, present and conduct customized programs and training targeted to their specific audiences and needs.  For additional information about upcoming programs, to explore becoming a presenting sponsor for an upcoming event, e-mail your request to info@Solutionslawpress.com   These programs, publications and other resources are provided only for general informational and educational purposes. Neither the distribution or presentation of these programs and materials to any party nor any statement or information provided in or in connection with this communication, the program or associated materials are intended to or shall be construed as establishing an attorney-client relationship, to constitute legal advice or provide any assurance or expectation from Solutions Law Press, Inc., the presenter or any related parties. If you or someone else you know would like to receive future Alerts or other information about developments, publications or programs or other updates, send your request to info@solutionslawpress.com.  CIRCULAR 230 NOTICE: The following disclaimer is included to comply with and in response to U.S. Treasury Department Circular 230 Regulations.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN. If you are an individual with a disability who requires accommodation to participate, please let us know at the time of your registration so that we may consider your request.

 ©2013 Cynthia Marcotte Stamer, P.C. All rights reserved.


AHRQ Issues New Guide for Use of Interactive Preventive Care Record

July 19, 2012

A new guide from the Agency for Healthcare Research and Quality (AHRQ) titled An Interactive Preventive Care Record (IPHR): A Handbook for Using Patient-Centered Personal Health Records to Promote Prevention provides practical steps for healthcare professionals to follow when deploying IPHRs as components of electronic health records.  AHRQ and other government and private health care technology advocates hope that the IPHR will help boost and promote care delivery practices that promote health and wellness among patient populations.

AHRQ touts the resource as a guidebook of  targeted advice for practice leaders, informatics staff, and practice personnel on selection, implementation and maintenance of electronic health records and practices to help them work as a team to promote full utilization of IPHRs.

To get the handbook, see here

For More Information Or Assistance

For help  reviewing and updating your health care compliance, workforce, internal controls and risk management policies, technology, operations, practices or programs; assessing the strength of your organizations existing operations, risk management and compliance controls under these laws or other healthcare regulatory or operational issues or concerns, please contact Cynthia Marcotte Stamer via e-mail here or via telephone at 469.767.8872.   To review  and register to receive other helpful updates or for more information about Ms. Stamer and her experience, see here.

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need help responding to concerns about the matters discussed in this publication or other health care concerns, wish to get information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here. 

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2012 Cynthia Marcotte Stamer, P.C. All rights reserved.


Nextcare Inc. $10 Million False Claims Act Settlement Shows Qui Tam Role In False Claims Act Prosecutions

July 11, 2012

A False Claims Act settlement announced last week with Arizona-based urgent care chain NextCare Inc. provides another illustration of the growing exposure that qui tam and other reports of illegal practices by employees, contractors and other business partners create for health care and other companies.

Last week, Justice Department officials announced that NextCare Inc agreed to pay $10 million to settle federal and state allegations that it submitted false claims initially raised in a lawsuit filed against NextCare Inc. by former NextCare employee Lorin Cohen.    

The settlement resolves allegations that NextCare violated the False Claims Act by:

  • Submitting false claims to Medicare, TRICARE, the Federal Employees Health Benefits Program, and the Medicaid programs of Colorado, Virginia, Texas, North Carolina and Arizona, by billing for unnecessary allergy, H1N1 virus and respiratory panel testing and
  • Upcoding when billing for urgent care medical services.

As a condition of the settlement, NextCare Inc. will become subject to a five-year Corporate Integrity Agreement with HHS-OIG. 

Investigated and prosecuted as part of the Federal government’s highly touted HEAT initiative, the Nextcare Inc. settlement emphasize both the strong commitment by the Department of Justice and HHS to find a prosecute Medicare and Medicaid financial fraud and the growing importance of qui tam actions and other insider reports of legal violations to the success of these actions. 

Qui tam and other fraud reports made by employees or other business partners have become a significant tool in the Federal government’s war against health care fraud.  Under the False Claims Act, private citizens acting as relators can bring suit on behalf of the United States and share in the recovery.   Ms. Cohen will receive $1.614 million as her share of the recovery.

Through the False Claims Act alone, the Justice Department has recovered more than $7.7 billion since January 2009 in cases involving fraud against federal health care programs.   The Justice Department’s total recoveries in False Claims Act cases since January 2009 are over $11.3 billion.   

In response to the Nextcare Inc. settlement and other enforcement actions, health care providers should strengthen both their health care compliance and employment management processes.  In addition to working to promote compliance with the False Claims Act and other health care laws, health care providers need to implement strong internal investigation, audit, and employee and contractor management procedures to help self-discover and address potential compliance or other liability concerns. 

As part of these efforts, health care providers generally should not only provide hotlines for reporting suspected fraud or other misconduct.  Many health care providers also can benefit by adopting and enforcing strong policies that require employees, contractors and other business partners to timely report and cooperate in the investigation and redress of potential health care fraud or other legal violations, should promptly investigate and redress as needed alleged noncompliance, and should retaliation against individuals making these reports in good faith.   GSK and other enforcement actions show that Federal officials are acting on this promise. 

For More Information Or Assistance

For help designing, enforcing or defending your organization’s health care compliance, workforce and risk management policies, practices or programs; assessing the strength of your organizations existing risk management and compliance controls under these laws or other healthcare laws and regulations; or in addressing other compliance or health care concerns, please contact Cynthia Marcotte Stamer via e-mail here or via telephone at 469.767.8872.   To review  and register to receive other helpful updates or for more information about Ms. Stamer and her experience, see here.

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need help responding to concerns about the matters discussed in this publication or other health care concerns, wish to get information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Solutions Law Press, Inc.™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here. 

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2012 Cynthia Marcotte Stamer, P.C. All rights reserved.


Pharmas Face New Pressure To Put Patients Before Profits After GlaxoSmithKline Record $3 Billion Health Care Fraud, FDCA Conviction & Settlement

July 11, 2012

Pharmaceutical companies will need to carefully study and consider how to react to “groundbreaking” business practice reforms global health care giant GlaxoSmithKline LLC (“GSK”) has agreed to implement as part of the record $3 billion criminal and civil agreement resolving federal health care fraud and drug marketing charges following its July 2, 2012 guilty plea in U.S. v. GlaxoSmithKline PLC Complaint.  Justice Department and Food & Drug Administration (FDA) officials have signaled they expect industry businesses to “follow suit” by adopting business practice reforms that GSK has agreed to implement in the five year Corporate Integrity Agreement it entered into as part of collection of criminal plea agreements and accompanying civil settlements that is resulting in the largest combined federal and state health care fraud recovery in a single global resolution against a pharmaceutical company in the history of the United States.  Meeting this expectation will require most pharmaceutical companies to significantly change research and marketing, compensation and other workforce management, board governance and other fundamental business practices well-beyond the reforms already being implemented in response to the past decade’s enforcement war against the industry.

Snapshot of U.S. v. GlaxoSmithKline PLC Civil & Criminal Charges & Settlement

After GSK plead guilty on July 2, 2012 to criminal charges it illegally marketed three drugs, the Federal Court in Massachusetts on July 5, 2012 approved a Justice Department sentencing recommendation that incorporated the settlement agreement. In recommending approval of the settlement agreement, the Justice Department told the Court GSK’s commitment to ‘put patients before profits’ by make sweeping reforms to its marketing and other business practices justified approving the settlement agreement in lieu of imposition of probation or other sanctions.

To resolve the criminal charges, GSK agreed to pay a criminal fine of $956,814,400, and criminal forfeiture in the amount of $43,185,600, for a total amount of $1 billion. Along with its criminal guilty plea, GSK also agreed to pay amount additional $2 billion to the U.S as restitution to the federal health care programs and other civil payments and implement an unprecedented list of business practice changes that will revolutionize its sales, marketing and drug efficacy study practices.

GSK Misdemeanor Guilty Plea

On July 2, 2012, GSK plead guilty to three misdemeanor violations of the Food, Drug and Cosmetic Act (FDCA):

  • Regarding Paxil, GSK plead guilty to distribution of a misbranded drug due to false and misleading labeling, in violation of 21 U.S.C. §§ 331(a), 333(a)(1) & 352(a);
  • Regarding Wellbutrin, GSK plead guilty to distribution of a misbranded drug due to inadequate directions for use, in violation of 21 U.S.C. §§ 331(a), 333(a)(1) & 352(f)(1); and
  • Regarding Avandia, GSK will plead guilty to failure to report data to the FDA, in violation of 21 U.S.C. §§ 331(e), 333(a)(1) & 355(k)(1).

The misdemeanor guilty pleas resolved Justice Department criminal charges GSK engaged is a series of serious violations of federal law in the marketing of Paxil, Wellbutrin and Avandia.

GSK $2 Billion Civil Settlement Payments

The criminal sentence approved by the Court is part of a broader series of criminal, civil and administrative agreements reached between GSK and federal officials.

The civil and administrative agreements included in the package deal include three civil settlements that resolve health care fraud and qui tam claims arising from GSK’s marketing, sales and health program billings relating to various drugs.

Under the civil settlement agreement, GSK will make sweeping business practice reforms specified in a corporate integrity agreement as well as pay $2 billion in civil damages to federal and state health care programs, which is the largest civil recovery from a drug company in a single global resolution.

Under the settlement package negotiated to resolve these civil claims, GSK has agreed to pay $2 billion in civil damages.  The $2 billion of civil damages include:

  • $1,043,000,000 in civil damages to resolve allegations relating to false claims arising from the off-label promotion and kickback allegations relating to Paxil, Wellbutrin, Advair, Lamictal, Zofran, Flovent, Imitrex, Lotronex and Valtrex;
  • $657,000,000 in civil damages to resolve allegations relating to misrepresentations about Avandia;
  • $300,000,000 in civil damages to resolve allegations relating to false reporting of best prices.

The settlement package actually includes three civil settlement agreements.

  • One civil settlement resolves allegations relating to false claims to federal health care programs resulting from marketing and promotion practices, including off-label marketing of Paxil, Wellbutrin, Advair, Lamictal and Zofran for uses that were not approved as safe and effective by the Food and Drug Administration and paid kickbacks to doctors to induce them to prescribe Advair, Flovent, Imitrex, Lotronex, Paxil, Wellbutrin, and Valtrex and other drugs, critically undermining the doctors’ independent clinical judgment.
  • A second civil settlement resolves allegations that GSK promoted Avandia to physicians and other health care providers with false and misleading representations, causing false claims to be submitted to federal health care programs in the marketing and sale of Avandia.
  • A third settlement resolves allegations that GSK reported false best prices to the Department of Health and Human Services and as a result underpaid quarterly rebates owed under the Medicaid Drug Rebate Program. Under federal law, pharmaceutical companies are required to give Medicaid the best price on medications that they offer to any customer.   The Justice Department contends that GSK improperly “bundled sales” arrangements that included steep discounts known as “nominal prices” and yet failed to take such contingent arrangements into account when calculating and reporting its best prices to HHS.

Whistleblower Claims Played A Role, Resolved By Settlement

A review of the settlement emphasize both the strong commitment by the Department of Justice and HHS to find a prosecute Medicare and Medicaid financial fraud and the growing importance of qui tam actions and other insider reports of legal violations to the success of these actions. 

Qui tam and other fraud reports made by employees or other business partners have become a significant tool in the Federal government’s war against health care fraud.  Under the False Claims Act, private citizens acting as relators can bring suit on behalf of the United States and share in the recovery.  Furthered in part by a series of qui tam claims, whistleblower suits clearly played a role in many of the GSK charges.

The off-label civil settlement also resolves allegations set forth in the following lawsuits filed against GSK under the qui tam, or whistleblower, provisions of the federal False Claims Act, 31 U.S.C. § 3730:

  • U.S. ex rel. Thorpe et al. v. Smith Kline Beecham Inc. and GlaxoSmithKline PLC d/b/a GlaxoSmithKline, Civil Action No. 11-10398 (D. Mass, transferred from D. Colo.) (filed 1/1/03);
  • U.S. ex rel. Gerahty et al. v. GlaxoSmithKline PLC and SmithKline Beecham Corp. d/b/a GlaxoSmithKline, (D. Mass.), Civil Action Number 03-10641 (D. Mass.) (filed 4/7/03);
  • U.S. ex rel. Graydon v. GlaxoSmithKline PLC, Civil Action No. 11-10741 (D. Mass.) (filed 6/5/09);
  • U.S. ex rel. LaFauci v. GlaxoSmithKline PLC, Civil Action No. 11-10921 (D. Mass.) (filed 8/7/09).

Get more details here.

 

Corporate Integrity Agreement Requires GSK To “Put Patients Before Profits” Thru “Groundbreaking” Business Practice Reforms

Pharmaceutical industry businesses should view with grave concern the statements made by Carmen Ortiz, U.S. Attorney for the District of Massachusetts in announcing agreement that with Federal officials “hope the rest of the pharmaceutical industry follows suit” in “putting patients before profits” by adopting the “groundbreaking” business practice reforms set forth in the a five-year Corporate Integrity Agreement with the Office of Inspector General of the Department of Health and Human Services.  Given the ongoing aggressive investigation and enforcement of federal drug and health care fraud laws by the Justice Department and Food and Drug Administration and the Justice Department’s stated hope that the rest of the pharmaceutical industry will adopt similar reforms to those GSK has committed to implement in connection with its sentence, pharmaceutical companies will want to carefully examine the “groundbreaking” marketing and other business practice reforms that GSK has committed to implement for insights about what federal prosecutors and regulators expectation expect companies involved in the industry to do to reform their marketing, research and other practices.

In encouraging the Court to approve a total of $1 billion of criminal penalties as the sanction for the criminal charges, Justice Department officials argued GSK’s commitment under the related civil resolution agreement to make “groundbreaking” business practice reforms to ensure better behavior by its sales force, and to ensure full, fair and accurate reporting of scientific data from GSK studies justified the penalty in lieu of probation or other sanctions.   

The Justice Department officials announcing the settlement enhanced accountability, increased transparency and wide- ranging monitoring activities conducted by both internal and independent external reviewers. Specifically, among other things, the agreement requires:

  • Abolishment of incentive sales compensation; instead, the sales force will be compensated based on business acumen, customer engagement, and scientific knowledge of GSK products;
  • Clawback of up to 3 years of annual performance pay (annual bonus and long term incentives) for executives discovered to be involved in significant misconduct;
  • Publication of all GSK human research studies, not just those with positive outcomes for GSK drugs;
  • Publication of final clinical trial protocols to allow outside researchers to meaningfully analyze the results of GSK studies;
  • Removal of commercial influence on the determination of which GSK studies will be conducted; instead, studies will be conducted on scientific merit;
  • Removal of commercial influence on the determination of which GSK studies will be published and when; instead, studies will be published when the study is complete, not to create a buzz around a drug;
  • Annual certifications by the GSK’s Board of Directors that the GSK compliance program is effective, and by GSK’s U.S. President that the compliance measures continue and reportable incidents have been properly reported.

GSK & Other Prosecutions Reflect Need To Tighten Compliance

Pharmaceutical companies take seriously the need to maintain compliance and tighten marketing and other procedures to promote their ability to defend against the growing risk of federal prosecution signaled by the GSK and other enforcement actions. 

In announcing the GSK settlement, Justice Department officials touted the GSK case as demonstrating its “continuing commitment to ensuring that the messages provided by drug manufacturers to physicians and patients are true and accurate and that doctors’ decisions as to what drugs are prescribed to sick patients are based on best medical judgments, not false and misleading claims or bad science.”

The GSK and other enforcement actions show that Federal officials are acting on this promise.  Even before announcing the $3 billion resolution with GSK, the Justice Department and other federal officials accumulated an impressive and growing record of successful investigation and prosecutions.  The Justice Department health care fraud union in Boston that lead the GSK prosecution over the past three years already had recovered more than $5.5 billion in settlements, judgments, fines, restitution, and forfeiture in health care fraud cases under the False Claims Act and the Food, Drug and Cosmetic Act before it announced the GSK settlement.  Coupled with the overall increase in fraud and FDCA enforcement against pharmaceutical industry providers specifically and health care providers generally nationwide, the GSK decision makes clear that pharmaceutical and other health industry clients need to prepare to withstand ever-tightening expectations and rising enforcement.

In response to the GSK settlement and guilty plea, pharmaceutical companies will need to review their existing and former practices to identify pre-existing and ongoing exposures, and decide what steps to take, if any, to mitigate these risks.  In addition to considering what, if any, of the reforms outlined in the GSK Corporate Integrity Agreement to implement and how, these organizations also should consider the workforce management and other internal controls that will help promote compliance with these policies and manage potential whistleblower and other liabilities.

In addition to working to promote compliance with the False Claims Act and other health care laws, pharmaceutical companies and health care providers need to implement strong internal investigation, audit, and employee and contractor management procedures to help self-discover and address potential compliance or other liability concerns.  These processes and policies should involve but not be limited to hotlines and other processes for reporting suspected fraud or other misconduct.  Most companies also should consider adopting and enforcing strong policies that require employees, contractors and other business partners to timely report and cooperate in the investigation and redress of potential health care fraud or other legal violations, should promptly investigate and redress as needed alleged noncompliance, and should retaliation against individuals making these reports in good faith. 

For More Information Or Assistance

For help  reviewing and updating your Stark Law, Anti-Kickback Statute, or other health care compliance, workforce, internal controls and risk management policies, practices or programs; assessing the strength of your organizations existing risk management and compliance controls under these laws or other healthcare laws and regulations; or in addressing other compliance or health care concerns, please contact Cynthia Marcotte Stamer via e-mail here or via telephone at 469.767.8872.   To review  and register to receive other helpful updates or for more information about Ms. Stamer and her experience, see here.

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 24 years experience advising health industry clients about these and other matters. Her experience includes advising hospitals, nursing home, home health, rehabilitation and other health care providers and health industry clients to establish and administer compliance and risk management policies; prevent, conduct and investigate, and respond to peer review and other quality concerns; and to respond to Board of Medicine, Department of Aging & Disability, Drug Enforcement Agency, OCR Privacy and Civil Rights, HHS, DOD and other health care industry investigation, enforcement and other compliance, public policy, regulatory, staffing, and other operations and risk management concerns.

A popular lecturer and widely published author on health industry concerns, Ms. Stamer continuously advises health industry clients about compliance and internal controls, workforce and medical staff performance, quality, governance, reimbursement, and other risk management and operational matters. Ms. Stamer also publishes and speaks extensively on health and managed care industry regulatory, staffing and human resources, compensation and benefits, technology, public policy, reimbursement and other operations and risk management concerns. Her insights on these and other related matters appear in the Health Care Compliance Association, Atlantic Information Service, Bureau of National Affairs, The Wall Street Journal, Business Insurance, the Dallas Morning News, Modern Health Care, Managed Healthcare, Health Leaders, and a many other national and local publications.  You can get more information about her health industry experience here. If you need help responding to concerns about the matters discussed in this publication or other health care concerns, wish to get information about arranging for training or presentations by Ms. Stamer, wish to suggest a topic for a future program or update, or wish to request other information or materials, please contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.

If you or someone else you know would like to receive future updates about developments on these and other concerns from Ms. Stamer, see here.

About Solutions Law Press

Solutions Law Press™ provides business risk management, legal compliance, management effectiveness and other resources, training and education on human resources, employee benefits, compensation, data security and privacy, health care, insurance, and other key compliance, risk management, internal controls and other key operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press resources including:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile here. For important information concerning this communication click here. 

THE FOLLOWING DISCLAIMER IS INCLUDED TO COMPLY WITH AND IN RESPONSE TO U.S. TREASURY DEPARTMENT CIRCULAR 230 REGULATIONS.  ANY STATEMENTS CONTAINED HEREIN ARE NOT INTENDED OR WRITTEN BY THE WRITER TO BE USED, AND NOTHING CONTAINED HEREIN CAN BE USED BY YOU OR ANY OTHER PERSON, FOR THE PURPOSE OF (1) AVOIDING PENALTIES THAT MAY BE IMPOSED UNDER FEDERAL TAX LAW, OR (2) PROMOTING, MARKETING OR RECOMMENDING TO ANOTHER PARTY ANY TAX-RELATED TRANSACTION OR MATTER ADDRESSED HEREIN.

©2012 Cynthia Marcotte Stamer, P.C. All rights reserved.


HIPAA Heats Up: HITECH Act Changes Take Effect & OCR Begins Posting Names, Other Details Of Unsecured PHI Breach Reports On Website

February 25, 2010

By Cynthia Marcotte Stamer

The Department of Health and Human Services Office of Civil Rights (OCR) has begun posting on its website the names and certain information about health care providers, health insurers,  employer and other health plans, health care clearinghouses and their business associates (Covered Entities) reporting to OCR “breaches” of “unsecured protected health information” (UPHI) under new breach notice rules added by the Health Information Technology for Economic and Clinical Health Act (HITECH Act).

Covered Entities should anticipate the posting of the breach information and other HITECH Act breach notices coupled with amendments to the medical privacy and security requirements of the Health Insurance Portability & Accountability Act (HIPAA) effective since February 17, 2010, will heighten enforcement risks and public sensitivities about medical information privacy safeguards.  As failing to comply with the amended rules effective February 17, 2010 can trigger obligations under the Breach Regulations and other significant liability exposures, Covered Entities should act quickly to manage these emerging risks.

Covered Entity Breach Notification Requirements

The initial list of Covered Entities reporting  breaches of UPHI affecting 500 or more individuals posted by OCR on February 22, 2010 discloses the Covered Entity’s name and State, the approximate number of individuals affected, the date and type of breach and the location of the breached information. OCR’s posting of this information is required under the HITECH Act breach notification requirements as part of its implementation and enforcement of new breach notification requirements added to HIPAA by Section 13402(e)(3) of the HITECH Act.

The HITECH Act amended HIPAA to require Covered Entities to require Covered Entities provide notification to individuals, OCR and others when certain breaches of UPHI happen.  The implementing interim “Breach Notification For Unsecured Protected Health Information” regulations (Breach Regulation) published by OCR here require Covered Entities subject to HIPAA to notify affected individuals, OCR and in some cases the media within specified periods following a “breach” of UPHI occurring on or after September 23, 2009 unless the Covered Entity can demonstrate that the breach qualified as exempt from the breach notification obligation under the Breach Regulations.

Covered Entities generally should consider the need to provide breach notification under the Breach Regulation whenever electronic or non-electronic protected health  information which is not adequately encrypted or destroyed to qualify as “secured” under the breach rules is used, accessed or disclosed in violation of HIPAA.  

Since the potential need to provide breach notification is triggered by an impermissible use, access or disclosure of UPHI, up-to-date maintenance, monitoring and enforcement is at the heart of compliance with the Breach Regulation as well as HIPAA generally.

You can review the currently posted list of Covered Entities that have reported breaches on the OCR website here.  Learn more about the Breach Regulation requirements here

Broader & Stricter Medical Privacy Mandates Effective 2/17/210

The new breach notification requirements are part of a series of changes made to HIPAA under the HITECH Act that are increasing the responsibilities and liability exposures of Covered Entities. On February 17, 2010, Covered Entities and their business associates also became subject to tighter federal requirements for the use, access, protection and disclosure of protected health information under amendments to HIPAA’s Privacy & Security Standards enacted in the HITECH Act. When the HITECH Act was signed into law on February 17, 2009, Covered Entities also became subject to expanded sanctions and remedies for HIPAA violations.

To comply with the HITECH Act changes to HIPAA effective on February 17, 2010, most Covered Entities and their business associates generally will need to update their written policies, operational procedures, technical safeguards, privacy notices, vendor and other agreements, training, and other management procedures in several respects. For more details, see here.

While the HITECH Act gave Covered Entities and business associates a year to complete the necessary arrangements to comply with these HITECH Act changes, many Covered Entities and business associates have not adequately implemented the necessary arrangements. To mitigate these exposures, Covered Entities and their business associates should act quickly to review and update their policies, procedures, training, business associate and other services agreements, and other practices and procedures, as well as to implement the training, oversight, and other management necessary to comply with the HITECH Act changes and to mitigate other HIPAA risks.

Exposures Significant & Growing

HIPAA-associated exposures for Covered Entities are significant and growing. Timely action to comply with the amended HIPAA requirements and Breach Regulations is important to avoid triggering the breach notification requirements; to prevent loss of public trust and reputation;  and to minimize exposures to legal actions, administrative complaints and sanctions and the  investigation, defense and correction costs likely to result when a Covered Entity violates or is accused of violating HIPAA or otherwise mishandling medical or other personal information. 

Even before the HITECH Act changes became effective, federal regulators were stepping up HIPAA enforcement. The HITECH Act amendments further increase the risk that Covered Entities violating HIPAA face investigation and sanction. The HITECH Act amendments increase the likelihood that Covered Entities violating HIPAA will get caught and will face some form of damage or penalty assessment.  Heightened awareness of UPHI breaches resulting from HITECH Act mandated breach notifications are likely to fuel new HIPAA-related complaints, charges and demands.  Covered Entities, workforce members who wrongfully access protected health information now face potential civil penalties,  criminal prosecution, civil lawsuits and other actions. Allowing state attorneys general to bring suit adds more manpower to the enforcement team.   Furthermore, the wrongful use, access or disclosure of protected health information or other confidential information also increasingly is the basis of civil or criminal actions brought under a variety of other federal and state laws.

New Risks Created By HITECH Act Amendments

Heightened HIPAA exposures stem in part from the HITECH Act’s amendments to HIPAA’s remedy provisions.  Among other things, the HITECH Act amended HIPAA to:

  • Allow a State Attorney General to sue Covered Entities that commit HIPAA violations after February 16, 2009 for damages caused to state citizens;
  • Expand the mandate by OCR to investigate violations and audit compliance with HIPAA;
  • Require OCR to impose civil sanctions against Covered Entities and business associates involved in violations of HIPAA in accordance with tightened standards added to HIPAA by the HITECH Act;
  • Revise the criminal sanctions that the Department of Justice can seek against Covered Entities and others for violations of HIPAA; and
  • Amend HIPAA to make clear that workforce members and others improperly using, accessing or disclosing protected health information in violation of HIPAA can face criminal prosecution.

State Attorney General Lawsuit Exposures

Covered Entities must be concerned about the potential that a state Attorney General may bring civil suit to remedy damages caused to state citizens by a breach of HIPAA.  In certain situations, the HITECH Act empowers a state attorney general to sue Covered Entities for damages if their HIPAA violations harm state citizens. Statutory damages equal to the sum of the number of violations multiplied by 100 up to a maximum of $25,000 per calendar year plus attorneys fees and costs are authorized.

A HIPAA civil lawsuit demonstrates the willingness of at least some states to exercise the new authority to sue Covered Entities. On January 13, 2010 Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. (Health Net) for failing to secure private patient medical records and financial information involving 446,000 Connecticut enrollees and promptly notify consumers endangered by the security breach.   The first attorney general enforcement action brought based on amendments made to HIPAA under the HITECH Act, Connecticut charges that Health Net violated HIPAA by failing to safeguard protected medical records and financial information on almost a half million Health Net enrollees in Connecticut then allowing this information to remain exposed for at least six months before notifying authorities and consumers. The suit also names UnitedHealth Group Inc. and Oxford Health Plans LLC, who have acquired Health Net. 

Stepped Up Federal Enforcement

Even before the HITECH Act amendments, OCR and Department of Justice increased HIPAA investigation and enforcement.  The Department of Justice has obtained a variety of criminal convictions against violators of HIPAA.  See, e.g., 2 New HIPAA Criminal Actions Highlight Risks From Wrongful Use/Access of Health InformationMeanwhile, OCR also is emphasizing HIPAA enforcement.  In February, 2009, OCR announced that CVS Pharmacies, Inc. would pay $2.25 million to resolve HIPAA charges.  This announcement followed OCR’s announcement in July, 2008 that Providence Health Care would pay $100,000 to resolve HIPAA violation charges.  OCR also has taken HIPAA enforcement actions against a broad range of other Covered Entities. See more details hereWhile not resulting in the significant payments involved in CVS or Providence, all Covered Entities involved in these and other enforcement actions or investigations have incurred significant legal and other defense costs, loss of community trust, or both.

In addition to these HIPAA-specific exposures, wrongful use, access or disclosure of medical information also can expose Covered Entities, members of their workforce and others improperly using, accessing or disclosing protected health information to liability under other federal or state laws.  Federal and state prosecutors may and increasingly do bring criminal or civil actions against organizations or individuals for improperly accessing or using medical or other personal information under a variety of other federal or state laws .  See e.g., Cybercrime & Identity Theft: Health Information Security Beyond HIPAA; NY AG Cuomo Announcement of 1st Settlement For Violation of NY Security Breach Notification Law; Woman Who Revealed AIDs Info Gets A Year

State Civil Lawsuits

Covered Entities also need to prepare to defend HIPAA-related conduct in state civil actions.  Individual plaintiffs increasingly used alleged HIPAA violations in state privacy, negligence, retaliation, wrongful discharge or other lawsuits.  State courts have allowed private plaintiffs to use the obligations imposed by HIPAA as the basis of a Covered Entity’s duty for purposes of certain state law lawsuits.  In  Sorensen v. Barbuto, 143 P.3d 295 (Utah Ct. App. 2006), for example, a Utah appeals court ruled a private plaintiff could use HIPAA standards to establish that a physician owed a duty of confidentiality to his patients for purposes of maintaining a state law damages claim.  Similarly, the Court in Acosta v. Byrum, 638 S.E. 2d 246 (N.C. Ct. App. 2006) ruled that a plaintiff could use HIPAA to establish the “standard of care” in a negligence lawsuit. Meanwhile, disgruntled employees or other business partners performing services for  Covered Entities also increasingly are pointing to HIPAA as the basis for their retaliation or wrongful discharge claims. See, e.g.,  Retaliation For Filing HIPAA Complaint Recognized As Basis For State Retaliatory Discharge Claim. Read more here

Coupled with the HITECH Act changes, these and other enforcement actions signal growing potential hazards for Covered Entities that  fail to properly manage their HIPAA compliance obligations and risks. To help guard against these exposures, Covered Entities should act quickly to strengthen their HIPAA defenses by updating policies, contracts, practices, security, training, oversight, documentation and management.

Covered Entities & Business Associates Urged To Act Promptly To Manage Mitigating Expanded HIPAA Risks & Obligations

Faced with these expanding obligations and exposures, Covered Entities should prepare for the need to defend the adequacy of their HIPAA compliance efforts on paper and in operation. As part of these efforts, Covered Entities should consider:

  • Reviewing the adequacy of the practices, policies and procedures of the Covered Entities, business associates, and others that may come into contact with protected health information within the scope of attorney-client privilege taking into consideration the Corrective Action Plan, published OCR noncompliance and enforcement statistics, their own and reports of other security and privacy breaches and near misses, and other developments to determine if additional steps are necessary or advisable;
  • Updating policies, privacy and other notices, practices, procedures, training and other practices as needed to promote compliance and defensibility;
  • Renegotiating and enhancing service provider agreements to detail the specific compliance obligations of each party; to clarify the respective rights, procedures and responsibilities of each party in regards to compliance audits, investigation, breach reporting, and mitigation; to clarify rights of indemnification; and other related relevant matters;
  • Improving technological and other tracking, documentation and safeguards and controls to the use, access and disclosure of protected health information;
  • Conducting well-documented training as necessary to ensure that members of the Covered Entity’s workforce understand and are prepared to comply with the expanded requirements of HIPAA, can detect potential breaches or other compliance concerns, and understand and are prepared to follow appropriate procedures for reporting and responding to suspected violations;
  • Tracking actual and near miss violations and making adjustments to policies, practices, training, safeguards and other compliance components as necessary to deter future concern
  • Establishing and providing well-documented monitoring of compliance;
  • Establishing and providing well-documented timely investigation and redress of reported violations or other compliance concerns;
  • Establishing contingency plans for responding in the event of a breach;
  • Establishing a well-documented process for monitoring and updating policies, practices and other efforts in response to changes in risks, practices and  requirements;
  • Preparing and maintaining a well-documented record of compliance activities; and
  • Pursuing other appropriate strategies to enhance the Covered Entity’s ability to demonstrate its compliance commitment both on paper and in operation.

For Assistance With Compliance Or Other Concerns

The author of this article,  Ms. Stamer has extensive experience advising and assisting health care practitioners and other businesses and business leaders to establish, administer, investigate and defend health care fraud and other compliance and internal control policies and practices to reduce risk under federal and state health care and other laws. If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact the author of this article, Cynthia Marcotte Stamer, CTT Health Care Practice Group Chair, at cstamer@cttlegal.com, 214.270.2402 or another Curran Tomko Tarski LLP attorney of your choice.  You can get more information about the CTT Health Care Practice  and more specifics about Ms. Stamer’s health industry experience here.

Ms. Stamer is nationally known for her work, training and presentations, and publications on privacy and security of health and other sensitive information in health and managed care, employment, employee benefits, financial services, education and other contexts. 

Vice President of the North Texas Health Care Compliance Professionals Association, Past Chair of the ABA Health Law Section Managed Care & Insurance Section and the former Board Compliance Chair of the National Kidney Foundation of North Texas, Ms. Stamer has more than 22 years experience advising clients, conducting workshops and other training, and providing policy advice about health care, privacy, data security, and other matters. She advises health care providers, health insurers and administrators, employer and other health plan sponsors, employee benefit plan fiduciaries, schools, financial services providers, governments and others about privacy and data security, health care, insurance, human resources, ERISA, technology, and other legal and operational concerns. Ms. Stamer also publishes and speaks extensively on health and managed care industry privacy, data security and other technology, regulatory and operational risk management matters. A widely published author on privacy, data security, health care and other related matters, Ms. Stamer is the author of “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security Beyond HIPAA,” and a host of other highly regarded publications. Her insights on health care, health insurance, human resources and related matters appear in the Atlantic Information Service, Bureau of National Affairs, World At Work, The Wall Street Journal, Business Insurance, the Dallas Morning News, Managed Healthcare, Health Leaders, and a many other national and local publications.  For additional information about Ms. Stamer, her experience, involvements, programs or publications, see here.  

Other Helpful Resources & Other Information

If you found these updates of interest, you also be interested in one or more of the following other recent articles:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail- by creating or updating your profile at here. You can access other recent updates and other informative publications and resources provided by Curran Tomko Tarski LLP attorneys and get information about its attorneys’ experience, briefings, speeches and other credentials here.

For important information concerning this communication click here.  If you do not wish to receive these updates in the future, send an e-mail with the word “Remove” in the Subject to here.

©2010 Cynthia Marcotte Stamer.  All rights reserved. 


Federal HEAT & Other Federal Health Care Fraud Efforts Score More Than 15 Successes As OIG Claims $20.97 Billion Saved From Enforcement Activities In December

December 30, 2009

As the interagency Medicare Fraud Strike Force targeting Medicare Fraud scored another series of more than 15 successful criminal enforcement actions across the national during December, 2009, the Department of Health & Human Services (HHS) Office of Inspector General (OIG) credited the Medicare Fraud Strike Force and other stepped up oversight and enforcement activities as helping it achieve $20.97 Billion in Medicare and other federal health care program savings during Fiscal Year 2009 in its Semiannual Report to Congress

The Detroit convictions were among three of more than 15 other criminal enforcement successes reported by the Department of Justice during December.  These and other reports document the rising prosecution and enforcement risks that health care providers face for failing to tailor their billing and other practices to comply with federal health care fraud laws.  In light of the growing enforcement and emphasis of federal prosecutors and regulations on the detection and prosecution of organizations and individuals participating in billing or other activities that violate federal health care fraud laws, health care organizations, their officers, directors, employees, consultants and other business partners should tighten practices and step up oversight to minimize the likelihood that they or their organizations will engage in activities that federal regulators view as federal health care fraud.

December 13 Detroit Criminal Convictions

The U.S. Department of Justice Criminal Division (Justice Department), Federal Bureau of Investigation (FBI) and Inspector General for the U.S. Department of Health and Human Services (HHS) jointly announced Friday (December 11, 2009) that Baskaran Thangarasan, Sandeep Aggarwal and Wayne Smith had plead guilty for their roles in connection with several Detroit-area health care fraud scheme.

On December 9, 2009, Thangarasan plead guilty to one count of conspiracy to commit health care fraud and Aggarwal plead guilty to one count of conspiracy to launder money. On December 11, 2009, Smith plead guilty to one count of conspiracy to commit health care fraud.

  • Thangarasan Guilty Plea To Conspiracy To Commit Health Care Fraud

On December 9, 2009, Thangarasan plead guilty to one count of conspiracy to commit health care fraud. And Aggarwal plead guilty to one count of conspiracy to launder money. He faces a maximum sentence of 10 years in prison and a $250,000 fine at sentencing.

According to information contained in plea documents, Thangarasan, a licensed physical therapist, admitted that he began working in approximately September 2003 as a contract therapist for a co-conspirator. This co-conspirator owned and controlled several companies operating in the Detroit area that purported to provide physical and occupational therapy services to Medicare beneficiaries. Thangarasan admitted that he, the co-conspirator and others created fictitious therapy files appearing to document physical therapy services provided to Medicare beneficiaries, when in fact no such services had been provided. According to court documents, the fictitious services reflected in the files were billed to Medicare through sham Medicare providers controlled by Thangarasan’s co-conspirators.

Thangarasan admitted that his role in creating the fictitious therapy files was to sign documents and progress notes indicating he had provided physical therapy services to particular Medicare beneficiaries, when in fact he had not. Thangarasan was paid approximately $50 by co-conspirators per file that he falsified in this manner. Thangarasan also admitted that in the course of the scheme charged in the indictment, he signed approximately 1,011 fictitious physical therapy files, falsely indicating he had provided physical therapy services to Medicare beneficiaries. Thangarasan admitted he knew that the files he helped falsify were used to justify fraudulent billings to Medicare.

In addition, Thangarasan admitted that between approximately September 2003 and May 2006, his co-conspirators submitted claims to the Medicare program totaling approximately $5,055,000 for files that were falsified by Thangarasan. Medicare actually paid approximately $2,325,000 on those claims. Thangarasan admitted that throughout the conspiracy, he was fully aware that Medicare was being billed for occupational therapy services he had falsely indicated he had performed.

  • Aggarwal Guilty Plea to Money Laundering

Aggarwal faces a maximum sentence of 20 years in prison and a $500,000 fine after admitting in the same case to assisting co-conspirator Suresh Chand in laundering the proceeds of Chand’s Medicare fraud scheme. Chand, who pleaded guilty in September 2009 to conspiracy to commit health care fraud and conspiracy to launder money, admitted to conspiring to submit approximately $18 million in fraudulent physical and occupational therapy claims to the Medicare program. Aggarwal, who admitted working at Chand’s office, acknowledged that his role in the scheme was to set up sham entities at Chand’s direction, with the purpose of using those entities to distribute the proceeds of the fraud to the various co-conspirators. According to plea documents, one such entity was called Global Health Care Management Services. Aggarwal admitted that Global Health Care Management Services, which he helped create, provided no health or management services of any type, but existed solely as a mechanism to conceal the location of fraudulently obtained Medicare proceeds. Aggarwal admitted in his plea that he and Chand laundered approximately $393,000 through this sham entity.

  • Smith Guilty Plea To Conspiracy To Commit Health Care Fraud

At sentencing, Smith face a maximum sentence of 10 years in prison and a $250,000 fine for his participation in a scheme to falsely bill Medicare.  His indictment charged that he transported and paid Medicare beneficiaries to attend Sacred Hope Center, a Southfield, Mich.-infusion clinic. According to the indictment, the Medicare beneficiaries he paid and transported were paid to sign paperwork indicating that they had received infusions and injections of specialty medications that they did not in fact receive.

According to the indictment, Sacred Hope Center routinely billed the Medicare program for services that were medically unnecessary and/or never provided. The primary owners and operators of Sacred Hope Center have pleaded guilty and admitted purchasing only a small fraction of the medications that the clinic billed the Medicare program for providing. These co-conspirators have also stated that patients were prescribed medications at the clinic based not on medical need, but instead based on which medications were likely to generate Medicare reimbursements.

Other Criminal Enforcement Actions During December

The Detroit convictions are three of nearly 20 successful criminal enforcement activities that DOJ announced during December, 2009.  During the same month, DOJ also announced:

  • On December 20, 2009, sentencing of an Audiologist to six months in prison for Medicare Fraud in California  here
  • On December 17, 2009 , the guilty plea and sentencing of a Houston physician for operating an illegal pill mill here
  • On December 16, 2009, the sentencing in Michigan of the owner of health care agency to 18 months prison in Medicare kickback scheme here
  • On December 15, 2009, the sentencing of a Lexington. South Carolina doctor to perform community service in a health care fraud case  here
  • On December 15, 2009, the guilty plea of a Plymouth, Minnesota man to defrauding Medicaid out of $74,000  here
  • On December 14, 2009, the sentencing of a Miami, Georgia man to more than a decade in Federal prison for million dollar Medicaid fraud here
  • On December 11, 2009, the charging of a durable medical equipment company and six other defendants in Pennsylvania in a Medicare Fraud And Kickback Scheme here
  • On December 11, 2009, the guilty plea of an Aulander, North Carolina woman to $650,000 Health Care Fraud  here
  • On December 7, 2009, the guilty plea of a corporation various health care fraud schemes here
  • On December 6, 2009, the guilty plea of a Dallas, Texas durable medical equipment business owner to aggravated id theft in a Medicare Fraud scheme  here
  • On December 3, 2009, the arrest of the owner of a Florida home health care provider and his alleged accomplice for a scheme to bribe a government contractor  here
  • On December 3, 2009, the conviction of two defendants for Health Care Fraud in Idaho here
  • On December 2, 2009, the entry of an order requiring a Sioux City, Iowa hospital to pay $400,000 to resolve false claims allegations  here
  • On December 1, 2009, the admission by a Maryland man to health care fraud on a hospital in the District of Columbia  here
  • On December 1, 2009, the arrest of a Miami, Florida man for obstructing a Health Care Fraud Investigation here
  • On December 1, 2009, the $125,000  fine of a Michigan chiropractor for Falsifying Records here

HEAT Operations Continued & Expanded

The Detroit and many of these other criminal successes resulted from joint investigations by the FBI and the OIG as part of the Medicare Fraud Strike Force as part of various interagency Medicare Fraud “Strike Forces” operating in several regions of the U.S. as part of the continuing Health Care Fraud Prevention and Enforcement Action Team (HEAT) operations of the FBI, HHS and the Justice Department which DOJ credits with producing more than 250 criminal convictions since their inception,  Based on initial successes of Strike Force operations in Miami (Phase One) and  Los Angeles (Phase Two), the Justice Department and HHS on May 20, 2009 expanded the scope of these operations to include Detroit and Houston Strike Force teams. Recently, DOJ and HHS announced the expansion of its HEAT operations to include Strike Force teams also targeting health care fraud in Brooklyn, New York; Tampa, Florida and Baton Rouge, Louisiana.

The heightened emphasis on enforcement of federal health care fraud laws reflected in the HEAT program the enactment of recent amendments to the False Claims Act, 31 U.S.C. § 3729 (FCA)  under the “Fraud Enforcement and Recovery Act of 2009”(FERA).  The FERA amendments increase the likelihood both that whistleblowers will turn in health care providers and other individuals and organizations that file false claims in violation of the FCA and the liability that violators may incur for that misconduct.

The FERA amendments and the HEAT Team and Strike Force activities are part of a broader emphasis in the enforcement of federal health care fraud laws by both the Administration and Congress.  President Obama’s proposed Fiscal Year 2010 budget seeks to further increase funding for fraud prevention and enforcement by investing $311 million — a 50 percent increase from 2009 funding — to strengthen program integrity activities within the Medicare and Medicaid programs.  The Obama Administration anticipates that all combined, the anti-fraud efforts in the President’s budget could save $2.7 billion over five years by improving oversight and stopping fraud in the Medicare and Medicaid programs, including the Medicare Advantage and Medicare prescription drug programs.  Many state agencies also are stepping up their health care fraud investigations and enforcement.

Health Care Providers Must Step Up Compliance & Risk Management

In light of this new emphasis upon health care fraud detection and enforcement, health care providers now more than ever need to prepare to demonstrate the appropriateness and defensibility of their health care billing and other compliance efforts.

Solutions Law Press author and Curran Tomko and Tarski LLP Health Care Practice Chair Cynthia Marcotte Stamer has extensive experience advising and assisting health care practitioners and other businesses and business leaders to establish, administer, investigate and defend health care fraud and other compliance and internal control policies and practices to reduce risk under federal and state health care and other laws. You can get more information about the CTT Health Care Practice  and more specifics about Ms. Stamer’s health industry experience here on the CTT Website.

If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact Cynthia Marcotte Stamer, CTT Health Care Practice Group Chair, at cstamer@cttlegal.com, 214.270.2402, CTT White Collar Defense Litigation Practice Chair Edwin J. Tomko at etomko@cttlegal.com, or  214.270.1405 or another Curran Tomko Tarski LLP attorney of your choice.. 

Other Helpful Resources & Other Information

We hope that this information is useful to you.   If you found these updates of interest, you also be interested in other updates on HEAT activities such as the following:

Other recent updates that also may be of interested published on our electronic Solutions Law Press Health Care Update publication include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please register to receive this Solutions Law Press Health Care Update here and be sure that we have your current contact information – including your preferred e-mail- by creating or updating your profile at here. You can access other recent updates and other informative publications and resources provided by Curran Tomko Tarski LLP attorneys and get information about its attorneys’ experience, briefings, speeches and other credentials here.

For important information concerning this communication click here.  If you do not wish to receive these updates in the future, send an e-mail with the word “Remove” in the Subject here.

©2009 Cynthia Marcotte Stamer.  All rights reserved. 


HEAT Initiative Snares Health Fraud Related Guilty Pleas of Physical Therapist, Money Launderer and Patient Recruiter In Detroit

December 14, 2009

By Cynthia Marcotte Stamer

The interagency Medicare Fraud Strike Force targeting Medicare Fraud in the Detroit area scored another series of criminal convictions last week. 

The U.S. Department of Justice Criminal Division (Justice Department), Federal Bureau of Investigation (FBI) and Inspector General for the U.S. Department of Health and Human Services (HHS) jointly announced Friday (December 11, 2009) that Baskaran Thangarasan, Sandeep Aggarwal and Wayne Smith had plead guilty for their roles in connection with several Detroit-area health care fraud scheme.

On December 9, 2009, Thangarasan plead guilty to one count of conspiracy to commit health care fraud and Aggarwal plead guilty to one count of conspiracy to launder money. On December 11, 2009, Smith plead guilty to one count of conspiracy to commit health care fraud.

Thangarasan Guilty Plea To Conspiracy To Commit Health Care Fraud

On December 9, 2009, Thangarasan plead guilty to one count of conspiracy to commit health care fraud. And Aggarwal plead guilty to one count of conspiracy to launder money. He faces a maximum sentence of 10 years in prison and a $250,000 fine at sentencing.

According to information contained in plea documents, Thangarasan, a licensed physical therapist, admitted that he began working in approximately September 2003 as a contract therapist for a co-conspirator. This co-conspirator owned and controlled several companies operating in the Detroit area that purported to provide physical and occupational therapy services to Medicare beneficiaries. Thangarasan admitted that he, the co-conspirator and others created fictitious therapy files appearing to document physical therapy services provided to Medicare beneficiaries, when in fact no such services had been provided. According to court documents, the fictitious services reflected in the files were billed to Medicare through sham Medicare providers controlled by Thangarasan’s co-conspirators.

Thangarasan admitted that his role in creating the fictitious therapy files was to sign documents and progress notes indicating he had provided physical therapy services to particular Medicare beneficiaries, when in fact he had not. Thangarasan was paid approximately $50 by co-conspirators per file that he falsified in this manner. Thangarasan also admitted that in the course of the scheme charged in the indictment, he signed approximately 1,011 fictitious physical therapy files, falsely indicating he had provided physical therapy services to Medicare beneficiaries. Thangarasan admitted he knew that the files he helped falsify were used to justify fraudulent billings to Medicare.

In addition, Thangarasan admitted that between approximately September 2003 and May 2006, his co-conspirators submitted claims to the Medicare program totaling approximately $5,055,000 for files that were falsified by Thangarasan. Medicare actually paid approximately $2,325,000 on those claims. Thangarasan admitted that throughout the conspiracy, he was fully aware that Medicare was being billed for occupational therapy services he had falsely indicated he had performed.

Aggarwal Guilty Plea to Money Laundering

Aggarwal faces a maximum sentence of 20 years in prison and a $500,000 fine after admitting in the same case to assisting co-conspirator Suresh Chand in laundering the proceeds of Chand’s Medicare fraud scheme. Chand, who pleaded guilty in September 2009 to conspiracy to commit health care fraud and conspiracy to launder money, admitted to conspiring to submit approximately $18 million in fraudulent physical and occupational therapy claims to the Medicare program. Aggarwal, who admitted working at Chand’s office, acknowledged that his role in the scheme was to set up sham entities at Chand’s direction, with the purpose of using those entities to distribute the proceeds of the fraud to the various co-conspirators. According to plea documents, one such entity was called Global Health Care Management Services. Aggarwal admitted that Global Health Care Management Services, which he helped create, provided no health or management services of any type, but existed solely as a mechanism to conceal the location of fraudulently obtained Medicare proceeds. Aggarwal admitted in his plea that he and Chand laundered approximately $393,000 through this sham entity.

Smith Guilty Plea To Conspiracy To Commit Health Care Fraud

At sentencing, Smith face a maximum sentence of 10 years in prison and a $250,000 fine for his participation in a scheme to falsely bill Medicare.  . 

Smith pleaded guilty to an indictment that charged he transported and paid Medicare beneficiaries to attend Sacred Hope Center, a Southfield, Mich.-infusion clinic. According to the indictment, the Medicare beneficiaries he paid and transported were paid to sign paperwork indicating that they had received infusions and injections of specialty medications that they did not in fact receive.

According to the indictment, Sacred Hope Center routinely billed the Medicare program for services that were medically unnecessary and/or never provided. The primary owners and operators of Sacred Hope Center have pleaded guilty and admitted purchasing only a small fraction of the medications that the clinic billed the Medicare program for providing. These co-conspirators have also stated that patients were prescribed medications at the clinic based not on medical need, but instead based on which medications were likely to generate Medicare reimbursements.

HEAT Operations Continuing

The cases are being investigated by the FBI and the HHS Office of the Inspector General. Theses cases were brought as part of the Medicare Fraud Strike Force, supervised by the Criminal Division’s Fraud Section and U.S. Attorney’s Office for the Eastern District of Michigan.

The investigation resulting in these guilty pleas were conducted as part of a series of interagency Medicare Fraud “Strike Forces” operating in several regions of the U.S. as part of the continuing Health Care Fraud Prevention and Enforcement Action Team (HEAT) operations of HHS and the Justice Department.  Based on initial successes of Strike Force operations in Miami (Phase One) and  Los Angeles (Phase Two), the Justice Department and HHS on May 20, 2009 expanded the scope of these operations to include Detroit and Houston Strike Force teams.

The heightened emphasis on enforcement of federal health care fraud laws reflected in the HEAT program the enactment of recent amendments to the False Claims Act, 31 U.S.C. § 3729 (FCA)  under the “Fraud Enforcement and Recovery Act of 2009”(FERA).  The FERA amendments increase the likelihood both that whistleblowers will turn in health care providers and other individuals and organizations that file false claims in violation of the FCA and the liability that violators may incur for that misconduct.

The FERA amendments and the HEAT Team and Strike Force activities are part of a broader emphasis in the enforcement of federal health care fraud laws by both the Administration and Congress.  President Obama’s proposed Fiscal Year 2010 budget seeks to further increase funding for fraud prevention and enforcement by investing $311 million — a 50 percent increase from 2009 funding — to strengthen program integrity activities within the Medicare and Medicaid programs.  The Obama Administration anticipates that all combined, the anti-fraud efforts in the President’s budget could save $2.7 billion over five years by improving oversight and stopping fraud in the Medicare and Medicaid programs, including the Medicare Advantage and Medicare prescription drug programs.  Many state agencies also are stepping up their health care fraud investigations and enforcement.

In light of this new emphasis upon health care fraud detection and enforcement, health care providers now more than ever need to prepare to demonstrate the appropriateness and defensibility of their health care billing and other compliance efforts.

Solutions Law Press author and Curran Tomko and Tarski LLP Health Care Practice Chair Cynthia Marcotte Stamer has extensive experience advising and assisting health care practitioners and other businesses and business leaders to establish, administer, investigate and defend health care fraud and other compliance and internal control policies and practices to reduce risk under federal and state health care and other laws. You can get more information about her health industry experience here.  

If you need assistance with these or other compliance concerns, wish to inquire about arranging for compliance audit or training, or need legal representation on other matters please contact Cynthia Marcotte Stamer, CTT Health Care Practice Group Chair, at cstamer@cttlegal.com, 214.270.2402 or your other favorite Curran Tomko Tarski LLP attorney. 

Other Helpful Resources & Other Information

We hope that this information is useful to you.   If you found these updates of interest, you also be interested in other updates on HEAT activities such as the following:

Other recent updates that also may be of interested published on our electronic Solutions Law Press Health Care Update publication include:

If you or someone else you know would like to receive future updates about developments on these and other concerns, please register to receive this Solutions Law Press Health Care Update here and be sure that we have your current contact information – including your preferred e-mail- by creating or updating your profile at here. You can access other recent updates and other informative publications and resources provided by Curran Tomko Tarski LLP attorneys and get information about its attorneys’ experience, briefings, speeches and other credentials here.

For important information concerning this communication click here.  If you do not wish to receive these updates in the future, send an e-mail with the word “Remove” in the Subject here.

©2009 Cynthia Marcotte Stamer.  All rights reserved. 


Two Recent Criminal Prosecutions For HIPAA Privacy Rule Violations Signal Rising Criminal Enforcement Risks

September 8, 2009

Register here  To Participate In September 9 or September 17 Briefings on New HIPAA Data Breach Rules

September 8, 2009

Two recent separate criminal actions against hospital workers for wrongfully accessed medical records in violation of the medical privacy provisions of the Health Insurance Portability & Accountability Act of 1996, as amended (HIPAA) are the latest reminders to health care providers, health plans, health care clearinghouses, their business associates and members of their workforce that the criminal provisions of the HIPAA Privacy Rules have teeth. 

Palmetto General Hospital Employee And Accomplice Indicted For Stealing Patient Records As Part Of Fraud

 In Miami-Dade County, federal felony charges are pending against Jacquettia L. Brown, 29, and Tear Renee Barbary, 25, prosecution on for offenses relating to the theft of patient profile records from Palmetto General Hospital to further a fraud scheme.

A seven-count Indictment announced by the Department of Justice on May 26, 2009 charges Brown and Barbary with conspiracy to commit access device fraud in violation of Title 18, United States Code, Section 1029(b)(2), and criminal violations of HIPAA. In addition, Brown is charged with aggravated identity theft, in violation of Title 18, United States Code, Section 1028A(a)(1).  If convicted, the defendants face a statutory maximum of five (5) years’ imprisonment on Count 1, and a statutory maximum of ten (10) years’ imprisonment as to each of Counts 2, 3, and 7. As to Counts 4-6, Brown faces a two (2) year mandatory prison sentence per count. 

According to the Indictment, Brown, a medical records employee of Palmetto General Hospital, took records containing personal profile information of Palmetto General Hospital patients. Defendant Brown and Barbary then used the stolen personal information to further a credit card fraud conspiracy. The patient profile records that Brown stole included personal identifying information, such as patients’ names, birthdates, Social Security numbers, addresses, driver’s license numbers, and next of kin contacts. Brown used the stolen identifying information to obtain patients’ credit card account numbers. She gave patient profile records and credit card account numbers to Barbary, who used the information to make unauthorized credit card purchases. When law enforcement officials disrupted the scheme, Brown was in possession of 41 patient profile records and Barbary was in possession of six patient profile records.

Curiosity Check of Medical Records Results In Arkansas Doctor, 2 Former Hospital Employees Guilty Plea To HIPAA Violation

Three Arkansas health care workers could be sentenced to up to 1 year in prison, a fine of not more than $50,000, or both after pleading guilty in July, 2009 to misdemeanor violations of the health information privacy provisions of HIPAA for accessing a patient’s record without any legitimate purpose.

United States Magistrate Judge Henry L. Jones, Jr. accepted the guilty pleas of Dr. Jay Holland, age 56, of Little Rock, Arkansas; Sarah Elizabeth Miller, age 28, of England Arkansas; and Candida Griffin, age 34 of Little Rock, Arkansas after each admitted to accessing patient records to satisfy their own curiosity.

Dr. Holland, Medical Director of Select Specialty Hospital, located on the 6 floor of the St. Vincent Infirmary Medical Center (SVIMC), admitted that after watching news reports on television, he logged on to the SVIMC patient records from his computer at home and accessed a patient’s files to determine if the news reports were accurate. He admitted he accessed the file because he was curious even though he had had HIPAA training and understood he was violating HIPAA when he accessed the file. SVIMC suspended Dr. Holland’s privileges for two weeks and required him to complete on-line HIPAA training.

Sarah Elizabeth Miller, formerly an account representative at SVIMC, Sherwood Campus, was responsible for checking patients in and out of the clinic and for processing patient billing. In order to perform her duties, she had access to the SVIMC patient records program which includes all locations, not just that of the Sherwood clinic. Miller admitted that on October 20 and 21, 2008, she accessed a patient’s files approximately 12 times out of curiosity. She admitted that she accessed the records without any legitimate purpose. Records show that Miller was trained on HIPAA privacy laws by SVIMC. SVIMC fired Miller from her position.

Candida Griffin was the emergency room unit coordinator at SVIMC. Her responsibilities were to order patient tests, perform data entry into electronic patient files for patients and perform other secretarial functions in the emergency room. Griffin admitted that on October 20, 2008, she was told by the charge nurse to set-up an alias for a particular patient admitted to the emergency room. On October 21, 2008, after the patient had been moved to ICU, Griffin admitted that she became curious about the patient’s status and accessed the medical chart to find out if the patient was still living. Although Griffin did not inform anyone about accessing the chart, hospital records show that the patient’s records were accessed three times that day by Ms. Griffin. SVIMC records show that Griffin was trained on HIPAA privacy laws. SVIMC fired Griffin from her position.

Pursuant to plea agreements with the United States, Holland, Miller and Griffin pleaded guilty to a misdemeanor a violation of the health information privacy provisions of HIPAA based on their accessing a patient’s record without any legitimate purpose. Each faces a maximum penalty of 1 year imprisonment, a fine of not more than $50,000, or both. A sentencing date has not yet been set, but is expected within the next few weeks.

Criminal Referral and Enforcement Continues

Together with the HIPAA-related criminal convictions of in 2008 of David Gibson, Ferando Ferrer, Jr. and Andrea Smith discussed here, these new Arkansas and Florida criminal actions document the willingness of Justice Department attorneys to investigate and prosecute certain criminal violations.  Because they involved the theft of health information for use in furtherance of other health care fraud schemes, many have viewed as predictable and understandable the prosecution of Gibson, Ferrer, Brown and Barbary.  In contrast, the willingness of Jane W. Duke, United States Attorney for the Eastern District of Arkansas, to prosecute criminally the wrongful access by the SVIMC health care workers and Andrea Smith in the absence of other health care fraud motives challenges the perception widely held among certain segments of the health care and health plan industry that the criminal provisions of HIPAA have little teeth.  Since U.S. Attorney Duke pursued both the SVIMC and Smith prosecutions, it remains to be seen whether other U.S. Attorneys will be equally willing to pursue prosecution of HIPAA violations in the absence of evidence of other federal health care crimes.  

Less speculative is the growing readiness of the Department of Health & Human Services Office of Civil Rights to pursue civil remedies for HIPAA violations.  On February 18, 2009, for instance, OCR and the Federal Trade Commission (“FTC”) issued a joint announcement (the “Announcement”) ordering CVS Pharmacy, Inc., the nation’s largest retail pharmacy chain, to pay the U.S. government a $2.25 million settlement and to take other corrective action to ensure that it does not violate the privacy rights patients under HIPAA when disposing of patient information such as identifying information on pill bottle labels.  In a coordinated action, CVS Caremark Corp., the parent company of the pharmacy chain, also signed a consent order and agreed to a settlement with the FTC to settle potential violations of the FTC Act.  The investigation resulting in the settlement marks the first instance where the OCR formally coordinated on investigation and resolution of a case with the FTC. 

Coming as new data breach notification requirements for HIPAA-covered entities are set to take effect on September 23, 2009, these and other stepped up oversight and enforcement activities make it critical that all health care providers, health plans, health care clearinghouses and their business associates need to update their policies and practices, tighten their compliance and data breach monitoring processes, and strengthen their internal controls, compliance in preparation for defending their actions under the newly strengthened Privacy Rules.  Covered entities and their business associates more than ever must ensure their ability to demonstrate to federal regulators the effectiveness of their HIPAA compliance efforts by both adopting the written policies and procedures required by HIPAA and continuously monitoring and administering these safeguards.  Covered entities should consider reviewing the adequacy of their current HIPAA Privacy and Security compliance practices taking into consideration the Corrective Action Plan, published OCR noncompliance and enforcement statistics, their own and reports of other security and privacy breaches and near misses, and other developments to determine if additional steps are necessary or advisable.

If you need assistance with auditing, updating or defending your organizations HIPAA and other privacy and data security practices, please contact Curran Tomko Tarski LLP Partner Cynthia Marcotte Stamer at (214) 270-2402 or via e-mail at CStamer@CTTLegal.com.

Register Now For Upcoming September Health Industry Update Programs

If you found this information of interest, you also may be interested in one of the following upcoming health industry programs to be presented by Ms. Stamer during September:

  • HITECH ACT Health Data Security & Breach Update on September 9, 2009 hosted live or via teleconference by Curran Tomko Tarski LLP 
  • How to Ensure That Your Organization Is In Compliance With Regulations Governing Discrimination — What You Should Be Doing To Be Prepared for the New, Stepped Up Enforcement Actions on September 10, 2009 hosted via teleconference by Health Resources Publishing
  • Health Information Security & Data Breach Under HITECH Act on September 17, 2009 hosted via teleconference by the Health Care Compliance Association

To register or for other details about these and other upcoming programs and presentations by Ms. Stamer and other Curran Tomko Tarski members, see here.

Other Recent Developments

If you found this information of interest, you also may be interested in reviewing some of the following recent Curran Tomko Tarski LLP Latest in Health Care Updates available online by clicking on the article title:

For More Information

We hope that this information is useful to you.  If you need assistance with auditing or defending these or other health care compliance, risk management, transaction or operation concerns, please contact the author of this update, Curran Tomko Tarski LLP Health Practice Group Chair, Cynthia Marcotte Stamer, at (214) 270‑2402, cstamer@cttlegal.com, Edwin J. Tomko at (214) 270-1405 or another Curran Tomko Tarski LLP Partner of your choice. Ms. Stamer has extensive experience advising clients and writes and speaks extensively on these and other health industry and other internal controls and risk management matters. 

You can review other recent health care and internal controls resources and additional information about the health industry and other experience of Ms. Stamer here.  If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile at here or e-mailing this information to cstamer@cttlegal.com.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile at here or e-mailing this information here.  To unsubscribe, e-mail here.

©2009 Cynthia Marcotte Stamer.  All rights reserved.


Pfizer To Pay $2.3 Billion For Fraudulent Marketing In Largest DOJ Health Care Fraud Settlement

September 2, 2009

Announcement Highlights Growing Fraud Prosecution Risks of Health Industry Businesses

Today’s announcement that Pfizer Inc. and its subsidiary Pharmacia & Upjohn Company Inc. (collectively “Pfizer”) will pay $2.3 billion, the largest health care fraud settlement in the history of the Department of Justice, to resolve criminal and civil liability for alleged illegal promotion of certain pharmaceutical products and other stepped up oversight and enforcement activities make it critical that all health industry organizations strengthen their internal controls, compliance and audit activities as well as be prepared to defend their actions against the rising tide of federal and state oversight and enforcement.

The pharmaceutical giant Pfizer Inc. and its subsidiary Pharmacia & Upjohn Company Inc. have agreed to pay $2.3 billion, the largest health care fraud settlement in the history of the Department of Justice, to resolve criminal and civil liability arising from the alleged illegal promotion of certain pharmaceutical products, the Justice Department (DOJ) announced today (September 2, 2009).

According to DOJ, Pharmacia & Upjohn Company agreed to plead guilty to a felony violation of the Food, Drug and Cosmetic Act for misbranding Bextra with the intent to defraud or mislead.  Bextra is an anti-inflammatory drug that Pfizer pulled from the market in 2005. 

The Food, Drug and Cosmetic Act requires that a company specify the intended uses of a product in its new drug application to FDA.  Once approved, the drug may not be marketed or promoted for so-called “off-label” uses – i.e., any use not specified in an application and approved by FDA.  DOJ charged Pfizer promoted the sale of Bextra for several uses and dosages that the FDA specifically declined to approve due to safety concerns.  Under the announced settlement, Pfizer will pay a criminal fine of $1.195 billion, the largest criminal fine ever imposed in the United States for any matter.  Pharmacia & Upjohn will also forfeit $105 million, for a total criminal resolution of $1.3 billion.

In addition, Pfizer agreed to pay $1 billion to resolve allegations under the civil False Claims Act that the company illegally promoted four drugs – Bextra; Geodon, an anti-psychotic drug; Zyvox, an antibiotic; and Lyrica, an anti-epileptic drug – and caused false claims to be submitted to government health care programs for uses that were not medically accepted indications and therefore not covered by those programs.  The civil settlement also resolves allegations that Pfizer paid kickbacks to health care providers to induce them to prescribe these, as well as other, drugs.  The federal share of the civil settlement is $668,514,830 and the state Medicaid share of the civil settlement is $331,485,170.  This is the largest civil fraud settlement in history against a pharmaceutical company.

As part of the settlement, Pfizer also has agreed to enter into an expansive corporate integrity agreement with the Office of Inspector General of the Department of Health and Human Services.  That agreement provides for procedures and reviews to be put in place to avoid and promptly detect conduct similar to that which gave rise to this matter.

Whistleblower lawsuits filed under the qui tam provisions of the False Claims Act that are pending in the District of Massachusetts, the Eastern District of Pennsylvania and the Eastern District of Kentucky triggered this investigation.  As a part of today’s resolution, six whistleblowers will receive payments totaling more than $102 million from the federal share of the civil recovery.

Today’s announcement of this historic settlement emphasizes the continuing and growing government commitment to, coordination and sophistication in the investigation and prosecution of health care crimes by pharmaceutical industry and other health care providers.  The Obama Administration has made investigation and prosecution of health care fraud laws a key element of its strategy to manage U.S. health care program costs. Recently enacted changes in the False Claims Act and other laws are making it easier for federal prosecutors to successfully prosecute these and other health care fraud cases.

The enhanced coordination among agencies central to this strategy is reflected in the collaboration among the many agencies involved in the investigation leading to these charges. The U.S. Attorney’s offices for the District of Massachusetts, the Eastern District of Pennsylvania, and the Eastern District of Kentucky, and the Civil Division of the Department of Justice handled these cases.  The U.S. Attorney’s Office for the District of Massachusetts led the criminal investigation of Bextra.  The investigation was conducted by the Office of Inspector General for the Department of Health and Human Services (HHS), the FBI, the Defense Criminal Investigative Service (DCIS), the Office of Criminal Investigations for the Food and Drug Administration (FDA), the Veterans’ Administration’s (VA) Office of Criminal Investigations, the Office of the Inspector General for the Office of Personnel Management (OPM), the Office of the Inspector General for the United States Postal Service (USPS), the National Association of Medicaid Fraud Control Units and the offices of various state Attorneys General.

These and other stepped up oversight and enforcement activities make it critical that all health industry organizations strengthen their internal controls, compliance and audit activities as well as be prepared to defend their actions against the rising tide of federal and state oversight and enforcement.

Register Now For Upcoming September Health Industry Update Programs

If you found this information of interest, you also may be interested in one of the following upcoming health industry programs to be presented by Ms. Stamer during September:

  • HITECH ACT Health Data Security & Breach Update on September 9, 2009 hosted live or via teleconference by Curran Tomko Tarski LLP 
  • How to Ensure That Your Organization Is In Compliance With Regulations Governing Discrimination — What You Should Be Doing To Be Prepared for the New, Stepped Up Enforcement Actions on September 10, 2009 hosted via teleconference by Health Resources Publishing
  • Health Information Security & Data Breach Under HITECH Act on September 17, 2009 hosted via teleconference by the Health Care Compliance Association

To register or for other details about these and other upcoming programs and presentations by Ms. Stamer and other Curran Tomko Tarski members, see here.

Other Recent Developments

If you found this information of interest, you also may be interested in reviewing some of the following recent Curran Tomko Tarski LLP Latest in Health Care Updates available online by clicking on the article title:

For More Information

We hope that this information is useful to you.  If you need assistance with auditing or defending health care fraud concerns or other health care compliance, risk management, transaction or operation concerns, please contact the author of this update, Curran Tomko Tarski LLP Health Practice Group Chair, Cynthia Marcotte Stamer, at (214) 270‑2402, cstamer@cttlegal.com, Edwin J. Tomko at (214) 270-1405 or another Curran Tomko Tarski LLP Partner of your choice. Ms. Stamer has extensive experience advising clients and writes and speaks extensively on these and other health industry and other internal controls and risk management matters. 

You can review other recent health care and internal controls resources and additional information about the health industry and other experience of Ms. Stamer here.  If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile at here or e-mailing this information to cstamer@cttlegal.com.

If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information – including your preferred e-mail – by creating or updating your profile at here or e-mailing this information here.  To unsubscribe, e-mail here.

©2009 Cynthia Marcotte Stamer.  All rights reserved.


HHS Issues Interim Final Requiring Health Care Provider, Health Plans & Other Covered Entities To Give Breach Notifications When Certain Personal Health Information Breached Beginning In September; Register to Participate In September 10th Briefing on New Rules In Person or Via Telephone

August 20, 2009

The U.S. Department of Health and Human Services (HHS) yesterday (August 19, 2009) issued “breach notification” regulations requiring health care providers, health plans and other covered entities (Covered Entities) under the personal health information privacy and security rules of the Health Insurance Portability & Accountability  (HIPAA) to notify affected individuals following a “breach” of “unsecured” protected health information. Scheduled for publication in the Federal Register on August 24, 2009, the new breach notification regulations are part of a series of new rules that implement new electronic personal health information data security and data breach notification requirements for Covered Entities added to HIPAA under the Health Information Technology for Economic and Clinical Health (HITECH) Act signed into law on February 17, 2009 as part of American Recovery and Reinvestment Act of 2009 (ARRA).  Covered entities must begin complying with the new rules no later than September 24, 2009.

Curran Tomko Tarski, LLP Health Practice leader Cynthia Marcotte Stamer will conduct a briefing on these new protected health information data security and data breach rules on Thursday, September 10, 2009 from Noon to 1:30 P.M. Central Time. For a registration fee of $45.00, registrants will have the option to participate via teleconference or in person at the offices of Curran Tomko Tarski LLP, 2001 Bryan Street, Suite 2050, Dallas Texas 75201.  For more information, e-mail here.

 HITECH Act Data Breach and Unsecured PHI Rules

The new data breach notification rules are part of a series of recent HIPAA enacted under the HITECH Act to strengthen the federal rules requiring HIPAA covered entities to safeguard electronic and certain other protected health information. Enhanced data security and data breach rules added as part of these HITECH Act amendments obligate  covered entities and business associates to provide certain notifications following a breach of “unsecured”  “protected health information” within the meaning of HIPAA, as amended.  “Unsecured protected health information” is defined as protected health information that is not secured through the use of a technology or methodology specified by the HHS Secretary.

The new data breach regulations implement the HITECH Act requirement that Covered Entities and their business associates notify affected individuals, the Secretary of HHS, and in some cases, the media, of a breach and the form, manner, and timing of that notification.  For purposes of the HITECH Act, electronic protected health information is considered “unsecured” unless the covered entity has satisfied certain minimum standards for the protection of that data established pursuant to the HITECH Act.  HHS and the Federal Trade Commission previously issued certain initial guidance concerning the HITECH Act standards for determining when electronic personal health information qualifies as secure.  To help further define when electronic health information is treated as “unsecured” and therefore subject to the breach notification requirements, the data breach rules also update and clarify the previously issued existing HHS guidance specifying encryption and destruction as the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals published earlier this year by HHS to for purposes of determining when protected health information will be considered “unsecured” for purposes of the HITECH Act data breach rules.  Entities subject to the HHS and FTC regulations that secure health information as specified by the guidance through encryption or destruction are relieved from having to notify in the event of a breach of such information.  

The HHS interim final regulations are effective September 24, 2009, which is the date 30 days after the date they will be published on the Federal Register and include a 60-day public comment period. To review the interim final data breach regulations, see here.  To review the HITECH Act Breach Notification Guidance and Request for Information, see here.

For More Information

The author of this article, Curran Tomko and Tarski LLP Health Care Practice Chair Cynthia Marcotte Stamer has extensive experience advising and assisting health care providers, payors and their business associates about HIPAA and other privacy and data security matters, as well as a diverse range of health care policy, regulatory, compliance, risk management and operational concerns. 

Past chair of the American Bar Association Health Law Section Managed Care & Insurance Section, Martindale Hubble AV-rated and recognized in International Who’s Who of Professionals, Ms. Stamer continuously advises health care providers, health care payers and administrators, employers, governments and others about health care, insurance, human resources, privacy and data security, technology, and other legal and operational concerns.  A popular lecturer and widely published author on privacy and data security and other related health care and health plan matters, Ms. Stamer also writes and speaks extensively on health and managed care industry privacy, data security and other technology, regulatory and operational risk management matters.  She currently serves as the Editor in Chief of the forthcoming 2010 edition of the Information Security Guide to be published by the American Bar Association Information Security Committee in 2010.  Examples of her other works include “Protecting & Using Patient Data In Disease Management: Opportunities, Liabilities And Prescriptions,” “Privacy Invasions of Medical Care-An Emerging Perspective,” “Cybercrime and Identity Theft: Health Information Security Beyond HIPAA,” and a host of others.  Her insights on health care, health insurance, human resources and related matters appear in the Atlantic Information Service Privacy Report, The Wall Street Journal, Business Insurance, the Dallas Morning News, Managed Healthcare, Health Leaders, and a various other national and local publications.  For additional information about Ms. Stamer, her experience, involvements, programs or publications, see here.  

We hope that this information is useful to you.  If you need assistance monitoring, evaluating or responding to these or other proposed health care or other regulatory reforms or with other health care compliance, risk management, transaction or operation concerns, please contact the author of this update, Curran Tomko Tarski LLP Health Practice Group Chair, Cynthia Marcotte Stamer, at (214) 270-2402, cstamer@cttlegal.com or your other favorite Curran Tomko Tarski LLP Partner.

We also encourage you and others to join the discussion about these and other health care reform proposals and concerns by joining the Coalition for Responsible Health Care Reform Group on Linkedin, registering to receive these updates here.

Other Helpful Resources & Other Information

We hope that this information is useful to you.   If you found these updates of interest, you also be interested in one or more of the following other recent articles published on our electronic Solutions Law Press Health Care Update publication available here. If you or someone else you know would like to receive future updates about developments on these and other concerns, please register to receive this Solutions Law Press Health Care Update here and be sure that we have your current contact information – including your preferred e-mail- by creating or updating your profile at here. You can access other recent updates and other informative publications and resources provided by Curran Tomko Tarski LLP attorneys and get information about its attorneys’ experience, briefings, speeches and other credentials here.

For important information concerning this communication click here.  If you do not wish to receive these updates in the future, send an e-mail with the word “Remove” in the Subject to support@SolutionsLawyer.net.

©2009 Cynthia Marcotte Stamer.  All rights reserved. 


%d bloggers like this: