Mar 92022

DOJ’s First “Cyber-Fraud” Settlement Targets Healthcare Provider

Jaime L.M. Jones and Brenna E. Jenny
,

Yesterday DOJ announced its first settlement under the Department’s new “Cyber-Fraud Initiative.”  This initiative, announced in October 2021, aims to “utilize the False Claims Act to pursue cybersecurity related fraud by government contractors and grant recipients.”  However, as discussed further here, in addition to targeting traditional government contractors, the initiative presents broader opportunities for DOJ to use the FCA to address data protection practices by healthcare providers.

The healthcare industry is consistently the recipient of disproportionate oversight under the FCA, and thus it is perhaps no surprise that DOJ’s first settlement under the Cyber-Fraud Initiative was with a healthcare provider.  As announced here, a healthcare provider furnishing medical services on air force bases paid $930,000 to resolve allegations that it “violated the False Claims Act by falsely representing to the State Department and the Air Force that it complied with contract requirements relating to the provision of medical services.”  The settlement also resolved allegations relating to controlled substances.

Aside from being the first Cyber-Fraud Initiative settlement, the resolution is also notable because it is based on a broad conception of cybersecurity; the alleged misconduct did not involve flaws with the cybersecurity system in place, but rather resulted from allegedly lax data protection practices through the defendant’s failure to “consistently store[] patients’ medical records on a secure [electronic medical record] EMR system.”  DOJ’s press release also never states that the defendant violated a particular contractual requirement involving data protection.  Instead, DOJ notes that the defendant “submitted claims to the State Department for the cost of a[n] [EMR] system to store all patients’ medical records” and then failed to consistently use the system for which they were billing the government.  Thus, the government seems to be proceeding on a theory that the claims submitted for the cost of the EMR system were false, because the defendant implied it was consistently using that EMR system when it was not.

This settlement demonstrates how DOJ may begin to creatively pursue FCA theories of liability against healthcare providers based on criticisms of their data protection practices, even when providers are under no specific contractual obligations—from federal healthcare programs or otherwise—relating to cybersecurity.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Jaime L.M. Jones

Chicago

jaimejones@sidley.com

Brenna E. Jenny

Washington, D.C.

bjenny@sidley.com

You might also like
DOJ Reaches Settlement with Provider Based on Chronic Care Management Coding

Recently, DOJ, the State of Florida, and the State of Minnesota reached a nearly $15 million FCA settlement to resolve allegations that a provider knowingly submitted claims for services related to the management of patients in assisted living facilities (“ALFs”), group homes, and memory care units that did not comply with applicable federal healthcare program (“FHCP”) requirements.  This settlement is one of the first FCA settlements involving chronic care management (“CCM”) codes.  See United States ex rel. Loscalzo v. Bluestone Physician Servs. of Florida, LLC, 2:20-cv-00295 (M.D. Fla).

DOJ Reaches Settlement with Nursing Home Provider Based on Alleged Abuse of COVID-19 Waiver

Last week, DOJ and the State of California reached a $7,084,000 settlement with a California-based nursing home chain and two executives for allegedly misusing a pandemic-era waiver program by routinely submitting claims to Medicare for nursing home residents that did not have a qualifying prior hospital stay.  This settlement is noteworthy because it is one of the first FCA settlements involving alleged abuse of this particular Centers for Medicare & Medicaid Services (“CMS”) COVID-19 waiver.  See United States and State of California ex rel. Bay Area Whistleblower Partners v. Renew Health Group, LLC, No. 2:20-cv-09472-CBM-AS (C.D. Cal. Oct. 14, 2020).

Court Finds That Qui Tam Relator Cannot Enforce 340B Program Statute

A recent decision from the Central District of California held that a qui tam relator cannot bring a False Claims Act (FCA) case against pharmaceutical manufacturers to enforce the 340B Drug Pricing Program’s (“340B Program”) statutory requirements.  See United States ex rel. Adventist Health System/West v. AbbVie, No. 21-cv-04249 (C.D. Cal. Mar. 18, 2024). The 340B Program is a federal program that requires pharmaceutical manufacturers to offer discounted prices, called a “ceiling price,” on applicable drugs to certain hospitals and clinics, referred to as 340B “covered entities.”  The relator, Adventist Health System/West, a covered entity under the 340B Program, alleged that the defendant pharmaceutical manufacturers failed to comply with the 340B Program’s requirements related to the “penny pricing” policy, which requires manufacturers to offer drugs at a penny if the ceiling price calculation results in a number at or less than a penny.