Two federal appellate-court decisions handed down in the past few weeks have generated much speculation about whether “medical necessity” determinations underlying Medicare or Medicaid claims can now be considered “objectively false” — despite conflicting medical-expert opinions — and actionable under the False Claims Act (FCA). The most recent opinion was issued on July 9, 2018, in United States ex rel. Polukoff v. St. Mark’s Hospital (“Polukoff”).  Polukoff involved two cardiac surgical procedures reimbursed by Medicare, each of which involved the closing of a hole between the two upper chambers of the heart.  In reversing the District Court below, the Tenth Circuit Court of Appeals in Polukoff, reading the FCA “broadly,” concluded that the procedures, challenged as medically unnecessary, can form the basis for FCA liability.  Similarly, on June 25, 2018, the Sixth Circuit Court of Appeals, in United States of America v. Paulus, sustained a jury verdict in a criminal action against a cardiologist for health care fraud and making false statements, for having billed Medicare also for allegedly medically unnecessary procedures — implanting stents — based on angiograms showing some blockage of patients’ coronary arteries.

The opinions in Polukoff and Paulus came down just as the Eleventh Circuit Court of Appeals is considering the appeal in United States of America v. GGNSC Admin. Servs., known as the AseraCare case.  AseraCare involved FCA claims for hospice care based on allegedly false certifications, completed by physicians, that the hospice patients had a life expectancy of six months or less.  In granting summary judgment dismissing the lawsuit, the District Court opined: “If the Court were to find that all the Government needed to prove falsity in a hospice provider case was one medical expert who reviewed the medical records and disagreed with the certifying physician, hospice providers would be subject to potential FCA liability any time the Government could find a medical expert who disagreed with the certifying physician’s clinical judgment.”

Some have questioned whether the lower court’s holding in AseraCare can be sustained on appeal if the Eleventh Circuit were to follow the precedents in Polukoff and Poulus.  Such a reading of those decisions, however, may be too broad-brush, by essentially treating all medical necessity determinations alike, for purposes of FCA liability, and equally vulnerable to challenge as “objectively false.” There are critical differences between the cardiology surgical procedures at issue in Polukoff and Poulus, on the one hand, and the certifications of hospice eligibility in AseraCare, on the other hand.  The latter each rest not only on a medical diagnosis, but on a physician’s prognostication that the patient will not live longer than six months.  Such a judgment is more inherently subjective in nature, requiring both a professional assessment of objective medical facts, concerning the patient’s diagnosis and condition, and a projection into the future of the likely course or progression of the underlying disease or condition.

Other “medical necessity” determinations, which call for forecasting the likely benefits of, for instance, rehabilitation therapy or other prescribed treatments over time, are similarly difficult to characterize as “objectively false” — without, of course, the benefit of hindsight.  Those types of medical judgments, in large part, involve making an educated guess, where medical experts can and often do differ, and can reach, in good faith, conflicting medical opinions.

On June 11, 2018, the United States Court of Appeals for the Sixth Circuit sustained a complaint against a home health care agency alleging that the agency had violated the False Claims Act (FCA) by submitting numerous claims to the Medicare program, even though the agency had not timely received the requisite physician certifications of the need for the services billed‑for. United States ex rel. Prather v. Brookdale Senior Communities, Inc., 892 F.3d 822 (6th Cir. 2018).

The Sixth Circuit concluded that the agency’s former employee, who filed the FCA action, had sufficiently alleged that (i) the timely submission of physician certifications was “material to the Government’s decision to make the payment,” and (ii) the defendants had knowledge—or at least acted with “reckless disregard”—that the Medicare claims may not comply with the applicable Medicare regulations governing payment. The FCA action was allowed to go forward on that basis alone, even though there was no allegation that the home care services were not medically necessary or were not provided, or that the home health agency had backdated certifications, submitted claims with unsigned certifications, or withheld any information from Medicare.

This case highlights the need for providers to implement robust compliance policies and procedures to ensure that mere technical violations of the regulations do not mature into full-blown FCA violations.

Click here to read more.

Earlier this month, the federal District Court for the Northern District of Illinois, in U.S. ex rel. Derrick v. Roche Diagnostics Corp., sustained a whistleblower, or qui tam, complaint under the False Claims Act filed by a discharged employee of a manufacturer of glucose-testing products, and brought against the manufacturer and a Medicare Advantage (managed care) plan, asserting violations of the anti-kickback statute. The whistleblower alleged that the manufacturer (Roche Diagnostics) had compromised an earlier claimed debt owed to it by the Medicare Advantage plan (Humana)  – the so-called “remuneration” or kickback – in exchange for being restored to the plan’s formularies for glucose-testing products covered by Medicare.

Significantly, Medicare paid the managed care plan a fixed, or capitated, monthly amount for all covered health and medical services provided or arranged for each plan enrollee, and no allegation was made that the alleged kickback arrangement with the manufacturer had increased costs to the Medicare program or resulted in the over-utilization of the blood-testing products at the expense of the program.  Rather, the whistleblower, or “relator,” essentially alleged that the claims for monthly capitation payments submitted by the Medicare Advantage plan “were tainted by the alleged fraud” associated with the arrangement.

Key Takeaways

  1. The court’s decision is a stark reminder that health care transactions in managed care programs under Medicare or Medicaid can present risks under the anti-kickback statute and False Claims Act, and the risks are not limited to alleged upcoding of risk-adjustment scores to secure higher capitation payments for the managed care plan.  Nor does an alleged kickback arrangement have to result in overutilization of services or increased costs to the Medicare or Medicaid programs – a scenario more typical in the traditional fee-for-service environment.  Rather, the alleged fraud can be premised on the allegation that the “kickback” unduly influenced or steered the managed care plan to select a particular manufacturer’s products or provider’s services covered by the plan’s capitation payments.  That same risk could arise in  the context of other “all-inclusive” pricing or bundled payment models, where the selection of a particular vendor or participating provider might be similarly tainted by an improper inducement.
  2. The managed care “safe harbor” under the anti-kickback statute, the court held, did not immunize the alleged kickback arrangement to secure the manufacturer’s products on the plan’s formularies. Extending the logic of that holding, the managed care safe harbor would not protect any other improper remuneration or kickbacks offered by providers seeking to participate in a managed care plan’s network, or by suppliers wishing to secure contracts to sell their products, utilized by plan enrollees.
  3. The forgiveness of debt from an earlier or unrelated transaction may be deemed a form of “remuneration”, as broadly defined under the anti-kickback statute to include anything of value. In this case, the managed care plan had actually disputed the manufacturer’s claim, and the manufacturer and the plan then engaged in negotiations to resolve the dispute – what the manufacturer characterized as “simply a routine, arms-length compromise involving a disputed  contractual obligation.”  Nevertheless, the court found the whistleblower’s allegation – that the manufacturer’s willingness to compromise the claimed debt was intended to induce the managed care plan to restore the manufacturer’s products on the plan’s formularies – was sufficient, as a matter of law, to allow the False Claims Act case to go forward into the discovery phase.
  4. The former employee’s claim of retaliatory discharge  under the False Claims Act, asserted against the manufacturer employer, was also sustained based on the asserted nexus – in this case, the coincidence of timing – between the employee’s raising concerns to her supervisors about a potential anti-kickback violation and her termination shortly afterwards.

In an important break with the majority of case precedents, the United States Court of Appeals for the Fifth Circuit, reversing the District Court below, held that a Medicare provider, facing a $7.6 million recoupment for alleged overpayments, can file suit in federal court and seek an injunction against ongoing recoupments, even though the provider had not yet fully exhausted its administrative remedies. Family Rehabilitation, Inc. v. Azar, U.S.C.A., 5th Cir. March 27, 2018. (“Family Rehab”).

The “exhaustion of administrative remedies” requirement — that a person or entity aggrieved by a governmental action cannot file a lawsuit challenging the action before completing all avenues for appeal before the governmental agency — is a bedrock principle of administrative law and a formidable barrier to accessing the courts. Last year, we posted an article about a federal district court’s decision in MedPro Health Providers, LLC v. Hargan (“MedPro”),  filed in the Northern District of Illinois, that addressed this principle in the context of a Medicare audit and recoupment.  In that case, like the Family Rehab case, a home care agency challenged the recoupment of alleged Medicare overpayments determined by an audit contractor for the federal Centers for Medicare and Medicaid Services (CMS), known as a “Zone Integrity Program Contractor” or ZPIC.  The Court in MedPro turned aside the home care agency’s lawsuit and request for injunctive relief, holding that the Court lacked jurisdiction until the provider had gone through and completed the prescribed four-step administrative-appeal process.

The home care agency in Family Rehab was also audited by a ZPIC and mired in the same, “byzantine” four-step administrative appeal process.  The “colossal backlog” of “thousands” of administrative appeals pending before CMS, and the associated delay, did not go unnoticed.  The Fifth Circuit observed that it would take, by the federal government’s own estimate, “at least another three to five years” before the appeals process would be completed.  (Emphasis in original.)  In the meantime, CMS had begun recouping the $7.6 million in alleged Medicare overpayments from the home care agency. The provider argued that absent a court-ordered stay, it might be forced to shut down its operations and file for bankruptcy.

The Fifth Circuit addressed three discrete exceptions recognized by the courts to the exhaustion of administrative remedies, or “channeling,” requirement, and determined that one of them, the “collateral claim” exception, applied in this case. Under the collateral-claim exception, a court can exercise jurisdiction before all administrative appeals have been exhausted if (i) the claims being raised in the lawsuit are “entirely collateral” to the underlying bases for the government agency’s action, and (ii) “full relief cannot be obtained at a post-deprivation hearing.” With regard to the first element, the Fifth Circuit noted that a court would not need to “immerse itself” in, or “wade through,” the patient eligibility certifications completed by the home care agency found deficient by the ZPIC, in order to resolve the home care agency’s legal claims of “procedural due process” and “ultra vires.” As the Fifth Circuit noted, “those claims only require the court to determine how much process is required under the Constitution and federal law before recoupment.” The appellate court further explained that “Family Rehab does not seek a determination that the recoupments are unlawful under the Medicare Act” and thus “raises claims unrelated to the merits of the recoupment.”

With regard to the second “irreparable injury” element to the collateral-claims exception, the Fifth Circuit pointed to the home care agency’s contention that it would be forced to go out of business and file for bankruptcy, which would “have detrimental effects on its employees and patients.” On those bases, the Fifth Circuit held that the court could exercise jurisdiction over the home care agency’s “collateral” procedural due process and ultra vires claims and, if warranted, grant an injunction against ongoing recoupments.

The Court of Appeals, however, rejected the other two exceptions to the exhaustion requirement advanced by the home care agency: (a) the alleged futility of the administrative appeals process; and (b) the court’s exercise of “mandamus” jurisdiction, premised on a request to compel a government officer to perform a non-discretionary duty.  Regarding “futility,” the Fifth Circuit noted that this exception is “narrow” and that delay alone, however substantial or prejudicial, is insufficient without also showing that administrative review was a “legal impossibility.” The Circuit Court also held that the home care agency had not specifically requested mandamus relief in its court complaint and, accordingly, rejected that alternative basis for court jurisdiction.

Key Takeaway:  At bottom, a Medicare or Medicaid provider — faced with a substantial recoupment and delay in CMS’ administrative appeals process — may be able to petition a court to stop ongoing recoupments if it can fashion credible, “collateral” claims, such as procedural due process and ultra vires, that do not call upon the court to assess the merits of the underlying overpayment findings still being addressed at the administrative level.

The U.S. Attorney for the Southern District of Florida recently intervened in a whistleblower lawsuit brought under the federal False Claims Act, alleging fraudulent billing by a pharmacy reimbursed by the federal government. (U.S. ex rel. Medrano v. Diabetic Care Rx, LLC, No. 15-cv-62617, S.D. Fla.)

What makes this case significant is that the U.S. Attorney has also named a private equity (PE) firm as a defendant. This attempted extension of False Claims Act liability to a PE firm should serve as a cautionary tale about the risks to private equity invested in the health care space, for a portfolio company’s management decisions and business operations implicating the fraud and abuse statutes applicable to the Medicare, Medicaid and TRICARE programs.

Read more.

On October 19, 2017, the United States District Court for the Northern District of Illinois, in the case of MedPro Health Providers, LLC v. Hargan, dismissed a home care agency’s suit — without deciding the merits of the agency’s challenge to a Medicare contractor’s determination to suspend the agency’s Medicare payments.  Noting that the delay in adjudication was “unfortunate,” the District Court nevertheless held that the home care agency had to exhaust its administrative remedies prior to filing suit.  The provider thus had to first let the administrative process play out to conclusion even while its Medicare payments were cut off and the alleged overpayments continued to be recouped.

Regulatory Background.  The Centers for Medicare & Medicaid Services (“CMS”) and its contractors may temporarily suspend Medicare reimbursement payments to providers for up to 180 days if they possess “reliable information that an overpayment exists” — even in the absence of any suspected fraud.  42 C.F.R. § 405.371(a)(1).  A provider has the right to submit to the Medicare contractor, a rebuttal statement explaining why the suspension should be lifted, and the contractor is required to review and consider the statement when determining if the suspension should continue.  Id. at 405.372(b)(2); 405.375(a).  If CMS or its contractor determines to continue the suspension, it must provide written notice to the provider.  Id. at 405.375(b)(2).  The suspension will not be rescinded until CMS or its contractor finally determines whether the provider was overpaid.  The suspended payments would then be released to the provider, less the amount of any overpayment.  Id. at 405.372(c)(1)(ii) and (e).  A provider may then appeal the subsequent overpayment determination through a four-part administrative process, and ultimately to the Medicare Appeals Council.  It is only after the four-step process has been exhausted and the Council had rendered its decision that CMS’ action can be challenged in court.  Id. at 405.904(a)(2); 405.1130.

Factual Background.  MedPro Health Provider (“MedPro”) is a home health agency authorized to provide services to Medicare beneficiaries.  AdvanceMed Corporation is a Zone Program Integrity Contractor (“ZPIC”) that has contracted with CMS to identify suspected cases of Medicare fraud and prevent the mistaken overpayment of Medicare funds to health care providers.  The ZPIC reviewed 32 MedPro patient charts in 2016 and notified MedPro that it was suspending future Medicare payments to the company on the grounds that its review revealed that MedPro had billed Medicare for services that were not medically reasonable or necessary.  MedPro provided the ZPIC with a rebuttal statement and supporting documentation but, as alleged in MedPro’s complaint, ZPIC determined to continue the suspension even though it admitted that it had not reviewed or considered the supporting documentation.

Shortly after the ZPIC’s suspension determination, MedPro filed a lawsuit in U.S. District Court against the Secretary of the U.S. Department of Health and Human Services and the ZPIC, alleging that the ZPIC’s refusal to review the supporting documentation violated regulations and effectively deprived MedPro of its right of administrative review.  For relief, MedPro asked the Court to compel CMS to immediately review its rebuttal statement and supporting documentation, and to declare that the ZPIC had committed fraud by representing that it would, and failing to, review such documentation as required.  The ZPIC moved to dismiss the complaint on the ground that MedPro had failed to exhaust administrative remedies.

After the suit was filed, the ZPIC terminated the payment suspensions and notified MedPro that it determined that MedPro had been overpaid by $6.9 million.

The Court’s Decision.  By decision dated October 19, 2017, the court granted the defendants’ motion to dismiss for lack of subject-matter jurisdiction.  The Court explained that MedPro could have raised the ZPIC’s failure to review the rebuttal submission as a ground for administrative appeal of the ZPIC’s overpayment determination.  The court acknowledged that the delayed review “and the resulting hardship” to MedPro resulting from having to wait until the ZPIC made its overpayment determination was “unfortunate.”  Nevertheless, the court concluded that MedPro was required to exhaust the administrative process before resorting to the courts, and that it lacked authority at that stage to compel the ZPIC to review MedPro’s rebuttal submission.

The court also determined that MedPro’s related fraud claim, premised on the ZPIC’s failure to review MedPro’s rebuttal submission, was “bound up with a claim for benefits under the [Medicare] Act . . . and a challenge to the ultimate overpayment determination.”  Accordingly, the court held that this claim too must be addressed through the administrative process and could not be adjudicated separately from the underlying reimbursement claim.

Implications.  This decision highlights the formidable hurdle that exhaustion of administrative remedies can present for a provider seeking relief from the court when operating under a suspension of Medicare payments.  The exhaustion requirement was enforced in this case even when the provider challenged the Medicare contractor’s compliance with the very procedures prescribed to ensure a meaningful administrative review.  Although a Medicare suspension of payments can cripple a health care provider, the immediacy of such harm does not excuse a provider from first following the prescribed administrative procedures to challenge the underlying overpayment determination.  It may be high time to consider the efficacy and fairness of the backlogged Medicare administrative appeal process that can often leave providers with no meaningful relief.

The New York State Office of Medicaid Inspector General (“OMIG”) on August 31, 2017 issued its first Compliance Alert this year: “Mandatory Compliance Programs’ Risk Assessments: Changes in Medicaid Reimbursement Systems.”  While sounding the alarm for providers, the alert is unfortunately a missed opportunity to offer providers more concrete compliance guidance, in that it does not identify the specific risk areas associated with the new and emerging payment models and particular steps providers should be taking to mitigate those risks.  Instead, OMIG leaves it to the providers, along with their compliance counsel, to sort out the issues themselves.

As OMIG notes, New York State’s Medicaid program, much like Medicare and other state Medicaid program initiatives, is moving away from fee-for-service reimbursement to “new payment methodologies, including capitation, risk-sharing arrangements, and value-based payments, among others.”  OMIG continues: “in a fee-for-service environment, a provider’s compliance program should be focused on whether a covered-medically necessary service was: delivered, correctly coded, billed accurately and timely, and met established quality of care standards.”  In light of the sea change in health care delivery and payment systems, OMIG cautions that, to comply with mandatory compliance-program requirements, providers should “closely review reimbursement methodologies so they can identify where they may need to update risk-assessment activities” – beyond billing and payment processes associated with fee-for-service – to include the “processes involved in the delivery of Medicaid reimbursable services.” Continue Reading OMIG Compliance Alert For New Value-Based Provider Reimbursement — Strong On Warning, Short On Guidance

Yes, you read the title of this post correctly.  Under the False Claims Act, a whistleblower is not required to report compliance concerns internally through a company’s internal reporting system before filing a “qui tam” court action.  Indeed, the False Claims Act — with its potential “bounty” of 15 to 30 percent of the government’s recovery — may actually encourage employees to file suit in the first instance, to qualify as an “original source,” and bypass the organization’s reporting system altogether, thereby frustrating a key component of an effective compliance program.  Whistleblower organizations have recently gone so far as to discourage individuals employed by health care providers from bringing compliance concerns directly to their employer so that they can get a share of the government’s recovery.

A provider or other entity participating in the Medicare or Medicaid programs, however, can mitigate that risk through, among other things, employee training and disciplinary policies encouraging good-faith reporting and the promotion of a culture of compliance, including setting the right “tone from the top.”

Internal Reporting System.  The cornerstone of any effective compliance program is developing and implementing a robust internal reporting system that employees can use to raise any compliance concerns on an anonymous basis.  Among other things, when compliance concerns are brought to the attention of the organization’s compliance personnel, the organization can investigate the issue and take appropriate steps to prevent or remediate any continued potential misconduct.  Likewise, having such a system in place may serve as a defense to liability under the False Claims Act.  Even if improper billing is found to have taken place, evidence that the organization has an effective, anonymous internal compliance reporting system may show that the improprieties were not the result of deliberate indifference or reckless disregard for such practices.

False Claims Act.  Plainly, the risk of treble damages and per claim penalties under the False Claims Act is a powerful incentive for a health care organization to implement an effective compliance program.  What is more, the provision for whistleblower awards under the False Claims Act can be an effective tool to aid the government in detecting and preventing overpayments by Medicare and Medicaid to fraudulent operators and other bad actors.  By allowing whistleblowers to file relator actions under seal and potentially share in any of the government’s recovery — as well as to seek damages for any retaliatory employment action — the False Claims incentivizes employees in the health care industry to come forward with information about fraudulent billing, without the fear of reprisal.

The Tension Between The Two.  At the same time, a whistleblower’s potential recovery can operate as a countervailing disincentive for an employee to report compliance concerns internally.  That is because under the False Claims Act, a qui tam relator is entitled to a “bounty” only if the individual is the “original source” of information to the government about the improper billing practices that are the subject of the relator’s action.  On the other hand, if an employee does dutifully report a compliance concern internally through the organization’s reporting system, and the organization itself reports any overpayments to the government or remediates the misconduct itself, the whistleblower may be unable to sue and recover any “bounty.”  As noted earlier, this point is not lost on the relator bar.

Overcoming The Tension.  How does a provider overcome the entreaties of the relator bar, along with the incentives under the False Claims Act whistleblower provisions, to convince employees with compliance concerns to avail themselves of the company’s internal reporting system?  At the outset, the reporting system must be both effective and credible to instill  confidence in the system so that employees will take full advantage of it – that is, the organization must deliver on its promise of anonymity and protection of good-faith reporting and must follow through on a timely basis with a thorough investigation and meaningful corrective action, if indicated.  Further, a robust reporting system, standing alone, will not be effective unless all other elements of an organization’s compliance program are working effectively as well, starting with a “culture of compliance,” reinforced by the executive team and management, and continuing with inservice compliance training, underscoring the importance of timely reporting and the anonymity and other protections afforded to reporting employees.

Likewise, the organization must have personnel and disciplinary policies that reward good-faith reporting and punish compliance lapses, both for engaging in unlawful conduct as well as for failing to report it.  That said, taking any disciplinary action against an employee who files suit as a relator, without ever having reported the compliance concerns in breach of the employee’s duties, is fraught with the risk that the termination or other action will be challenged as retaliation for filing the False Claims Act action, and that the cited ground — failing to report   — is allegedly merely pretextual.

However, with the proper messaging and training, coupled with a robust anonymous reporting system, the company can give its employees good reason to “do the right thing” and report compliance concerns to the company in the first instance, despite the lure of a False Claims Act bounty.

On June 22, 2017, the United States Court of Appeals for the Fifth Circuit, in Maxmed Healthcare, Inc. v. Price, upheld an administrative determination by a Medicare Administrative Contractor (MAC) based on an audit of a sample of 40 home care claims. From its sample findings, the MAC extrapolated to a universe of 130 claims and determined that the home care agency under audit had been overpaid almost $800,000 on the grounds that the sampled patients were not homebound or the services provided were not “medically necessary.” The Maxmed Court’s endorsement of sampling and extrapolation involving medical-necessity reviews may have broader implications for the use of that tool in False Claims Act (FCA) investigations and lawsuits.

Among other arguments, Maxmed Healthcare, the home care agency under audit, maintained that any overpayment based on lack of medical necessity “should only be determined after a review of each beneficiary’s specific claims, and it is fundamentally at odds with extrapolation concerning home health care claims.” Citing to the federal Centers for Medicare and Medicaid Services (CMS) Medicare Benefit Policy Manual and the Medicare Act, the Fifth Circuit held, to the contrary, that Congress and CMS contemplated the use of sampling and extrapolation in post-payment audits, where “there is a sustained or high level of payment error.”  Citing 42 U.S.C. § 1395ddd(f)(3)(A).

In defending against FCA actions premised on the alleged lack of medical necessity of services, providers have argued that disputes over medical necessity involve essentially subjective differences in medical opinion as opposed to the “objective falsity” of Medicare or Medicaid claims, and that a medical-necessity determination requires a particularized claim-by-claim review, specific to each patient, that does not allow for extrapolation to a universe of hundreds or thousands of other claims.  Those arguments may be more difficult to sustain under the Eleventh Circuit’s holding in Maxmed. To avoid the reach of Medmax, providers in FCA cases will likely try to distinguish the “garden variety” audit liability involved in Medmax from the liability imposed under the False Claims Act – with its per claim penalties and treble damages – premised as it is on a finding of falsity among other rigorous elements.

DOJOn May 31, 2017, the Department of Justice announced a $155 million settlement with eClincialWorks (ECW), an electronic health records (EHR) software vendor, to resolve a whistleblower complaint that alleged violations of the False Claims Act and the Anti-Kickback Statute.  This settlement, the “largest financial recovery in the history of the State of Vermont,” should put EHR vendors on notice, as well as vendors that offer services or products to health care providers: providing misinformation to a government contractor or health care provider about their products or services, or furnishing nonconforming goods or services, may expose them to significant financial exposure under the False Claims Act, even if they do not themselves submit claims to the government.

Background:  Pursuant to the Health Information Technology for Economic and Clinical Health Act (HITECH Act) of 2009, the United States Department of Health and Human Services (HHS) established a program to provide incentive payments to health care providers who demonstrated “meaningful use” of “certified” EHR technology.  The incentive payments are to encourage health care providers to transition to using EHR.  To obtain the proper certification, EHR vendors are required to affirm that their products meet certain requirements adopted by HHS and then pass certain tests by a certifying agency approved by HHS.

Allegations:  The lawsuit, in which the federal government intervened, alleged that ECW falsely attested that its products met the applicable certification criteria and prepared its software to pass the certification testing without actually meeting the certification criteria.  Significantly, ECW was alleged to have violated the False Claims Act because it had “caused” the end user health care providers to submit inaccurate attestations concerning their use of “certified” EHR in support of their claims to the government for “meaningful use” incentive payments.

Settlement:  ECW agreed to pay $155 million to settle the complaint and entered into an onerous, five-year Corporate Integrity Agreement (CIA).  In what the DOJ described as “innovative,” the CIA requires, among other things, that ECW (a) retain an Independent Software Quality Oversight Organization to assess ECW’s software quality control systems, (b) provide prompt notice to its customers of any safety related issues, (c) maintain on its customer portal a comprehensive list of issues and steps users should take to mitigate potential patient safety risks, (d) provide its customers with updated versions of their software free of charge, (e) offer customers the option to have ECW transfer their data to another EHR vendor without penalties or charges, and (f) retain an Independent Review Organization to review ECW’s arrangements with health care providers to ensure compliance with the Anti-Kickback Statute.

Implications:  EHR and other health care vendors cannot assume that their liability is limited to breach of contract or indemnification of its customers.  Rather, the ECW case points to the risk of direct exposure under the False Claims Act, without ever submitting a single claim to the government.  In a similar vein, in the context of the Health Insurance Portability and Accountability Act (HIPAA), software and other vendors may also be directly subject to penalties under HIPAA for breaches of protected health information – as a business associate to their health care provider customers.