August 2, 2016

As reported in our 2015 Year-End Update, in recent years, both the Department of Justice ("DOJ") and the Department of Health and Human Services ("HHS") have demonstrated an increased commitment to holding providers accountable for fraud and abuse of the health care system; 2016 is no different.  So far this year, the DOJ and HHS have continued to find more ways to ensure compliance with the relevant health care laws and regulations, setting 2016 up to be another blockbuster year for enforcement. 

In this latest installment in our series of semiannual updates, we discuss regulatory and enforcement developments impacting health care providers.  We first address DOJ enforcement activity against health care providers, focusing on civil and criminal False Claims Act ("FCA") cases.  Next, we discuss notable HHS enforcement activity, followed by the most notable Anti-Kickback Statute ("AKS") and Stark Law developments from the first half of this year.  Finally, we turn to significant government health care program payment and reimbursement matters that have occurred during the last six months.  In addition to this Update, a collection of Gibson Dunn’s recent publications on health care issues impacting providers may be found on our website.

I.    DOJ Enforcement Activity

The DOJ has continued to make enforcement of health care laws and regulations a priority in 2016.  With both civil and criminal actions on the rise, the DOJ has signaled to the industry that the government remains dedicated to ensuring compliance.  We discuss these trends in DOJ enforcement more below.

            A.    False Claims Act

With a spate of enforcement activity and numerous large settlements already under its belt, the DOJ has continued to ramp up FCA enforcement in 2016.  A recent Supreme Court decision both narrowed and widened the scope of opportunities the DOJ has for FCA enforcement against health care providers.  All these developments, which we will discuss in greater detail below, indicate that FCA enforcement will continue to increase in the near term.  For more information on FCA enforcement in the initial half of 2016, including notable case law developments, please see our 2016 Mid-Year False Claims Act Update.

            1.    FCA Penalties

As explained in our 2016 Mid-Year False Claims Act Update, the DOJ recently took steps to comply with 2015 legislation requiring updates to statutory FCA penalties to account for inflation.  Because the DOJ last updated its penalties in 1999, the increase was predicted to be significant, but the eye-popping increase far surpasses the expectations of providers and their representatives.  According to the DOJ’s interim final rule published on June 30, 2016, minimum penalties will increase from $5,500 to $10,781 per alleged violation, and maximum penalties will go up from $11,000 to $21,563.[1]  These dramatic increases in penalties–which went into effect on August 1, 2016 for any violations occurring after November 2, 2015[2]–significantly raise the stakes for providers defending themselves against FCA allegations, and will no doubt have a substantial impact on the federal government’s future FCA recoveries.

            2.    FCA Recoveries from Providers

Health care providers have experienced a steady tide of enforcement activity by the DOJ and FCA whistleblowers (known as qui tam "relators") in recent years.  This year appears to be no different:  the government is on pace to resolve approximately the same number of FCA actions as it did in 2015.  To date, the government has announced 49 FCA settlements in 2016, compared to 57 settlements at this time last year.  The 2016 settlements to date cover a range of types of providers–and a range of alleged misconduct.  But, as expected based on recent trends, the settlements this year reflect clusters of actions involving hospital providers and medical necessity claims, as the graphs below illustrate.[3]

Number of FCA Settlements with Providers, by Provider Type:

Number of FCA Settlements with Providers, by Allegation Type: 

As is generally the case, settlements where the primary allegation relates to medical necessity far outnumber any other category of allegations.  A number of those settlements to date relate to the government’s nationwide review of implantable cardioverter defibrillator ("ICD") reimbursement.  As we noted in our 2015 Year-End Update, the government announced the first 70 settlements resulting from that review (covering more than 450 different hospitals) in October 2015.[4]  At the time, the DOJ stated that it was "continuing to investigate additional hospitals and health systems."[5]  In February 2016, the government announced an additional 11 settlements, involving another 51 hospitals, for more than $23 million.[6]  The February settlements bring the total government recoveries in the ICD investigation to more than $280 million collected from more than 80 defendants representing more than 500 hospitals.[7]   

According to the DOJ, these additional resolutions cap this nearly decade-long, nationwide investigation.[8]  The wide-ranging investigation is particularly notable because its origins trace not to insider knowledge, but to data mining:  the relators–a former cardiac nurse turned compliance consultant and a health care reimbursement analyst–analyzed Medicare claims data and allegedly found technical noncompliance with the restrictions on ICD procedures set out in national coverage determinations.[9]  These settlements underscore that data mining may allow the government, potential whistleblowers, and providers themselves (as part of their compliance programs) to evaluate key reimbursement data points and trends. 

Another major development in the first half of 2016 was the RehabCare settlement in January, which netted the federal government a total of $133 million,[10] the largest sum recovered from a provider thus far this year.  That investigation began with a qui tam suit brought by two former therapists; the government ultimately alleged that the therapy provider had failed to provide care consistent with patients’ needs, focusing instead on maximizing reimbursement.[11]  As it has in other recent cases against skilled nursing facility networks, the DOJ alleged that the company provided medically unnecessary therapy (including after therapists had recommended discharge), billed for services that were not actually provided or could not possibly have benefited the patient, and manipulated therapy plans to maximize reimbursement levels.[12] 

Allegations resting primarily on claims that services were never provided at all represented the next highest number of settlements to date this year.  This development is somewhat unusual; in recent years, AKS and Stark Law allegations have both outpaced failure to provide services allegations (although of course there is still time for those settlements to reclaim their top ranking before the year’s end).  The total number of settlements in the first half of 2016 for failing to provide services is remarkable, and has already reached approximately the same level as in each of the years 2014 and 2015.

• The largest settlement in this category so far this year is a $5.25 million settlement with a physician, Dr. Labib Riachi, and two companies he owns and operates.[13]  According to the allegations, Dr. Riachi and his companies routinely submitted reimbursement claims for diagnostic tests even though most of those tests were never performed.  The settlement also resolved secondary allegations relating to the submission of claims for reimbursement for physical therapy services that were provided by unqualified individuals. 

            B.    FCA-Related Case Law Developments

The first half of 2016 has seen several significant developments in cases that are testing civil FCA liability standards.  These developments have the potential to reshape government, relator, and defense strategies in ongoing and future FCA matters.

            1.    Supreme Court Recognizes Implied Certification Theory

One of the most hotly contested issues in recent FCA litigation is the viability and scope of the "implied certification" theory of falsity under the FCA.  Relying on this theory, the government and relators often have alleged that an entity’s submission of a claim for reimbursement from the government means that the entity has impliedly certified that it has complied with conditions of payment found in statutes, regulations, and contracts governing participation in government programs.  This issue is especially important for health care providers, which face the difficult task of monitoring compliance with the many complex regulations and contractual provisions that govern participation in Medicare and Medicaid.

In United States ex rel. Escobar v. Universal Health Services, Inc., the First Circuit concluded that a medical provider’s alleged violations of state medical licensing and supervision regulations could serve as the basis for FCA liability.[14]  The Supreme Court granted certiorari in Escobar, identifying two questions for review:

1. Whether the implied certification theory of legal falsity under the FCA is viable; and
2. If the theory is viable, whether a government contractor’s reimbursement claim can be "false" under that theory if the provider failed to comply with a statute, regulation, or contractual provision that does not state that it is a condition of payment, or whether liability requires that the statute, regulation, or contractual provision expressly states that it is a condition of payment.[15]

In its June opinion, the Supreme Court concluded that the "implied certification theory" is actionable in FCA litigation, at least (but perhaps only) where there has been an express statement on a claim for payment that is rendered false by the "omission" of a disclosure regarding a violation of a law, rule, or regulation.[16]  The Court also held that only "material" omissions are actionable and elaborated on the FCA’s "rigorous" and "demanding" materiality requirement.[17]  

The Court stressed the importance of the materiality requirement in evaluating such claims and provided a helpful discussion of the kinds of evidence that are relevant to the materiality element.[18]  For example, the Court explained that courts should consider the knowledge of both the defendant and the government as to the government’s decision to make payments (or not), despite the fact that a defendant failed to comply with regulatory, statutory, or contractual provisions.[19]  The Court also instructed that "whether a provision is labeled a condition of payment is relevant to but not dispositive of the materiality inquiry."[20]  Thus, a particular requirement’s designation as a "condition of payment" does not necessarily make a misrepresentation of compliance with that requirement material.  But even if a particular requirement is not explicitly a "condition of payment," it may be material. 

Critically, however, the Court left unanswered the question of whether a claim alone, absent any associated specific representation, is itself an implied representation that the submitter is legally entitled to payment, a representation that perhaps could be rendered materially misleading because of an omission.  In the months and years to come, the lower courts will surely wrestle with both the new materiality standard under Escobar and the key question the Court left open.  We will continue to monitor case developments in this area, as it has the potential to alter the landscape of FCA litigation for our clients.

            2.    Proving Falsity with Medical Experts

As was the case in 2015, United States ex rel. Paradies v. AseraCare, Inc. has been one of the most closely watched FCA cases of 2016.  In this case, relators and the DOJ alleged that AseraCare overbilled Medicare for hospice services through a scheme that involved hiding information from physicians in order to obtain certifications of hospice eligibility for their patients.  By way of background, the U.S. District Court for the Northern District of Alabama took the unusual step of bifurcating the trial into two phases:  the first phase would address whether the defendant submitted false claims, and, if necessary, the second would address whether the defendant did so knowingly.[21] 

During the first stage of the trial, the government presented a medical expert’s opinion as evidence of falsity.  After a ten-week trial and nine days of deliberation, the jury sided with the government and found that the claims were false.  After the verdict, however, the court acknowledged that it "misstepped" by failing to advise the jury that the FCA requires objective proof of falsehood and that "a mere difference of opinion, without more, is not enough to show falsity."[22]  The court ordered a new trial to correct the prejudicial impact of its original instructions and then decided, sua sponte, to reconsider whether summary judgment on the issue of falsity would be appropriate.[23]

In an order issued on March 31, 2016, the court granted AseraCare’s motion for summary judgment on the ground that the government had not proven that any claim was false.  As the court explained, the case "boils down to conflicting views of physicians about whether the medical records support AseraCare’s certifications that the patients at issue were eligible for hospice care."  The court credited the treating physicians who had originated the medical records, finding their opinion about the necessity of the care relevant to whether there was an "objective falsehood" in the certifications of medical necessity.  The court then reasoned that "[w]hen hospice certifying physicians and medical experts look at the very same medical records and disagree about whether the medical reports support hospice eligibility, the opinion of one medical expert alone cannot prove falsity without further evidence of an objective falsehood."[24]

In late May, the DOJ noticed an appeal to the Eleventh Circuit of the court’s summary judgment order, as well as the earlier orders bifurcating the trial and granting a new trial after the jury verdict.[25]  We will follow this appeal closely; the Eleventh Circuit’s analysis may have a powerful impact on FCA cases nationwide.

            3.    Statistical Sampling

The past few years have seen a troubling trend:  FCA plaintiffs increasingly offer statistical sampling (rather than individualized proof) to establish falsity in health care fraud cases.  Battles on this front continued in 2016, beginning with an appeal to the Fourth Circuit in United States ex rel. Michaels v. Agape Senior Community, Inc.  There, the district court denied defendant’s motion to enforce a settlement agreement with relators over the government’s objections, and then sua sponte certified its order for appellate review because it was "faced  with a unique dilemma:  The government, claiming an unreviewable veto right over the tentative settlement in this case, objects to a settlement in a case to which it is not a party, using as a basis of its objection some form of statistical sampling that this court has rejected for use at the trial of the case."[26]

In its March 2016 brief to the Fourth Circuit, the DOJ urged the court to hold that it has unreviewable veto power over settlements, which would obviate the need to "reach any of the other issues raised in this interlocutory appeal[,]" such as the use of statistical sampling.[27]  But the DOJ argued nevertheless that "statistically-valid random sampling is a well-accepted method of establishing liability and damages in a variety of contexts" and is "an especially effective and indispensable tool in [FCA] cases where the scope of the defendant’s fraud makes claim-by-claim review impracticable."[28]  It is unclear whether the court will reach the statistical sampling issue, and it may do so even if it concludes that the government has an unreviewable veto authority over settlements.  If the Fourth Circuit does reach the issue, it will be the first appeals court to weigh in on the question of the validity of statistical sampling in the FCA context. 

In the meantime, lower courts continue to wrestle with these issues.  For example, in United States ex rel. Wall v. Vista Hospice Care, Inc., the district court rejected the relator’s effort to use sampling and extrapolation to prove damages and liability.  In this case, the relator alleged, among other things, that defendants caused patients to be improperly certified as eligible for the Medicare hospice benefit and then submitted claims for ineligible patients.[29]  The court concluded that the statistical sampling at issue "cannot establish liability for fraud in submitting claims for ineligible patients, as the underlying determination of eligibility for hospice is inherently subjective, patient-specific, and dependent on the judgment of involved physicians."[30]  Although no circuit court has resolved whether sampling and extrapolation can be used to establish liability in an FCA case where falsity depends on individual physicians’ judgment, the court found the Agape district court’s analysis persuasive.  The court also noted that the Supreme Court and Fifth Circuit have "made clear that sampling and extrapolation cannot always be used to prove liability[.]"[31]  Instead, courts must "engage in a particularized analysis of [] whether extrapolation from a particular data set can reliably prove the elements of the specific claim."[32]

Notably, Vista Hospice is the first FCA case to discuss statistical sampling after the Supreme Court’s decision in Tyson Foods v. Bouaphakeo.  Although some observers may have expected Tyson Foods to provide a basis to approve statistical sampling in the FCA context, the court in Vista Hospice relied on the Supreme Court’s statement that permissibility of statistical sampling "turns on ‘the degree to which the evidence is reliable in proving or disproving the elements of the relevant cause of action.’"[33]  Because of the idiosyncrasies of medical judgment as to particular patients, the Vista Hospice court determined that statistical sampling is not reliable in proving the elements of an FCA cause of action.

The government has long argued, as it did in Agape, that statistical sampling is necessary because of the difficulty of proving fraud involving myriad claims.  But AseraCare and Vista Hospice reveal a critical flaw in that argument:  oftentimes the government’s theory of fraud against providers is based on claim-specific analyses that are fact-intensive and that may cause reasonable clinicians to disagree.  In Agape and AseraCare, the appellate courts will have a chance to weigh in on the viability of that approach in cases purportedly premised on theories of objective falsity.

            C.    Criminal Prosecutions

Late last year, the DOJ’s new policy memorandum regarding cooperation by business organizations and efforts to pursue criminal and civil cases against individual employees responsible for corporate misconduct–known as the "Yates Memorandum"–dominated the news.[34]     

This year, the DOJ has begun to implement the Yates Memorandum’s directives, but it is difficult to discern (thus far) any specific impact on criminal prosecutions.  We have, however, already seen some enhanced efforts to ensure corporate cooperation, as reflected in corporate settlements that specifically refer to cooperation against individuals engaged in misconduct.

The DOJ and the Department of Health and Human Services, Office of Inspector General ("HHS OIG"), are not, of course, dependent on corporate cooperation pursuant to the Yates Memorandum’s standards to target individuals.  Indeed, criminal enforcement efforts against individuals entirely independent of alleged civil or criminal corporate wrongdoing have increased in the first half of 2016.  Most notably, in June, the DOJ and HHS OIG announced an unprecedented takedown led by the Medicare Fraud Strike Force, which resulted in civil and criminal charges against 301 individuals in 36 federal districts.[35]  The DOJ estimated that the various fraud schemes resulted in approximately $900 million in false billings, making this the largest coordinated takedown effort in history, both in terms of the number of individuals wrapped up in it and the dollar value of the alleged fraud.[36]  Indeed, the scope of this takedown far exceeded last year’s record-setting takedown of 243 individuals for fraud scheme allegations involving $712 million.[37]  Of the 301 individuals ensnared in this year’s takedown, 61 were doctors, nurses, and other licensed medical professionals.

The DOJ announced another record-setting criminal indictment on July 22, which was remarkable not for its breadth but for the dollar value of the alleged fraud.  The DOJ has charged three individuals–Philip Esformes, Odette Barcha, and Arnaldo Carmouze–for their alleged involvement in a $1 billion fraud and money laundering scheme.[38]  According to the government’s allegations, the scheme involved the provision of medically unnecessary services provided at a network of skilled nursing and assisted living facilities operated by Mr. Esformes, and receiving kickbacks for referring these same patients to other health care providers where patients received further medically unnecessary treatment.  Mr. Esformes and Ms. Barcha were also charged with obstructing justice.  The alleged scheme was uncovered through sophisticated data analysis and forensic accounting techniques.  This indictment is particularly noteworthy as it relates to Mr. Esformes, who–if the allegations prove to be accurate–apparently did not learn his lesson after he paid $15.4 million in 2006 to resolve civil FCA claims for engaging in the same conduct.

II.    HHS Enforcement Activity

            A.    HHS OIG Activity

            1.    Developments and Trends in 2016

At the close of Fiscal Year 2015, HHS OIG reported $3.35 billion in expected recoveries from its investigative and audit programs.[39]  This represents a decrease from recent years, but reflects just how astronomical OIG’s recoveries have been.[40]  Yet 2016 may well prove 2015 to be the anomaly, as HHS OIG’s investigative receivables in just the first half of Fiscal Year 2016 have already matched the $2.2 billion total investigative receivables from the full 2015 Fiscal Year.[41]  In total, HHS OIG reported expected recoveries of more than $2.77 billion from just the first half of Fiscal Year 2016, putting the agency on track to meet or exceed $5 billion over the course of the year, as it did in Fiscal Years 2013 and 2014.

Through the first half of Fiscal Year 2016, HHS OIG also has reported 428 criminal actions, trending slightly below last year’s 925 total criminal actions, while the 383 civil actions initiated, including False Claims Act suits, civil monetary penalty ("CMP") settlements, and administrative recoveries, reflect what may turn out to be an uptick from last year’s record total of 682.[42]

                        a)    HHS OIG’s New Litigation Team

Last June, HHS OIG announced the creation of a new affirmative litigation team focused on CMP and exclusion cases.[43]  The agency’s commitment of additional resources to support and expand its enforcement work has reportedly yielded immediate payoffs.  Principal Deputy Inspector General Joanne Chiedi reported in June that the team of about ten to twelve attorneys generated $40 million in recoveries over the first five months of Fiscal Year 2016.[44]  Ms. Chiedi expressed an interest in growing the litigation team as part of an effort to fill enforcement gaps, particularly in cases involving smaller payments.  Enforcement of Corporate Integrity Agreements ("CIAs")–agreements reached to ensure providers’ compliance with Medicare rules and regulations–has also been a key aspect of the litigation team’s work.

                        b)    Guidance on Exclusions

In an apparent effort to improve transparency and reduce unpredictability connected with the exercise of HHS OIG’s exclusion authority, HHS OIG released in April a revised policy statement setting out criteria for HHS OIG’s exercise of its permissive power to exclude providers.[45]  The revised guidance focuses on HHS OIG’s assessment of the future risk to federal health care programs posed by the individual or entity in question.  In evaluating the risk posed, HHS OIG announced that it will review factors loosely grouped into four categories:  (1) nature and circumstances of the conduct at issue; (2) conduct during any investigation; (3) the existence and nature of any significant ameliorative efforts; and (4) the individual or entity’s history of compliance.[46] 

Among the factors that reflect a higher risk of future harm to federal health care programs are:  conduct that causes or has the potential to cause adverse impact on beneficiaries or other patients; greater amounts of loss; repeated or long-term conduct; concealment of the conduct or obstruction of any investigation, or failure to comply with a subpoena within a reasonable period of time; a criminal resolution (including deferred prosecution agreements and non-prosecution agreements); and the absence of a compliance program that incorporates the U.S. Sentencing Commission Guidelines Manual’s seven elements of an effective compliance program.[47]

By contrast, other factors indicate lower risks, including:  the initiation of an internal investigation before learning of the government’s investigation; self-disclosure of conduct as a result of internal investigation; cooperation with the government, particularly where it results in criminal, civil, or administrative action against other individuals or entities; devotion of significant additional resources to compliance; and a history of significant self-disclosures in good-faith to HHS OIG, Centers for Medicare & Medicaid Services ("CMS"), and related agencies.[48]

In the guidance, HHS OIG counsels that the risk assessment is not affected by the lack of patient harm or the absence of criminal sanctions.[49]  Further, prompt compliance with subpoenas and the existence of a compliance program that incorporates the Sentencing Commission Manual’s seven elements of an effective compliance program are expected, and will not affect the risk assessment.[50] 

                        c)    Notable Reports and Reviews

HHS OIG has focused recently on fraud connected with hospice care, and a report released in March 2016 showed why that has been the case.  In the wake of several major fraud cases between 2011 and 2014 alleging misuse of hospice general inpatient care ("GIP"), HHS OIG launched a comprehensive review to determine the amount of improper GIP billing.[51]  The agency reviewed a random sample of 565 GIP stays in 2012, and concluded that 20% of GIP stays were unnecessary for the entire period of the stay and an additional 10% were only partially necessary.[52]  HHS OIG found that there was no evidence that the beneficiary had elected hospital care–or even had a terminal illness–in 1% of cases.[53]  This amounted to $268 million in improper billing for GIP stays in 2012 alone.[54] 

According to HHS OIG, hospices should instead have been billing for routine home care, which would have yielded a reimbursement of just $151 per day–compared to $672 per day for GIP.[55]  For-profit hospices were behind many of the improperly billed GIP stays, as 41% of their GIP stays were deemed inappropriate.[56]  HHS OIG singled out Florida as a particularly problematic source of GIP billing: more than half of its 99 reviewed stays were determined to be inappropriate.[57] 

Beyond inappropriate billing, HHS OIG found that care planning was deficient in 85% of the reviewed GIP stays, while 9% of stays did not provide sufficient nursing, physician, or medical social services for beneficiaries.[58]  The HHS OIG report also observed numerous instances in which Medicare Part D paid for drugs already covered as part of the daily rate paid to hospices under Medicare Part A.[59]  At the conclusion of its report, HHS OIG recommended that CMS increase its oversight of hospice GIP claims, increase state surveyors’ efforts to monitor hospices, and establish remedies other than termination from the Medicare program to address hospice performance problems.[60]  Providers of hospice care should anticipate increased scrutiny from HHS OIG and CMS in the coming months.

The agency’s work for the year is far from over.  In its Work Plan Mid-Year Update, released in April, the agency added a number of new reviews to its task list for the year.[61]  The new reviews include:  an analysis of potential Medicare savings from elimination of outlier payments for hospital outpatient stays; a review of potential fraud indicators associated with home health care; and a statistical analysis of the outcomes and effectiveness of state Medicaid Fraud Control Units.[62]  Reviews first announced in October that are still scheduled to be released during this Fiscal Year include the evaluation of CMS’s use and validation of hospital-submitted quality reporting data and a review of payments received by hospitals for replacement of implanted medical devices.[63]

            2.    Significant HHS OIG Enforcement Activity

Aggressive enforcement has been the story of 2016 for HHS OIG as the agency is on pace to surpass last year’s totals in almost every area of enforcement–including total exclusions, total CMPs assessed, and dollars received from CMPs.  The agency remains particularly attentive to instances of false and fraudulent billing, and continues to focus on home health agencies and emergency ambulance services. 

                        a)    Exclusions

Perhaps the most potent enforcement penalty in HHS OIG’s arsenal is exclusion.  This penalty, when imposed, prevents an individual or entity from receiving payment from any federal health care program for items or services rendered.  It must be imposed upon any entity or individual engaged in a patient abuse-related crime, felony health care fraud, or the use, manufacture, distribution, or prescription of controlled substances;[64] HHS OIG has discretion to impose the penalty in cases of fraudulent conduct, in cases involving the submission of claims for unnecessary treatments or procedures, and in connection with a license suspension or CIA.[65] 

HHS OIG reported a record number of exclusions in Fiscal Year 2015, with 4,112 entities and individuals excluded.[66]  Since the close of Fiscal Year 2015, HHS OIG has excluded 2,849 individuals and entities over nine months.[67]  The exclusions since the start of the calendar year include 31 entities (on par to match last year’s total), with home health agencies accounting for six exclusions, and pharmacies and clinics each accounting for four exclusions.[68]  Among excluded individuals, 171 have been identified as business owners or executives.[69]  Home health agencies continue to be a focus; after accounting for 25% of the executives excluded in Fiscal Year 2015, they are again leading the exclusions list in 2016, with 28 exclusions already this year.[70]

                        b)    Civil Monetary Penalties

Last year, HHS OIG assessed approximately $39 million in penalties against 54 individuals and entities.  This year, the agency is on pace to dramatically increase the number of penalties assessed and to exceed the dollar figure recovered last year.  HHS OIG has announced 73 CMPs as a result of settlement agreements and self-disclosures and has recovered nearly $30 million.[71]  The increase in penalty actions likely reflects the work of the new litigation team, which has declared its intent to expand enforcement to cases involving lower amounts than would be sufficient to attract the DOJ’s attention.  Meanwhile, the year-to-date’s largest penalties have come in cases of self-disclosure.[72]

As in past years, HHS OIG has routinely pursued CMPs where entities employ individuals that the entities know or should have known were excluded from federal health care programs.  These cases account for 32 of the 73 CMPs assessed this year, amounting to nearly $5 million in penalties.[73]  False and fraudulent billing and improper claims for payment continue to be another leading reason for the assessment of CMPs; these cases account for 30 of the announced CMPs thus far in 2016 and $20.7 million in penalties.[74]  A key focus of HHS OIG in this area (specifically, eight of eleven cases that did not stem from a self-disclosure) has been the improper submission of claims for emergency ambulance transportation to destinations such as skilled nursing facilities and patient residences; these claims should have been billed at the lower non-emergency rate.[75]  Penalties also have been assessed for violations of the Emergency Medical Treatment and Labor Act ("EMTALA"), the AKS, the Stark Law’s physician self-referral prohibitions, and drug price reporting requirements.[76]

The largest CMPs assessed against providers this year are summarized below:

• Lancaster Healthcare Center:  After self-disclosing certain conduct, Lancaster agreed to the year’s highest penalty thus far, paying $8.6 million to resolve allegations related to improper billing and anti-kickback violations.[77]  HHS OIG alleged that the entity submitted claims for services without proper certifications and clinical records, and that it paid a physician for referrals pursuant to a medical director agreement.[78]
• Decatur County Memorial Hospital:  Like Lancaster, Decatur self-disclosed conduct and then agreed to pay $3.76 million to resolve claims related to improper billing for home health care.[79]  HHS OIG identified five major deficiencies in Decatur’s patient files, including missing or incomplete documentation, unsigned and undated physicians’ orders, and inadequate justification for Medicare home health eligibility.[80]
• Lahey Health System, Inc.:  Lahey, too, self-disclosed purported violations of physician self-referral and anti-kickback provisions and agreed to pay $1.92 million to settle allegations that it received remuneration from home health agencies.[81]  The remuneration allegedly took the form of discharge planning and administrative services.  Ordinarily, these functions would have been performed by Lahey Clinic Hospital staff, but HHS OIG alleged that they were instead performed by staff from the home health agencies.[82]

                        c)    Corporate Integrity Agreements

The first half of 2016 has seen 13 CIAs take effect, primarily in connection with other enforcement penalties.[83]  For example, in January, contract therapy providers RehabCare Group Inc., RehabCare Group East Inc., and their parent company Kindred Healthcare, Inc. agreed to a five-year CIA in connection with a $125 million settlement of allegations that the providers billed for unreasonable and unnecessary rehabilitation services.[84] 

CIAs can come in actions of all shapes and sizes.  For example, Toccoa Clinic Medical Associates, a dermatology clinic, agreed to a five-year CIA in connection with a $1.9 million settlement of allegations that the company and two of its doctors billed Medicare for impermissible evaluation and management services.[85]

As recent actions demonstrate, HHS OIG is serious about compliance with CIAs.  In February, John Sunghoon Won, D.D.S., M.D., was assessed a $10,000 penalty for failure to comply with multiple CIA requirements, including prominent posting of the telephone number for HHS OIG’s Fraud Hotline, timely submission of implementation reports, and employee screening and training.[86]  Also in February, Advanced Cardiology Care was assessed a $2,800 penalty for late submission of its CIA-mandated annual report.[87]

            B.    CMS Activity

In addition to CMS’s work to develop quality-of-care initiatives and to improve the payment process for providers–discussed in Part V–CMS has continued to play a critical role in enforcement of anti-fraud initiatives, as discussed below. 

            1.    New Rule Regarding Provider Enrollment Fraud Prevention

This spring, CMS proposed a new rule that would enhance fraud controls connected with the provider enrollment process.  The new rule targets providers who seek to evade previous exclusions or other sanctions imposed on them by enrolling under new names or through new provider arrangements.[88]  Under the new rule, enrolling providers would be required to disclose any affiliation with individuals or entities that owe uncollected debt to federal health care programs, that have been suspended or are subject to HHS OIG exclusion, or that have had their enrollment denied or revoked.[89]  A provider’s enrollment could be denied or revoked if CMS determines that the affiliation poses an undue risk of fraud.[90]  Other provisions would increase that maximum enrollment bar from three years to ten years and enable CMS to add three years to the re-enrollment bar for attempts to re-enroll under a different name.[91]  Finally, CMS would be permitted to revoke enrollment for a pattern of abusive ordering, certification, or prescription of Medicare Part A or B services or drugs.[92]  The rule was proposed on March 1; 56 comments were received before the comments period closed.[93]  

            2.    Data Transparency and Accessibility

Improving access to data related to the use of Medicare and Medicaid services has been a primary focus of CMS over the past few years, and the first half of 2016 suggests that this will continue. 

In January, CMS proposed rules that would enable certain entities to sell analyses of Medicare and private sector claims data to providers and other interested groups.[94]  The Patient Protection and Affordable Care Act ("PPACA") created the "qualified entity program," which grants organizations that meet certain criteria access to patient-protected Medicare data for the purpose of combining Medicare data with private payer data and generating performance analyses.[95]  Under existing rules, the analyses had to be released as public reports.  CMS’s proposed rules would permit qualified entities to produce nonpublic reports, as well as the claims data, to be shared or sold to providers and others who might use the analyses to improve care.[96]  The rule, of course, incorporates strict privacy and security requirements for both qualified entities and providers receiving the analyses and data.[97]  Thus far, 13 organizations have been approved as qualified entities under the existing system.[98]

In March, CMS released utilization and payment data for skilled nursing facilities.  The Skilled Nursing Facility Utilization and Payment Public Use File includes information on over 15,000 skilled nursing facilities, accounting for $27 billion in Medicare payments in 2013.[99]  In addition to data on payments made to providers and services charged, the data set released by CMS provides detailed information on therapy provided to "Ultra-High" rehabilitation resource utilization groups and "Very High" rehabilitation resource utilization groups.[100]  These codes are applied to patients who must receive a significant amount of therapy (resulting in substantially higher reimbursement rates).  The data indicates that the amount of therapy provided to patients in these groups is very close to the minimum necessary to qualify for these levels of reimbursement.[101]  CMS is particularly attentive to these patient groups because the difference in reimbursement between patients in these groups and patients provided with fewer minutes of therapy can be as much as 25%.[102]    

            3.    Moratoria

The PPACA authorizes CMS to impose moratoria on certain geographic areas, blocking any new provider enrollments within regions designated as a "hot spot" for fraud.[103]  The moratoria are imposed after consultation with the DOJ and HHS OIG and reviewed every six months to assess whether they remain necessary.

To date, CMS has exercised its moratorium power in two fields:  home health programs and ground ambulance services.  Home health programs were first blocked in Chicago and Miami in 2013, with Fort Lauderdale, Detroit, Dallas, and Houston added in 2014.[104]  In 2013, CMS also established a moratorium on ground ambulance services in Houston, before adding Philadelphia in 2014.[105]  After twice extending the moratoria in 2015, CMS again announced in February 2016 that it would extend all existing moratoria.  The agency reported that "a significant potential for fraud, waste, and abuse continues to exist in these geographic areas."[106]

Less than a month after extending the moratoria, CMS announced the creation of a Moratoria Provider and Supplier Services Utilization Data Tool.  The tool includes interactive maps and data that show the number of Medicare ambulance services and home health providers in all 50 states and the District of Columbia.[107]  The interactive maps reflect data at the national, state and county level, and use color coding to show whether the selected geographic region is in the lowest to highest quartiles, and showing extreme value areas.[108]  The maps show the saturation of providers in areas subject to moratoria, and may reflect areas at risk of imposition of future moratoria.

For example, the map reflecting the number of ambulance providers nationwide shows both Texas and Pennsylvania among the states with "extreme values."  Dallas and Philadelphia are both subject to moratoria on new enrollments of ground ambulance service providers.[109]  A similar map for home health providers shows Florida, Michigan, and Texas as states with "extreme values"–all states where cities subject to home health moratoria are found.[110]  These maps suggest that metropolitan areas in Illinois, Ohio, and California could be at risk of future moratoria, as CMS will undoubtedly continue to review this data to identify high-risk areas for fraud and abuse at both the state and county levels.

            C.    OCR and HIPAA Enforcement

In October 2015, HHS’s Office of Civil Rights ("OCR") reported that it had reviewed and resolved more than 115,000 Health Information Portability and Accountability Act ("HIPAA") complaints since compliance rules took effect in 2003.[111]  In May 2016, OCR reported that the number now totals over 128,000–a sizeable increase in just six months’ time.[112]  OCR indicated that it reached nine new settlements since its October 2015 report, amounting to $13 million in fines.[113]  With the recent issues surrounding cybersecurity and high-profile patient data breaches, protection of patients’ confidential information has been a priority for HHS, and providers should expect HIPAA scrutiny to only increase in 2016 and beyond.

            1.    Developments and Trends in 2016

One of the key lessons from the first half of 2016 is that OCR is no longer the only name in HIPAA enforcement.  To the contrary, HIPAA enforcement has become a key focus of a wide variety of agencies and entities.

The Federal Trade Commission ("FTC") is keenly interested in HIPAA compliance, particularly in connection with the proliferation of mobile health apps.  In April, the FTC announced the creation of a web-based tool that uses a series of high-level questions to identify federal laws or regulations (including HIPAA) that may apply to the app.[114]  The guidance provided by the FTC tool is high-level, but the site also links to OCR’s health app developer portal, created in Fall 2015. 

In February, OCR added to its portal guidance on "Health App Use Scenarios & HIPAA."[115]  The new guidance explores six different scenarios involving the use of a health app–such as the case of a consumer who downloads an app at the recommendation of his doctor to track diet, exercise, and weight, and to send a summary report to the doctor before his next appointment.[116]  The guidance then addresses whether the app developer would, under the circumstances described, be considered a "business associate" of a HIPAA-covered entity, rendering the app developer also subject to certain HIPAA provisions.[117]  Apart from this guidance, the OCR health app portal also now includes more than 30 questions posted by developers and other interested parties for discussion.[118]

Data breaches compromising health data also have continued to draw attention at both the federal and state level.  In July 2016, OCR issued guidance addressing the effect of ransomware attacks–in which malicious software denies access to a user’s data until a ransom is paid to the hacker–on HIPAA compliance.[119]  OCR confirmed that ransomware events in which electronic protected health information ("ePHI") is encrypted and held for ransom as a result of the attack generally constitute a reportable HIPAA breach, unless the entity attacked can show that there is a "low probability" that protected health information ("PHI") was compromised.[120] 

At the state level, Illinois’s legislature has devoted significant attention to the effect of data breaches on private health information.  In May, the state amended its Personal Information Protection Act to expand the state’s definition of personal information to include information regarding the individual’s medical history, treatment, or diagnoses; health insurance identifiers; and unique biometric data.[121]  The amendments also require any entity experiencing a breach affecting over 250 state residents to provide notice to the attorney general’s office within 45 days and require entities to maintain "reasonable security measures" to protect personal information from unauthorized access.[122]

            2.    HIPAA Enforcement Actions

Despite the increased involvement from other entities, OCR remains at the vanguard of HIPAA enforcement.  OCR has announced six resolution agreements since the start of the calendar year, already matching last year’s total.[123]  And the $9 million collected has already exceeded last year’s total by approximately 50%.  With three seven-figure fines already announced this year, it looks like OCR is on pace for a record-setting year.  

The agency’s enforcement efforts were given a boost recently when an HHS Administrative Law Judge ("ALJ") upheld a CMP assessed by OCR against respiratory care and infusion therapy provider Lincare, Inc.[124]  As OCR’s usual practice is to resolve allegations of HIPAA violations through agreements with providers, this was just the second time in its history that OCR has brought an administrative action seeking a CMP for HIPAA violations–and the second time such a CMP has been upheld.[125]  OCR launched an investigation of Lincare after a Lincare employee’s estranged husband informed the agency that the employee had left documents behind–documents which allegedly contained PHI for nearly 300 patients–after vacating the marital residence.[126]  OCR alleged that the employee removed the PHI from Lincare’s premises and left the information exposed, before abandoning it after the move.[127]  As to Lincare, OCR alleged that the company failed to establish adequate policies and procedures to protect PHI taken offsite.[128]  Lincare objected to the assessment of the approximately $240,000 CMP, contending that the PHI was "stolen" by the employee’s estranged husband and used as leverage to convince her to return to him.[129]  The ALJ disagreed, characterizing this allegation as unsupported, and noting that it was Lincare’s responsibility to protect PHI from theft.[130] 

With the benefit of ALJ approval of OCR’s power to assess CMPs, providers should expect OCR to move forward confidently in investigating and pursuing monetary resolutions to allegations of HIPAA violations. 

The year’s biggest settlement thus far was announced in March, when the Feinstein Institute for Medical Research agreed to a $3.9 million fine.[131]  The investigation into Feinstein’s HIPAA compliance began, as these cases so often do, with the theft of an employee’s laptop.  The laptop contained PHI for 13,000 patients.[132]  Upon further investigation, OCR concluded that Feinstein had only a rudimentary security management process and no policies and procedures addressing access to PHI or safeguards to restrict unauthorized access.[133] The company also lacked sufficient policies with respect to the removal of laptops from the company’s facilities.[134] 

This year, two companies have been penalized for HIPAA violations in connection with their failure to develop and execute HIPAA business associate agreements.  As with Feinstein, North Memorial Health Care of Minnesota’s problems began with the theft of an unencrypted laptop from a car belonging to an employee of North Memorial’s business associate, Accretive Health.[135]  Accretive had access to electronic PHI for nearly 300,000 patients, as well as hard copy PHI through the provision of on-site services.[136]  But, according to OCR, North Memorial failed to develop and implement a required business associate agreement, in violation of HIPAA.  OCR’s review also found that North Memorial failed to complete a risk analysis to evaluate vulnerabilities connected with PHI stored on company devices.[137]  North Memorial agreed to a $1.55 million settlement and agreed to develop an organization-wide risk analysis and risk management plan.[138] 

Raleigh Orthopaedic Clinic of North Carolina agreed to pay $750,000 to resolve allegations that it too violated HIPAA by failing to execute a business associate agreement before providing access to PHI.[139]  Raleigh allegedly made arrangements with an entity to transfer x-ray images to electronic media in exchange for the opportunity to harvest the silver from the x-ray film.[140]  Raleigh agreed to the deal, and provided the entity with PHI and x-rays related to 17,300 patients, but it allegedly did so without having first executed a business associate agreement, in violation of HIPAA.[141]  The North Memorial and Raleigh cases underscore the paramount importance of ensuring that business associate agreements are in place prior to providing access to any PHI.

The year’s most unusual factual scenario formed the basis for a $2.2 million settlement between OCR and New York Presbyterian Hospital.[142]  OCR alleged that New York Presbyterian permitted the film crew from the ABC reality television program "NY Med" to record patients without first obtaining authorization.[143]  The PHI of two patients–one dying and one in considerable distress–was disclosed to the ABC film crew and staff.[144]  The high-dollar value of the fine, relative to the extremely small number of patients affected, illustrates that OCR is prepared to seek substantial fines in cases it considers "egregious."[145]  In connection with its announcement of the resolution, OCR also issued a new FAQ providing guidance on health care providers’ ability to arrange for media access to treatment areas within their facilities.[146]  The guidance notes that providers cannot allow media access to areas where PHI will be accessible without prior written authorization from every individual in the relevant area (or every individual whose PHI will be accessible).[147]

III.    Anti-Kickback Statute Developments

The AKS prohibits companies and individuals from offering, paying, soliciting, or receiving "remuneration" to induce or reward referrals of business that will be paid for by federal health care programs, such as Medicare and Medicaid.[148]  The government interprets "remuneration" expansively to include "the transferring of anything of value in any form or manner whatsoever,"[149] so the AKS potentially criminalizes a broad spectrum of business activity for health care providers trying to increase business.  Any violation of the criminal AKS may result in the imposition of steep monetary penalties and treble damages under the FCA.[150]  As government agencies, and FCA whistleblowers, forge ahead with AKS-related enforcement actions, health care providers must stay attuned to the developments in the courts and the regulatory landscape.

            A.    AKS-Related Case Law Developments

During the first half of 2016, the federal courts handed down several notable decisions interpreting the AKS.  Several of those decisions related to pharmaceutical and medical device companies, and are covered in our Mid-Year FDA/Pharma Update.  As for decisions related to health care providers, two recent cases involving hospice companies elaborate on important defenses under the AKS.

In United States ex rel. Wall v. Vista Hospice Care, Inc.,[151] a federal district court in Texas granted summary judgment on AKS allegations to a hospice care defendant by (1) giving effect to the AKS safe harbors and (2) requiring the plaintiff-relators to produce evidence of an actual certification of compliance with the AKS and an actual false claim.  The relator in that case alleged that the hospice company violated the AKS by paying bonuses to its employees "for hitting admissions targets and census goals."[152]  The court first found that such bonuses came under the safe harbor for payments "by an employer to an employee (who has a bona fide employment relationship with such employer) for employment in the provision of covered items or services."[153]  Although the relators argued that the employees were not engaged "in the provision of covered items or services"–because they were sales and marketing personnel, not medical professionals–the court rejected this narrow interpretation of the safe harbor.[154]  Instead, the court held that "the exception protects payments to employees of entities in the business of providing covered services . . . not only for specific direct patient care for which bills can be submitted to Medicare."[155] 

The court proceeded to hold, as an alternative ground for granting summary judgment, that the relator also failed to provide any "evidence of false certifications for submitted claims."[156]    It is not enough for a relator to "rely on mere assertions that such certifications exist" without identifying specific certifications of compliance with the AKS.[157]  And even where such certifications do exist, the court explained that the plaintiff bears the burden of "sufficiently link[ing] the payment of a bonus to a referral, patient, or claim."  Id.  Because the relator had failed to produce evidence of actual certifications and actual claims, the court found the relator had not met its burden, concluding that "the mere fact that 93% of Defendants’ patients are Medicare patients is not sufficient to show Defendants submitted claims that falsely certified compliance with the AKS."[158] 

In another recent case, Druding v. Care Alternatives, Inc., the U.S. District Court for the District of New Jersey held that AKS allegations are subject to an especially high pleading standard where the conduct is potentially covered by an AKS safe harbor.[159]  There, the court strictly applied Fed. R. Civ. P. 9(b)’s "particularity" pleading requirement to dismiss an alleged AKS violation.  The plaintiffs alleged that physicians, administrators, and others were given "gifts, lunches, dinners, additional staff, and other . . . perks" to induce referrals to a hospice care provider.[160]    But the whistleblower’s pleadings "fail[ed] to detail at least examples of what gifts, meals, and other perks were offered by whom, to whom, and when."[161]  The court noted that the lack of particularity was especially "troubling" because "the AKS includes . . . safe harbor exceptions for certain payment and business practices that are not treated [as] offenses under the statute."[162]  Thus, the court concluded that the defendant did not have adequate notice of its allegedly unlawful conduct, leaving it no opportunity to defend against these claims on the ground that any gifts or perks offered might be permissible under the AKS safe harbors.[163]

            B.    Guidance and Regulations

AKS enforcement remains a high priority of HHS OIG, which has continued to issue advisory opinions that provide potential guidance for AKS compliance. 

            1.    HHS OIG Advisory Opinions on Preferred Hospital Networks

In a series of four advisory opinions during the first half of this year (already matching last year’s total on the same topic), HHS OIG approved the use of cash credits to encourage patients to use in-network hospitals.[164]  Several different insurance companies requested clarification from HHS OIG as to whether they could offer $100 credits to customers who used hospitals in a preferred hospital network.[165]  The insurers had negotiated discounts with the in-network hospitals under Medicare Supplemental Health Insurance ("Medigap") policies.[166]  The insurers "would indirectly contract with hospitals for discounts on the otherwise-applicable Medicare inpatient deductibles for their policyholders and, in turn, would provide a premium credit of $100 to policyholders who use a network hospital for an inpatient stay."[167]  If a patient were to be admitted to a hospital outside of the network, the insurers would pay the full Part A hospital deductible.[168]  As such, the arrangement involved both (1) a discount provided by the network hospitals to the insurer and (2) a discount provided by the insurer to patients.[169] 

HHS OIG explained that "[t]he law is clear that prohibited remuneration under the anti-kickback statute may include waivers of Medicare cost-sharing amounts," and expressed the view that the arrangement would not qualify for any safe harbor under the AKS.[170]  Nonetheless, HHS OIG found that the proposed arrangement "would present a sufficiently low risk of fraud or abuse under the [AKS]" because (1) Medicare payments for services are fixed irrespective of the credit, (2) the credit paid to patients only counted towards the individual’s cost-sharing obligation so it would not increase "utilization," and (3) the program was open to any Medicare-certified hospital.[171]  HHS OIG also noted that there would be no effect on clinical judgment because no payments flowed to physicians, and that patients would not be penalized for foregoing the payment and choosing an out-of-network hospital.[172]  Finally, HHS OIG also concluded that the $100 credits would not "implicate the prohibition on inducements to beneficiaries,"[173] because, although "the premium credit is not technically a differential in a coinsurance or deductible amount," which is allowed, the credit "would have substantially the same purpose and effect as such a differential."[174] 

On balance, HHS OIG’s approval of these arrangements represents a helpful example of the factors the agency will consider when evaluating tripartite arrangements between payors, providers, and patients.

            2.    HHS OIG Advisory Opinion on Free Services for Low-Income Patients   

In February 2016, a university hospital sought approval from HHS OIG for a program to offer transportation and housing to low-income pregnant women.[175]  The arrangement was targeted at pregnant women who lived far from the university’s labor and delivery facilities, including specialized facilities for seriously ill or premature newborns, but who attended clinics around the state operated by the university health system.[176]  "Because of the distances between the Clinics and the Hospital," some women experiencing high-risk pregnancies "expressed concern about the costs and difficulty of travel to the Hospital for delivery."[177]  To mitigate these hardships, the hospital offered mileage or fare reimbursement for public transportation, and free lodging at a perinatal residence located four blocks from the hospital.[178]  These benefits were not advertised, and participation was available only to patients who were already receiving prenatal care at a clinic.[179]  Nor were the benefits conditioned on a patient’s "use of any other goods or services from the Hospital or the Clinics, or the selection of any other particular provider or practitioner."[180]

While acknowledging that the benefits implicated the AKS, HHS OIG nonetheless approved them.  The conclusion was based on several practical considerations, including the fact that the services were beneficial to high-risk, low-income patients, and that the transportation and accommodations were modest and unadvertised, so they did not serve as much of an "inducement."[181]  HHS OIG also considered the limited risk of financial impact on federal health programs.  Namely, HHS OIG noted that eligibility for the benefits was not limited to individuals with federal health insurance coverage and that the university system agreed not to claim any of the costs as "bad debt" in order to shift the cost to Medicare, Medicaid, or other payors.[182]  But HHS OIG emphasized that this opinion should be limited to this specific arrangement, noting that "no individual factor set forth above, nor any subset of them, would justify this conclusion."[183]

            3.    Update on New AKS Safe Harbors

As reported in our 2014 Year-End Update, HHS OIG published a proposed rule on October 3, 2014 that would create additional safe harbors to the AKS.  We noted in our 2014 Year-End Update the potential impact on and legitimization of a range of provider practices through the expansion of certain safe harbors, exclusion of those practices from the definition of "remuneration," or formal recognition of beneficial gainsharing.  As of the date of this update, HHS OIG is still working to finalize the proposed rule, with no reported timeline for the final release.  In the meantime, as required by law,[184]  HHS OIG put out its annual call for ideas about additional new safe harbors and special fraud alerts, seeking to tap the knowledge and real-world experience of industry participants. 

            C.    Notable Settlements

The first half of 2016 was relatively quiet for settlements with providers under the AKS and FCA.  Still, several multi-million-dollar settlements serve as a reminder of the risks associated with noncompliance with the AKS. 

• In January, a former owner of a Virginia-based laboratory company agreed to pay $3.75 million to resolve allegations that he ordered medically unnecessary cancer detection tests and violated the AKS by offering various discounts and billing arrangements to treating physicians to induce physicians to refer business to his laboratory.[185]
• In March, the former owner of a Florida-based home health care agency agreed to pay $1.75 million to resolve allegations that he violated the AKS by paying physicians thousands of dollars per month to conduct sham quality reviews of patient charts.  The physicians allegedly performed little or no work, and the government contended that the payments were, in fact, kickbacks intended to induce the physicians to refer their patients.[186]
• In June, a Tennessee-based lab company and its former CEO agreed to pay $9.35 million to resolve allegations that they violated the AKS and FCA by paying for electronic health record ("EHR") systems for physicians’ practices.  Although there was an AKS safe harbor that permitted lab companies to contribute to EHR systems, the company allegedly went beyond the safe harbor by tying its payments to the volume and value of referrals.[187] 

IV.    Stark Law Developments

During the first half of 2016, there were several notable developments relating to the federal physician self-referral law, known as the Stark Law.  First, proposed legislation seeks to clarify the reach of the Stark Law, including its application in the Medicaid context and the scope of certain exceptions.  Second, after its recent clarification of the 60-day overpayment rule, CMS also has issued proposed revisions to the self-referral disclosure protocol to clarify and streamline the reporting process.  At the same time, the government has continued to hold both companies and individuals responsible for violations of the Stark Law, further reinforcing the significance of this particular statutory scheme.

            A.    Proposed Legislation

            1.    H.R. 776 and H.R. 1083

As we reported in our 2015 Year-End Update, two Stark Law-related bills were proposed in the House of Representatives and referred to committees earlier last year.  H.R. 776, or the Stark Administrative Simplification Act of 2015, which prescribes a single civil monetary penalty as an alternative sanction for Stark Law violations, was referred to the Subcommittee on Health for consideration in February of 2015.[188]  H.R. 1083, the Medicaid Physician Self-Referral Act of 2015, was similarly referred to the Subcommittee on Health for consideration early last year.[189]  That proposed bill clarifies several significant areas pertaining to the application of the Stark Law, including expressly applying the Stark Law self-referral restrictions to Medicaid reimbursements and explicitly stating that Stark Law violations constitute false or fraudulent claims for purposes of the FCA.[190]  Neither bill has moved out of its respective committee so far this year.

            2.    Promoting Integrity in Medicare Act of 2016 (H.R. 5088)

Proposed in April, H.R. 5088 seeks to prevent the improper billing of ancillary services to Medicare by limiting the in-office ancillary services exception to the Stark Law.[191]  The proposed bill removes from the exception those services that are not considered integral to the physician’s initial diagnosis or are rarely provided same-day, and therefore do not increase patient convenience.[192]  Specifically, the proposed bill excludes the following "specified non-ancillary service[s]" from the in-office ancillary services exception:  certain categories of anatomic pathology services, radiation therapy services and supplies, advanced diagnostic imaging studies, physical therapy services, and "any other service  . . .  not usually provided and completed as part of the office visit to a physician’s office."[193]

H.R. 5088 would most significantly affect providers that offer any of the newly excluded on-site services in reliance on the exception.  This proposed legislation does not, however, affect those services still within the proposed narrower scope of the exception, or those services provided under the separate exception for rural providers.  The bill was referred for consideration to both the House Energy and Commerce and Ways and Means Committees in April, but there have been no further developments.[194]

            B.    Regulatory Developments

            1.    Proposed Revisions to the CMS Voluntary Self-Referral Disclosure Protocol

Following the new February rule, CMS published a request for comments on the information to be collected in accordance with the CMS Voluntary Self-Referral (Stark) Disclosure Protocol ("SRDP").[195]  The original SRDP was developed in 2010, pursuant to the Affordable Care Act, with the goal of enabling self-disclosure of actual or potential Stark Law violations.[196]  CMS revised the original protocol in an effort to streamline the reporting process and conform it to the final rule issued in February to clarify the 60-day overpayment rule.  Although a submission under the revised protocol would likely contain the same substance as a submission under the original protocol, there are some notable changes. 

First, the revised protocol seeks to standardize the SRDP process.  In contrast to the original protocol, which lists in general terms the information to be provided as part of an SRDP, the revised version includes standardized forms for the disclosing provider to use.[197]  The forms are intended to streamline the process, but they may in fact require more time (because the provider may need to assemble the necessary data to complete them, given their increased specificity).[198]  Among other changes, under the revised protocol, disclosing parties are required to report the "Pervasiveness of Noncompliance" to address the frequency of that type of noncompliance for that entity.[199]  This enables the provider, as well as CMS, to provide broader context for the disclosed violation.   

Second, since the SRDP currently requires a four-year lookback period, CMS is revising the protocol to provide for a six-year lookback, reflecting the updated lookback period in the February final rule.[200]  The revisions also require a provider to disclose to CMS within 30 days if it files for bankruptcy, changes ownership, or changes its designated representative.[201]  Although the revised protocol creates a more standardized and streamlined process, it is not likely to decrease the effort involved for providers.

            C.    Significant Settlements

Recent settlements illustrate the government’s eagerness to prosecute individuals as well as corporations on the basis of allegations arising out of Stark Law violations.

            1.    Tri-City Medical Center

In January, the DOJ announced a $3.2 million settlement with California-based Tri-City Medical Center for alleged Stark Law violations.[202]  The government alleged that the hospital had nearly 100 financial arrangements with physicians and physician groups that did not fit within an enumerated exception to the Stark Law.[203]  Specifically, five arrangements with the hospital’s former chief of staff allegedly were not commercially reasonable, and 92 arrangements purportedly did not satisfy a Stark Law exception because, for example, no agreement could be located, the available agreement lacked signatures, or the agreement had expired.[204]

The government emphasized the significance of Tri-City Medical Center’s cooperation in the investigation in its press release.[205]  The DOJ press release also lauded this settlement as another success of the Health Care Fraud Prevention and Enforcement Action Team ("HEAT") initiative, created in 2009 as a joint effort of the DOJ and HHS.[206]  As the Tri-City settlement illustrates, the HEAT Task Force continues to push forward in its mission.

            2.    Martin Conklin of RHC

More recently, the former owner of two Florida-based home health care companies settled FCA allegations premised on AKS and Stark Law violations for $1.75 million.[207]  The government alleged that, from 2009 through 2012, owner Mark T. Conklin caused Recovery Home Care, Inc. and Recovery Home Care Services, Inc. ("RHC") to pay physicians thousands of dollars to serve as sham medical directors.[208]  The government further alleged that the physicians did little work to justify those payments, as the true purpose of those payments was to induce referrals to RHC in violation of the AKS and Stark Law.[209]  The new owner of RHC previously agreed to pay $1.1 million to settle the allegations against the two companies.[210]  That the government pursued the owner of RHC on an individual basis is a good example of the DOJ’s recent press to seek action against individuals where possible.

V.    Developments in Payments and Reimbursements

To date, 2016 has been eventful in the area of federal health program payments and reimbursements as well.  Between the finalization of the 60-Day Medicare Overpayment Rule, the controversial proposal to test alternative Medicare Part B payment models, numerous developments in CMS’s ongoing push towards quality-based payment, and recent activity in Congress, there is much to report from the first half of 2016.

            A.    Update on 60-Day Medicare Overpayment Rule

As previewed in our 2015 Year-End Update, on February 12, 2016, CMS announced its final 60-Day Medicare Overpayment Rule applicable to Medicare Parts A and B providers.  The final rule fleshes out the PPACA requirement that health care providers report and return overpayments "by the later of (A) the date that is 60 days after the date on which the overpayment was identified; or (B) the date any corresponding cost is due," or else face liability under the reverse false claims provision of the FCA.[211]

The final rule addresses three critical issues:  (1) when the 60-day period begins to run, (2) what kind of diligence is required in investigating overpayments, and (3) what further investigation must be conducted when an overpayment is discovered.  In the final rule, CMS determined that an overpayment has been "identified"–thus starting the 60-day clock–when a provider "has or should have, through the exercise of reasonable diligence, determined" that it has received an overpayment.[212]  Under the final rule, the provider has a period of up to six months from the receipt of credible information in which to conduct a timely, good-faith investigation into the possible overpayment, and to identify and quantify it before the 60-day period begins to run.  In the absence of a good-faith investigation, however, no six-month grace period will be allowed.[213]  The six-month provision provides clarity that was absent in the original proposed requirement that providers use "all deliberate speed" to conduct their investigations.

Also central to the final rule is the exercise of "reasonable diligence."  Although the rule itself does not define "reasonable diligence," the supplementary text accompanying the final rule defines the term to include "both proactive compliance activities conducted in good-faith by qualified individuals to monitor for the receipt of overpayments and investigations conducted in good-faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment."[214]  The rule thus provides a useful reminder of the importance of both prospective and retrospective activities to ensure compliance with the 60-day rule.

Further, the final rule provides that once an overpayment is identified, a provider must look back and investigate payments received for the six years prior to the identified overpayment.  This is a significant limitation of the 10-year lookback period originally proposed, and CMS deemed this limitation of the lookback period "necessary in order to avoid imposing unreasonable additional burden or cost on providers and suppliers."[215] 

            Proposed Test of Medicare Part B Prescription Drug Payment Reform

In early March, CMS announced a controversial proposed rule that would implement tests of new payment models under Medicare Part B for prescription drugs administered in a physician’s office or hospital outpatient department (as well as drugs administered by a covered item of durable medical equipment).[216]  Under the current framework, Medicare Part B reimburses physicians for the Average Sales Price ("ASP") of a prescription drug plus 6% of the ASP.  According to CMS, this system creates financial incentives for physicians to use more expensive drug alternatives and "can penalize doctors for selecting lower-cost drugs, even when these drugs are as good or better for patients based on the evidence."[217]  In an effort to change the incentive structure–and combat the growing costs of prescription drugs–the proposed rule would initiate tests of a new model combining a smaller add-on percentage of 2.5% plus a flat payment of $16.80 per drug per day.[218]

The proposed demonstration would occur in two phases.  Under phase I, all providers of Part B drugs in a "Primary Care Service Area" would be assigned either (1) to a control group reimbursed under the existing model of ASP + 6%, or (2) to a test group reimbursed at a rate of ASP + 2.5% + $16.80 per drug per day.[219] Under phase II, CMS would incorporate into the payment model value-based payments and clinical-decision support tools similar to those used by Medicare Part D and commercial insurers.[220]  These would include:  indications-based pricing (reimbursing a single drug differently according to what condition it is prescribed for and its efficacy in treating that condition); reference pricing (setting the reimbursement rate for an entire group of drugs in a "therapeutic class" at a single benchmark level); outcomes-based, risk-sharing agreements with drug manufactures (linking patient outcomes with permissible price adjustments); and feedback on prescribing patterns and online decision support tools.[221] The proposed plan would also eliminate or greatly reduce beneficiary co-pay for Part B drugs.[222]  These pricing and decision tools are intended to facilitate the transition "from a volume-based payment system into one that encourages or even rewards providers and suppliers who maintain or achieve better patient outcomes while lowering Part B drug expenditures."[223]

It is uncertain whether the new model will actually reduce Medicare Part B spending, and, if so, to what extent.  According to CMS, phase I is intended to be budget neutral, but it will have the effect of shifting Part B spending away from more expensive drugs to more inexpensive ones.[224]  CMS indicates that the phase II value-based payments are not intended to be budget neutral, and that the agency "believe[s] that implementation of these tools will result in some reduction in expenditures."[225]  However, the agency has been unable to estimate or quantify savings at this time given the lack of well-developed details on the value-based payments.[226]

Industry opposition to the proposal has been both strenuous and widespread.  By the close of the comment period, 1,350 comments had been submitted, with some, for example, threatening that the commenting organization would pursue "every legal, legislative, and related option to stop the CMS Medicare Part B Drug Payment Model."[227]  Within a week and a half of the release of the proposed rule, 316 health organizations lobbied Congress to urge CMS to reconsider the rule,[228] and Congress has already taken action.  In April, four House Republicans introduced H.R. 5122, a bill to "prohibit further action on the proposed rule regarding testing of Medicare part B prescription drug models," which awaits further action in the House Energy and Commerce Subcommittee on Health.[229]  In early May, 242 members of the House submitted a letter to CMS urging withdrawal of the proposed rule.[230]  On May 17, the Subcommittee on Health hosted a hearing on the proposed rule,[231] and there are indications that the Senate Finance Committee will host a hearing on the same topic at the end of June.  CMS’s proposed Part B payment model experiment is very clearly on Congress’s radar, and further Congressional action is quite likely if and when CMS finalizes the proposed rule later this year.

            B.    Continued Progress toward Pay-for-Performance