Bankrupt Business Associate Agrees to $100K HIPAA Settlement for Medical Records Left at Dumpster

FileFax, Inc has agreed to pay $100,000 to settle potential HIPAA violations. FileFax, Inc. was a business associate that provided medical record storage, maintenance and delivery services. Back in Jan – Feb 2015, FileFax impermissibly disclosed the PHI of 2,150 by leaving the PHI in an unlocked truck in the FileFax parking lot or by granting permission to a person to remove the PHI from Filefax. A “dumpster diver” then took those medical records to a shredding and recycling facility for cash.

During the course of the HIPAA investigation, FileFax closed for business. However, the investigation continued, and even though the business associate went out of business, it could not escape its legal obligation. The bankruptcy receiver agreed to the Resolution Agreement and payment of the penalties to resolve the alleged violation.

For more information, read the Press Release and Resolution Agreement on the OCR Compliance Enforcement website.

Written by: Jacob Simpson

Simpson, Jacob headshot

Few things can ruin a day faster than having a federal investigative agent show up at the door. In the current climate in which the government pushes hard to ferret out fraud, waste, and abuse in government healthcare programs, such an occurrence, though not inevitable, is not as rare as perhaps it once was. Because of this, healthcare lawyers need to understand the potential ramifications of all contact with federal investigators to best  advise their clients who are likely (and understandably) panicking at the prospect of a federal investigation. The following overview provides a basic and very general outline of the significant points regarding the complicated world of federal investigations and the importance of seeking qualified counsel to assist as soon as an investigation comes to light.

1. Criminal versus Civil

In understanding the nature of the federal agent’s visit, it is important to understand the basics of criminal and civil laws and the corresponding penalties that apply in federal healthcare investigations.

Criminal investigations are usually brought under several federal statutes, chiefly the healthcare fraud statute 18 U.S.C. § 1347. The statute requires proof of specific intent to defraud through means of “false or fraudulent pretenses, representations, or promises,” and carries a maximum penalty of 10 years in prison, as well as statutory fines and mandatory restitution. A common, but less severe, charge that is used in healthcare prosecution is the Anti-Kickback Statute (AKS) 42 U.S.C. § 1320a-7b. AKS violations require proof of general intent and carry a maximum term of imprisonment of five years. A conspiracy charge may also be brought under 18 U.S.C. § 371 without any substantive count; this statute likewise carries a maximum penalty of five years in prison. In addition to these charges, the government may also bring money laundering
charges, which greatly enhance its ability to seize and collect money and property
involved in the fraud. Forfeiture allegations are routinely included in the indictment, which allow for the government to more easily seize the individual defendant’s personal property (such as personal accounts and real property) following a judgment of conviction. Exclusions from government healthcare programs are mandatory upon criminal conviction.

The primary tool for civil fraud/false claims charges is the False Claims Act (FCA) 31 U.S.C. §§ 3729 et seq. The FCA provides for treble damages and statutory penalties for false or fraudulent claims made to the government. Actual knowledge of the falsity of the claim is not required; one can be held liable under the FCA under theories of deliberate ignorance/reckless indifference to the truth. To be actionable under the FCA, the falsity must be “material”—i.e., it must affect the government’s decision to pay. In an FCA qui tam case, the suit against the defendant is initiated by the filing of a suit under seal by a private individual, or relator, acting on behalf of the government, and if the suit is  successful the relator recovers a percentage of the damages awarded. In addition to FCA remedies, the government may also bring actions under common law theories of fraud, unjust enrichment, and payment of a thing not due. Where the actions do not rise to the level of a civil claim, a remedy may exist in the form of civil monetary penalties at the administrative level. Corporate integrity agreements are almost always the result of a successful civil investigation.

2. Who’s that at the door?

The first thing to look at when an agent visits is what agency he or she hails from. In terms of healthcare fraud/false claims, the agent will likely be from the Department of Health & Human Services, Office of Inspector General (HHS-OIG). An HHS-OIG “special agent” is an agent who generally does both criminal and civil investigations, while an HHS-OIG “civil investigator” is limited to investigating potential civil liability. The FBI, as a general law enforcement agency, is often involved in healthcare fraud investigations; if there is an FBI investigator, it is almost certain to have some criminal component or allegation to the investigation. Some other investigatory agencies that could be involved are the Food and Drug Administration (FDA) (for drug cases), the Drug Enforcement Administration (DEA) (for drug diversion cases), and the Internal Review Service (IRS) (for tax and money laundering charges). Also, an agent from a state Medicaid Fraud Control Unit (MFCU) should be included in the list, as state and federal authorities often work Medicaid fraud cases jointly.

3. What does the agent want?

Obviously, the reason for the agent’s visit is the biggest clue as to the nature and target of the investigation. Generally, the most dreaded reason for a visit is for service of a grand jury subpoena. A grand jury subpoena can be for documents, testimony, or exemplars (such as a handwriting samples). The grand jury subpoena is issued only for criminal investigations, and as a general rule, information and testimony produced in response to a grand jury subpoena cannot be used in a civil investigation. Although the service of a grand jury subpoena should strike fear in most people, such an occurrence does not necessarily mean that the company or individual is under investigation, since they are routinely used to procure documents and testimony from third parties. When this is the case, it is unlikely that there is any liability on the part of the corporation. As a general rule, a prosecutor will disclose to a third party that it/he/she is not under investigation and that the subpoena is for records only.

In addition to grand jury subpoenas, criminal prosecutors may also use an administrative subpoena, pursuant to 18 U.S.C. § 3486, for records in the investigation of healthcare offenses. These subpoenas are in many ways like grand jury subpoenas  except the responses may be disclosed in a civil healthcare fraud/false claims investigation.

As for civil investigation, the corresponding tool is the civil investigative demand (CID), which is authorized by 31 U.S.C. § 3733. The CID provides for the production of both documents and testimony. Unlike a grand jury proceeding, a witness who testifies pursuant to a CID may have a lawyer present during the interrogation. Although the CID cannot be used as a tool in a criminal investigation, the testimony and documents that are relevant to a parallel criminal investigation may be disclosed to the criminal prosecutors.

Finally, the investigative agencies, pursuant to the code of federal regulations, may issue investigative subpoenas for documents and testimony. In such a case, the investigation may or may not implicate a Department of Justice investigation; as such subpoenas are also used during an agency’s administrative investigation.

In lieu of a formal request for records, a federal agent may attempt to conduct and/or obtain records with an unannounced site visit. The element of surprise is a powerful investigatory tool, because catching people “off guard” usually makes it more likely that they’ll be more intimidated and less guarded with what they say. Also, it is the easiest and fastest way for the agents to get information. While sometimes there is no such ulterior motive when an agent asks questions on routine matters from third parties, clients need to exercise extreme caution when answering questions, especially where the agent has not made it known what he/she is investigating. If a company’s representative does not know who or what conduct the agents are investigating, then he or she may unwittingly answer questions that could come back to haunt the company.

Keep in mind that one can always decline to speak with an agent absent a subpoena, and when in doubt regarding the purpose of the visit a good practice is to politely request a more convenient time to speak with the agent. This will give the representative and the company time to notify the appropriate persons of the possibility of an investigation and to take the appropriate steps to take, notably in informing and/or hiring counsel. Most  importantly, it is important for clients to realize that, if they decide to speak to a federal agent or prosecutor, they need to tell the truth, even in a consensual interview, as lying to a federal official can under certain circumstances be actionable under 18 U.S.C. § 1001.

4. What else has happened/is happening?

Except in cases where the federal agent informs the client that it is not a target and asks that the visit be kept confidential to preserve the integrity of the investigation, by the time the agent shows up at the doorstep, a conscious decision has been made to “out” the investigation. As a general rule, investigators try to gather as much information as possible while the target(s) are still in the dark. By the time the investigator shows up with subpoena in hand, one, some, or all of the following may have occurred:

a. Whistleblower/Informant Interview. Criminal investigations are often initiated through the cooperation of a criminal defendant seeking to reduce his or her sentence. Civil investigations are often commenced through the filing of a qui tam complaint by a private individual under the provisions of the False Claims Act. This means that the investigators have some direct evidence—albeit often of questionable veracity regarding the alleged conduct.

b. Data mining from billing records. Investigators use billing data to identify potential fraudulent billing practices. They may also cross-reference the billing of one provider with that of another provider to determine whether the investigation has merit.

c. Subpoena of financial records. Investigators can get a company’s and an individual’s financial records through a grand jury subpoena. Through the records, the investigators will have traced the money stream to the provider and payments to and from individuals and other entities, often through an extensive forensic analysis of the documents. In criminal investigations, the prosecutors may have also obtained copies of the individual and company’s tax returns.

d. Interviews/grand jury testimony, or CID testimony of former employees/other third parties. Often the relator or cooperator will give investigators information on others with knowledge of the conduct who are no longer involved with the company or individual investigated. Department of Labor reports allow investigators to identify former employees to interview and also give the investigators an idea of the potential decision-makers within the company.

e. Surveillance. This is actually the old-fashioned method of going by the facility and monitoring who is entering and leaving. This is common in cases where there is allegedly a lack of services or unbundling of services.

f. Consensual recordings. Many successful criminal and civil cases are made by consensual recordings of face-to-face conversations and/or phone calls. This is allowed only in those states that allow recordings upon one-party consent. Wiretapping is also a possibility, though this would be rare in a health care fraud investigation.

In cases where a company becomes aware that it is actively being investigated, it should bear in mind that other investigative steps have likely occurred and proceed accordingly.

It’s important for clients to understand that in many cases there is the potential of parallel litigation—i.e., both civil and criminal investigations occurring at the same time. In some cases, the government will elect to proceed on the criminal charges first, as the criminal case, with its higher scienter and burden of proof requirements, will necessarily prove the civil case. Depending on the prosecutors and investigators, a company may get little to no information on what conduct is being investigated or what information the investigative team has, and long periods may pass with little or no communication or activity seemingly taking place. Also note that although companies put a lot of stress on compliance programs (rightly so), prosecutors and investigators care little to nothing about compliance or compliance programs, as such programs are not relevant to the investigation of individual employee/director’s criminal and civil liability. (However, these programs, if followed, may be helpful in reducing a corporation’s liability through negotiation with the government.)

5. Advising the Client

What steps should the lawyer take in advising his client regarding what to do if an agent shows up at the door?

  • Tell clients to get the name of the agent and the investigative agent. If the client was served with a subpoena this information should be on the subpoena itself, if not, it’s up to the client to get the name and the agency, usually by asking for a business card.
  • Advise clients of the potential problems in talking with agents informally when an investigation is involved. The best advice is to have the client set a time to speak with the agent at a more convenient time (for your client). Clients also need to understand that any visit from a federal agency could involve investigations into certain individuals within the company, and that speaking with an agent without counsel is likely not in anyone’s best interest if it appears that it is the client that is being investigated. In some cases, separate counsel will be necessary if it is apparent that the witness could have some criminal exposure.
  • Advise clients to inform employees that the employees are to report any contact with any federal agent as soon as it occurs. Clients should be encouraged to direct any questions to a compliance officer or manager of the company. The client should also be advised to report any such employee contact to their lawyer.
  • A client should be advised to have a policy for preservation of records that can be implemented where a request for records or subpoena is delivered.
  • The client should be advised of the dangers of “creating” records for responses to subpoenas. Such conduct raises serious red flags for prosecutors, and record creation following a request for production is good evidence of consciousness of guilt if the records are determined not to be legitimate.

Finally, if there is any possibility of civil or criminal liability, retaining an experienced lawyer is the most important thing a company can do. An experienced fraud litigator will be able to quickly understand the nature of the investigation and the targets, and will be able to better protect the company’s interest by controlling the communication and cooperation with the investigators, organizing an internal investigation with all the potential legal ramifications in mind, and timely intervening with the investigators/prosecutors to ensure the best outcome possible.

Written by: Catherine M. Maraist

Maraist, Catherine