Fraud and Abuse Changes in the New Laws Enhance Government Enforcement Power and Heighten Industry Transparency Obligations

Healthcare Update

President Obama recently signed into law two pieces of legislation that, together, represent the most comprehensive reform that the U.S. health care system has seen in decades.1 In addition to providing for sweeping changes to health insurance coverage, healthcare delivery, and healthcare funding mechanisms, these laws substantially expand the government’s investigative and enforcement authority in connection with healthcare fraud and abuse. Additionally, the new laws include increased penalties for fraud and abuse in several contexts, as well as heightened disclosure and compliance obligations for providers, manufacturers, and other entities as part of government efforts to reduce fraud and to increase transparency.

This update highlights the key provisions of the new laws pertaining to anti-fraud and pro-transparency initiatives. Several of these new enforcement risks and compliance obligations take effect immediately or within one year, so affected entities will need to familiarize themselves with these provisions and plan for their implementation accordingly.

Enhanced Enforcement of Fraud and Abuse Laws

Expanded Applicability of the False Claims Act (FCA).

The PPACA extends the scope of payments subject to the FCA in two significant ways. First, it amends the Anti-Kickback Statute (AKS) to state that any claims for items or services “resulting from” a violation of the AKS also constitute a “false or fraudulent claim” under the FCA. Second, the PPACA extends the FCA to any payments made “by, through, or in connection with” any of the state-based health insurance exchanges created by the PPACA to assist individuals in finding affordable and available coverage, if such payments include any federal funds.

Additionally, the PPACA amends the FCA’s “public disclosure” bar in several ways. First, it limits the scope of relevant disclosures in government reports or investigations to those that occur at the federal level. Second, it eliminates language that previously described public disclosure as a matter implicating the court’s subject-matter jurisdiction, and authorizes the government to permit a complaint that otherwise would violate the public disclosure bar to proceed. Third, it expands the scope of individuals who qualify as an “original source” to include any person who “has knowledge that is independent of and materially adds to the publicly disclosed allegations or transactions.”

Affirmative Obligation To Report and Return Overpayments.

The PPACA imposes on recipients of overpayments an affirmative obligation to report and return the overpayment on the later of (a) 60 days after the overpayment is “identified,” or (b) the date any corresponding cost report is due, if applicable. Any overpayment retained after the applicable deadline is an “obligation” under the civil FCA statute, and therefore subject to a repayment obligation. For purposes of this requirement, the PPACA defines the term “overpayment” as “any funds that a person receives or retains under title XVIII or XIX [of the Social Security Act] to which the person, after applicable reconciliation, is not entitled under such title.”

The PPACA requires that any “person” receiving an overpayment must “report and return the overpayment to the Secretary, the State, an intermediary, a carrier, or a contractor, as appropriate, at the correct address”, and must notify the returnee “in writing of the reason for the overpayment.” The term “person” includes a provider of services, supplier, Medicaid managed care organization, Medicare Advantage organization, or Part D prescription drug plan sponsor; it does not include a beneficiary.

Lowered Intent Standard Under the Anti-Kickback Statute (AKS).

The PPACA amends the AKS to overrule court decisions holding that, in order to be criminally liable under the AKS, an individual must have actual knowledge of and the specific intent to violate the AKS. Specifically, the PPACA amends section 1128B of the Social Security Act (which includes the AKS) to state that “[w]ith respect to violations of this section, a person need not have actual knowledge of this section or specific intent to commit a violation of this section.”

Stronger Tools for Criminal Enforcement.

In addition to establishing a lowered intent requirement under the AKS, the PPACA amends the federal health care fraud statute (18 U.S.C. § 1347) to state explicitly that, “[w]ith respect to violations of this section, a person need not have actual knowledge of this section or specific intent to commit a violation of this section.” It also amends the definition of a “federal health care fraud offense” (18 U.S.C. § 24(a)) to include violations of the AKS—and also to include violations of section 301 of the Food, Drug, and Cosmetic Act (21 U.S.C. § 331) (FDCA) or section 501 of the Employee Retirement Income Security Act of 1974 (29 U.S.C. § 1131). As a result, an FDCA violation potentially can trigger certain enforcement-related authorities under title 18, including the use of administrative subpoenas under section 3486 and criminal forfeiture authorities under section 982, as well as providing a new basis to be prosecuted for money laundering under section 1956 or obstruction of justice under section 1518.

Additionally, the PPACA includes substantial enhancements to federal sentences for violations of health care fraud under the advisory U.S. Sentencing Guidelines. In particular, the law requires the U.S. Sentencing Commission to amend the federal sentencing guidelines to provide that, when a court is calculating the amount of intended loss by the defendant in an action for health care fraud, the “aggregate dollar amount of fraudulent bills” submitted to a government health care program “shall constitute prima facie evidence” of the loss amount. The PPACA also sets forth new offense-level multipliers for government losses related to federal health care offenses.

Expanded Administrative Remedies

New Civil Monetary Penalties (CMPs).

The PPACA also includes several provisions creating new or increased CMPs, including the following:

• A $50,000 penalty for any false statement, misrepresentation, or omission in applications, bids, or contracts to participate as a provider or supplier under any federal health care program. The $50,000 penalty would apply to each violation, plus up to three times the damages for such claims.
• A $10,000 penalty for any excluded individual or entity who orders or prescribes a covered item or service under a federal health care program during the period of exclusion, or who “knows or should know that a claim” for such item or service will be made under a federal healthcare program.
• A $10,000 penalty for any person who knows of an overpayment and does not report and return the amount due.
• A $15,000 penalty for any failure to grant timely access to the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) “for the purposes of audits, investigations, evaluations, or other statutory functions of” the OIG. The $15,000 penalty can be assessed for each day of delayed access.
• A $50,000 penalty (per violation) for conduct that is also actionable under the FCA.

New CMPs are also created under provisions of the PPACA and Reconciliation Act that establish the Medicare Part D “coverage gap discount program” starting in 2011. Under this program, manufacturers must sign an agreement with the Secretary and provide 50% discounts on covered drugs provided to beneficiaries who are in the coverage gap. As part of their participation in the coverage gap discount program, manufacturers are subject to audits by the Secretary to ensure that they are satisfying the terms of their agreements, and are subject to CMPs if they fail to provide beneficiaries with the discounts required. The penalty amount can be up to 125% of the total amount the manufacturer was obligated to provide in coverage gap discounts.

Exclusion Authority.

The PPACA amends section 1128(b)(2) of the Social Security Act (SSA) to authorize permissive exclusion for, among other things, obstructing an investigation or audit. Under pre-PPACA law, this provision permitted exclusion only for obstructing certain criminal investigations.

The PPACA also extends permissive exclusion authority under SSA section 1128(b) to “[a]ny individual or entity that knowingly makes or causes to be made any false statement, omission, or misrepresentation of a material fact in any application, agreement, bid, or contract to participate or enroll as a provider of services or supplier under a Federal health care program”, including Medicare Advantage organizations under Part C, prescription drug plan sponsors under Part D, Medicaid managed care organizations, and other “entities that apply to participate as providers of services or suppliers in such managed care organizations and such plans.”

To enhance Medicaid integrity, PPACA requires states to terminate individuals or entities from their Medicaid programs if the individual or entity has been terminated from Medicare or from the Medicaid program of another state. Further, the PPACA requires Medicaid agencies to exclude individuals or entities from Medicaid participation for a specified period of time if the entity or individual “owns, controls, or manages an entity that (or if such entity is owned, controlled, or managed by an individual that)” is suspended, excluded, or terminated, or is “affiliated with” an individual or entity that has been excluded, suspended, or terminated.

Suspension and Withholding of Payments.

Substantially expanding the authority of the Secretary of the Department of Health and Human Services (HHS), the PPACA permits the Secretary to “suspend payments to a [Medicare] provider of services or supplier . . . pending an investigation of a credible allegation of fraud against the provider of services or supplier, unless the Secretary determines there is good cause not to suspend such payments.” The Secretary is required to consult with the HHS Office of Inspector General (OIG) in determining whether there is a “credible allegation of fraud” against a provider of services or supplier, and to issue implementing regulations to carry out this provision.

Further, the Reconciliation Act allows the Secretary to withhold payments to new suppliers of durable medical equipment (DME) for up to 90 days if the Secretary determines the supplier is operating in an area with significant levels or risks of fraud and abuse among DME suppliers. The Reconciliation Act refers to this 90-day withholding period as an “enhanced oversight” period.

Revocation of Enrollment.

Effective as of January 1, 2010, the PPACA allows the Secretary to revoke enrollment for up to one year for any home health provider or DME supplier that fails to maintain documents substantiating claims for items or services, or that fails to provide the Secretary with access to such documentation upon request. This provision applies to orders, certifications, and referrals made by physicians, home health providers, and DME suppliers.

Enhanced Authority and Access for the OIG and Department of Justice (DOJ).

The PPACA requires the HHS Secretary to maintain an “Integrated Data Repository” with claims and payment data for all major federal health care programs, including Medicare Parts A, B, C, and D; Medicaid; the Children’s Health Insurance Program (CHIP); and any health-related programs administered by the Departments of Veterans Affairs and Defense, the Social Security Administration, and the Indian Health Service. Further, this section expressly provides that the OIG and DOJ shall have access to this data “[f]or purposes of conducting law enforcement and oversight activities”, to the extent that such access is consistent with regulations promulgated under the Health Insurance Portability and Accountability Act of 1996.

In addition, the PPACA specifies that the OIG’s authority to obtain information extends to any person or entity who “directly or indirectly provides, orders, manufactures, distributes, arranges for, prescribes, supplies, or receives medical or other items or services payable by any Federal health care program (as defined in [SSA] section 1128B(f)) regardless of how the item or service is paid for, or to whom such payment is made.” In connection with this authority, the OIG is authorized to access any documents necessary to validate claims, including medical records and any other “records necessary for evaluation of the economy, efficiency, and effectiveness of” federal health care programs.

The PPACA also expands the government’s subpoena power by allowing for physical access by DOJ to any institution, and its books and records, where the institution “is the subject of an investigation under [the Civil Rights of Institutionalized Persons Act (42 U.S.C. § 1997 et seq.)] to determine whether there are conditions which deprive persons residing in or confined to the institution of any rights, privileges, or immunities secured or protected by the Constitution or laws of the United States.”

340B Integrity Amendments

The PPACA adds a new subsection (d) to section 340B of the Public Health Service Act (42 U.S.C. § 256b). The new subsection includes important provisions regarding manufacturer compliance (including new CMPs), covered entity compliance, and the administrative dispute resolution process. These amendments to the 340B program take effect as of January 1, 2010, and apply to drugs purchased on or after that date.

Manufacturer Compliance.

The manufacturer compliance provisions are designed to prevent overcharges and other violations of the discounted pricing requirements in section 340B through various regulatory mechanisms, such as the publication of more precise guidelines by the HHS Secretary. The provisions also authorize the Secretary to conduct spot checks of manufacturers and wholesalers, and to establish procedures for manufacturers to issue refunds to covered entities in the event of an overcharge.

The 340B integrity amendments impose sanctions in the form of CMPs on any manufacturer with an agreement under 340B that “knowingly and intentionally charges a covered entity a price that” exceeds the applicable 340B ceiling price. The CMPs would be assessed “according to standards established in regulations to be promulgated by the Secretary not later than 180 days after the date of enactment” and would be capped at $5,000 per instance of overcharging a covered entity.

Covered Entity Compliance.

The provisions regarding covered entity compliance call for clarification of covered entity requirements through “more detailed guidance” from the agencies that administer the program. This section also sets forth sanctions, in the form of interest payments to manufacturers, where covered entities knowingly and intentionally violate their 340B program requirements. Further, if the Secretary determines that a covered entity’s violations are “systematic and egregious as well as knowing and intentional,” the Secretary may remove the covered entity from the 340B drug discount program and may prohibit re-entry “for a reasonable period of time”- also to be determined by the Secretary.

Dispute Resolution and “Must Offer” Language.

The PPACA also provides for the replacement of the informal and involuntary alternative dispute resolution (ADR) process established under prior guidance from the Health Resources and Services Administration (HRSA), the agency responsible for administering the 340B program, by authorizing new regulations providing for a binding ADR process to adjudicate and make final determinations regarding complaints about non-compliance by covered entities or manufacturers. Covered entities would be afforded at least some discovery during these administrative proceedings. Notably, manufacturers would still be required to conduct the rather time-consuming and cumbersome audit process under the existing HRSA guidance before proceeding with the ADR process.

Additionally, the PPACA includes language requiring manufacturers to “offer” covered outpatient drugs to 340B covered entities if such drug “is made available to any other purchaser at any price.” The Administration has indicated that the intent of this language is simply to codify existing HRSA guidance requiring manufacturers to treat 340B covered entities in a non-discriminatory manner as compared to entities that do not participate in the 340B program. It remains to be seen, however, exactly how the language will be interpreted and enforced moving forward.

Transparency: New Reporting and Disclosure Obligations

Physician Payments “Sunshine” Provisions.

Reflecting heightened public attention in recent months to financial relationships between physicians and industry, the PPACA requires drug, device, biological, and medical supply manufacturers to submit annual, electronic reports to HHS disclosing any “payment or other transfer of value” made to a physician and/or teaching hospital. It also requires applicable manufacturers and group purchasing organizations (GPOs) to submit annual, electronic reports regarding any ownership or investment interest (other than publicly traded securities and mutual funds) held by a physician, or immediate family member of a physician, in the applicable manufacturer or GPO.

This provision of the PPACA codifies many aspects of what had previously been introduced as a stand-alone bill sponsored by Senators Charles Grassley (R-IA) and Herb Kohl (D-WI), known as the “Physician Payments Sunshine Act” (S. 301). As enacted, the provision defines an applicable “manufacturer of a covered drug, device, biological, or medical device supply” as:

any entity which is engaged in the production, preparation, propagation, compounding, or conversion of a covered drug, device, biological, or medical supply (or any entity under common ownership with such entity which provides assistance or support to such entity with respect to the production, preparation, propagation, compounding, conversion, marketing, promotion, sale, or distribution of a covered drug, device, biological, or medical supply).

The first required “transparency reports” are due March 31, 2013, and must cover all payments or other transfers of value made, and all ownership and investment interested existing, during calendar year 2012.

These reports must include, for each payment or transfer of value:

• the name and business address of the covered recipient;
• the amount of the payment or other transfer of value;
• a description of the form of the payment or other transfer of value (e.g., cash or cash equivalent; in-kind items or services; stock, stock options, or other ownership or investment interests);
• the dates on which the payment or transfer of value was made; and
• a description of the nature of the payment or transfer of value (e.g., consulting fees, compensation for non-consulting services, grant, gift, entertainment, education, research, etc.).

For payments or other transfers of value related to marketing, education, or research specific to a particular covered drug, device, biological, or medical supply, the report also must include the name of the covered product. Additionally, the statute permits the Secretary to determine additional appropriate categories of information to be required in the reports.

Importantly, several types of transactions are excluded from the statute’s definition of a covered “payment or other transfer of value”, including (among others):

• A transfer of anything valued under $10, unless the aggregate amount transferred to, requested by, or designated on behalf of the covered recipient by the applicable manufacturer in the calendar year exceeds $100. (For calendar years after 2012, these dollar amounts will be indexed to the consumer price index for all urban consumers.)
• Product samples that are not intended to be sold and are intended for patient use.
• Educational materials that directly benefit patients or are intended for patient use.
• Short-term loans for a covered device, unless the trial period exceeds 90 days.
• Discounts (including rebates).
• In-kind items used for the provision of charity care.

With respect to manufacturers’ and GPOs’ required annual disclosures of ownership or investment interests (other than publicly traded securities and mutual funds) held by a physician, or immediate family member of a physician, these reports must include:

• the dollar amount invested by each physician (or family member) holding such an ownership or investment interest;
• the value and terms of each such ownership or investment interest;
• any payment or other transfer of value provided to a physician holding an ownership or investment interest; and
• any other information regarding the ownership or investment interest that the HHS Secretary deems appropriate.

Any information reported under this provision must be made publicly available by no later than September 30, 2013, and on June 30 of each calendar year thereafter. Public availability must be provided through a searchable Internet website and in a format that is clear, understandable, and “able to be easily aggregated and downloaded.” Publicly available reports also must contain background information on industry-physician relationships. The Secretary must establish procedures for the submission of information and for public availability by no later than October 1, 2011, and must consult the HHS Office of Inspector General, as well as “affected industry, consumers, consumer advocates, and other interested parties in order to ensure that the information made available to the public under [this section] is presented in the appropriate overall context.”

The public availability process must afford applicable manufacturers and GPOs with a 45-day “review period” before the information becomes available to the public, so long as the 45-day period for review and submission of corrections does not prevent the information from being posted for public access by the dates specified above. An exception would allow “delayed publication” for payments made pursuant to product research or development agreements or in connection with a clinical investigation regarding a new drug, device, biological, or medical supply. In these cases, reports must be made available after the earlier of the following: (1) the FDA approval date of the product; or (2) four calendar years after the date the payment/transfer was made.

Manufacturers and GPOs that fail to comply with the Act’s reporting requirements are subject to civil monetary penalties (CMPs) ranging from $1,000 to $10,000 per unintentional violation, and up to $10,000 to $100,000 per knowing violation. The maximum annual fines would be $150,000 and $1 million, respectively. (The statute defines the term “knowingly” by way of cross-reference to the definition in the False Claims Act provided at 31 U.S.C. § 3729(b).)

Finally, this provision of the PPACA preempts any state laws that mandate disclosure of payments or other transfers of value governed by the federal law. However, states are not prohibited from enacting or enforcing disclosure laws that are more stringent than the federal standard set forth in this provision. Because many states have demonstrated an interest to legislate in this area, the provision’s “partial preemption” approach presents the possibility that manufacturers and GPOs will face a patchwork of federal and state financial disclosure requirements moving forward.

Pharmacy Benefit Managers Transparency Requirements.

The PPACA also imposes reporting requirements on pharmacy benefit managers (PBMs), or health benefits plans that provide PBM services, that contract with health plans under Medicare or a health insurance exchange. Such entities must report to the Secretary information regarding:

• the generic dispensing rate;
• the total number of prescriptions dispensed;
• the aggregate amount and type of rebates, discounts, or price concessions negotiated by the PBM (excluding bona fide service fees—such as distribution service fees, inventory management fees, product stocking allowances, and fees associated with administrative services agreements and patient care programs—but including a specification of which are attributable to patient utilization under the plan and which are passed through to the plan sponsor); and
• the aggregate difference between amounts that health benefits plans pay to PBMs versus amounts that PBMs pay to retail pharmacies and mail order pharmacies.

Information disclosed to the Secretary under this section will be confidential except for limited, specified circumstances, such as to permit review by the U.S. Comptroller General or Director of the Congressional Budget Office. Even in connection with these permitted disclosures, the Secretary may not disclose the identity of a specific PBM or plan, or the prices charged for drugs.

Increased Funding for Anti-Fraud Efforts

Funding Boosts for the Health Care Fraud and Abuse Control Fund (HCFAC Fund).

The PPACA adds an extra $10 million to the HCFAC Fund for each fiscal year from 2011 through 2020—a total of $100 million in additional appropriations. Additionally, the Reconciliation Act appropriates another $95 million in FY 2011, $55 million in FY 2012, $30 million in each of fiscal years 2013 and 2014, and $20 million in each of fiscal years 2015 and 2016, to be used to combat fraud in Medicaid programs. Together, the bills increase HCFAC funding by $350 million over the coming decade. Moreover, the PPACA permanently applies the consumer price index for all urban consumers (CPI-U) to HCFAC Fund, and the Reconciliation Act does the same with respect to funding for the Medicaid Integrity Program.

Additional Compliance Obligations and Integrity Provisions

Required Compliance Programs.

Notably, the PPACA requires providers and suppliers to adopt compliance programs. More specifically, the statute requires the Secretary to develop a compliance program that providers and suppliers “within a particular industry sector or category shall, as a condition of enrollment,” complete. The provision does not specify which industry sectors or categories will be affected, and it leaves to the Secretary, in consultation with the OIG, the task of specifying the required “core elements” of these compliance programs and the timeline for their implementation.

RAC Expansion and Audits.

The PPACA expands the Medicare Recovery Audit Contractor program to require all states to establish one or more RAC contracts by December 31, 2010, for purposes of identifying overpayments and underpayments provided by state Medicaid plans and/or plan waivers. This provision also expands the RAC program to Medicare Parts C and D and includes “special rules” requiring, among other specifications, that Medicare Advantage plans and Part D plans to have an anti-fraud plan in effect and that such plans review the effectiveness of their respective anti-fraud plans.

Data Collection and Provider Screening / Reporting Requirements.

The PPACA requires HHS to maintain a national fraud and abuse data collection program for final adverse actions and to provide the data collected to the National Practitioner Data Bank (NPDB). It also contains provisions that impose new screening requirements for providers and suppliers participating in Medicare, Medicaid, and CHIP, as well as extensive disclosure requirements, demonstration projects, and enforcement tools designed to improve the quality of care in Medicare skilled nursing facilities and Medicaid nursing facilities. It also requires the HHS Secretary to establish a national program for conducting background checks on “direct patient access employees” of long-term care facilities and providers.

Additionally, the Reconciliation Act establishes new requirements for community mental health centers aimed at preventing fraud and abuse, and it modifies previously applicable restrictions on Medicare administrative contractors’ ability to conduct prepayment medical record reviews in cases of suspected fraud and abuse.

As you and your organization work to address and implement these important new changes to health care law, and to review your organization’s policies and procedures to ensure compliance, we would be happy to answer any questions you may have about these, or other, aspects of the newly enacted legislation. Please contact the Sidley lawyer with whom you usually work, or any of the lawyers listed on this alert, if you have any questions or wish to discuss further.

If you have any questions regarding this update, please contact Jim Stansel (+1.202.736.8092, jstansel@sidley.com), William Sarraille (+1.202.736.8195, wsarraille@sidley.com), Scott D. Stein (+1.312.853.7520, sstein@sidley.com), Stephanie Hales (+1.202.736.8349, shales@sidley.com) or the Sidley lawyer with whom you usually work.

1 On March 23, 2010, the President signed the Patient Protection and Affordable Care Act (H.R. 3590) (PPACA), Pub. L. No. 111-148. On March 30, 2010, the President signed the Health Care and Education Reconciliation Act of 2010 (H.R. 4872) (Reconciliation Act), Pub. L. No. 111-152, a smaller bill that effectuated a series of changes to the PPACA.

The Healthcare Practice of Sidley Austin LLP

Our Healthcare Practice represents participants in all facets of the healthcare industry, including pharmaceutical, biotech and device companies, DME suppliers, hospitals, skilled nursing facilities, physician-owned companies, professional associations and research institutions. Our lawyers combine a strong background in the complexities of healthcare financing and delivery, including coding, reimbursement, and coverage issues, privacy and security, trade regulation, and competition. We have extensive experience representing clients on enforcement and regulatory matters before federal and state enforcement agencies.

The Global Life Sciences Practice of Sidley Austin LLP

On three continents, Sidley’s Global Life Sciences Practice team offers coordinated cross-border and national advice on Food, Drug and Medical Device laws, Healthcare, Intellectual Property, Products Liability, International Trade and Arbitration, FCPA Enforcement, Environmental/Nanotechnology, Antitrust/Competition, Corporate M&A, Licensing and Joint Ventures. Globally rated as one of the top life sciences practices, our team includes former government officials, medical doctors, and leaders in various life sciences fields.

To receive future copies of the Global Life Sciences: US-Healthcare Update via email, please click here.

This Sidley Update has been prepared by Sidley Austin LLP for informational purposes only and does not constitute legal advice. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this without seeking advice from professional advisers.

Attorney Advertising - For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300 and One South Dearborn, Chicago, IL 60603, 312.853.7000. Prior results do not guarantee a similar outcome.