IT’S NOT HIPAA

What do you do if your computer system is breached but there is no disclosure of protected health information?  If you are in Indiana, I.C. 24-4.9-1 provides the methodology for assessing the breach, your obligations to notify those affected, the timetables and other requirements.

Why is this important?  If your PHI is encrypted (as it should be) you may not have an obligation to disclose under HIPAA, but you may still have an obligation to make disclosures and to take certain steps under the applicable Indiana data breach notification law.  The Indiana Attorney General is allowed to bring an action under this statute for an injunction to avoid any further violation and a civil penalty of up to $150,000 per deceptive act.

IDENTIFY STARTS 60 DAY OVERPAYMENT RETURN CLOCK

As I previously reported, the Social Security Act was amended to add a provision which required any person who received an “overpayment” to report and return the overpayment to the government within 60 days from the date the overpayment is identified.

Overpayment is conveniently defined as any amount a person receives or retains from Medicare or Medicaid which “after applicable reconciliation” you’re found not to be entitled.

You must report and return the overpayment within 60 days of identification or you have committed a violation of the False Claims Act (FCA).

A failure to report and return identified overpayments is commonly referred to as a Reverse FCA.  Although several problematic issues arise, one of the areas of interest we previously discussed was when an overpayment is identified.  A recent federal court case, Kane v. Healthfirst, attempted to answer when an overpayment is identified.  Judicial definition becomes critical since no definition was provided under PPACA, the bill which amended the Social Security Act to raise this issue.

Typically, the receiver of overpayments wants to use a definition of “identification” that is when the receiver of the overpayment has conclusively identified the particular overpayments.  This is the “classified with certainty” definition.

On the other hand, the government argues that once a person is put on notice that a certain claim may have been overpaid, that is sufficient for “identification.”

The court chose to side with the government of the 60 day period beginning on the date that a recipient is put on notice that there might or may be an overpayment.  The court recognized that it is a demanding standard of compliance, but noted that PPACA does not contain language which would “temper or qualify this unforgiving rule”.  All recipients of Medicare/Medicaid funds should be aware of this recent decision.

Our takeaways:

• In the Kane case, the problem was first identified some two years prior to Healthfirst taking any action to quantify and repay the claim.  This appears to be an extreme case, and certainly the failure of Healthfirst to take any action on this matter made it easier for the Court to decide for the government.
• We cannot be sure, but we believe that an active investigation and process to identify and quantify potential overpayments would likely result in a different outcome than this case.  It is difficult to imagine that a Medicare/Medicaid provider recipient who worked diligently and quickly to identify the scope of the problem, and even made interim repayments, would be facing significant enforcement action.
• Given the significance and the certainty of constant Reverse FCA whistle blowing claims on this issue, we believe it is likely that Congress and regulators will take some action to define what steps by a provider may extend the 60 day period or may eliminate the possibility of unduly harsh enforcement.
• As with most situations in this area, ignoring the problem does not make the problem go away, it provides the opportunity for FCA claims and greater penalties.

FCA RETALIATION

Although these claims are relatively rare, the False Claims Act does contain a provision which prohibits discrimination against FCA whistleblowers.  An Indiana ER physician, Dr. James Thomas, has asserted an FCA retaliation claim, and the Court has sided with the doctor against a procedural challenge by EmCare, Inc.  Dr. Thomas had complained about admission procedures and patient tests and their billing under Medicaid and Medicare.  Apparently, Dr. Thomas forwarded his complaints to EmCare’s regional director, and shortly thereafter he was terminated.  This case continues to work its way through the United States District Court for the Southern District of Indiana.

ANOTHER DAY, ANOTHER PHI BREACH

Excellus Blue Cross Blue Shield announced last week that it was the “victim” of a cyber attack.  The attack apparently occurred in December 2013, and may have allowed millions of patients’ personal information and PHI to have been breached by and released to hackers.

Excellus followed the Standard PR Spin Memo followed by Anthem and others where they first claimed to be “victims”, and assert that their IT protections are first rate and totally ignored or avoided talking about the fact that the true victims, the patients, and the data that was kept by Excellus, Anthem or others, was not encrypted or sufficiently encrypted.

This newsletter is edited by Paul Wallace of Jones ∙ Wallace, LLC, a member of the American Bar Association Healthcare Law Section and the American Health Lawyers Association who has been representing physicians and healthcare practices for over 25 years.  Mr. Wallace assists physicians, practices and hospitals in contract items, federal legal compliance, practice entity creation, estate and wealth planning and similar issues.  Please feel free to call if you have any questions on this newsletter or legal matters at (812) 402-1600 or pwallace@joneswallace.com.