Data Security
Software Provider and DOJ Reach $8.6M Settlement for FCA Case Involving Alleged Cyber Security Shortcomings
Amid increased public and government attention to cyber security, a qui tam plaintiff’s lawsuit has resulted a large settlement for a government contractors’ purported misrepresentations regarding compliance with government cyber security standards. In what is believed to be the first-of-its-kind settlement of an FCA claim premised upon cyber security misrepresentations, Cisco Systems recently agreed to pay $8.6 million to the federal and state governments. The case, United States of America v. Cisco Systems, involved allegations from a former-subcontractor whistleblower that Cisco Systems knowingly sold video monitoring technology containing security flaws to the United States, eighteen states, and the District of Columbia. See Complaint, Case No. 11-cv-400 (W.D.N.Y. May 5, 2011). According to the whistleblower, the security flaws to the video monitoring technology created a backdoor to the system, enabling a potential user to gain unauthorized access to the entire network of a federal agency, take control of or bypass an agency’s physical security systems, or even allow an unauthorized user to obtain administrative access to the system to make modifications. Id. Notwithstanding its awareness of the security flaws, and knowing that the disclosure of the security flaws would have prevented the federal government from purchasing the video monitoring technology, the Relator alleged that Cisco Systems withheld information regarding the security flaws from multiple federal and state agencies to which it sold the video monitoring technology. Id. On July 31, 2019, the federal government, fifteen states, and the District of Columbia settled the claims against Cisco Systems. Pursuant to that agreement, Cisco Systems will pay $2.6 million to the federal government to resolve the FCA claims and approximately $6 million to state governments to resolve similar state law fraud-in-contracting claims. Cisco framed the settlement as a “partial refund” to the governments involved, and did not explicitly admit liability. The company acknowledged that “times and expectations have changed.” The settlement may be a harbinger of more cyber security claims to come. Information security has become an increasingly prominent component of all government contracts, extending well beyond contracts in the information technology space. Government contractors will therefore be increasingly required to abide by the security standards imposed by the Federal Information Security Management Act and related regulations when selling products to the government. The recent seven-figure settlement emphasizes the government’s interest in pursuing FCA actions premised upon cyber security shortcomings, and serves as a reminder to government contractors to be mindful of their cyber security compliance obligations.
August 20, 2019
by Jack Huerter
Data Security
Alleged Violations of Government Data Security Requirements Yield FCA Settlement
On May 31, 2019, U.S. Attorney Stephen McAllister of the District of Kansas announced a $250,000 settlement with Coffey Health System to resolve a False Claims Act case. The case arose from allegations that the hospital’s patient data security was insufficient to justify an incentive payment from the federal government. The two whistleblowers each will receive $50,000 from the settlement. In 2016, two whistleblowers filed a qui tam complaint under the False Claims Act, alleging that Coffey Health System (“Coffey”) improperly certified information in its applications for federal incentives. Coffey is a non-profit health provider that is affiliated with the local government in rural Coffey County, Kansas, and located in the town of Burlington with a population of approximately 3,000 city residents. As part of the American Recovery and Reinvestment Act of 2009 enacted in the wake of the last financial crisis, the U.S. Department of Health and Human Services administered an Electronic Health Records Incentive Program (“EHR”) as part of Medicare and Medicaid to encourage adoption of electronic record systems. To apply for EHR, medical providers must attest their compliance with certain criteria, including patient data security measures and risk reviews. The complaint in this case alleged that Coffey’s certification was knowingly inaccurate, because Coffey was aware of deficiencies in its data security measures, including the lack of security risk reviews. The complaint alleged that Coffey received more than $2 million in EHR payments during the relevant years. The whistleblowers are Coffey’s former chief information officer and former compliance officer. After a lengthy delay, the U.S. Government intervened in the case on May 23, 2019, leading to the unsealing of this case. This settlement quickly followed a week later. The settlement resolves this complaint without any determination of Coffey’s liability. The case is a reminder that even small rural health providers are not immune from whistleblower actions and government intervention—and that data security obligations are the new frontier for FCA relators.
June 21, 2019
by T. Augustine Lo
