Uncategorized
DOJ Announces First Settlement Under New Civil Cyber-Fraud Initiative
In October 2021, the Department of Justice (“DOJ”) announced its new Civil Cyber-Fraud Initiative, led by the Civil Division’s Fraud Section, to enhance its ongoing efforts to address cybersecurity threats. The initiative utilizes the False Claims Act (“FCA”) to prosecute cybersecurity fraud by federal contractors and grant recipients who put government information or systems at risk through deficient cybersecurity standards. Cybersecurity risks that the initiative will pursue include knowingly providing deficient cybersecurity products or services, knowingly misrepresenting cybersecurity practices or protocols, and failure to monitor and report cybersecurity incidents and breaches. This month, DOJ settled its first case under the new initiative. Florida-based Comprehensive Health Services (“CHS”) agreed to pay $930,000, in part to resolve FCA allegations related to cyber fraud. The settlement also resolved FCA claims that alleged CHS provided medical supplies that were not approved by the U.S. Food and Drug Administration (“FDA”) or the European Medicines Agency (“EMA”) as required by their federal contracts. CHS is a medical services provider that has contracts to provide medical support services at State Department and Air Force facilities in Iraq and Afghanistan. Pursuant to these contracts, CHS submitted claims to the State Department for the cost of a secure electronic medical record (“EMR”) system, which was used to store patient medical records in an agency run medical facility in Iraq. This EMR system housed patient records containing confidential identifying information of U.S. service members, U.S. diplomats, government officials, and contractors. The DOJ alleged that CHS did not exclusively retain these confidential medical records on the EMR system, however, as they were required to under their contract. Instead, the DOJ alleged that the company left copies of the patient records on an internal network drive, which could be accessed by non-facility staff, between 2012 and 2019. This practice allegedly continued even after facility staff raised concerns about the breach in 2017, with CHS failing to disclose to the government this non-exclusive storage of patient records on a secure EMR system. The government was alerted to the alleged practices by a relator prior to filing its complaint in 2019. A key takeaway here is that government contractors and grant recipients must ensure that their cybersecurity practices are up to the standards required under their federal contracts. They should ensure not only that their products and systems are up to date and proper policies are in place to address cyber security risks, but also that those policies are followed in practice, and any breach must be promptly disclosed to the government. The Civil Cyber-Fraud Initiative is yet another avenue for FCA enforcement, and for the government to ensure those receiving its funds are appropriately securing its data.
March 28, 2022
by Erica Andrews
Uncategorized
Home-Health Services Company Settles After Allegations of Double-Billing Scheme
The Department of Justice recently announced that a home-health services company has agreed to pay over $45,000 to resolve alleged False Claims Act (“FCA”) violations. Professional Family Care Services, Inc. (“PFCS”), a North Carolina corporation, faced allegations of fraudulent billing for work by an employee that was convicted of wire fraud and sentenced to prison for her role in the alleged scheme. For two years starting in 2015, PFCS billed the Department of Veterans Affairs (the “VA”) for home-health services related to the medical care of an Army veteran identified by the initials W.R. While PFCS was billing the VA for home-health services, W.R. was actually residing with a Certified Nursing Aide. Relevant evidence indicated that PFCS was billing the VA based on falsified timesheets provided by the aide, for example, timesheets showing her providing services to W.R. and another patient simultaneously. As a result, VA alleged that PFCS failed to provide W.R. with the time and quality of care required under the VA program. W.R. was eventually admitted to the hospital, where it was discovered that W.R. was extremely malnourished and died shortly after. Following the death of W.R., PFCS submitted 15 separate claim forms seeking payment from the VA for the services provided by the aide totaling $11,273.92. Under 31 U.S.C. § 3729(a)(1), civil FCA claims may lead to treble damages in addition to other penalties for false or fraudulent claims. As a result, PFCS agreed to pay $45,486.76 to settle the dispute and avoid litigation. The aide was sentenced to twelve months and one day in federal prison for wire fraud related to the charging of home services for W.R. and ordered to pay over $90,000 in restitution. The primary takeaway here is that businesses that bill services to the government must closely review their invoices. PFCS’s employee was double-charging the government for services, which could have been identified by internal review protocols. Regardless of whether PFCS was aware of or condoned the actions, they were ultimately liable for monetary penalties. Healthcare is one of the largest drivers of FCA liability, and this case serves to highlight the importance of internal controls when billing the government for healthcare services.
March 8, 2022
by Ryan Cole
