Health Care Laws: Criminal Liability Risks

Healthcare laws are designed to protect patients and uphold standards of patient care. However, healthcare providers must navigate a complex web of compliance obligations and regulations to avoid criminal liability. Violations of healthcare laws can result in serious criminal penalties, including fines, imprisonment, and exclusion from federal health programs. While healthcare fraud, false claims, and kickbacks are among the most common reasons for criminal liability, other issues such as medical malpractice, negligent care, and HIPAA violations can also lead to criminal charges. With the evolving nature of healthcare laws and the potential for harsh consequences, healthcare providers must stay informed to ensure safe and ethical care delivery.

Healthcare fraud

The Anti-Kickback Statute (AKS) is a crucial component of healthcare fraud legislation. It prohibits the knowing and willful payment of "remuneration" to induce or reward patient referrals or generate business involving federal healthcare programs. Remuneration can take various forms, including cash, free rent, expensive hotel stays, and excessive compensation for consultancies or directorships. The AKS holds both the payers and recipients of kickbacks liable, and intent is a key factor in determining liability.

The Stark Law is another important statute in healthcare fraud prevention. It is a strict liability law, meaning that proof of specific intent to violate it is not required. The Stark Law prohibits the submission of claims that violate its restrictions on referrals. Violators face penalties such as fines and exclusion from federal healthcare programs.

To combat healthcare fraud, the United States has established various initiatives and guidelines. The Department of Justice's Criminal and Civil Divisions, along with the United States Attorneys' Offices, play a pivotal role in investigating and prosecuting healthcare fraud cases, often in collaboration with other agencies to develop nationwide strategies. These efforts aim to maximize the government's recovery while minimizing duplication of resources.

False claims

The FCA outlines provisions and penalties to deter and punish those involved in improper claim submission. It is essential to understand that the FCA considers a claim false if it is inaccurate or fraudulent, even if there is no specific intent to defraud. This means that healthcare providers must exercise due diligence in submitting accurate claims to avoid violating the FCA.

Examples of potential false claims include:

• Billing for services not rendered: This involves billing for items or services that were never provided to the patient.
• Upcoding: This practice involves using billing codes that result in a higher reimbursement rate than what is typically assigned to the service or item.
• Unbundling: This is the act of billing separately for services that should be grouped together as a single service.
• Billing for medically unnecessary services: This includes charging for treatments or procedures that are not medically necessary for the patient's condition.
• Billing for excluded providers: This refers to billing for services provided by individuals who are not eligible to participate in Federal health care programs.

The consequences of submitting false claims can be severe. In addition to criminal penalties, such as imprisonment, individuals or entities may face civil fines of up to three times the programs' loss plus $11,000 per claim filed under the civil FCA. The FCA also encourages whistleblowing by allowing private citizens to initiate lawsuits on behalf of the government and receive a percentage of any recovery or settlements.

To mitigate the risk of false claims, healthcare providers should ensure compliance with relevant laws and regulations. This includes understanding the billing codes and guidelines, as well as staying informed about any updates or changes in the industry. Additionally, self-reporting and cooperating with investigations can demonstrate good faith and may result in reduced penalties.

Kickbacks

The AKS is a federal law that aims to prevent corruption and protect patients by prohibiting improper financial inducements for patient referrals. It is a criminal offence to knowingly and willfully offer, pay, solicit, or receive any form of remuneration to induce or reward patient referrals or generate business involving items or services payable by federal healthcare programs, such as Medicare or Medicaid. Remuneration can include not only cash but also other forms of benefits such as free rent, expensive hotel stays, meals, or excessive compensation for consultancies or directorships.

The penalties for violating the AKS can be severe and include criminal and administrative sanctions. Individuals found guilty of kickbacks may face fines of up to $50,000 per violation, in addition to three times the amount of the kickback. They may also be sentenced to up to five years in prison and excluded from participating in federal health programs, including Medicare and Medicaid.

In determining whether a payment to a physician or medical provider constitutes a kickback, courts apply the "One Purpose Test". If one purpose of the payment is to encourage patient referrals, it is considered a kickback, even if the payment is also compensation for a legitimate service.

In addition to the AKS, the Stark Law and the False Claims Act are also relevant to kickbacks and aim to prevent fraud and uphold integrity in the healthcare system. The Stark Law prohibits physicians from referring patients to entities with which they or their immediate family have a financial relationship, including ownership, investment, or compensation arrangements. The False Claims Act imposes liability on individuals or entities that defraud governmental programs, such as Medicare, by submitting false or fraudulent claims.

To ensure compliance and avoid criminal liability, it is essential for healthcare professionals and providers to understand their legal obligations and adhere to the relevant laws and regulations.

Medical malpractice

For medical malpractice to become a criminal case, the level of negligence must be extremely egregious and rise to the level of recklessness or intentional misconduct. This is known as "culpable negligence," which is a course of conduct showing a reckless disregard for human life or the safety of others. In such cases, the state must prove that the doctor's conduct was appalling and that there was criminal intent, or "mens rea," which is a Latin phrase meaning "guilty mind."

Some specific examples of medical malpractice that can lead to criminal liability include:

• Gross negligence, such as providing medical services while under the influence of alcohol or drugs.
• Practicing without a license.
• Healthcare fraud, including kickbacks, false claims, and billing for services not rendered.
• Fraud, such as profiting from unnecessary procedures or treatments.
• Failure to comply with federal statutes, such as the Anti-Kickback Statute, the False Claims Act, and the Stark Law, which aim to uphold transparency and prevent corruption in the healthcare industry.

HIPAA violations

The Health Insurance Portability and Accountability Act (HIPAA) establishes rules for the protection of sensitive patient information. When a HIPAA-covered entity or business associate violates HIPAA rules, civil penalties can be imposed. Criminal penalties can also be imposed for intentional violations, leading to fines and potential imprisonment.

There are two types of HIPAA violations: civil and criminal. Civil penalties are usually issued when the offender is unaware they are committing a violation and can include fines and corrective action plans. Criminal penalties are typically issued when individuals knowingly obtain or use protected health information (PHI) without permission and can result in fines, corrective action plans, and jail time.

Criminal HIPAA violations fall under three tiers:

• Tier 1: Deliberately obtaining and disclosing PHI without authorization—up to one year in jail and a $50,000 fine.
• Tier 2: Obtaining PHI under false pretenses—up to five years in jail and a $100,000 fine.
• Tier 3: Obtaining PHI for personal gain or with malicious intent—up to 10 years in jail and a $250,000 fine.

The Department of Justice (DOJ) interprets the "knowingly" element of the HIPAA statute for criminal liability as requiring only knowledge of the actions that constitute an offense, not specific knowledge of the violation itself. Criminal HIPAA violations include the theft of patient information for financial gain and wrongful disclosures with the intent to cause harm.

In addition to financial penalties, covered entities may be required to adopt a corrective action plan to address compliance deficiencies and bring their policies and procedures up to HIPAA standards. State attorneys general are increasingly cracking down on data theft and pursuing jail time for individuals found to have violated HIPAA Privacy Rules, especially if data is stolen for financial gain.

Frequently asked questions