Company: UHS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027785
Chunk: 28

Company: UNIVERSAL HEALTH SERVICES INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 28
---
ifies that a false claim violation occurs upon the knowing retention, as well as the receipt, of overpayments. In addition, recent changes to the anti-kickback statute have made violations of that law punishable under the civil False Claims Act. Further, a number of states have adopted their own false claims provisions as well as their own whistleblower provisions whereby a private party may file a civil lawsuit on behalf of the state in state court. The False Claims Act require that federal healthcare program overpayments be returned within 60 days from the date the overpayment was identified, or by the date any corresponding cost report was due, whichever is later. Failure to return an overpayment within this period may result in additional civil False Claims Act liability.

Other Fraud and Abuse Provisions: The Social Security Act also imposes criminal and civil penalties for submitting false claims to Medicare and Medicaid. False claims include, but are not limited to, billing for services not rendered, billing for services without prescribed documentation, misrepresenting actual services rendered in order to obtain higher reimbursement and cost report fraud. Like the anti-kickback statute, these provisions are very broad.

Further, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) broadened the scope of the fraud and abuse laws by adding several criminal provisions for health care fraud offenses that apply to all health benefit programs, whether or not payments under such programs are paid pursuant to federal programs. HIPAA also introduced enforcement mechanisms to prevent fraud and abuse in Medicare. There are civil penalties for prohibited conduct, including, but not limited to billing for medically unnecessary products or services.

5

HIPAA Administrative Simplification and Privacy Requirements: The administrative simplification provisions of HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), require the use of uniform electronic data transmission standards for health care claims and payment transactions submitted or received electronically. These provisions are intended to encourage electronic commerce in the health care industry. HIPAA also established federal rules protecting the privacy and security of personal health information, including recently proposed updates to HIPAA security rule requirements. The privacy and security regulations address the use and disclosure of individual health care information and the rights of patients to understand and control how such information is used and disclosed. Violations of HIPAA can result in both criminal and civil fines and penalties.

We believe that we are in material compliance with the privacy regulations of HIPAA, as we continue to develop training and revise procedures to address ongoing compliance. The HIPAA security regulations require health care providers to implement administrative,