Source: https://fcadefense.com/false_claims_act/whistleblower/qui_tam/category/regulatory-noncompliance-2/
Timestamp: 2019-04-25 10:07:57+00:00

Document:
The Sixth Circuit Court of Appeals, in US ex rel. Sheldon v. Kettering Health Network, affirmed the dismissal of a False Claims Act (“FCA”) suit alleging fraud based upon certifications of compliance with the HITECH Act and a data breach.
The HITECH Act, or Health Information Technology for Economic and Clinical Health Act, encourages the adoption of electronic medical records. Providers receive incentive payments for adopting EMR and meeting certain “meaningful use” objectives and compliance requirements. Data security is included in those requirements.
Kettering Health Network (“KHN”), the defendant in the action, is a health network that includes hospitals and physicians. KHN certified that it implemented a system to protect electronic data as part of its HITECH certifications, and KHN did receive incentive payments.
Vicki Sheldon was the qui tam relator, or whistleblower, in the action. Her husband, Duane Sheldon, was having an affair with an employee, and the latter two accessed Mrs. Sheldon’s protected health information. Mrs. Sheldon was advised of this breach by a letter from KHN, which she argued demonstrated a per se violation of the HITECH Act and, therefore, the FCA.
The court explicitly rejected that argument, noting that the HITECH Act and subsequent regulations required a security risk assessment, security updates and correction of “identified security deficiencies,” all of which had been performed. It did not perfect prevention of breaches. CMS itself anticipated security deficiencies and required ongoing efforts to identify and correct them.
Health care providers can read this Sixth Circuit decision, which is binding in Kentucky, Michigan, Ohio and Tennessee, and persuasive in other jurisdictions, to offer protection from the FCA where electronic data breaches occur notwithstanding compliance with the HITECH Act.
From October 1 through October 12, 2014, there were 14 federal cases reported that mentioned the False Claims Act. One was previously discussed in the September 2014 FCA Update. Eight more only tangentially discussed the False Claims Act.
Five cases might be of interest to parties and counsel in a False Claims Act suit. US ex rel. May v. Purdue Pharma L.P. was the most interesting case. Defendants were permitted to depose relators’ attorneys, who represented an earlier relator in a dismissed FCA case on the same issues, to explore relators knowledge in a public disclosure challenge.
In US ex rel. Cestra v. Cephalon, Inc., a jurisdiction challenge based upon the first-to-file bar, the court stated that the complaint to be used for comparison was the second relator’s original complaint, not any subsequently amended complaints.
Two cases, US ex rel. Kelly v. Serco, Inc. and US ex rel. Smith v. Boeing Co., reiterated the oft-stated rule that the FCA is not to be used for regulatory compliance. In Boeing, the court went a step further, noting that the FAA had expertise, remedial powers and congressional oversight, and where it had opined on the regulatory question, the court could consider same in ruling on a motion for summary judgment.
In the final case, U.S. ex rel. Graves v. Plaza Medical Centers Corp., the court dismissed claims that failed to plead specific claims against all individual defendants without prejudice and dismissed a conspiracy allegation that failed to allege an agreement among defendants with prejudice.
The Eighth Circuit’s recent decision adds to a growing body of case law rejecting FCA relator allegations of regulatory noncompliance as the basis for FCA claims. It reinforces the position that when health care providers reasonably interpret complicated and confusing billing guidelines and regulations, they cannot violate the FCA.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v.