Healthcare Litigation

The disputes that follow a provider's money and its data. A False Claims Act investigation usually announces itself as a civil investigative demand, with a sealed qui tam complaint behind it. A Stark or Anti-Kickback problem found in a compliance review raises the question of whether, where and how to self-disclose. A breach report brings an Office for Civil Rights inquiry. A payor audit ends in an extrapolated overpayment demand and a Medicare appeal. Physician employment and restrictive-covenant disputes, and contract fights between providers and the management companies or investors behind them, round out the docket. We represent the institution in court, in arbitration and before the agency; we do not act for patients or payors against it.

Through the Office for Civil Rights, which opens most investigations after a breach report or a complaint, and through state attorneys general, who have been able to sue under HIPAA since 2009. There is no private right of action under HIPAA itself, but state privacy and consumer statutes supply one, and Illinois adds the Biometric Information Privacy Act. The OCR data-request letter asks first for the enterprise-wide security risk analysis, the finding that recurs most often in its resolution agreements is a missing or incomplete one, and a monitored corrective action plan, commonly two years, is the usual outcome.

Because the enforcement machinery pays for itself. A qui tam relator keeps 15 to 30 percent of a False Claims Act recovery, which recruits billing staff and former physicians as plaintiffs. The 60-day rule converts an ordinary overpayment into FCA exposure if it is not returned, and since 2010 a kickback makes the resulting claims false by statute. CMS and the Inspector General run claims-data analytics that flag outlier coding before anyone complains, and every breach affecting 500 or more people is posted on a public HHS portal. None of that requires a new law; it requires only that the institution's own records be read by someone else first.

It changes the multiplier. A matter self-disclosed to the Inspector General under its Self-Disclosure Protocol is, by the OIG's published practice, resolved at a minimum of 1.5 times single damages, against treble damages plus per-claim penalties if the government or a relator finds it first. A Stark-only problem goes to CMS under its Self-Referral Disclosure Protocol instead. The review must be run under privilege and built to produce a number within the 60-day rule's timetable, using the 180-day suspension for related overpayments where it applies, since a review that identifies a problem and then stalls is the worst of the three outcomes.

Most are, and the question is on what terms. False Claims Act matters usually settle after the government decides whether to intervene, and the settlement is negotiated alongside, not instead of, the Inspector General's exclusion authority and any Corporate Integrity Agreement. Payor disputes often carry arbitration clauses, and Medicare overpayment demands are resolved through the five-level appeal rather than in court at all. A dispute with a physician group or a management company is mediated when the referral relationships are worth keeping. We prepare every matter as if it will be tried, because that is the position from which the other terms improve.

By controlling what becomes public and when. A breach affecting 500 or more individuals appears on the HHS breach portal, and a False Claims Act settlement is announced by the Justice Department, so the statement to patients, payors and lenders is drafted with the filing rather than after it. The internal review is run under attorney-client privilege, and peer-review material is kept within the state statutory privilege that protects it, so the working papers do not become the other side's exhibits. Where the facts allow, the resolution is structured as a corrective action plan rather than an admission, and payor enrollment and licensure are checked before any term is agreed.