Your healthcare organization receives any of the following: an anonymous telephone hotline tip, a subpoena for records, an insurance audit request for patient files, a civil lawsuit, a question about an accounting mix-up, an expressed concern about unusual computer activity, a safety complaint, a licensing board inquiry, an employee's exit interview comment about a physician's possible conflict of interest, an audit finding in connection with clinical research, news of the investigation of another provider that enters into contracts with your physicians or an out-of-the-ordinary contact from the alphabet soup of local, state and federal governmental agencies (HHS, FDA, DEA, FBI, etc.) that you deal with on a daily basis.
You are not a bad organization if you learn that someone in your organization may have misbehaved. You are only a bad organization if you learn there is a reasonable possibility that one of your employees or agents has violated your policies or the law and you do not take appropriate action to find the truth.
But do you need to launch an all-out investigation? Before you answer that question, think about these five things:
1. What conduct is being challenged?
Before commissioning a formal fact investigation, boil it down: what is the real gist of the accusation, question or concern? Many issues can be resolved by the human resources department. Isolated billing and accounting issues usually can be handled by bookkeeping and internal compliance personnel. But if the tip or complaint involves a pattern of conduct, or if it questions the conduct or judgment of one or more high-level employees, the likelihood is great that someone outside your organization should investigate for you.
This early, a quick look will help you as you consider, without pre-judging the facts, what to do next: Place an employee on paid or unpaid leave? Locate and preserve documents? Communicate with employees? Hire counsel? And so on.
I say "without pre-judging the facts" because it is natural to resist the suggestion that someone within your ranks would intentionally break the law. But if the subject of the tip or request is fraud, that is exactly what you must consider. We have all heard the cliché of the sweet bookkeeper who embezzled millions. Guess what? She or he is a cliché for a reason. Healthcare organizations, to a large extent, run on trust and access. Otherwise they would not be able to take care of patients; they would be too busy policing themselves. The flip side, of course, is that a few bad actors will take advantage of that very trust and access for personal gain, to the organization's detriment.
The nature of the conduct will provide insight into whether an internal investigation is necessary. Some occurrences are inherently accidental or isolated. In those cases, remedial training, practice or policy updates or reminders may be all that are necessary. Keep a record of those efforts, however, in case the conduct recurs or escalates to something more serious.
2. If the complaint or concern turns out to be true, which laws or policies are implicated, and which governmental agencies will likely investigate, and should you self-disclose?
Regardless of whether you believe the conduct actually occurred -- and, absent an investigation, you don't yet know -- if it did, various federal and state laws will come into play. Identifying which laws apply to the conduct will help you to determine the extent of the investigation you may need. If federal funds are involved, for example, the False Claims Act will be at the heart of your inquiry. FCA whistleblower suits are the Justice Department's primary source of monetary fraud recoveries. Whistleblowers, who are called Relators, are rewarded with a percentage of federal funds paid out in these lawsuits, which can recover treble damages and significant penalties. The civil False Claims Act requires evidence that a person or company knowingly or recklessly made false claims for federal funds, for example, Medicare or Medicaid reimbursement or grant monies. If such a suit succeeds, or even settles, there is a risk that HHS will require a resource-intensive Corporate Integrity Agreement (CIA) or even exclusion from billing federal programs. You can gain significant advantages if you bring the conduct to the government first, or at least before you know that it is the subject of an investigation.
If the complaint involves vendor or provider kickbacks, does it implicate the federal Stark Law? The Anti-Kickback Statute? Violations of those statutes also create potential liability under the False Claims Act on the principle that federal agencies would not pay claims if they knew those claims were based on unlawful referrals or kickbacks.
Any of the above concerns likely implicates your conflict of interest policy, and any policy requiring employees and contractors to obey all applicable laws.
If a false claim to federal funds is made with specific intent to defraud, it may also be prosecuted under the criminal False Claims Act or under federal criminal statues prohibiting healthcare fraud and theft or embezzlement in connection with healthcare. Those criminal statutes prohibit fraud involving not only Medicare, Medicaid and other federal programs, but from private insurance as well. Again, without knowing which laws are relevant, you cannot make an intelligent decision about whether, or even where, you should disclose the facts to the government. States have their own healthcare fraud laws as well. And of course, in any of the above scenarios, the chances are great that a state licensing board will investigate.
Does the conduct, if true, question the integrity of a clinical research study? If so, the Food & Drug laws and regulations, and again, the False Claims Act, may come into play. Does the conduct challenge the use of federal grant funds? Again -- you guessed it -- the False Claims Act is relevant. If the concern is about patient health and safety, or occupational hazards, you should anticipate dealing with OSHA, EPA and parallel state agencies. If the conduct involves insurance reimbursement, you must assume that you will be dealing with all the agencies that enforce those laws, and that those agencies are working together on parallel paths. Similarly, if the conduct involves prescribing patterns, you must assume that you are also dealing with the DEA and local drug task force agents.
And of course, if the problem is a potential data breach, you will be dealing with the government whether as a victim of a hacker, or under state or federal reporting duties, for example, for companies in the business of insurance, while handling questions from the media.
More and more, the government is looking into conduct that might not be caught in a hospital's usual compliance audits or screens, but that nonetheless affects its right to federal reimbursement. Examples are insurance claims for procedures rendered capably, but that are suspected of being (1) medically unnecessary if only because of their frequency, or (2) invalid because the institution failed to comply with government reporting requirements, for example, as to hours worked by resident physicians.
Your best early assessment of the nature of the conduct, and of which laws or policies could apply, will tell you a lot. With this information you can consider who should investigate, and who that person will report to. For example, if your investigator will be asking questions about the conduct of your CEO, then your board should commission the investigation. If the General Counsel's office would possess relevant factual evidence, then the investigator should not report to your legal department. If you are not sure whether you will disclose the results of the investigation to the government, you need an investigator who is experienced in dealing with the relevant agencies, and whose work will maintain attorney-client privileges until you decide whether to approach the government.
At every stage, you will have questions. How long will the investigation take? What will it cost in both staff time and external expense? What you should communicate to employees, patients and the community? How should you conduct business in the meantime? The answers will evolve on a daily basis as the facts begin to come into focus.
3. Is a criminal investigation underway?
If you learn that criminal authorities are investigating, stop what you are doing and get specialized legal advice. Corporations are legal persons. Although they cannot go to prison in the physical sense, they can be convicted just like individuals. A company's employee or agent can cause a company to be criminally culpable if even one purpose of his or her actions was to benefit the company. And criminal judgments result not just in parallel civil liabilities, but in exclusion and debarment from federal programs: the death knell for any healthcare organization.
If a criminal investigation is underway, your outside counsel should interact with the government on your behalf. It is critical to get ahead of the problem to the extent that you can. On the one hand, if your organization is the target of the investigation, it likely will be in your interest to cooperate by conducting your own investigation and providing the results to the government. It is important to observe the attorney-client privilege and to make only knowing and appropriate waivers of the privilege. Privilege waivers will likely create discoverable evidence in any related civil litigation. On the other hand, if the government is investigating individuals within your organization, but is not targeting the organization itself, you likely will stand down and respond to government requests for information. You will do that to avoid interfering with the government's work, and to avoid giving credence to a defendant's accusation that the government used your organization to obtain evidence in violation of the Fourth Amendment right to be free of illegal search and seizure.
If the authorities are investigating criminal conduct, you will need to consider whether to provide individual employees or agents with their own attorneys. That decision must be made on a case by case basis and in accordance with any relevant policies.
The truth is, you will not always know if a parallel criminal investigation underlies a matter that you are internally investigating. Grand jury investigations are, by law, secret. You may only learn of an investigation if you receive a grand jury subpoena for documents. If the nature of the concern is fraud, however, and particularly if a federal whistleblower suit has been filed, you should proceed as if a criminal investigation is likely.
4. Has a civil case been filed -- in particular, a whistleblower suit under seal?
Federal whistleblower suits under the False Claims Act are filed under seal. They remain sealed while the government fulfills its duty to investigate the merits of the complaint. This means, in a practical sense, that an Assistant United States Attorney will supervise investigators from the FBI, HHS-OIG and any other relevant agencies as they parse the allegations of the sealed complaint. With a court's permission, these factual investigations can take years. The plaintiff is forbidden by law to disclose the existence of the sealed complaint. The government cannot disclose it, even to your organization, without court permission, which can happen if the government needs information from you to assess the case. And of course, while the civil case proceeds under seal, another Assistant U.S. Attorney will consider whether the facts alleged in the civil complaint merit a parallel criminal investigation.
If you know or have information to suggest that an employee has reported potentially unlawful conduct to the government, even conduct committed by another company or person, it is critical that you do nothing with respect to that person that could be considered a retaliatory or other discriminatory action. Doing so can create liability in addition to, and independent of, the original subject of the whistleblower's complaint.
5. Are you looking at a horse, a zebra or a centaur -- or all three?
Why do you need to consider so many moving parts before even deciding whether to conduct an internal investigation? After all, many of the questions raised here cannot be answered early on, when you are just beginning to look at the problem. One set of facts may require you to act on multiple fronts: criminal, civil and administrative. It is worthwhile to consider these questions as fully as you can before you decide to unearth -- or set aside based on a potentially inaccurate assumption as to their import -- facts that could affect you and your organization well into the future. For example, if the concern is that your physicians are receiving more than fair market value for their services under contracts with outside entities, you may be answering to civil and/or criminal authorities, private litigants, licensing boards or even attorneys representing another healthcare organization that is conducting due diligence before agreeing to acquire or merge with yours. The same is true if the concern has to do with prescribing patterns, billing practices or any of the subjects mentioned here.
In short, you may be responding to one person, but chances are that more than one set of ears is listening. And your own constituencies -- employees, patients, community leaders, competitors, joint venture partners and the media, just to name a few -- are listening, too.
Regardless of the circumstances, given what is at stake, it is likely that you will decide to commission an internal investigation that is thorough yet reasonable in scope. It is better to know what is going on in your own house so that you can deal appropriately with it before you find yourself answering questions from others.
Davidson is a partner at Calfee, and chairs the firm's White Collar Defense and Investigations practice. A former Assistant United States Attorney, Virginia advises and defends individuals, publicly and privately held corporations, boards, committees and governmental bodies in enforcement actions, internal and external investigations and civil and administrative actions and compliance reviews. Her practice includes securities, health care, accounting, tax, bankruptcy, FCPA, import-export, False Claims Act, FTC Act and disciplinary and licensing boards.