Labs In Court: A roundup of recent cases and enforcement actions involving the diagnostics industry

Cancer Center Hit with $4.3 Million HIPAA Fine for Failure to Encrypt
Case: The University of Texas MD Anderson Cancer Center was on the wrong end of the fourth largest HIPAA fine ever dished out by the HHS Office for Civil Rights for a trio of incidents between 2012 and 2013:

• An employee's laptop was stolen;
• A trainee lost a thumb drive; and
• A visiting researcher lost another thumb drive.

Result: Personal data of 33,800 patients was compromised.

Significance: Theft and loss of devices containing patient data is an all too common occurrence. What made this case different and egregious enough to warrant a massive HIPAA fine was that Anderson failed to encrypt the data.  MD Anderson implemented an encryption policy in 2006 but didn't begin actual encryption of PHI on its computers until 2011, an effort that took over two years to complete. It argued that since the data was used for research purposes, HIPAA requirements didn't apply. But the HHS administrative law judge disagreed finding the Texas hospital's "dilatory conduct shocking given the high risk to patients resulting from the unauthorized disclosure" of digital PHI. MD Anderson says it plans to appeal the ruling contending that there's no evidence that any unauthorized party actually viewed the PHI. 

Whistleblower Sues Montana Health System Officials for Elaborate Kickback Scheme
Case: The CFO of a Montana hospital physician network filed a qui tam lawsuit against his employer for paying physicians above-market compensation in exchange for referrals to network labs, hospitals, clinics and specialists.

Significance: The network, the biggest in Montana, denies the charges and contends that the Work Relative Value Units (WRVU) system it uses to measure physician productivity is the same method commonly employed by other hospitals across the country. But the CFO contends that the WRVU system is just a smoke screen to conceal payments based on referrals rather than productivity, citing among other examples, a neurosurgeon paid $900K per year even though collections for his services ranged from $207K to $374K, which is roughly the 10th percentile for neurosurgeons in national productivity metrics.

Insurer Accuses Florida Lab, California Hospital of Toxicology Test Billing Fraud
Case: Anthem Blue Cross Blue Shield is suing Reliance Laboratory Testing for allegedly conspiring with California hospital Sonoma West Medical Center to create a fraudulent billing organization in a bid to get around Anthem's $32 per test fee cap. By billing toxicology tests through the hospital rather than the Florida Reliance lab that performed them, Sonoma West was able to bill $3,500 per claim, the suit charges. Over a nine-month period, Sonoma West submitted more than 15,000 netting $16 million in payments, according to the complaint.

Significance: This is the latest in a growing line of private insurer suits targeting labs for test billing rip offs. (For more details, see GCA, May 23, 2018.) Anthem says it got wise to the scheme after receiving a call from a Missouri health plan member saying she had received a statement from Sonoma West even though she had never been to California. After investigating and finding that patients listed on Sonoma West claims were never patients at the hospital, Anthem put a stop to the scheme by implementing a "zero pay" system edit that Anthem into its toxicology claims software system.

Midwest Lab & Pain Clinics Charged in Massive Opioid Distribution Scheme
Case: The feds filed criminal charges against a CEO and four physicians as part of an investigation into a $200 million health care fraud scheme involving a network of Michigan and Ohio pain clinics, labs and other providers responsible for the distribution of over 4.2 million doses of medically unnecessary opioid injections, many of which were resold on the streets. The CEO and owner of the clinics and labs allegedly conspired with clinic physicians to prescribe oxycodone, hydrocodone, oxymorphone and other controlled substances to Medicare beneficiaries who did not need them, including addicts. Beneficiaries were also required to submit to expensive, medically unnecessary and painful injections to obtain the drugs, the indictment charges.

Significance: This case is typical of the new face of health care fraud enforcement in the opioid epidemic era. It began when Medicare conducted a medical review of the injection claims and determined that 100% of the claims were not eligible for Medicare reimbursement and summarily suspended the billing privileges of the pain clinics involved.  The labs allegedly got involved by performing medically unnecessary urine drug tests ordered by clinic physicians. After medical review of lab claims determined that 95% of claims failed to meet Medicare reimbursement criteria, the lab was ordered to repay $6.9 million to Medicare.