See page 16. Billing compliance for non-physician providers: Understanding the CMS billing regulations. Debbie Bohr

Transcription

1 Compliance TODAY March 2014 a publication of the health care compliance association How do you know if your compliance program is working? an interview with Kim Otte Chief Compliance Officer, Mayo Clinic See page Compliance officers and personal liability: Are you covered? Janice A. Anderson and Ryan M. McAteer 31 Billing compliance for non-physician providers: Understanding the CMS billing regulations Debbie Bohr 37 From if to when : The prevalence of ZPIC audits Pamela A. Duncan 41 Prove it or lose it Lyndsay C. Tanner This article, published in Compliance Today, appears here with permission from the Health Care Compliance Association. Call HCCA at with reprint requests.

2 by Janice A. Anderson, Esq. and Ryan M. McAteer, Esq. Compliance officers and personal liability: Are you covered? Compliance officers are tasked with the responsibility of operating and monitoring an organization s compliance program. Compliance officers may be held liable if the services they provide are deemed to be negligent, so they need adequate insurance to cover liability risks. Compliance officers should request copies of their organization s directors and officers (D&O) policy and ask if their role is specifically covered. If compliance officers are covered by a D&O policy, they should confirm the instances or acts which trigger coverage and what is excluded from coverage. If not included in D&O coverage, they should check state statutes, corporate bylaws, and other insurance coverage to see if they can get other insurance or indemnification coverage. Janice A. Anderson ([email protected]) is a Shareholder in the Chicago office and Ryan M. McAteer ([email protected]) is an Associate in the Los Angeles office of Polsinelli, PC. The recent trend of regulators and enforcement officials expanding the scope of their investigations to in-house compliance personnel has, in some cases, resulted in personal liability for corporate wrongdoing. Aggressive prosecution of individuals implicated in healthcare fraud and abuse is certainly nothing new, but never before has there been such a distinct focus on the compliance officer s efforts to prevent civil and criminal violations. As a result, corporate compliance professionals are left scrambling to determine how much personal liability they may incur, if corporate fraud is uncovered within their organization. Duties of compliance officers Compliance officers are tasked with the responsibility of operating and monitoring an organization s compliance program, which typically includes direct access to the CEO and governing body. Although a compliance officer may be given other responsibilities, the general responsibilities of a compliance officer usually include: Developing and implementing the elements of an effective compliance program; Anderson Revising the program in light of organizational changes and new developments in applicable laws and regulations; Generating policies and programs related to compliance issues, including those that encourage managers and employees to report suspected fraud and other McAteer improprieties without fear of retaliation; Developing and implementing education and training programs to ensure employed personnel and independent contractors

3 are in compliance with state and federal requirements; Conducting internal audits and compliance reviews; Reporting on the progress of the compliance program to the compliance committee, CEO, and governing body; Investigating areas of potential non-compliance and developing corrective actions; Coordinating personnel issues with the organization s Human Resources Office, including those involving physician employment and compensation; and Assessing the effectiveness of the compliance program and revising as necessary to improve its overall effectiveness. One of the most essential elements of an effective compliance program is helping an organization prevent, detect, and investigate misconduct. In some cases, compliance officers must challenge management if certain improprieties are not appropriately addressed. This often puts compliance officers in an undesirable position directly at odds with management. No current laws or regulations directly govern their obligations, but emerging guidance emphasizes that compliance officers should not consent or passively assent to any misconduct. If challenging management fails, a compliance officer should attempt to escalate the issue to the board of directors. Personal liability for compliance officers the risks In 2007, the Department of Justice and U.S. Attorneys Office for the Southern District of Florida filed a lawsuit against Christi Sulzbach, former General Counsel for Tenet Healthcare. The government alleged that Sulzbach violated the False Claims Act when she submitted sworn declarations under a Corporate Integrity Agreement, falsely certifying that Tenet was in compliance with applicable federal healthcare statutes and program requirements. The case was unique because the False Claims Act was applied to an individual not personally responsible for the underlying Medicare fraud at issue. In this case, the underlying fraud was based on Stark Law violations related to physician employment agreements executed by a corporate predecessor to Tenet, and Sulzbach played no role in these agreements. In 1994, Sulzbach was Associate General Counsel of National Medical Enterprises, Inc. (NME), a large hospital chain, which later merged with another company, American Holdings, Inc., which was renamed Tenet Healthcare Corporation. In 1994, NME and the government settled fraud charges that the government had brought against it. As part of the settlement, NME agreed to implement a Corporate Integrity Agreement to ensure that future misconduct did not occur. Sulzbach was named the Corporate Integrity Program Director for NME and then Tenet, which gave her responsibility for overseeing NME s compliance program. This position required her to sign declarations on a yearly basis to assure the Department of Health and Human Services that NME/Tenet was in material compliance with the legal requirements for federal healthcare programs. The government alleged that Sulzbach violated the False Claims Act when she submitted sworn declarations in June 1997 and June 1998 that falsely certified Tenet was in compliance with the federal healthcare program requirements. Although the actual fraud was committed by a corporate predecessor of Tenet, the government claimed Sulzbach had been alerted to potential ongoing violations of the federal healthcare program when she made the certification. As a result, Sulzbach s contrary sworn statements implicated her in the False Claims Act suit against Tenet, and the government sought to find her personally liable for the allegedly

4 fraudulent Medicare claims. In 2010, the suit against Sulzbach was thrown out. However, it raised the possibility that a compliance officer could be found personally liable if corporate compliance issues are not handled appropriately. Thus, compliance officers may be wondering what they can do to protect themselves. Protecting compliance officers from personal liability Waiting until the unthinkable happens and a compliance officer faces personal liability charges is not a good strategy. Some actions can be taken to mitigate this risk. Indemnification When corporate wrongdoing is discovered or disclosed, litigation is almost certain to follow. Most organizations provide for indemnification of the board of directors and high-level officers in their corporate bylaws as permitted by state law. These bylaw provisions often state that the organization will indemnify such individuals to the fullest extent permissible by state law. State indemnification statutes are intended to protect corporate directors and officers, but often permit corporations to indemnify other employees and agents if they are named in a lawsuit related to their services on behalf of the organization or at the direction of a member of the board. Indemnification of corporate officers, employees, or agents may be mandatory or permissive, and the determination of when indemnification applies can vary state to state. In California, a corporation has the power to indemnify any person who is a party to any proceeding by reason of the fact that the person is an agent of the corporation. Such indemnification includes expenses, judgments, fines, settlements, and a compliance officer could be found personally liable if corporate compliance issues are not handled appropriately. other amounts actually and reasonably incurred in connection with the proceeding, as long as the individual acted in good faith and in a manner he/she reasonably believed to be in the best interests of the corporation. Such expenses typically include attorneys fees and other fees incurred in establishing a right to indemnification. The California statute also applies to officers and other employees serving at the request of the corporation who act in good faith. Compliance officers should therefore assess state indemnification statutes and review corporate bylaws to determine if corporate indemnification would apply to them on a mandatory or permissive basis. Further, compliance officers should endeavor to make clear with their employer that they will be included in corporate bylaws among the corporate officers covered by statutory indemnification protections. Directors and officers liability insurance In addition to state statutes, compliance professionals should determine whether they are covered by the corporation s directors and officers (D&O) liability policy or if the corporation provides any other liability coverage that may apply to them. Usually a D&O policy will cover board members and other corporate officers acting in the capacity of such roles. Less certain is whether a compliance officer will be considered a corporate officer if the D&O policy does not specifically include their name or position within the organization. There is no requirement that a D&O policy specifically apply to a compliance officer, and therefore, a cautious assessment of such policies should be undertaken. If the D&O policy is unclear,

5 compliance officers should work with their employers to ensure that the policy extends to them. Both federal securities laws and the Federal Sentencing Guidelines identify compliance officers as playing a substantial role in the policy making of the organization, and therefore, compliance officers can point to federal guidelines to support that they should be covered by the corporation s D&O policy. In addition to determining if they are covered by a D&O policy, compliance officers should confirm the scope of D&O coverage. D&O policies typically offer a few coverage options, each of which is triggered under different circumstances. Some coverage is triggered when an indemnification claim is filed and the corporation is financially unable to indemnify its directors and officers due to insolvency. (This is an extension of the indemnification obligation discussed above.) D&O policies also can cover certain covered persons for specified claims, such as employment claims. Thus, it is important for compliance officers to know not only if they are covered by the policy, but also the scope of coverage that is provided. Knowing when the organization s policy will be triggered is key to understanding whether or not a compliance officer s acts will be covered. Further, compliance officers should be aware of policy exclusions. All D&O policies carve out certain occurrences that will not be covered, including wrongful conduct, fraud, breach of contract, or discrimination and employment practices liability. However, carriers typically draft each policy differently, and definitions will vary policy to policy. If a compliance officer is also acting as legal counsel, coverage may not be available, because legal services are typically excluded from D&O coverage. Finally, compliance officers should confirm whether significant deductibles apply Earn Your HEALTH CARE COMPLIANCE CERTIFICATE ONLINE Award-winning program Taught by world-class faculty Now offered in a flexible online format Competitive tuition Complete the program in just one year Designed for working professionals Offered by Hamline University School of Law For more information: law.hamline.edu/ohcc

6 or whether the policy has an aggregate limit (e.g., a $1 million policy limit) or is an unlimited policy. If the policy has a $1 million deductible, the compliance officer must look to the organization to cover the deductible first. Further, if the policy has a $1 million limit, and the carrier pays $500,000 defending the organization s directors and officers, only $500,000 will remain to settle the case or pay judgments levied by a court. These limitations to coverage under a D&O policy are important to recognize. Other insurance Depending on a compliance officer s role in his/her organization, services provided, and licenses or certifications held, other liability policies may be available that can be tailored to an individual or organization. For example, if a lawyer serves a dual role as compliance officer and in-house counsel, a D&O policy likely only applies to those services provided by that individual in his/her capacity as a compliance officer, and additional professional liability coverage would be necessary for any legal services provided. Therefore, after determining when corporate indemnification and D&O coverage apply, compliance officers should consult their insurance department to assess whether additional coverage is necessary. Conclusion Because compliance officers are becoming increasingly targeted by government regulators, it is important to be aware of the available remedies if they are personally named in a suit against their employer. A thorough reading of the organization s bylaws, corporate documents, and D&O policies is necessary to determine how much personal risk a compliance officer has at stake. This article is for informational purposes only and does not constitute, and should not be construed as, legal advice. Law360 has named King & Spalding s healthcare practice as a Health Care Practice Group of the Year for We achieved this by delivering value and security to our clients every day