HIPAA and the criminalization of American medicine.

• Author: Turner, Grace-Marie
• Position: Health Insurance Portability and Accountability Act of 1996

Waste, fraud, and abuse in federal health care programs are serious problems, but so are the federal government's efforts to combat them. There are egregious cases of fraud, and those engaged in these criminal activities should be stopped and prosecuted. But an expanding dragnet for "health care criminals" is threatening and intimidating innocent doctors as well. It is creating an unhealthy climate of fear and defensiveness that is having an adverse impact on the medical profession.

In its zeal to rid the nation's health care system of waste, fraud, and abuse, Congress has passed a blizzard of new federal criminal statutes targeting the health care industry, including those contained in the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Congress created new "health care" laws on top of the existing mountain of rules and regulations and funded an army of enforcement agents. The statutes are being enforced by hundreds of federal agents, armed with hundreds of millions of dollars in investigatory funds. This new army of law enforcement agents has been sweeping through hospitals and doctors' offices throughout the country to investigate a new class of "health care offenders."

Mark L. Bennett Jr., an attorney with the firm of Bennett & Dillon, L.L.P. in Topeka, Kansas, says that health care has become the prosecution of choice for many U.S. attorneys: "At one point in time, drugs and drug offenders got the most attention from the authorities, then it was banking and savings and loan violations. Now ... one of the prosecutions of choice is fraud relating to the provision of medical services.... That's where the money is" (Bennett 1998: 1).

The federal government uses the threat of prosecution and arbitrary penalties to collect excessive settlements from doctors "guilty" of clerical errors. Federal officials developed a crude system to extrapolate fines on doctors and hospitals. Any billing practice that established a physician as a financial outlier on a computer statistical analysis could lead to a payment audit. The audit may look at a fraction of the doctor's medical records, identify a percentage that have coding or billing errors, and then extrapolate the estimated overbillings to the whole practice based upon the sample. But Medicare enforcement officials do not stop there--they then may impose penalties as great as three times the total amount of those estimated overbillings. (1)

Many of the nation's 650,000 physicians are living in fear that they could face armed federal agents, prosecution, and even jail time because of a dangerous new trend to criminalize the practice of medicine. "Demonizing the entire medical community with the broad brush of `fraud, waste and abuse' trivializes real fraud and sets up an adversarial tension in every patient-physician encounter," according to Nancy Dickey, M.D., former president of the American Medical Association (Dickey 1999).

HIPAA Loads New Bullets into Enforcement Guns

The national effort to target medical professionals began in earnest when the Clinton administration introduced the concept of "health care offenses" into the general public lexicon in its proposed 1993 Health Security Act. While the public rejected the draconian bill within less than one year, many of its enforcement provisions became law two years later as part of the Health Insurance Portability and Accountability Act of 1996, sponsored by Senators Edward Kennedy (D-Mass.) and Nancy Kassebaum (R-Kan.). To the surprise of strong critics of the original Clinton health plan, congressional staff resurrected nearly identical language from many of the enforcement provisions in the 1993 Clinton bill and transplanted them into the Kennedy-Kassebaum legislation (see Appendix I).

HIPAA broke ground in creating a new national health care fraud and abuse control program to coordinate federal, state, and local law enforcement efforts. It also created a federal criminal statute specific to health care offenses, making it easier for authorities to prosecute. It provided generous funding for authorities to investigate and prosecute violators, and it instituted a fraud and abuse data collection program in which government agencies and health plans are required to report on "final adverse actions" against providers. (2)

Federal Health Care Offenses

HIPAA defines a "federal health care offense" as a violation of, or a conspiracy to violate, any of the nine current criminal statutes or any of the four new health care crimes created under the act: health care fraud, embezzlement, false statements, and obstruction.

The penalties for health care fraud are even more onerous than a similar provision contained in the Clinton Health Security Act. Under HIPAA, anyone knowingly and willfully executing a scheme to defraud any health care benefit program or to obtain falsely money or property owned by or under the control of any health benefit program faces imprisonment of not more than 10 years, a $250,000 fine, or both. If these schemes result in bodily injury, the person responsible can be imprisoned for 20 years. If the patient dies, a life sentence can be imposed.

HIPAA's broad provision on false statements makes anyone who knowingly and willfully falsifies or covers up material information or makes false statements in connection with the delivery of health care benefits liable for fines, jail terms, or both.

Criteria and penalties for obstruction and embezzlement are similar. One section creates a new penalty for "incorrect coding or medically unnecessary services." There is a separate penalty for a pattern of upcoding.

Conviction on a health care fraud offense under HIPAA can easily lead to a money laundering conviction, according to the Medical Association of Georgia's David A. Cook: "Money laundering occurs when funds gained illegally are commingled with funds earned legitimately" (Cook 1997: 7). Since physicians usually deposit Medicare and Medicaid checks into their practice accounts, the physician may also face money-laundering charges because he or she commingled allegedly tainted funds with legitimate revenue.

Bounty System for Fraud Enforcement

HIPAA provided two major sources of new funding for federal anti-fraud programs.

The Office of Inspector General at the Department of Health and Human Services and the Attorney General jointly run the Fraud and Abuse Control Program. It is funded through a trust account, which in turn is funded by criminal fines, civil judgments, forfeitures, penalties, and damages imposed on health care providers and institutions.

This self-funding mechanism, in which money from this trust then is used to finance more fraud and abuse investigations and prosecutions, was also a provision of the Clinton Health Security Act. Politicians, who did not want to add red ink to the federal budget by adding another spending program, created instead a program in which federal health care authorities have a huge financial incentive to extract settlements and judgments from health care providers, just as in the Clinton Health Security Act, they can seize property, sell it, and use the money to fund more health care investigators.

In addition, Congress appropriated more than $100 million a year in taxpayer money to supplement the account. The FBI received an additional appropriation of $47 million in 1997, increasing to $114 million in 2002, for investigations of health care offenses through the Fraud and Abuse Control Program. HIPAA also created separate funding for a Medicare Integrity Program, enabling investigators to go after alleged violators of Medicare law even more aggressively. Program funding grew from $430 million in 1997 up to $710 million in 2002. The law created a private sector enforcement force by authorizing the use of private contractors.

Congress has criticized the Health Care Financing Administration (HCFA), recently renamed the Centers for Medicare and Medicaid Services, for not having been aggressive enough in awarding contracts to carry out the activities specified in law, including investigating doctors, auditing cost reports, recovery of payments, education of providers, etc. HCFA responded by aggressively stepping up its efforts. HIPAA even created an incentive plan to encourage Medicare beneficiaries and health plan employees to become "whistleblowers" and report information that leads to the collection of at least $100.

Other Sanctions

One of the most ominous provisions of the law allows the government to exclude a provider from federal programs based simply on an indictment or "on OIG initiated determinations of misconduct, e.g., poor quality care or submission of false claims for Medicare or Medicaid payment." (3) This means that a provider need not even have been found guilty to face catastrophic damages.

HIPAA's Health Care Fraud and Abuse Data Collection Program requires publication of judgments against medical providers, suppliers, or others convicted of health care offenses. Any health plan that fails to report "final adverse actions" against any health care professional is subject to fines up to $25,000 per instance not reported. (4)

The Department of Health and Human Services (HHS) claimed in the explanation of its new rule that "Congress intended a broad interpretation of the terms `health care fraud and abuse,' ... including adverse patient outcomes, failure to provide covered or needed care in violation of contractual arrangements, or delays in diagnosis and treatment" (emphasis added). (5)

In other words, HHS can use HIPAA to enforce "quality of health care." And doctors and hospitals are not the only ones in the sights of enforcers. In addition, HHS interpreted health care practitioners covered by the statute to include "nurses, chiropractors, podiatrists, emergency medical technicians, physical therapists, pharmacists, clinical psychologists, acupuncturists, dieticians, aides, and licensed or certified alternative medicine...