Health Providers Should Beware FCA Risks Of COVID-19 Aid

By Ellen Murphy, Mark Mermelstein and Andrea Mazingo
Law360 is providing free access to its coronavirus coverage to make sure all members of the legal community have accurate information in this time of uncertainty and change. Use the form below to sign up for any of our weekly newsletters. Signing up for any of our section newsletters will opt you in to the weekly Coronavirus briefing.

Sign up for our Banking newsletter

You must correct or enter the following before you can sign up:

Select more newsletters to receive for free [+] Show less [-]

Thank You!

Law360 (August 6, 2020, 5:19 PM EDT) --
Ellen Murphy
Ellen Murphy
Mark Mermelstein
Mark Mermelstein
Andrea Mazingo
Andrea Mazingo
The Coronavirus Aid, Relief, and Economic Security Act created a number of stimulus programs that provided aid to health care providers, including a fund titled the Public Health and Social Services Emergency Fund, which was specifically designated for the health care industry, and the Paycheck Protection Program, a program for which some health care providers have qualified as small businesses.

While there is no question that health care providers have been impacted by COVID-19 such that government aid was necessary, it is important for health care providers to be wary of the reality that accepting either or both forms of aid results in potential criminal exposure and related civil exposure under the False Claims Act. Health care providers therefore should take some simple, practical steps to best protect themselves.  

The FCA is among the government's strongest weapons to combat fraud in relation to government spending. It has been used by the U.S. Department of Justice to recover funds obtained fraudulently after virtually every recent economic aid package.

The FCA imposes significant civil and criminal monetary penalties and, in cases of egregiously culpable conduct by an individual, prison terms. It allows the government to recover damages that result from those who knowingly present, or cause to be presented, a false or fraudulent claim for payment of government money.

Deliberate ignorance of or reckless disregard for the truth also are sufficient for liability under the FCA. In addition, the FCA permits private individuals to bring civil whistleblower actions, known as qui tam actions, by which a private individual can allege fraud on behalf of the government and earn a bounty. When qui tam actions are filed, the government investigates the allegations and, if it determines that the allegations have merit, the DOJ will intervene and assume primary responsibility for prosecuting the claim.

As with previous aid packages, the DOJ has confirmed that it will focus resources on COVID-19 related fraud, including by Attorney General William Barr urging the public to report suspected schemes related to COVID-19 fraud and directing all U.S. attorneys to prioritize their enforcement efforts on investigating and prosecuting such frauds.[1]

If history is any guide, there will be significant government enforcement under the FCA in light of the CARES Act like there was after the Troubled Asset Relief Program in response to the 2008 financial crisis and relief funding after Hurricane Katrina and Superstorm Sandy.[2] 

FCA Risks for Health Care Providers Accepting Emergency Relief Funds

The CARES Act set aside $100 billion specifically for distribution to health care providers in the relief fund, an amount that the Enhancement Act has since increased by an additional $75 billion. The U.S. Department of Health and Human Services announced that $50 billion of the relief fund would be general distribution funds sent automatically to eligible providers, with much of the remainder being sent to specific categories of providers — such as nursing facilities, Medicaid and Children's Health Insurance Program providers, and hospitals in hotspots — only after application.[3]

Of the $50 billion general distribution funds, $30 billion was distributed immediately in proportion to providers' share of Medicare fee-for-service reimbursements in 2019. The other $20 billion was distributed to providers with a relatively small share of their revenue coming from Medicare fee-for-service by augmenting these providers' allocations pursuant to their 2018 net patient revenue reported in providers' annual cost reports maintained by the Centers for Medicare & Medicaid Services.

HHS' relief fund isn't reserved for hospitals providing treatment for COVID-19. HHS' online portal describes that the "quick dispersal of funds will provide relief to both providers in areas heavily impacted by the COVID-19 pandemic and those providers who are struggling to keep their doors open due to healthy patients delaying care and cancelled elective services."

HHS indicated that even providers that ceased operations could be eligible for funds so long as they "provided diagnoses, testing, or care for individuals with possible or actual cases of COVID-19." HHS also added that the "[c]are does not have to be specific to treating COVID-19. HHS broadly views every patient as a possible case of COVID-19."[4]

HHS Secretary Alex Azar further supported this view in an April 22 press release stating that "President Trump recognizes that every American health care provider has pitched in for this fight in some way."[5]

Providers nonetheless must be wary of FCA liability, irrespective of whether they applied for their funds or received them automatically. Providers who received funds from the general distribution were required, within 45 days, to sign an attestation confirming receipt of funds, agreeing to the terms and conditions of payment, and confirming their Centers for Medicare & Medicaid Services cost report.

Even without signing the attestation, providers are deemed to have passively accepted the terms and conditions of payment merely by retaining it without contacting HHS regarding remittance.

Providers also agree to HHS' auditing by retaining funds. HHS guidance states that for the purpose of "[p]reventing fraud and misuse of the funds ... [r]ecipients/providers must submit documents sufficient to ensure that these funds were used for health care-related expenses or lost revenue attributable to the coronavirus."[6]

In addition, all providers who automatically received funds on or before April 24 must provide HHS with an accounting of their annual revenues by submitting tax forms or financial statements on HHS' online portal. Moreover, health care providers agree in the terms and conditions to submit further information requested by HHS.

For example, any provider receiving more than $150,000 in funds must submit to the secretary and the Pandemic Response Accountability Committee a report each quarter containing, among other things, "a detailed list of all projects or activities for which large covered funds were expended or obligated."[7]

In addition, the terms and conditions[8] of payment require that providers certify, among other things, that the funds received will only be "used to prevent, prepare for, and respond to coronavirus, and that the Payment shall reimburse the Recipient only for health care related expenses or lost revenues that are attributable to coronavirus."

The terms and conditions also require that providers agree not to seek collection of out-of-pocket payments from a presumptive or actual COVID-19 patient that are greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider.

Health care relief fund recipients should be wary that — while HHS has used generous language and inclusively distributed funds to all Medicare providers based on the fact that they provided services in 2019 — merely retaining funds automatically sent to them brings a risk of FCA liability. HHS may accuse a provider of making a misrepresentation relating to any of the terms and conditions of payment described above, including those passively accepted.

Although there is a question as to whether a provider could have acted knowingly when it passively accepted certifications and information underlying a provider's receipt of funds, the DOJ is unlikely to see this as a barrier to prosecution and could argue that such a provider acted with deliberate ignorance of or reckless disregard for the truth of the certifications and information.

Moreover, health care providers suffer the risk of liability posed by ambiguous terms and conditions. For example, a provider like an orthopedic surgeon or mental health care professional may be accused of not having used the funds to "prevent, prepare for, and respond to coronavirus" simply due to the nature of their practice (i.e., it being essential yet not specifically involving treating patients for COVID-19).

For providers in such practices, the requirement that funds be used to prevent, prepare for and respond to coronavirus seemingly prevents them from using the funds to support their practices generally. However, the requirement is ambiguous in light of HHS guidance that every patient is a possible case of COVID-19 and that the relief fund is intended to help health care providers generally keep their doors open if they're struggling from healthy patients delaying care and cancelled elective services.

With so many health care providers representing to HHS the accuracy of various information — either by applying for a distribution from the relief fund or merely retaining one automatically sent — it may be no surprise that the terms and conditions for receiving a distribution include "measures to help prevent fraud and misuse of the funds."

These measures include whistleblower protections, a hotline for reporting fraud, abuse and waste, and enumeration of the various penalties for any deliberate omission, misrepresentation or falsification of any information, which include "criminal, civil, or administrative penalties, including but not limited to revocation of Medicare billing privileges, exclusion from federal health care programs, and/or the imposition of fines, civil damages, and/or imprisonment."

FCA Risks for Health Care Providers Accepting Paycheck Protection Program Funds

Another stimulus program created by the CARES Act is the Paycheck Protection Program, a program for which some health care providers have qualified as small businesses. The PPP is a forgivable loan program that makes it easier for companies to keep employees on the payroll and stay open in the near term. The CARES Act made $349 billion available for PPP loan distributions initially, and this has since been increased by an additional $310 billion.

Any company participating in the PPP and accepting government funding is subject to conditional requirements giving rise to a risk of FCA liability. Although the CARES Act has fairly expansive standards for eligibility, businesses that sought loans under the PPP were required to make certain certifications to the government in their loan applications, including certifying that "[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant."

This requirement has been the subject of significant uncertainty and follow-up guidance by the Small Business Administration and the U.S. Department of the Treasury. Certifications that are inaccurate or misleading — even unintentionally so — can result in FCA exposure. The SBA and the Treasury also issued a FAQ that informed PPP loan recipients that all loans over $2 million would be reviewed by the SBA.[9]

There are additional disclosures businesses will need to make in order to obtain PPP loan forgiveness that in some ways are even more substantial than those made during the application process. To obtain loan forgiveness, businesses are required to submit to the SBA information including their total number of full-time-equivalent employees at the beginning and the end of the loan period, total payroll costs that are eligible under SBA guidance, and total business mortgage insurance, rent, and utility payments made by the business.

Businesses also must disclose whether they have made any salary or hourly wage reductions in excess of 25% for certain employees identified by SBA guidance and calculate a corresponding loan forgiveness reduction. In addition, businesses must disclose whether at least 60% of the potential forgiveness amount businesses themselves calculated was used for payroll cost and, if not, calculate an appropriate proportional reduction to their forgiveness amount so that the 60% threshold is met.[10]

As with the underlying PPP loan application, any certifications made in a loan forgiveness application that are inaccurate or misleading, even unintentionally so, also can result in FCA exposure.

This exposure is relatively significant considering that businesses themselves calculate the amount of their loan forgiveness, calculations which include determining whether business expenses are eligible and/or qualify as payroll expenses, whether expenses were incurred during the covered period, and how many employees at various points in time are full-time-equivalent employees.

Proactive Recommendations to Minimize FCA Risk

As the government continues to expand relief and issue additional guidance, a health care provider receiving relief funds should consider taking the following practical steps.

Document all decisions regarding applying and retaining funds.

Misrepresentations or alleged falsehoods are only violations under the FCA if they are not made in good faith. Documenting one's reasons behind the decision to apply or retain funds may provide valuable evidence on the scienter and materiality elements in defending against an FCA claim.  

Monitor developments.

The government has frequently issued additional guidance and information regarding the funds under the CARES Act programs. Ignoring these announcements may result in the government alleging that one has acted with deliberate ignorance or reckless disregard should a recipient ultimately be forced to defend its decision to retain funds.

Seek clarification from the government.

The fluid nature of the COVID-19 pandemic has resulted in confusion and inconsistencies surrounding the legal requirements surrounding CARES Act relief. As such, seeking confirmation of rules and requirements — and documenting such requests — can be a useful tool to ensure clarity in the immediate and a retroactive defense if necessary in the future.

To note, awareness will not be an outright defense against an FCA claim, but it may help to combat scienter allegations. 

Implement an effective internal employee reporting system.

Most whistleblowers are current or former employees who first report issues internally before reporting externally to the government. Implementing a robust and effective reporting system may help ensure that any issues can be addressed without intervention by the DOJ.

Document criteria for observing requirements laid out in the relief fund.

The relief fund imposes specific requirements on recipients relating to collecting payment from patients.

For example, since the terms and conditions for health care relief fund recipients require that providers agree not to seek collection of out-of-pocket payments from a presumptive or actual COVID-19 patient that are greater than what the patient otherwise would have been required to pay if the care had been provided by an in-network provider, providers must establish criteria for finding and applying the discount on copays for such patients, including procedures for identifying presumptive COVID-19 patients.

In addition, to comply with this requirement, out-of-network providers will need to establish new methods for determining what a patient's in-network benefit and copay levels would have been.

Verify financial data underlying relief fund distributions.

Many health care providers received funds from the relief fund general distribution based upon data in historical CMS cost report (i.e., 2018 net patient revenue). Even without signing the attestation accepting their distribution, providers are deemed to have passively confirmed their CMS cost reports by retaining the funds. Thus, providers should review historical cost reports for accuracy.

Moreover, to demonstrate good faith with respect to FCA compliance, providers who automatically received funds should submit tax forms or financial statements on HHS' online portal, a step HHS has deemed mandatory for providers who automatically received funds on or before April 24.

Ensure that the procedures for tracking expenditures are accurate.

Businesses applying for PPP loan forgiveness and all health care providers receiving relief fund distributions will need to submit accountings of how they spent their money. Businesses should ensure that the procedures for tracking relevant expenses are accurate and should review such information with reference to government guidance before it's submitted.  

Ellen Murphy and Mark Mermelstein are partners, and Andrea Mazingo is a managing associate, at Orrick Herrington & Sutcliffe LLP.

Rachelle Navarro, a senior associate at the firm, contributed to this article.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

[1] In addition to the DOJ's focus, the CARES Act itself also provides that oversight and investigations will accompany the relief program. The CARES Act established a Pandemic Response Accountability Committee tasked with preventing and detecting fraud and abuse, a Special Inspector General for Pandemic Recovery with the Department of the Treasury ("Treasury") responsible for audits and investigations into loans, and a bipartisan Congressional Oversight Commission. The oversight of the CARES expenditures by these bodies can very likely result in referrals to the DOJ for further investigation and can potentially result in FCA actions.

[2] DOJ Press Release, Justice Department Recovers Nearly $6 Billion from False Claims Act Cases in Fiscal Year 2014 (November 20, 2014), available at DOJ Press Release, Hurricane Katrina Contractor Accepts $4 Million Judgment Under the False Claims Act (April 24, 2009), available at DOJ Press Release, Manhattan U.S. Attorney Announces $5.3 Million Proposed Settlement Of Lawsuit Against New York City For Fraudulently Obtaining FEMA Funds Following Superstorm Sandy (Feb. 20, 2019), available at

[3] HHS Press Release, HHS Announces Additional Allocations of CARES Act Provider Relief Fund (April 22, 2020), available at

[4] HHS Online Portal, CARES Act Provider Relief Fund "Who is eligible for initial $30 billion" (June 16, 2020), available at

[5] HHS Press Release, HHS Announces Additional Allocations of CARES Act Provider Relief Fund (April 22, 2020), available at

[6] HHS Online Portal, CARES Act Provider Relief Fund: General Information (June 16, 2020), available at

[7] The Relief Fund application requires providers must certify to the accuracy of additional, application-specific information. For example, for the $10 billion allocated to hospitals in high-impact areas, providers must identify their total number of intensive care unit beds and admissions with a positive diagnosis for COVID-19 as of April 10, 2020.

[8] See HHS Webpage, CARES Act Provider Relief Fund: For Providers, CARES Act Provider Relief Fund Terms and Conditions (June 12, 2020), available at

[9] Id.

[10] SBA and Dep't of Treasury, Paycheck Protection Program Loan Forgiveness Application Instructions for Borrowers (June 16, 2020), available at

For a reprint of this article, please contact

Hello! I'm Law360's automated support bot.

How can I help you today?

For example, you can type:
  • I forgot my password
  • I took a free trial but didn't get a verification email
  • How do I sign up for a newsletter?
Ask a question!