A Guide for All Medicare Whistleblowers

Becoming a whistleblower and notifying federal authorities of Medicare fraud is a big public service and can even lead to a lucrative whistleblower award. Furthermore, the chief concern for interested whistleblowers is whether they could get reprimanded at their job for blowing the whistle on healthcare fraud or even fired, but any form of whistleblower retaliation is unlawful under the Whistleblower Protection Enhancement Act.

If you think that you have uncovered evidence of Medicare fraud and want to learn more about what could happen next, here are four things to know.

  1. There are Lots of Known Ways to Defraud Medicare

Medicare is an $800 billion federal program, but estimates are that tens of billions, if not nearly $100 billion of that is lost to fraud every year – and that estimate is widely regarded as a conservative one.

A lot of this type of health care fraud can be categorized into one of the following types of schemes, many of them having to do with fraudulent billing tactics:

  • Phantom billing, where medical goods or services are billed against Medicare even though they were never provided or the purported patient does not exist
  • Double billing for the same goods or services
  • Providing medically unnecessary healthcare
  • Buying prescription drugs with Medicare drug plan money and then reselling them
  • Upcoding, or providing a healthcare service to a patient, but then billing Medicare for a similar but more expensive one
  • Unbundling, or billing for each service independently even though they are normally charged in a discounted package because they are often performed together
  • Paying or taking financial kickbacks for referring patients to a certain healthcare provider, or to a provider that the referring party has a financial stake in

However, these are just the types of Medicare fraud that have been discovered. There are likely other ways of defrauding the program that have yet to be detected. Therefore, even if the evidence that you have uncovered does not fit squarely into one of these types of Medicare fraud does not necessarily mean that it is not a problem.

  1. What Happens After Deciding the Blow the Whistle on Medicare Fraud

Most people are not completely familiar with how other civil or criminal cases move forward in the justice system. Because whistleblower cases are different and even more nuanced and complex, even fewer people understand the process – and those that presume that they are just like other cases find themselves misinformed.

Whistleblower cases are nearly unique in that they have three parties to them:

  1. The whistleblower
  2. The government
  3. The defendant

After you have found evidence of Medicare fraud and abuse, decided to report suspected fraud and become a whistleblower, and hired a law firm well versed in federal laws to represent you, you will continue to gather evidence to support your allegations. This is a sensitive endeavor, as most whistleblowers only have access to the incriminating evidence through their employment, and their employer may be actively trying to cover up the fraudulent activity.

Being represented by an experienced whistleblower lawyer is essential for this stage of the process. They will have gone through it before and will see how to gather evidence to support your case without exposing yourself to the risk of being detected for reporting fraud.

Once you have a strong case, the next step is to present it to the law enforcement agency that would have jurisdiction over your case. Typically you would present information to the Health and Human Services Office or Office of the Inspector General (OIG) hotline. For Medicare fraud, reports are often made to the Centers for Medicare and Medicaid Services, or CMS. The goal is typically to persuade agents there to intervene in your case, conduct the investigation that you started, and prosecute the fraudsters.

If the agency declines to intervene, you can still pursue the case on the government’s behalf.

  1. You Can Receive a Financial Award

One of the main incentives for whistleblowers is the award that they can receive for bringing the evidence to the attention of federal law enforcement. That award can be substantial.

Because Medicare is a federal program, most claims of Medicare fraud advance under the False Claims Act (31 U.S.C. §§ 3729 et seq.). This federal law provides an avenue for whistleblowers who have evidence of fraud against the government.

Importantly, the False Claims Act offers quite generous whistleblower awards, even when compared to other whistleblower statutes. The amount that you receive depends on several factors, the most important of which is whether the government intervened in your case or not. If it did, you can receive between 15 and 25 percent of the proceeds of the case. If it did not and you prosecuted the case on behalf of the government, you can recover up to 30 percent of the case’s proceeds.

Other factors include:

  • Whether there are other whistleblowers who played a role in the case
  • How important the evidence was that you brought to the table
  • Whether you played a part in the Medicare fraud
  1. Your Job is Protected 

Because workplace retaliation is such a foreseeable outcome of becoming a whistleblower, and because the federal government relies so heavily on whistleblowers, it should come as no surprise that the False Claims Act and other whistleblower statutes provide legal protections in the workplace for those who engage in lawful whistleblower activities.

For Medicare fraud whistleblowers, the False Claims Act’s anti-retaliation provision, 31 U.S.C. § 3730(h), is particularly strong. Not only does it protect you from retaliatory conduct that falls short of termination, like workplace harassment and threats to fire you, it also entitles you to significant remedies if your employer breaks the law and commits an act of reprisal.

Ankura CTIX FLASH Update – January 3, 2023

Malware Activity

Louisiana’s Largest Medical Complex Discloses Data Breach Associated to October Attack

On December 23rd, 2022, the Lake Charles Memorial Health System (LCMHS) began sending out notifications regarding a newly discovered data breach that is currently impacting approximately 270,000 patients. LCMHS is the largest medical complex in Lake Charles, Louisiana, which contains multiple hospitals and a primary care clinic. The organization discovered unusual activity on their network on October 21, 2022, and determined on October 25, 2022, that an unauthorized actor gained access to the organization’s network as well as “accessed or obtained certain files from [their] systems.” The LCMHS notice listed the following patient information as exposed: patient names, addresses, dates of birth, medical record or patient identification numbers, health insurance information, payment information, limited clinical information regarding received care, and Social Security numbers (SSNs) in limited instances. While LCMHS has yet to confirm the unauthorized actor responsible for the data breach, the Hive ransomware group listed the organization on their data leak site on November 15, 2022, as well as posted files allegedly exfiltrated after breaching the LCMHS network. The posted files contained “bills of materials, cards, contracts, medical info, papers, medical records, scans, residents, and more.” It is not unusual for Hive to claim responsibility for the associated attack as the threat group has previously targeted hospitals/healthcare organizations. CTIX analysts will continue to monitor the Hive ransomware group into 2023 and provide updates on the Lake Charles Memorial Health System data breach as necessary.

Threat Actor Activity

Kimsuky Threat Actors Target South Korean Policy Experts in New Campaign

Threat actors from the North Korean-backed Kimsuky group recently launched a phishing campaign targeting policy experts throughout South Korea. Kimsuky is a well-aged threat organization that has been in operation since 2013, primarily conducting cyber espionage and occasional financially motivated attacks. Aiming their attacks consistently at entities of South Korea, the group often targets academics, think tanks, and organizations relating to inter-Korea relations. In this recent campaign, Kimsuky threat actors distributed spear-phishing emails to several well-known South Korean policy experts. Within these emails, either an embedded website URL or an attachment was present, both executing malicious code to download malware to the compromised machine. One (1) tactic the threat actors utilized was distributing emails through hacked servers, masking the origin IP address(es). In total, of the 300 hacked servers, eighty-seven (87) of them were located throughout North Korea, with the others from around the globe. This type of social engineering attack is not new for the threat group as similar instances have occurred over the past decade. In January 2022, Kimsuky actors mimicked activities of researchers and think tanks in order to harvest intelligence from associated sources. CTIX continues to urge users to validate the integrity of email correspondence prior to visiting any embedded emails or downloading any attachments to lessen the risk of threat actor compromise.

Vulnerabilities

Netgear Patches Critical Vulnerability Leading to Arbitrary Code Execution

Network device manufacturer Netgear has just patched a high-severity vulnerability impacting multiple WiFi router models. The flaw, tracked as CVE-2022-48196, is described as a pre-authentication buffer overflow security vulnerability, which, if exploited, could allow threat actors to carry out a number of malicious activities. These activities include stealing sensitive information, creating Denial-of-Service (DoS) conditions, as well as downloading malware and executing arbitrary code. In past attacks, threat actors have utilized this type of vulnerability as an initial access vector by which they pivot to other parts of the network. Currently, there is very little technical information regarding the vulnerability and Netgear is temporarily withholding the details to allow as many of their users to update their vulnerable devices to the latest secure firmware. Netgear stated that this is a very low-complexity attack, meaning that unsophisticated attackers may be able to successfully exploit a device. CTIX analysts urge Netgear users with any of the vulnerable devices listed in Netgear’s advisory to patch their device immediately.

For more cybersecurity news, click here to visit the National Law Review.

Copyright © 2023 Ankura Consulting Group, LLC. All rights reserved.

Acronis Reports Ransomware Damages Will Exceed $30B by 2023

In its Mid-Year Cyberthreat Report published on August 24, 2022, cybersecurity firm Acronis reports that ransomware continues to plague businesses and governmental agencies, primarily through phishing campaigns.

According to the report over 600 malicious email campaigns were launched in the first half of 2022, with the goal of stealing credentials to launch ransomware attacks. Other attack vectors included vulnerabilities to cloud-based networks, targeting unpatched or software vulnerabilities, and cryptocurrency and decentralized finance systems.

According to Acronis, “ransomware is worsening, even more so than we predicted.” It estimates that global damages related to ransomware attacks will top $30 billion by 2023.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.