Sixth Circuit Affirms Dismissal of FCA Whistleblower Lawsuit Based on Health Data Breach
The U.S. Court of Appeals for the Sixth Circuit recently affirmed a district court’s dismissal of a whistleblower lawsuit alleging violations of the False Claims Act based on an individual security breach. The case, United States ex rel. Sheldon v. Kettering Health Network, arose after the relator (or whistleblower) received letters from Kettering Health Network (KHN) informing her that KHN employees, including her now ex-husband, impermissibly accessed her medical records.
The relator argued that the unauthorized access led to the submission of false claims to the government under the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The HITECH Act provides financial incentive payments for providers that satisfy “meaningful use” standards for their electronic health record systems. The meaningful use standards include certain data security safeguards. Kettering Health Network (KHN) received incentive payments under the HITECH Act after certifying that it met the meaningful use standards. The relator argued that KHN's certification that it met meaningful use standards was false as a result of the data breach. The relator further argued that the false certification constituted a violation of the False Claims Act.
The district court dismissed the case for failure to state a claim and the Sixth Circuit affirmed. The Sixth Circuit agreed with the lower court that an individual security breach is not proof that KHN failed to meet the meaningful use standards under the HITECH Act. The HITECH Act requires providers to implement policies and procedures to prevent, detect, and correct security violations. However, the Sixth Circuit noted that “attestation of compliance [with meaningful use standards] is not rendered false by virtue of individual breaches.” The court also noted that the HITECH Act requires providers to take appropriate actions in the event of a breach, thus contemplating the occasional breach.
The relator also argued that KHN failed to run certain compliance reports to monitor impermissible access to PHI on an appropriate schedule. The Sixth Circuit rejected this argument, noting that the HITECH Act does not require providers to adhere to a particular schedule for running reports.
This Sixth Circuit decision, which is binding in Michigan, confirms that an individual security breach does not, by itself, constitute a false certification of meaningful use compliance under the HITECH Act.
- Health Insurance Exchange
- Digital Assets
- Department of Labor
- Labor Relations
- Affordable Care Act
- Fraud & Abuse
- Alerts and Updates
- 6th Circuit Court of Appeals
- Workers' Compensation
- Legislative Updates
- Health Care Reform
- Medicaid Planning
- COVID-19 and Workers' Compensation
- Employee Benefits
- HITECH Act
- Long-Term Care
- News & Events
- Electronic Health Records
- Did you Know?
- Accountable Care Organizations
Best Lawyers® 2021
Congratulations to the attorneys of the Health Care practice group at Foster Swift Collins & Smith, PC for their inclusion in the Best Lawyers in America 2021 edition. Firm-wide, 44 lawyers were listed. Best Lawyers lists are compiled based on an exhaustive peer-review evaluation and as lawyers are not required or allowed to pay a fee to be listed; inclusion in Best Lawyers is considered a singular honor. Health Care practice group members listed in Best Lawyers are as follows:
To see the full list of Foster Swift attorneys listed in Best Lawyers 2021, click here.