In Fiscal Year 2011, the U.S. Department of Justice recovered more than $3 billion as a result of False Claims Act (FCA) settlements and judgments. On September 7, 2011, DOJ arrested ninety-one people in eight states and charged them with attempting to steal $295 million from Medicare in what was the largest Medicare arrest to date. These anti-fraud measures were the result of a concerted governmental effort to curb fraud within the healthcare industry.

The latest weapon is a provision in the Patient Protection and Affordable Care Act of 2010 (PPACA) that takes aim at overpayments and significantly increases the organizational risk involved with retaining an overpayment for healthcare services. Section 6402(d) of PPACA requires a provider to report and return an overpayment to the appropriate Medicaid state agency or Medicare contractor within 60 days of its identification. The provider must also supply, in writing, an explanation of the overpayment.

The FCA is the government's primary enforcement mechanism against fraud. The act imposes civil liability on any person who knowingly uses a "false record or statement to get a false or fraudulent claim paid or approved by the Government," or any person who "conspires to defraud the Government by getting a false or fraudulent claim allowed or paid.

To incentivize FCA actions, the law empowers private parties to bring a qui tam action on behalf of the United States.

In May 2009, President Barack Obama signed the Fraud Enforcement and Recovery Act (FERA) into law. The FERA amended the FCA's provision dealing with reverse false claims, which occurs when a party attempts to avoid an obligation to pay the government. The FERA also significantly expanded liability under the FCA by prohibiting a provider from "knowingly and improperly avoid[ing] or decreas[ing] an obligation to pay or transmit money or property to the government.

The latest amendment to the FCA came with the passage of PPACA, which continued the trend of increasing healthcare providers' exposure to liability under the FCA.

As a result of PPACA Section 6402(D), a healthcare provider that receives an overpayment may now be in jeopardy of violating the FCA. The proposed rule defines an overpayment as"... any funds a person receives or retains under Title XVIII of the [Social Security] Act to which the person, after applicable reconciliation, is not entitled under such title." Examples: Payments made by Medicare for non-covered services, duplicate payments and Medicare payment when another entity had the primary responsibility for the payment.

Under PPACA, an overpayment must be reported and returned within 60 days from the date on which the overpayment was "identified", or the date any corresponding cost report is due. Examples from CMS when an overpayment has been "identified" for purposes of the law include: a provider learns that a patient death occurred prior to the service date on a claim that has been submitted for payment, and a provider performs an internal audit and discovers overpayments exist.

There are two common defenses to an FCA allegation, neither of which has emerged unscathed from the trend of increased liability.

Historically, a viable defense to an alleged FCA violation is a motion to dismiss for failure to plead fraud with particularity under the Federal Rules of Civil Procedure Rule 9(b).

A healthcare provider facing a charge of impermissibly retaining an overpayment has a second defense available. A qui tam action brought under the PPACA's overpayment provision could be susceptible to a proper 12(b)(6) motion via the "public disclosure bar" of the FCA.

PPACA, however, has dealt several blows to the public disclosure defense. First, PPACA explicitly limited "public disclosures" to federal proceedings and reports, effectively nullifying a Supreme Court decision. Secondly, even if a disclosure has occurred in a federal proceeding, PPACA gives DOJ the opportunity to oppose a defendant's motion to dismiss. Lastly, by altering the exception to the public disclosure bar, PPACA has made it markedly easier for a private party to bring a qui tam suit.

Under the responsible corporate officer doctrine, an officer may be liable for civil and criminal penalties where the officer participates in corporate wrongdoing, knowingly approves of wrongful conduct, or was in a position to prevent wrongdoing but failed to do so.

Punishment for Medicare or Medicaid fraud usually involves excluding the individual from the programs for three years. However, HHS recently imposed a twelve-year exclusion on three pharmaceutical executives charged with misdemeanor drug misbranding.

PPACA Section 6402(d) is a small provision, but it will almost certainly have important and far-reaching implications for the healthcare industry. In addition, in the proposed overpayment rule, CMS is now pushing for ten-year look back period by amending the current regulation