Attorneys and compliance professionals in the health care industry are routinely required to help their clients interpret complex laws and regulations, often without sufficient authoritative guidance from regulators.  Because failure to comply with regulations can result in significant consequences to the organizations that they advise, these professionals have a critical role in risk management. Indeed, whether a health care company acted reasonably in light of ambiguous authority is frequently at issue when proving liability under the federal False Claims Act (FCA).  A recent case before the U.S. Supreme Court, U.S. v. Supervalu, may prove to be a pivotal turning point in FCA jurisprudence on this issue, depending on how the court rules. BCLP’s analysis of the issues and ramifications raised by Supervalu for the upcoming ruling was featured recently on Law360; subscription may be required. Additional information can be found here as well.

To be highly effective in this risk management role, advisors must not only understand ever-evolving, complicated laws and regulations, but must balance a variety of interests, including legal, compliance, business demands, and personalities within the organization. This is often quite challenging, and practical guidance in this area can be elusive. Below are key practical takeaways to mitigate risk when laws and regulations are unclear. These are strategies that BLCP’s health care practice group has amassed through years of advising senior-level attorneys and executive-level business personnel.

• Become a trusted advisor. When advising the business team on regulatory and compliance matters, it is important to build trust and understanding with this team, with the ultimate goal of having them view you as a critical part of their team.  If you can demonstrate to this team that (i) you value their input and want to achieve the business goals while still managing risk to an acceptable level and (ii) you are a creative problem-solver to achieve this balance of business goals and risk tolerance, the business team is more likely to include you in earlier stages of the decision-making process, thus allowing you to issue-spot, provide solutions and guidance and ensure decision-making is documented appropriately.
• Documentation. In practice, business discussions about regulatory interpretations often take place without attorney or compliance personnel input. With the advent of texting and email, these communications are often documented in writing and are not subject to the attorney-client privilege. These real-time, documented communications can be a high-risk area for businesses and risk in this area may increase if the court in Supervalu decides that these non-privileged communications are relevant in determining knowledge under the FCA. Ideally, legal and compliance personnel can work with the executive and business team to train them on best practices regarding these types of communications, as discussed in more detail in the training section below, such that non-privileged communications of this type are not recorded in writing. However, if such documentation is created, attorneys and compliance personnel can mitigate risk by (i) obtaining copies of such communications and (ii) working further with the business to team to create careful and contemporaneous documentation to more precisely explain the legal and compliance justification for the interpretation of the rule. This documentation may be helpful if the one day the business must defend its position in an FCA and waive the privilege with respect to any relevant privileged communications.
• Training. Frequently and continuously train business and other personnel on underlying laws and regulations. This can be done formally, through presentations and webinars, but it is also important to remind the team of important regulatory concerns informally, without technical legal jargon. Formal trainings should be documented, including attendance, to help bolster the defense that the company never intended to violate any laws. In addition, it is important for executives and the business team to understand the role their emails, discussions and other written communications regarding regulations and business objectives can play in establishing liability under intent-based statutes like the FCA or federal Anti-kickback statute. For example, in S. v. Supervalu, the Supreme Court will decide whether companies can be liable under the FCA for claims submitted to the government based on the company’s subjective belief (as established through emails and other documented conversations of executives), even if the company’s position is an objectively reasonable interpretation of the law. Similarly, reminders about what is privileged (and more importantly, what is not protected by attorney-client privilege) and how to ensure the privilege is not inadvertently waived are also important as a risk mitigation tactic.
• Consult outside counsel. Outside counsel can be helpful in a number of ways beyond the obvious. Since outside counsel provides feedback to clients throughout the industry, they can often have a good sense of what is “market” for a particular term or approach, in light of developing case law and incomplete authoritative guidance. Outside counsel can also serve as an independent voice if in-house legal, compliance and business teams are having a difficult time agreeing on an approach. Use of outside counsel also helps bolster the defense that the company never intended to violate any laws; indeed they spent significant resources engaging outside counsel to help guide them. Privilege assertions are also less susceptible to challenges when outside counsel is involved.
• Response plan. Create a response plan for how you will respond to reports or allegations of fraud and how you will respond to governmental inquiries. The plan should complement other internal governance and compliance procedures. Once the plan is established, it should be disseminated to key employees in roles likely to be the subject of these allegations or inquiries. The plan should establish:
  • Steps to ensure prompt communication with a potential whistleblower or government regulator;
  • Criteria for conducting an internal investigation and criteria for determining if allegations or inquiries rise to the level of necessitating an independent, internal investigation conducted by outside counsel;
  • A single point of contact within the company who will be responsible for all company communications with the government or whistleblower; and
  • A data collection plan and an individual within the company who will be responsible for ensuring the data is retained and segregated until the conclusion of the matter.

We hope the above strategies prove useful for attorneys and compliance professionals alike.