The federal and state responses to COVID-19 have resulted in a dizzying and ever-evolving array of executive orders, waivers, flexibilities, emergency declarations and enforcement discretion (collectively referred to as “regulatory flexibilities”) that significantly change the rules governing health care providers. Although regulatory flexibilities and relief funds are in part intended to shield front-line responders from liability and mitigate financial losses, taking advantage of these accommodations comes with independent risks. While not exhaustive, health care providers should be aware of the following six pitfalls and practical takeaways to avoid them.

Pressures on Health Care Staff Increase Whistleblower Potential Beyond the Norm

The pressure of the COVID-19 public health emergency has prompted organizational providers to rapidly expand capacity in the face of supply and staffing shortages or, conversely, to cut costs drastically in an effort to stay afloat as elective (and typically more profitable) services are limited, delayed or canceled. This creates a unique workload and financial pressures on health care workers. Widespread employee dissatisfaction in the wake of COVID-19 will fuel a range of lawsuits, including the potential for fraud litigation, with overworked, furloughed, or terminated employees blowing the whistle on practices perceived to be noncompliant both during and predating the public health emergency. The sheer increase in the volume of laid-off or financially disadvantaged providers will likely increase the number of whistleblower actions.

Also, the confusion and constant evolution of legal requirements in the COVID-19 environment may independently trigger a deluge of whistleblower activity. Health care workers with legitimate concerns about the lack of appropriate PPE may not realize that their concerns are not the result of noncompliance or negligence on the part of their organization. The ever-changing regulatory flexibilities and associated guidance mean that previously recognized “best practices” or prohibited conduct may frequently change or be temporarily permitted, leading health care workers to question organizational practices. Disagreements will continue to arise between health care organizations and their workers related to tough choices necessary to effectively respond to COVID-19 financial and patient care pressures. In short, even compliant practices may trigger whistleblower activity if there is confusion and miscommunication about changed practices.

Regulatory Flexibility and Relief Funding Are Separate: Don’t Confuse Them

Providers should not confuse regulatory flexibility with relief funding: the remedy for a strained operational response is regulatory flexibility, and the chief remedy for significant financial loss is relief funding. Providers do not necessarily have carte blanche to take advantage of every regulatory flexibility for any and all patient care scenarios, and liberal interpretations of the scope of these flexibilities may create additional liability. It is reasonable to anticipate the health care industry’s response will be second-guessed at some point.

The False Claims Act (FCA) is the federal government’s primary vehicle for imposing civil penalties on health care providers who knowingly submit claims to Medicare or state Medicaid programs that do not meet the conditions of payment. During this public health emergency, several of these conditions have been altered or waived through regulatory flexibilities. Generally speaking, a waiver is appropriate only as needed to respond to the public health emergency. Depending on the scenario, if a provider uses regulatory flexibility beyond what is necessary to respond to COVID-19, the provider may not meet the applicable conditions of payment and may be exposed to FCA liability.

There Is No Immunity from Fraud

Even the broadest, most encompassing immunity available during the public health emergency does not protect against willful misconduct. Additionally, the confusion and fear of a pandemic creates an ideal situation for bad actors to engage in fraud. Fraudulent submission of claims can trigger both criminal and civil penalties, and the government is moving swiftly in this regard. State attorneys general have begun forming joint task forces with U.S. Attorneys with the specific purpose of targeting COVID-19 related health care fraud. Already, the U.S. Attorney’s Office for the District of Rhode Island announced it had filed federal criminal charges in response to a fraudulent application for a Paycheck Protection Program (PPP) loan.

Scope, Scope, Scope

It cannot be stressed enough: every government action limits risk in different ways. The term “blanket” waiver can be misleading. Every regulatory flexibility is limited by:

• the jurisdiction and authority of the government branch or agency that issued it;

• the provider type to which it applies;

• the conduct it protects or permits;

• the geographic area to which it applies;

• the timeframe of its applicability; and

• the specific relief it provides.

For example, some states have issued executive orders protecting health care entities and individual providers from professional liability under state negligence laws for services rendered in response to the public health emergency. Some states recognize that providers operating under an expanded scope of practice or license, and with limited resources available, might not meet the pre-COVID-19 standards of care. But immunity from patients’ medical malpractice claims in state court does not preclude the U.S. from imposing penalties when the same conduct violates unwaived conditions of payment for claims related to that treatment. This is particularly true for allegations that services were not medically necessary. Moreover, while negligence may be excused under state immunities, most levels of culpability beyond that (e.g., recklessness or gross negligence) are not waived.

Failure to attend to the scope and time-limited nature of regulatory flexibilities may form the foundation of a whistleblower’s argument that the provider knowingly submitted a false claim. Providers that affirmatively modify operational processes in reliance on regulatory flexibilities will be ascribed with knowledge of the applicable limitations and timeframe, and it may be difficult to establish that the submission of noncompliant claims was an unknowing mistake rather than knowing fraud, particularly once the emergency expires.

Today’s Relief is Tomorrow’s FCA Investigation

The relief funds authorized under the CARES Act, such as the Provider Relief Fund and the PPP, are built-in sources of FCA liability. Federal and state fraud investigations and enforcement are certain to arise from pervasive audits related to relief funds. The Provider Relief Fund website explicitly states that the terms and conditions for the funds are intended to combat fraud and that “[t]here will be significant anti- fraud and auditing work done by HHS, including the work of the Office of the Inspector General.” Unfortunately, the terms and conditions attendant to the various relief funds are constantly evolving, making it difficult for providers to evaluate their ability to comply with the terms and the risks of accepting the funds.

Applications to obtain relief funds or enroll in new payment programs likely constitute a “statement” for purposes of the FCA and often include a tick-the-box certification of eligibility for the funds and compliance with the terms and conditions. If any part of the certification of eligibility for funds or compliance with the terms and conditions is knowingly or carelessly false, the entire amount provided under the grant, loan or program may be clawed back, with penalties. The risk of accepting relief funds without monitoring for updates to the terms and conditions can be significant. For example, large publicly-traded companies who received PPP loans were given a deadline to return the funds after the agency updated guidance defining the term “necessary” in the loan applications. Providers who fail to understand the scope and limits of each relief mechanism, whether regulatory or financial, risk civil and criminal penalties.

Immunity from Liability does not Mean Freedom from Suit

As discussed above, regulatory flexibilities offer limited protection when providers comply with the specific language, scope and applicability of a waiver or interim rule. Provider relief funds are available if providers meet all of the eligibility requirements for the assistance type and amount awarded. But even when organizations act diligently and in good faith to comply with all the elements required, whistleblowers and the government alike can contest the organization’s good faith as it applies to each element. This is further complicated by a lack of available guidance when taking advantage of regulatory flexibilities.

Appropriate documentation will be the provider’s best evidence against fraud. However, a favorable decision may not come until the summary judgment stage, after discovery and pre-trial litigation which is extensive, expensive and intrusive. Depending on the nature of the suit, the cost of a successful defense can rival the avoided damage award.

Practical Takeaways: Avoiding Pitfalls

Only use the regulatory flexibilities and relief funds that you reasonably need and document your good faith decision-making when you do use them.

• Perhaps challenging under the circumstances, the best way to avoid litigation is to minimize reliance on regulatory flexibilities and relief funds. When needed, document that your decision to use a regulatory flexibility was appropriate or necessitated by your COVID-19 response effort, as supported by the testing numbers, projections in your community, resource strain or availability, and other relevant considerations.
• Not only will diligent documentation assist with any future audit, but it should also assist the decision-making process itself and aid the organization in determining how to phase out reliance on regulatory flexibility.
• As a practical tip, save copies of guidance documents that influence your decision-making processes. As these documents are updated, older versions are typically removed from the agency’s website. Obsolete documents may be evidence that your compliance efforts were undertaken in good faith even if they fall short.
• Seek advice of counsel to assure you are acting in good faith, and without the knowledge or carelessness that could lead to FCA risk.

Act with an eye toward the optics.

• The perception that a provider is needlessly cutting costs, does not support front-line workers or is trying to silence health care workers who are speaking out will only prompt additional scrutiny and increase the likelihood of whistleblower action, regardless of whether the organization’s efforts are undertaken in good faith.
• Communicate to health care workers, patients and the community about the organization’s commitment to providing high-quality patient care, compliance efforts, the reason for changes in policies or staffing due to regulatory flexibilities and financial concerns, and the organization’s support for front-line workers.

Dedicate sufficient resources to compliance with regulatory flexibilities and relief funding programs.

• Know the applicable conditions and adapt to any later issued changes in guidance.
• Make sure key personnel understand the timeline for returning to normal when each regulatory flexibility expires.
• For processes that may be permitted post-public health emergency (for example, telemedicine and in-home health care services), start shifting waived requirements into compliant processes in advance of the expiration of the waiver or temporary flexibility.
• Always ensure that conditions of payment known and applicable at the time of treatment are met before submitting claims to government payors.

Actively monitor updates to regulatory flexibilities and relief funds terms and conditions.

• Senate Majority Leader Mitch McConnell recently stated that legislation may be introduced providing liability protections for organizations acting in accordance with public health guidance. This may provide broader liability protections than may otherwise be available under the regulatory flexibilities, but until details about the scope and applicability of such protections are released, providers should continue to act with an eye towards compliance.
• Regularly monitor agency websites for guidance documents, such as Frequently Asked Questions or FAQ, on existing flexibilities and programs.
• Monitor legal alerts issued directly from the relevant state and federal agencies.
• Monitor legal alerts from your state hospital association and other state and federal provider associations.

This post was adapted from the original article in Hall Render Killian Heath & Lyman’s blog, with links to additional information and resources.

This article is published on the State Bar of Wisconsin’s Health Law Blog. Visit the State Bar sections or the Health Law Section web pages to learn more about the benefits of section membership.