AHLA's Speaking of Health Law

Compliance from the Cheap Seats: Lessons Learned from Recent Health Care Fraud Enforcement

American Health Law Association

Leah Voigt, Chief Compliance Officer, Corewell Health, and Anthony J. Burba, Partner, Barnes & Thornburg, discuss takeaways from recent health care fraud enforcement activity, recent compliance guidance from DOJ and OIG, and practical steps that health care companies can take to address, mitigate, and remediate risks in key focus areas for the government. Anthony and Leah spoke about this topic at AHLA’s 2025 Annual Meeting in San Diego, CA.

Watch this episode: https://www.youtube.com/watch?v=PviibFEEEpE

Learn more about the AHLA 2025 Annual Meeting that took place in San Diego, CA: https://www.americanhealthlaw.org/annualmeeting 

Essential Legal Updates, Now in Audio

AHLA's popular Health Law Daily email newsletter is now a daily podcast, exclusively for AHLA Premium members. Get all your health law news from the major media outlets on this podcast! To subscribe and add this private podcast feed to your podcast app, go to americanhealthlaw.org/dailypodcast.

Stay At the Forefront of Health Legal Education

Learn more about AHLA and the educational resources available to the health law community at https://www.americanhealthlaw.org/.

SPEAKER_00:

This episode of AHLA Speaking of Health Law is brought to you by AHLA members and donors like you. For more information, visit AmericanHealthlaw.org.

SPEAKER_01:

Hi everyone, my name is Leah Voigt, and my colleague Tony Burba and I had the pleasure of presenting at the AHLA annual meeting in June on the topic of compliance from the cheap seats. And neither Tony nor I have really been in the cheap seats. We've actually both been in the trenches when it comes to healthcare compliance and enforcement activity. I am a healthcare attorney by background and a compliance professional. Most recently, I was the chief compliance officer at Corwell Health, an integrated health system based in Grand Rapids, Michigan. Tony, let me hand it over to you.

SPEAKER_02:

Absolutely. I'm excited to speak in this topic again. My name is Tony Berba. I'm a partner at Barnes and Thornburg. I practice out of our Chicago and Washington, D.C. offices, and my practice really centers on fraud and abuse and compliance issues, everything from assisting uh clients with their compliance program to internal investigations, to defense of government investigations, especially around the False Claims Act. So it's definitely an area that I work in a lot, and we're seeing a lot of things happening in the market right now. So I think it's a timely conversation. I will say that I'll start with the same disclaimer that I gave at our panel at the annual meeting, which is these are all potentially fraught political discussions, and that's not our goal here. Our goal is really to talk practically about how some of these things that are being uh put forward as priorities for the current administration are affecting companies in the market and what companies can do to respond to those things both proactively and in the event that they end up getting um uh getting hit with some kind of investigation or audit or whatever. Um I'll just start things off and say, you know, in my practice, I am definitely seeing an uptick in several kinds of investigations. I think that, you know, with respect to the um corporate enforcement or the criminal enforcement priorities for uh DOJ, which uh just as a as a uh reminder were sort of five key areas. One was national security, including trade, cartels, and forest terrorist organizations, one was the opioid crisis, one was government fraud and waste, and then another is um combating actions which circumvent rules and regulations to protect American consumers and prioritize uh violations of the Controlled Substance Act and the FDCA or the Food Drug Cosmetic Act. So um we had had a number of uh discuss this quite a bit. I think within these priorities, which are pretty similar to the civil priorities that were stated by the civil division, um, you know, there's a number of things that the government I think is doing. Some of those things are a continuation from the Biden administration. Um, some of those things I think are a bit more um aggressive uh or have been put forward. So I think two areas that I'm seeing a lot of enforcement is um number one, the UPICs are incredibly active right now. Um really pursuing companies that are doing any kind of advanced wound care, um wound care related to skin grafts and those kinds of things. Um they're going after uh companies for you know purportedly providing cosmetic procedures. Um and then sort of more traditional areas as well, just sort of medically unnecessary services and those kinds of things. Um and then another area, another key area is COVID enforcement. Um the UPICs are definitely targeting as is the civil division uh COVID testing companies, especially labs set up by physicians during the early days of the pandemic. Um we got several clients dealing with that issue right now. And then the civil division seems to have a task force targeting uh those folks that took the paycheck paycheck protection program loans, and in particular the second of those loans. Um and those are basically CIDs coming to American subsidiaries of foreign uh inbound companies, and whether or not specifically those companies counted their foreign employees and their employee count when they uh applied for the second PPP loan. So um just sort of starting it off, those are two areas, those are some areas where I see a lot of activity right now. Um, you know, I'm not sure sort of um, you know, if you're sort of seeing anything, experiencing anything, hearing about anything sort of within those uh priorities, um, or if you want to sort of just sort of discuss some of the uh ways that a you know, those at least two initial areas of enforcement might be um addressed by a compliance officer.

SPEAKER_01:

Sure. Yeah. Well, well, Tony, you mentioned you pick activity. I would say I'm certainly hearing um that that is an increased area of focus. Um and with respect to um CMS, I think I would just note, we know it's in healthcare, we always have to keep our eyes on you know more than one agency or sub-agency within the federal government, um, and certainly something that um starts within CMS from uh, I'll say quote unquote routine audit approach can uh be handed over for enforcement, civil or criminal in nature. And certainly the False Claims Act is that that key. One of the things that we saw even before the new administration um came uh on board earlier this year was an increase in um target probe and educate audits by CMS. And some of those areas um that the agency was looking at are uh what compliance officers might call low-hanging fruit, you know, activities and TPEs in particular, looking at you noted wound care. That was a key area that CMS is auditing on as well. Also, medical necessity and ABNs, advanced beneficiary notices, the things that have been around for, you know, it seems like forever. Um, certainly if you've been a compliance officer in the last 10 to 15 years. Um, and it seems that there is an increased focus on reinforcing some of those rules that maybe hadn't been top of mind for healthcare organizations. And so all of those things together, I think, underscore one of the key themes that you and I spoke about uh in June, which is for compliance programs and for the healthcare organizations in which they reside to stay the course. Um, this is not the time to take your foot off the gas to use another analogy. Um, there may be a general view from executive leaders and from boards of directors that under the Trump administration that compliance activities are less important or not as prioritized. Um, and I think that would be a foolish uh conclusion to make because what we're actually seeing is that it's just as important, um, if not in some ways more intense, the activities that we're seeing in the enforcement priorities are different. I think as you're highlighting, Tony, and we'll get into this here more, I know, in the next 20, 20 plus minutes. You know, where do healthcare organizations need to shift their compliance focus, not take the foot off the gas or what have you, but rather to reprioritize some of those activities so that you're really focusing on what we're seeing are um, I'll say some new uh areas uh from the Trump administration.

SPEAKER_02:

Um yeah, no, I absolutely agree. I think that now is a very good time to do some uh sort of good practices, house cleaning, uh especially for those companies that are providing things like wound care, companies that took significant um you know monies or loans during the pandemic, or companies that were involved in COVID testing. Um similarly, you know, companies involved in the opioid industry, both pharmacies uh prescribing physicians and particular sober homes and other types of recovery um providers. You know, what I'm seeing a lot of is especially my clients that are smaller providers, smaller suppliers are running into issues uh with documentation, finding data that they need when they once the UPEG shows up in particular, or if the DOJ sends us on OCID. I've also seen some of the states, including Ohio, becoming a bit more aggressive with their investigation. So, you know, now is the time to really think through where your risk areas are and start doing your own internal audits, making sure your documentation is where it needs to be, uh, making corrections, uh, doing provider education on things like um documentation and those kinds of things, which are I think very traditional areas of uh compliance work. Um to your point, uh these are certainly not areas that are slowing down and if anything they're picking up. Um, my my standard joke with the government these days is it's not entirely clear that anyone works there anymore. Um, but you know, I think that because of that, and because there's been such a you know restructuring, especially at CMS and HHS uh and DOJ, that they really are leaning into their private contractors like the UPEX and the Macs and expecting them to carry the load in a lot of these areas. And because a lot of these uh audits are pretty predictable and what they're looking for is pretty well known, um it's definitely a good time to be uh doing some house cleaning.

unknown:

Yeah.

SPEAKER_01:

Tony, could we shift gears um just a bit and talk about um the executive orders and the the number of things that have occurred since those um early executive orders came out? It seemed like you know it was a slew of things um day after day from the space of January through March. Um what are we seeing now in terms of how the administration is continuing to reinforce what are some pretty significant policy changes, some departures from policies that really have largely been unchanged for the last uh 10 to 20 years?

SPEAKER_02:

Um Yeah, I think that uh you know we at our panel in uh San Diego talked about the two specifically two executive orders, executive order 14173 and 14168, both of which were signed on uh President Trump's first day in office. Um 14173 being the one that effectively um declared uh that the DOJ was going to disband all illegal government programs and directing the DOJ to uh uh pursue private companies, identify private companies that were in the words of the executive order in uh instituting illegal DEI. Um and then the other uh 14168 being the one that sort of related to the definition of biological sex and tying it to the uh the gender at birth as opposed to the gender that is identified by individual. Um and so at least with respect to my practice, I'm seeing a lot more activity related to the DEI uh area. Um many of my clients and many law firms and other institutions are uh even the ones that are remaining committed to uh diversity policies and procedures, are uh rebranding, uh, finding ways to uh restructure their programs, doing evaluations of those programs, pursuing to some recent guidance from DOJ that was put out, I believe, by Todd Blanch related to what constitutes, you know, quote, illegal diversity, equity and inclusion programs. I think that's not a bad practice to be in generally. Obviously, everyone wants to uh you know, end of pursuing diversity, equity, and inclusion, make sure that there is a focus on equity and inclusion for everyone. And uh I think that's a good thing. I think that um certainly the EEOC has stepped up enforcement, has been sending out a lot of letters, um, sending out letters in particular uh to federal grant and uh recipients of federal money, asking them to voluntarily produce documents um and to voluntarily cooperate with the administration uh to provide information and data on it. Uh diversity, equity, and inclusion. Um at least so far, I think you know, best practices seems to be to politely decline those invitations. Um generally speaking, they don't have the power under the contracts. And um I think you're just asking for uh a lot of trouble if you start producing a lot of information that could be protected by various state and federal laws and other things without proper process. I think my general advice to clients is to respectfully request that they provide some kind of you know actual legal process, so whether it's a subpoena or uh an administrative warrant or any number of other tools they have at their disposal so that there is a you know lawful basis for providing that information.

SPEAKER_01:

One of the other tools, which is um really a key component of an effective compliance program is ensuring um free and fair, I will say, disclosure of any potential violations of law and in particular disclosure within an organization. Um, the idea of whistleblower protections, the ability for um potential whistleblowers to communicate any um alleged violation of law has been, again, at the core of what we've considered an effective compliance program. Um, and we've seen the administration highlight the whistleblower activity as a way to further enforce the policies of the administration, both within the context of DEI as well as gender-affirming care. Um we uh saw the administration focus, for instance, on the whistleblower hotline maintained by the Office for Civil Rights. Um, and in that context, the administration focused on provider conscious rights, conscious rights. So the ability of a provider to say, you know, I don't agree with gender affirming care and therefore I don't want to participate in it in any way whatsoever. And so the administration um has highlighted that that hotline as a way for individuals to come forward and therefore to find another enforcement mechanism, um, particularly again around the DEI executive order and the policies contained therein, as well as the biological, sex, and gender affirming care um policies that the the administration has put forward. Are you hearing from any of your clients concerns about that whistleblower activity and anything that they are doing to shift, again, shift focus for their compliance programs?

SPEAKER_02:

Yeah, I mean, I think in particular, as I'm sure you painfully aware, um, at you know, institutions, large companies of any kind, but even in healthcare, um, you know, 90% of what comes through a traditional hotline is what would be considered traditionally to be more HR type issues. Um, I've had clients and um you know seen other trends in the in the um some companies where they even you know have the HR department primarily responsible for reviewing the hotline reports and sending any of the sort of ring in compliance over to the compliance department to investigate further. Now, I think that is a not a great practice to begin with because I don't think that you should be trusting your HR professionals to be able to assess and identify what a compliance issue may be. I think you need a little more associated. So but now especially many of these what would have been considered HR workplace complaints related to being passed over for a promotion or required to do certain types of training or having a boss who's giving favor to a particular group or class of people. Those are now potentially compliance issues and certainly uh based on you know some of the guidance that's come out of the Department of Justice encouraging whistleblowers to come forward, um, I think it's now going to be uh an area where if there is legit legitimate false claims act and other types of enforcement risk. Um, so I think that uh for sure like you know certainly the clients I'm working with, uh others I'm talking to in the industry are certainly cognizant of that and sensitive to that and really rethinking how they look at those things. Um obviously the sort of counter to that is there's now a judge in the middle district of Florida who's ruled that the key TAN provisions to the false claims act are unconstitutional, and that case is kind of working its way up. And we know that there's at least two Supreme Court justices that may um agree with that. So it'll be interesting to see how you know those the the tension between uh what's happening in the courts and what the administration is encouraging people to do ultimately resolves itself. But um but yes, I think that especially when it relates to diversity, equity, and inclusion, um there needs to be a heightened sensitivity around the compliance request. You know, I think even things that you know maybe you know, two years ago, eight months ago would have been considered to be kind of a crank, you know, and uh a 50-year-old white male at an executive level complaining about being passed over for a promotion, you know, I don't know that even HR would have necessarily dealt with that. Um, but I think that the way they're dealing with it now is very different and has to be very different based on what the administration has said. That becomes a legitimate risk to the organization.

SPEAKER_01:

And as you and I talked about in June, this is an area of the compliance program where some re-energization is is likely called for. And I think, as you're noting, um for the compliance team to um stay more involved, if not potentially taking the lead along with legal and HR colleagues, of course, in collaboration when these types of concerns are being raised because of the um new legal um quiet wire that organizations are finding themselves in in these areas. I'm also wondering, Tony, if we could talk a little about the um shifting gears again a bit, the DOJ's um approach to white collar enforcement and the shift toward a voluntary self-disclosure approach. Um, the kind of general, I'll say, gist of um the current DOJ's perspective on this is that prior enforcement priorities were really placing too much of a burden on businesses in the United States, including healthcare businesses, um, that was essentially you know too high of a cost from an enforcement standpoint. And again, um, you know, without digging deeper into it, one might conclude that, well, this means that, you know, the the foot is off the gas. Um, but there's another way of looking at this because the DOJ has said, well, really what we're talking about is the importance of voluntary self-disclosure as a way to essentially avoid prosecution. Self-disclosure requires the organization to understand what's actually going on within its proverbial or um virtual four walls. And so the role of the compliance program, again, is just as important, if not more important, if organizations are trying to stay in line with the DOJ's current approach. Could you talk a little bit more about that and again what you're how you're seeing your clients react to um the criminal enforcement approach?

SPEAKER_02:

Um absolutely. Uh, and I think that you know one of the key changes in DOJ's policy has been that whereas uh a declination previously was something that was on the table if you self-disclosed, now it's mandatory if you meet the requirements under the uh DOJ self-disclosure protocol. So there is a great benefit to coming forward and self-disclosing. Um and I think you know, there's sort of two things I would highlight there and that I've talked about in other forums. Um, one is uh just the interplay between legal and compliance. You know, I think that a good healthy compliance program, especially in an environment that's uh rewarding self-disclosure, will give a fair amount of autonomy to the compliance department to conduct non-privileged investigations because what all of these government policies, the CEP, the um you know, guidance to prosecutors, prosecuting business organizations, all of the guidance, even the OAG's recent um program guidance on compliance, um all of those things really highlight the need for uh transparency and for those who are self-disclosing or dealing with the government and investigation to be able to, you know, when I say show your work, right? Um they don't just want to see your conclusion, they want to understand how your program's functioning and that it is functioning, and if everything's occurring behind the veil of privilege, that can be a challenge at times. Um the other thing I would say is, you know, at least with respect to um corruption-based crimes, um, while I think that the Foreign Uh Corrupt Practices Act investigations have certainly shifted their focus, you know, any American company that's operating internationally, device manufacturers, drug uh manufacturers, and distributors are still likely subject to any number of other anti-corruption laws in within the individual countries where they are operating, as well as the United Kingdom's anti-corruption law, which has a breadth similar to the traditional enforcement of the FCPA. So if you're doing business in the United Kingdom, that can also um tie you to more traditional things. The anti-kickback statute, on the other hand, is aligned well, as is the START law, and both are being used um even by the UPIX as a basis for seeking uh reimbursement.

SPEAKER_01:

So, Tony, what um what things do you think compliance officers should be thinking about that maybe they're not thinking about or maybe they haven't thought about at least up until this year? Where do they really need to shift their focus as we've been talking about?

SPEAKER_02:

Uh yeah, one area that we have not talked about today, I think we touched on it in our presentation, would be immigration. Um, I think that that uh that would be on multiple, multiple levels, right? I think you know, verifying uh uh and making sure that all visas and other documentation is in order when you bring in and for instance a foreign physician, um, that you understand the requirements and that you do everything as closely to the letter of the law as you can. Um, and maybe going back through if you're, for instance, a university or an academic medical center, going back through and sort of auditing your uh the paperwork on various visa holders that are either matriculating or that are teaching or that are you know practicing within your organization. Um and the other sort of critical thing here, and something that I've been doing a lot of, um, is that you know traditionally healthcare providers in particular were relatively safe from ICE activity. They were sort of off-limits along with churches and schools. Um there have been sort of viral videos circulating on the internet, and I've heard of other instances with um individuals showing up at hospitals or at physicians' offices trying to get access to a patient or an employee trying to gain access to the uh office. So I think now more than ever, there needs to be a compliance focus on ensuring that the people, especially your frontline employees, receptionists, uh schedulers, those kinds of people um understand what the rights of the organization are and what the preference of the organization is as to how to enforce those rights and what their own personal rights are. Um, because there's also been um a number of um criminal prosecutions, including a judge in Milwaukee, for people who have, you know, to the government's perspective, done more than they are allowed to do to inhibit ICE from obtaining access to a person. Right. And so to me, that's typically you know, you don't lie, you don't um you know, encourage an individual to flee or anything like that. I think you need to have a process of in place so that you know what's gonna happen, right? I think you know, at a base uh at a base, you know, everyone needs to understand that a hospital, uh physician practice, even a factory floor is a private space, not open to the public, which means that the government must have a warrant to come in. And um I encourage all of my clients to demand that because especially when you're talking about something as sensitive as healthcare treatment, um, the last thing you want is um people who don't really have a need there in terms of the treatment of the patients coming into that area and disrupting you know what's happening, uh, which is far more critical, I think, for patients. So um, you know, and I think you have to be careful. The enforcement in this area has been, let's call it non-traditional. Um you know, I think those operating as ICE agents and those um deputized to go along and work with ICE agents, including FBI agents and ATF agents and others, even IRS agents um feel emboldened. Um, you know, I've heard that they have you know, they'll come in wearing masks, they will you know, represent to the individuals on the floor that they have more authority than they do. They threaten they threaten people with prosecution for demanding a warrant. Um while all of these things would be concerning to me on a number of different levels, um, I think it just reinforces the fact that comp a good compliance program right now really needs to be educating all of the the entire organization on what the institution's priorities are, um, what you know their rights are, and what they expect of those frontline employees should they have an interaction with immigration authorities.

SPEAKER_01:

So, Tony, you're highlighting what has been the case for some time now, which is that interactions between healthcare organizations, particularly those that are providing direct patient care and law enforcement, is uh can be a legal and regulatory landmine for everyone involved, um, and can also have a real impact, of course, on community relations between the organizations. Um, one of the things that I think is important is not only the education on the priorities and what the policy and process is within a healthcare organization to address a request from or the presence of law enforcement, but also creating very simple processes for your frontline caregivers and your other team members, who do they reach out to when law enforcement is contacting them or standing in front of them because this is such a fraught area, and in particular now with ICE enforcement and it being what it is, um making sure that your team members know who to call, where do they go to? If you're a large healthcare organization, you probably have um a physical security team that can really step in and help. If you're a smaller organization, um, you know, that can be really tough. And this is where I think your compliance officer, your risk manager, um, your legal counsel, someone who can take that call because having your team members navigate that on their own, even with all of the education, the understanding in the world, um is still just incredibly difficult and in a very um what can be a very tense situation. So who to call and identifying who that is, I think is is first and foremost from my perspective.

SPEAKER_02:

Yeah, and I think that uh you know one of the things that we've worked a lot with our clients on is development policies. I think now more than ever, that's an important thing to have that lays out what you know who might come, what kinds of service they might provide, you know, what what the difference between a you know judicial warrant and an administrative warrant and a grand jury subpoena and a you know administrative subpoena are, and what your rights are and what you can't. Can and can't uh or that does and does not allow the government to do. And as part of those policies, we're recommending that you have sort of a first response team or an inspection team that's identified with contact information within that policy, and that's posted at all frontline locations where the public is interfacing with the employee. So again, if it's a physician practice, likely to throw desk, uh on the sign, you know, signs on the doors indicating that areas are private, and then a list of people right next to the telephone that you know the person should be empowered to call immediately when the uh government uh agent does show up.

SPEAKER_01:

Yeah. Well, Tony, this has been a far-ranging conversation. Again, I know you and I could spend hours um and then some um talking about everything that is healthcare compliance. Um, we are rounding out our time. So one more uh question for you, Tony. What is the the one or two things that um you want to be sure to share that you haven't had a chance to share yet? And then I'll uh provide my thoughts and wrap us up.

SPEAKER_02:

Absolutely. Um, you know, I think one thing that we talked about at length during our presentation in June that I think is just as relevant now. Um, as I said at the beginning, these are politically fraught in some instances, moral um questions as to how these organizations are going to respond. And the time to have those conversations is not while the government's on our doorstep. Um I'm really encouraging my clients to have those sort of what I would consider to be normative or ethical discussions now, well before the government shows up because that's going to inform what your policy is and what you're gonna do in different situations. Um, if your uh board of directors is very uh pro-immigrant, for instance, but you have a CEO who's very you know pro government enforcement, you know, that conflict could really cause a lot of harm to the organization if it's playing out while the government is trying to access that facility. And so I think organizations at their board meetings, at their executive meetings, at their compliance team meetings need to be having these conversations about you know, what are our values as an organization? How do we do these different things that the government's doing and how are we going to react? Um, because again, um you're really not those conversations take time. Sometimes they take mediation, they take outside uh consultants to come in and help the organization through conflict. And you just don't have time for that if the government, if there's a federal agent at your door demanding access to your facility in order to go after a specific employee, or to just go through and do an audit of all your employees who may be undergressed to see if they can be taken. So those are all uh very important conversations, and I think that organizations should be having those conversations and renewing those conversations on a monthly or quarterly basis to make sure that you know they're they continue to be aligned with what's actually happening, you know, in the in the industry.

SPEAKER_01:

Yeah, I couldn't agree with you more, Tony. Um having the time with your executive leadership and your board to talk about what really are kind of first or foundational principles for your organization is always important uh from a compliance officer's lens. It's even more important now when we are uh continue to experience, again, significant departures from policies that have been in place for the last decades and where we've seen historically incremental change administration over administration. We're seeing some pretty uh significant departures, if not um, might I say radical departures from policy. And so it is imperative, as you're noting, to have those conversations, have them proactively, know where your values are as an organization. And I would add also know where your risk appetite is with respect to not only the various policy initiatives, but then also with respect to your potential for enforcement. Um, you know, that's not something that historically compliance officers like to talk much about. Um, that we follow the law regardless, or at least we want our organizations to do so. But I think given all of the things that we're experiencing as a healthcare industry, that it is really important to have those foundational discussions. And then, as you said, to keep coming back to them. Um, it's great to have the conversation once and say, well, we've done that, let's check the box. Um, but given the pace and the volatility um that we're experiencing, uh you have to continue to come back to it. So carving out that time is absolutely crucial.

SPEAKER_02:

Absolutely. If your organization is going to be on the front page of the Wall Street Journal, what do you want the headline to read?

SPEAKER_01:

That's right. That's right. Well, let's hope neither one of us or our organizations, uh, current or former find themselves in that situation. Um, Tony, thank you as always for the conversation. Thank you, everyone, for listening. Um, we want to give a shout out for AHLA's annual meeting next summer, uh, June of 2026 in New York City. Um, can't wait to see you all there. And hopefully we'll have more compliance uh uh to talk about with you then. Thank you.

SPEAKER_02:

Thank you.

SPEAKER_00:

If you enjoyed this episode, be sure to subscribe to AHLA Speaking of Health Law wherever you get your podcasts. For more information about AHLA and the educational resources available to the health law community, visit Americanhealthlaw.org and stay updated on breaking healthcare industry news from the major media outlets with AHLA's Health Law Daily Podcast, exclusively for AHLA comprehensive members. To subscribe and add this private podcast feed to your podcast app, go to americanhealthlaw.org slash daily podcast.