The Problem of Criminal Penalties in Civil Statutes:
From Anti-Kickback to HIPAA, is the Scienter Requirement for Culpability Too Ambiguous?

By Alexander L. Bednar, J.D., LL.M. candidate

In recent years, our federal legislature has seen fit to regulate the medical profession using an underlying paradigm of deterrence. Federal agencies, such as the Federal Bureau of Investigation (FBI), have exponentially increased the number or yearly arrests for healthcare-related federal crimes. See New Medicare Coverage Process Can Help Improve Compliance, Medicare Compliance, May 6, 1999, at 1:
# of Agents
 # of Indictments
# of Convictions

See Growth in FBI Health Fraud Enforcement, Medicare Compliance supra, at 7. Numerous federal statutes are designed to impose extremely harsh civil and criminal penalties upon individuals and entities in violation of federal law. Thus, like the Racketeer Influenced and Corrupt Organizations provisions, these health care statutes are often considered hybrid. Criminal law scholars argue that traditional mens rea requirements must be met, particularly if individuals are to be subjected to time in prison. Courts, however, cannot assess the mental culpability of institutions, nor can a corporation be jailed. Furthermore, scenarios arise, especially during hospital mergers, where one entity absorbs an entire department that might be billing improperly, or a remote staff that has allowed for dissemination of protected health information. Often, health care employees who commit these mistakes simply are not aware of the legal ramifications of their actions, nor have they been warned about them.

While the legislature has repeatedly designated the scienter requirement as "knowingly and willfully," it has failed to provide a clear threshold definition of this phrase. Circuit courts have created a spectrum of definitions for this phrase, and the Supreme Court of the United States has yet to resolve the issue. Some circuits offer a strict liability approach to scienter (See United States v. Greber, 760 F.2d at 68 (3d Cir. 1985)), while others focus upon the actual intent of the defendant. See Hanlester Network v. Shalala, 51 F.3d 1390 (9th Cir. 1995). Furthermore, other courts have developed unique intermediate standards of culpability which lie somewhere in between. See United States v. Jain, 93 F.3d 436 (8th Cir. 1996). Clearly, the best approach is a case-by-case analysis with a balanced perspective, where jury instructions are not tipped toward strict liability, but instead toward fact- specific proof of purposeful intent.

The high court and our legislature may well learn from mistakes of the securities industry. Causes of action under Rule 10b-5 have become numerous, in large part because the same standard of "knowing and willful" conduct is the threshold analysis for securities fraud. See Francine A. Ritter, Accountability of the Independent Accountant as Auditor in the Wake of Central Bank: Does the Implied Private Right of Action Survive Under Section 10(b) and Rule 10b-5, 31 Suffolk U. L. Rev. 873 (1998), citing Edward Brosky, "Accountant’s Liability in the Savings and Loan Crisis," 204 N.Y.L.J. 22, 26 (1990)(describing the proliferation of secondary claims against independent accountants during savings and loan crisis); also citing Daniel L. Goelzer, et al., Financial Statement Fraud and Auditor Liability, at 189, 235 (PLI Corp. Law & Practice Course Handbook Series No. B4-6731, 1985)(mentioning the increase in private secondary 10b-5 suits against auditors of publicly-owned corporations); also citing Newton M. Minnow, Accountant’s Liability and the Litigation Explosion, J. Acct. Sept. 1984, at 70, 72-73 (also citing number of lawsuits against accountants). A recent Ninth Circuit case of first impression under the rewritten Private Securities Litigation Reform Act of 1995 [hereafter PSLRA] defined "knowing and willful" as "deliberate." See Janas v. McCracken (In re Silicon Graphics Inc. Sec. Litig.), 195 F.3d 521 (9th Cir. 1999). The Ninth Circuit in Janas has thus created a higher level of conscious fault, and raised the threshold necessary for the government to prove scienter in securities fraud. Because the penalties can be so stringent, greater proof of mental culpability seems justified. Perhaps such a heightened mens rea requirement of "deliberate" would reduce litigation by government agencies, if imported into the health care arena.

I. A History of Scienter: Anti-Kickback

Passed in 1972, the Medicare-Medicaid Anti-Kickback statutes originally attached misdemeanor liability to soliciting, offering, or receiving of "any kickback or bribe in connection with" furnishing goods or services (specified under the statute) or referring a patient to a provider of these certain services. See Social Security Amendments Act, Pub. L. No. 92-603, §§ 242(b) and 242(c), 86 Stat. 1419 (1972). In 1977, Congress then changed the language to exclude the receipt or solicitation of "any remuneration (including any kickback, bribe, or rebate)" in return for referrals, in order to prevent the payment or offer of such remuneration to induce referrals, and to make felonious any violations of this statute. See Medicare-Medicaid Antifraud and Abuse Amendments, Pub. L. No. 95-142, 91 Stat. 1175, 1181, 1182 (1977) (emphasis added). The scienter requirement was added in 1980 after Congress changed the charge from a misdemeanor to a felony in order to curb the growing amounts of fraud and abuse in Medicare. See 42 U.S.C. 1396h(b) (1980).

The "knowingly and willfully" requirement was also added in 1980 [in the Omnibus Reconciliation Act of 1980, Pub. L. No. 96-499, 94 Stat. 2599, 2625 (1981)], and then in 1987 the Medicare and Medicaid statutes were combined into one statute (42 U.S.C. §1320a-7b (1987)), and Congress gave power to the Office of the Inspector General (hereafter IG) to bar persons and organizations that violated those statutes. See Medicare and Medicaid Patient and Program Protection Act of 1987, Pub. L. No. 100-93, 101 Stat. 680, 681-682 (1989). Section (b) of the Anti-Kickback Statute on "Illegal remunerations" has three main divisions: part 1 covers receiving and soliciting; part 2 refers to offering or paying; and part 3 describes scenarios that will avoid liability under the statute. See 42 U.S.C. §1320a-7b(b) (2000). The exceptions in part 3 pertain to price reductions, discounts, employment arrangements, and group purchasing agreements. Id. According to John B. Reiss, the IG established that these "safe harbors" be restricted to acts of employees. See John B. Reiss, Commentary on Payment and Reimbursement Issues Affecting the Marketing of Drugs, Medical Devices, and Biologics, with Emphasis on the Anti-Kickback Statute and Stark II, 52 Food Drug L.J. 99 at 104 (1997)(the IG "severely restricted these statutory exceptions other than that for employees").

In what appears to be a case of "adding insult to injury," besides attaching criminal liability, any person or entity that violates paragraph (1) or (2) is also subject to a civil money penalty of not more than $50,000 for every violation; furthermore, that person is also subject to an assessment of damages. See 42 U.S.C. §1320a-7a (2000). Many compounded government claims for monetary damages have been so ridiculously high, that some courts have recently been chastising the government agencies for the outrageousness of their cases against health care providers. See U.S. v. Krizek, 7 F. Supp. 2d. 56, 60 (D.D.C. 1998) (witty comment by a federal judge ridiculing the "astronomical" amount of damages sought by the government, and also mentioning that the government’s assault on this "fine physician" was "reminiscent of Inspector Javert’s quest to capture Jean Valjean in Victor Hugo’s Les Miserables").

II. Since Prison Time is one Punishment Option, Proof of Criminal Intent Should Accompany a Prima Facie Case Against Medical Providers

While all of us have etched in our memories from the movie "Wall Street" the knowledge that securities fraud may result in jail time for offenders, we often overlook the fact that many of the federal health care statutes provide for similar punishments. Currently, under the Anti-Kickback Statute, "knowing and willful" violations have a potential of "up to five years imprisonment." 42 U.S.C. 1396b(h) (2000). The Health Insurance Portability and Accountability Act of 1996 (HIPAA) also carries similar penalties for "knowing" violations of privacy in health care settings. For example, Section 1177 states that a:

"person who knowingly and in violation of this part--(1) uses or causes to be used a unique health identifier; (2) obtains individually identifiable health information relating to an individual; or (3) discloses individually identifiable health information to another person, shall…(1) be fined not more than $50,000, imprisoned not more than 1 year, or both; (2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and (3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both." See Pub. L. No. 104-191 (1996)(emphasis added). While HIPAA violations by a "knowing" defendant could result in a ten-year prison sentence, there is a clear lack of statutory language explaining what exactly represents a "knowing" action. This dearth of guiding language manifests an urgent need for legislative and judicial clarification of scienter.

Numerous questions arise as to what would trigger a heightened "knowing" violation under HIPAA. If a database caretaker hires a subordinate to help her with data entry, would the caretaker be liable for violations of the new employee, if the caretaker "should have known" of potential violations? Could liability exist under an agency theory? A Greber court would apply a per se analysis of the violation, and look only to the actus reus to find liability, whereas a Hanlester court might delve deeper into the actual intent of the defendant, to see if the defendant knew of the statute. On the other hand, a Jain court might inquire if the defendant knew her conduct was fundamentally wrong, without requiring knowledge of the statute.

Because the legislature designed "safe harbors" in the Anti-Kickback Statute, as well as in HIPAA, it appears a per se Greber strict liability approach to scienter is contrary to legislative intent. Furthermore, a wholly subjective standard would likely relax the urgency to comply with current statutes as malfeasant defendants might consistently claim ignorance of the law as a defense to liability. A compromise approach seems to offer the ideal remedy – a definition of "knowingly and willfully" that incorporates tangible proof of deliberate violation of statute. If legislators are concerned about the notion that such a narrow definition of scienter might be applied to other types of federal criminal prosecutions, they certainly could specifically restrict such a definition to specific health care statutes, such as HIPAA.

Some commentators have welcomed the paradigm of deterrence, and have even clamored for harsher criminal punishments than those existing in the statutes. One specific writer has suggested imprisonment for longer terms of years than the ten year maximum allowable under Anti-Kickback. See Pamela H. Bucy, Crimes by Health Care Providers, 1996 U. Ill. L. Rev. 589 at 639, citing U.S Sentencing Comm’n, Guidelines Manual 2A1.1-2X5.1, ch. 8 (Introductory Commentary) (1992). Empirical evidence, such as the FBI caseload chart above, seems to indicate that increasing the criminal penalty from misdemeanor to felony has failed to deter violations of statute.

Another approach, suggested by Jost and Davies, reasons that a civil approach to punishment has a stronger and more meaningful deterrent effect. In fact, these two experts believe that a concept of "optimal deterrence" should be applied to the health care setting since it is replete with corporate entities and problems of a systemic nature. See Timothy S. Jost & Sharon L. Davies, The Empire Strikes Back: A Critique of the Backlash Against Fraud and Abuse Enforcement, 51 Ala. L. Rev. 239 at 242 (Fall 1999)(hereafter Jost and Davies). Because of the fact that civil treble damages are higher than statutory criminal monetary damages, and are much more effective against corporate entities, it makes sense that a civil approach to punishment might be more successful. They later conclude that cases of "rogue employees" who violate statutes "might be best reserved for civil rather than criminal penalties, and specifically for civil penalties appropriate to achieve optimal rather than complete deterrence." See id. at 292. Logically, this latter view appears to be more sound than one of higher criminal penalties based upon sheer deterrence.

III. Conclusion

The growing significance of internal compliance programs has undertaken a new sense: to keep abreast of changes in the law, to scrutinize potential violations and to fix problems before government agencies learn of them. See David D. Queen & Elizabeth E. Frasher, Designing a Health Care Corporate Compliance Program 1, (1995). Prosecutors, faced with defendants who have established effective compliance programs, in some instances have been influenced to file civil charges instead of criminal ones, especially if the compliance programs in place effectively recognize and correct fraudulent or otherwise unsuitable activities. See Gabriel L. Imperato, Internal Investigations, Government Investigations, Whistleblower Concerns: Techniques to Protect Your Health Care Organization, 51 Ala. L. Rev. 205 (Fall 1999), citing Thomas F. O’Neill III & Adam H. Charnes, The Embryonic Self-Evaluative Privilege: A Primer for Health Care Lawyers, 5 Annals Health L. 33 (1996); see also U.S. Sentencing Guidelines Manual §§ 8C2.5(f), (g) (1996) (recognizing a reduction in criminal sentence should an organization have a thorough program to identify violations of the statutory law, and also offering seven criteria for effective compliance programs).

Recently, a paper criticized the DOJ of "us[ing] the False Claims Act as a blunt instrument to victimize hospitals who make innocent errors." See Jost and Davies at 242, citing American Hosp. Ass’n, Advocacy Papers for 1998 Annual Meeting: Your Mission on Capitol Hill (last modified Jan. 20, 1998); see also That paper mentioned, "[e]very day, more hospitals and health systems receive Justice Department demand letters that require them to choose immediately between settlement and admitting fraud, or fighting the Department and incurring potentially enormous monetary penalties." See id. The AMA stated that it is "extremely troubled to see the federal government’s tactics have consistently taken a punitive approach with physicians, rather than one of education and prevention." See id., citing Randolph D. Smoak, Jr., M.D., Chair, American Med. Ass’n Bd. of Trustees Rep., Medicare Fraud and Abuse I-98 (1998).

Furthermore, the American College of Physicians said that these laws have created "an atmosphere in which physicians feel that almost all of their behavior is suspect." See id. at 243, citing American College of Physicians, Understanding the Fraud and Abuse Laws: Guidance for Internists, 128 Ann. Intern. Med. 678 (1998).

A federal district judge recently elicited his frustrations as he dismissed 38 separate charges that the government asserted against two individual health care providers: "Although the government told the jury this case was about money and greed, it presented absolutely no evidence that either defendant received a single dollar as a result of any alleged criminal conduct….I understand that political pressure exists to prosecute Medicare and CHAMPUS fraud ---but this case is not one of them." See U.S. v. Butcher, 1998 U.S. Dist. LEXIS 22137 (N.D. Fla., 1998). Respect for the development of criminal law precedent in the United States dictates that if criminal penalties are to be assessed in court, the prosecution has the burden to prove evil intent on the part of the defendant. Unless a clearer definition of "knowingly" is adopted with respect to health care statute scienter, large amounts of litigation, as well as numerous discrepancies will continue to pollute the area of health care law. The Janas standard of "deliberate" seems to be a good starting point for narrowing the mens rea requirement of culpability.

© Alexander L. Bednar