May 31, 2006

Failure to Maintain an Effective Compliance and Ethics Program Can Expose a Company to Liability Under the False Claims Act

Holland & Knight Alert
David S. Black

Many companies derive revenue from federal funding. Examples include government contractors and subcontractors, health care providers, pharmaceutical companies, state and local-level contractors and subcontractors who work on federally funded projects, and recipients of federal grants, such as colleges and universities and other research organizations. For these companies, a recent federal court decision accepting a novel legal position provides fresh incentives for maintaining an effective compliance and ethics program.

Ineffective Compliance Programs as a Basis for False Claims Act Liability

For the first time, a federal court has held that an assertion that a company failed to maintain an effective corporate compliance program is sufficient, under the False Claims Act (FCA), to allege that a company submitted false claims with “reckless disregard” of their falsity, even though there is no allegation that upper management had actual knowledge that false claims were submitted. United States v. Merck-Medco Managed Care, L.L.C., 336 F.Supp.2d 430, 440-41 (E.D.Pa. 2004). As a result of this decision, all companies that derive revenue from federal funding should ensure that they have compliance and ethics programs and that their programs are “effective” under applicable legal standards and industry practices.

Merck-Medco Managed Care, L.L.C. arose out of a civil action brought by the Department of Justice under the False Claims Act, a law that provides the government with powerful tools to combat fraud, waste and abuse by recipients of federal funds. Under the FCA, companies which “knowingly” submit false claims paid with federal funds are liable for three times the actual damages suffered by the government, plus additional penalties of up to $11,000 per claim. These per claim penalties, alone, can snowball into astronomical amounts for companies, like health care providers and government contractors, which submit thousands of claims for payment each year. What makes the FCA particularly risky to companies is that the government is not required to prove the company had actual knowledge that a claim was false. Instead, a company violates the FCA if it lacked actual knowledge but is found to have acted in “reckless disregard” or “deliberate ignorance” of the truth or falsity of its claims – a much easier legal standard for the government to meet. Because of this loosened “knowledge” requirement, companies which are merely sloppy or careless in the preparation of claims can get caught in a quagmire of complex litigation and substantial liability, even though they intended no wrongdoing.

In addition, the FCA poses onerous risks for companies that receive federal funds, because FCA litigation can be initiated not just by the government but by any person who discovers allegedly false claims. The FCA allows individuals to act as “private attorneys general” and file FCA actions on the government’s behalf and receive a percentage of any recovery. It is not uncommon for such plaintiffs – known as qui tam relators – to rise from the ranks of a company’s disgruntled or recently fired employees. In recent years, relators in False Claims Act cases have sometimes received tens of millions of dollars from such cases.

In Merck-Medco Managed Care, L.L.C., the government filed an FCA action in the United States District Court for the Eastern District of Pennsylvania against a pharmacy benefits manager, Medco Health, which contracted with the government to provide pharmacy services to federal employees. The government asserted that Medco Health failed to provide a wide range of pharmacy services required under applicable state pharmacy laws, which was an express condition for payment under Medco Health’s contract with the government, and, nevertheless, charged and received payment for these unperformed services.

Compliance Weaknesses Equal “Reckless Disregard”

The government apparently could not prove that Medco Health’s upper management had actual knowledge of the alleged false invoicing or sufficient involvement in the billing process to have “reckless disregard” or “deliberate indifference.” Instead, in order to satisfy the FCA’s “knowledge” requirement, the government asserted in its complaint that Medco Health acted “with reckless disregard ... of the truth or falsity of information it submitted to the United States” in support of its claims, because Medco Health’s board members and officers “failed to implement a corporate compliance program which satisfied the requirements of proper corporate practice and Delaware law.” (Medco Health is a Delaware limited liability corporation.)

The government’s complaint included a laundry list of actions that Medco Health’s board and officers failed to take that largely tracks the elements of an effective compliance program set forth under U.S. Sentencing Commission guidance on compliance and ethics programs, which is widely recognized as the bellwether standard for corporate compliance programs in the United States. Specifically, the government alleged that Medco Health acted with reckless disregard of the truth or falsity of its claims because its board and officers failed to:

  • establish an effective code of ethics
  • designate specific high-level personnel with direct responsibility for overseeing compliance who had direct access to the CEO and board of directors
  • appoint a compliance officer with responsibility for independently investigating and acting on matters related to compliance
  • inform employees of the existence and details of the company’s compliance program
  • arrange for regular reports to the board concerning internal investigations
  • establish effective methods of monitoring, auditing, or reporting on compliance, including without limitation establishing an anonymous hotline and providing protection for whistleblowers
  • implement systems to assure reasonable steps to respond to or investigate reported offenses
  • consistently enforce the company’s policies and procedures through corrective action

While referencing the obligations of Medco Health’s board under Delaware law, the Government expressly relied upon In re Caremark, 698 A.2d 959 (Del. Ch. 1996), the seminal case for the proposition that directors have a duty to implement a “corporate information and reporting system” that is reasonably designed to provide senior management and the board with timely, accurate information sufficient to allow them to assess the corporation’s compliance with applicable laws.

An Effective Compliance Plan Is No Longer Optional

Medco Health moved the District Court to dismiss the complaint on the ground that the government had failed to plead facts sufficient to show that Medco Health “knowingly” submitted false claims under the FCA. The District Court rejected Medco Health’s argument, holding that the allegation that Medco Health lacked an effective compliance plan was adequate to state a claim under the FCA that Medco Health acted with “reckless disregard” of the truth or falsity of the information it submitted to the government. As the District Court explained:

To make its prima facie case, a FCA plaintiff must allege that the defendant, at the time it submitted its false or fraudulent claims, “(1) [had] actual knowledge of the information; or (2) act[ed] in reckless disregard of the truth or falsity of the information” alleged to be false. 31 U.S.C. § 3729(b). [The government has] sufficiently alleged that Medco submitted its false claims knowingly under this definition. At the very least, the Government has claimed that Medco’s compliance programs were either non-existent or insufficient, in satisfaction of the “reckless” requirements of § 3729(b).

Merck-Medco Managed Care, L.L.C., 336 F.Supp.2d at 440-41 (emphasis added).

Merck-Medco Managed Care, L.L.C. is significant because it is the first case in which a federal court held that the mere lack of an effective compliance program, without more, is sufficient to establish that a company “knowingly” submitted false claims under the FCA. Although the case is still pending in the District Court, the decision will embolden the government and qui tam relators to continue asserting this position in other FCA actions around the United States. At a minimum, a company in a heavily regulated industry that receives any funding from the government and that has a substandard compliance and ethics program faces an increased risk of becoming entangled in a costly FCA litigation in the event the government or a disgruntled employee discovers that the company has submitted false claims. Regardless of the actual knowledge of the company’s employees or management, an FCA plaintiff can now assert in good faith that the company had “knowledge” of these false claims merely because it failed to maintain an effective compliance program.

In light of the high stakes often involved in FCA litigation (i.e., possible treble damages and significant per-claim penalties, and the threat of exclusion, suspension or debarment from participation in government programs) any company which derives revenue from federal funds should, in the wake of Merck-Medco Managed Care, L.L.C., minimize its risk of having to defend otherwise weak or frivolous FCA claims by reviewing and, where necessary, enhancing its existing compliance program to ensure it meets the ever-changing legal standards and industry best practices.

Related Insights