Alleged Fraud Scam Involves Doctored Records SystemProsecutors Say Electronic Medical Records System Was Path to Fraud
A podiatrist, his wife and the CEO of a Chicago-based healthcare firm have been indicted in connection with an alleged Medicare fraud scam involving an electronic medical records system that was deliberately configured to submit false billing claims for services that patients didn't receive or need.
In an Oct. 16 FBI statement, prosecutors say that Yev Gray, M.D., owner and president of Aggeus Healthcare; his wife, Natalie Gray, an attorney and the director of corporate and legal affairs for Aggeus Healthcare, who supervised the billing, finance and accounts receivable departments; and James Sayadzad, CEO of Aggeus Healthcare and a minority owner and manager of a related firm, Aggeus Global, were indicted on Oct. 14 by a federal grand jury in Missouri. The three were are awaiting arraignment, on one felony count of conspiracy to commit healthcare fraud and four felony counts of making false statements relating to healthcare matters.
If convicted, each count carries a maximum penalty of five years in prison and/or fines up to $250,000, the FBI statement says.
Aggeus provides podiatry services to residents of long-term care facilities, such as nursing homes, and as of September 2015, both companies were operating in at least 16 states, prosecutors say.
Lead federal prosecutor in the case, Dorothy McMurty of the U.S. attorney's office in St. Louis, tells Information Security Media Group that her office has not had any other fraud cases to date involving allegations of a doctored EMR system such as those contained in the indictment against the Grays and Sayadzad. She declined to comment on whether there are any other federal cases pending involving other healthcare providers alleged to have committed fraud using doctored EMR systems.
New Approach to Fraud?
Privacy attorney Adam Greene says the allegations in the fraud case against Aggeus are the first he's aware of that involve deliberate configuration of a patient records system to submit false claims.
"While the [Department of Health and Human Services Office of Inspector General] has previously expressed concerns about the potential fraudulent use of EMR technology, this is the first case I have seen where the government alleges that the technology was specifically designed to create false claims," he says. "While I can't comment on this case, we have a long history of reports of those who knowingly and intentionally submit false claims to the government. It would not be surprising for some of them to try to use EMR technology to make their schemes easier and more profitable. What is important is that the actions of these few do not cast a shadow over the substantial potential benefits that EMR technology offers."
Over the last two years, the OIG has made recommendations to HHS about steps that can be taken to help reduce billing fraud related to EMRs, including fraud involving the copy-and-paste feature of EMRs, which can be used to falsify records or over-document a medical record by inserting fake or irrelevant documentation to create the appearance of support for billing higher level services (see OIG: HHS Still Needs to Act on EHR Fraud). Among the OIG recommendations is that audit logs should be operational whenever EHRs are updated or viewed so that changes to information are recorded.
Doctored EMR System
Prosecutors allege that Gray and his wife "created or caused the creation" of an electronic medical record system that automatically generated patient progress notes and other documents that did not accurately reflect the actual conditions and diagnoses of the patients.
The indictment alleges that the records system 'included only language which would justify the services" that could be billed to Medicare, whether the services were needed or provided to patients. Prosecutors allege that Aggeus required its contracted podiatrists to use the records system to document the patients' conditions and the services provided to them.
"However, in reality, Dr. Gray and Natalie Gray limited the choices available to the podiatrists and did not permit them to add information, even if accurate and truthful, into the EMR," the indictment says. "Dr. Gray and Natalie Gray thereby prevented the podiatrists from adding information that might show the patients did not need or did not receive the services for which Aggeus would later seek payment from Medicare. Aggeus podiatrists and employees describe the EMR as a 'point and click' system."
Prosecutors allege in court documents: "When Aggeus podiatrists entered specific billing codes in the EMR, the system automatically populated the assessment part of the progress note with the canned language selected by Dr. Gray and Natalie Gray. As an example, when the podiatrist chose the code for the debridement of six or more toenails, the EMR system automatically entered the diagnosis codes for fungus, peripheral vascular disease, and pain. The diagnoses and related language were inserted into the progress note, even if the patient did not have these diseases or symptoms."
The indictment indicates that the alleged scheme's unraveling involved numerous podiatrists complaining to Aggeus about the EMR. "Some podiatrists complained that the progress notes were inaccurate because they were unable to modify the language in the EMR and could not add their comments to the EMR. While some podiatrist signed the notes, other podiatrists refused to sign the progress notes. Other podiatrists recognized the progress notes were inaccurate, but continued to complete them and sign them."
The company also received complaints from the long-term care facilities where patients were treated by the contracted Aggeus podiatrists, the indictment says. "Aggeus employees received complaints daily from facilities about the progress notes, including complaints that the notes were inaccurate, the assessments were repetitive, and the notes were the same for all the patients. When Aggeus employees received complaints, often they would speak directly to the defendants. Sayadzad and Dr. Gray told employees that they would handle the complaints and that the information included in the progress notes was there because it was required for Medicare reimbursement. Aggeus employees in turn told the facilities that Aggeus inserted what was required by Medicare in the progress notes."
Meanwhile, some family members of patients treated by the Aggeus podiatrists also complained to doctors about false explanation of benefits forms they had received from Medicare about treatment.
"Despite repeated complaints from patients, nursing homes, and some of their podiatrists, the defendants continued to create false patient records and to bill for medically unnecessary services," the indictment says. "From 2009 to September 2015, Medicare paid Aggeus Healthcare millions of dollars based on the false reimbursement claims submitted by the defendants."
McMurty declined to comment on whether any contracted podiatrists or employees who worked for Aggeus are also expected to be charged in the case. Neither of the Grays nor Sayadzad are in custody, she says. An arraignment date is expected to be set soon, she adds.
Attorney David Holtzman of the security consultancy CynergisTek notes: "This is a Medicare fraud case that has a number of facets, including how an EMR system was configured to bill for services not provided, and as troubling, healthcare services that were not needed or performed in a way to cause pain and suffering on disabled patients who were unable to protect themselves. Cloning or cutting and pasting of physician notes is common practice, and there is real disagreement on whether it is a bad thing. In the case alleged here, it was impossible for the patient record to be valid when it was pre-populated to contain a full review of symptoms, an exam and treatment provided. "
Healthcare providers should always review copied notes to make sure they are accurate and relevant, Holtzman stresses. "Allowing the recording of inaccurate treatment records is not only a serious crime, it may also expose the patient to significant risk of harm when other health care providers are involved in their patient care," he notes.
Aggeus Healthcare did not immediately respond to ISMG's request for comment on the case.