As the Department of Justice (DOJ) continues to prioritize health care enforcement, federal prosecutors are making increasing use of a lesser-known but versatile weapon in their investigative arsenal, the HIPAA subpoena. Health Insurance Portability and Accountability Act (HIPAA) subpoenas are administrative subpoenas which, pursuant to 18 U.S.C. § 3486, allow DOJ prosecutors to compel the production of documents in any investigation involving a federal health care offense. And while compelling the production of documents can be similarly achieved with the issuance of a federal grand jury subpoena, the HIPAA subpoena provides federal prosecutors with the ability to do something that the grand jury subpoena cannot: share the gathered information with civil DOJ attorneys pursuing a parallel civil investigation. By opening the door to greater intra-departmental cooperation, the HIPAA subpoena is becoming the investigative tool of choice of certain US Attorney's Offices in health care investigations. It is, therefore, imperative for defense practitioners in the white collar and health care sectors to familiarize themselves with the capabilities and significance of this type of administrative subpoena.

How HIPAA Subpoenas Work

The expanded use of the HIPAA subpoena by federal prosecutors has facilitated an increase in parallel health care investigations in which criminal and civil DOJ attorneys work together. Such investigative teamwork is efficient because criminal and civil health care statutes often govern the same underlying conduct. For example, submitting fraudulent claims for payment of federal health care money and paying kickbacks in exchange for health care referrals violates both the False Claims Act (FCA) — a civil statute, and the criminal Anti-Kickback and Health Care Fraud statutes. Conducting a parallel health care investigation gives the DOJ the option to bring both criminal and civil penalties to bear simultaneously and provides charging flexibility if a civil resolution appears more appropriate. The use of grand jury subpoenas alone, however, made this nimble approach to health care investigations more difficult. Due to the grand jury secrecy rules of Fed. R. Crim. P. 6(e), information gathered via grand jury subpoena by criminal Assistant United States Attorneys (AUSAs) could not be easily shared with civil AUSAs, even if those civil AUSAs were investigating the same entity for the same conduct. The HIPAA subpoena proved to be a creative work around to this problem. HIPAA subpoenas are not encumbered by grand jury secrecy rules. Therefore, information gathered via a HIPAA subpoena by a criminal AUSA can be readily shared with a civil division AUSA. The result is that parallel investigations can proceed smoother as criminal and civil AUSAs can be paired on investigation teams.

White-collar and health care regulatory practitioners, therefore, need to recognize that the tools that the DOJ uses to compel testimony and document productions in health care investigations are often distinct from those in other types of investigations. With increased criminal-civil cooperation in US Attorney's Offices, clients are likely to see HIPAA subpoenas and Civil Investigative Demands (CIDs), rather than just grand jury subpoenas, initiating health care investigations. Practitioners also should understand that the type of investigatory demand a client receives could offer clues about the nature of the government's investigation.

Key Takeaways From the Use of HIPAA Subpoenas

1. Practitioners should recognize that HIPAA subpoenas are criminal subpoenas. Inexperience with HIPAA subpoenas may lead some clients to assume that the lack of a grand jury subpoena means that the government's investigation is purely civil in nature. This is incorrect. HIPAA subpoenas are issued as part of the criminal investigation process. What the appearance of a HIPAA subpoena typically indicates, however, is that DOJ is conducting a parallel criminal and civil investigation into conduct relevant to the subpoena.

2. Practitioners should recognize that the increase in criminal-civil division cooperation means that the appearance of a CID is not a guarantee that an investigation in purely civil in nature. CIDs are generally issued by DOJ civil attorneys in cases involving the FCA. The FCA is a civil statute, which makes an individual or institution liable for knowingly submitting false claims for payment to the federal government. The statute empowers DOJ to issue a CID for documents or testimony in connection with an FCA investigation. Once civil DOJ attorneys obtain that material, however, it can be shared with criminal prosecutors investigating the same conduct. Thus, if an institution or individual receives a CID in connection with a health care investigation, they should not assume that the investigation is limited to the civil division. Frequently, a criminal prosecutor is teamed up with the civil AUSA and also is reviewing the collected documents.

3. Grand jury subpoenas remain the traditional process used in criminal investigations to compel the production of documents and testimony. As discussed above, the grand jury process is governed by certain secrecy rules, which make it challenging for criminal prosecutors to share such materials with civil AUSAs. Thus, while grand jury subpoenas do not preclude the existence of a parallel civil health care investigation, their exclusive use makes it less likely that health care criminal and civil prosecutors are working in tandem on a particular matter.

Parallel health care investigations, where criminal and civil DOJ attorneys work side by side, are becoming increasingly common in health care cases. Many of these investigations are making increased use of HIPAA subpoenas that facilitate information sharing between civil and criminal DOJ attorneys. Institutions and individuals that are subjects of such investigations should closely monitor the type of process being used by DOJ attorneys, which can provide valuable insight into the nature of the investigation and the conduct at issue.