Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon Emergency Medical Services, LLC (Fallon). Lifeline and Fallon were acquired by another Massachusetts operator in 2022, when Transformative Healthcare ceased operations.
The settlement agreement also resolves allegations that Fallon and Lifeline upcoded claims to MassHealth by billing for more expensive levels of service than they provided, including billing for emergency services when nonemergency level services were provided, and submitting false claims for Advanced Life Support services when the services provided did not meet the criteria for Advanced Life Support services. Under the proposed consent judgment, the combined allegations have been resolved with a $1,000,000 financial penalty, which will be paid over five years.
The data security incident was first identified by Fallon on April 21, 2023. The forensic investigation confirmed that systems containing the data of Transformative Healthcare patients and employees were accessed by an unauthorized third party between February 17, 2023, and April 21, 2023, during an archiving process. During that time, the personal and protected health information of 750,116 Massachusetts residents was exposed and potentially stolen. The impacted data included names, contact information, dates of birth, driver’s license numbers, state identification numbers, Social Security numbers, medical information, and health insurance information.
The Massachusetts Attorney General launched an investigation into the data breach to assess compliance with the Massachusetts Consumer Protection Act, Massachusetts Data Security Law, and HIPAA. The fraud investigation was handled separately. The Massachusetts Attorney General determined that Transformative Healthcare had failed to maintain an appropriate written information security program, and concluded that Transformative Healthcare and Fallon violated the Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164, Subpart A (General Provisions of HIPAA), Subpart C (Security Standards for the Protection of Electronic Protected Health Information of the HIPAA Security Rule), and Subpart E (Privacy of Individually Identifiable Health Information of the HIPAA Privacy Rule).
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
In addition to the financial penalty, the settlement requires Transformative Healthcare and Fallon to ensure compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules, and includes the requirement to destroy personal information and protected health information within 45 days of the effective date of the consent judgment.
“Healthcare companies have a responsibility to protect the sensitive patient data they are entrusted with and to bill MassHealth only for the services they provide,” said Massachusetts Attorney General Andrea Joy Campbell. “My office will continue to hold companies accountable when they defraud MassHealth and put residents’ personal information at risk.”
