Research institutions face growing threat of sanctions may reset the clock on privacy regs

Administrative enforcement and False Claims Act activity are becoming more common

Research institutions and teaching hospitals should brace for an increase in administrative enforcement activity and use of the False Claims Act in the area of research compliance, health care attorneys warn.

"The level of activity administrative agencies have demonstrated recently is really unprecedented," says health care attorney Paul Kalb of Sidley Austin in Washington, DC. "It is not just investigative activity; it is actual sanctions." Along with that, he points to increased application of the False Claims Act in that area.

But not all the news is bad. Along with those rising threats are final policies from the federal Office of Research Integrity on the responsible conduct of research and education, as well as a governmentwide definition of "research misconduct" by the Office of Science and Technology Policy that health care attorneys say can limit potential liability when applied correctly.

While the Food and Drug Administration generally is responsible for the oversight of privately sponsored research, a variety of agencies oversee government-funded research, including the Office of Human Research Protection, which has the responsibility of protecting human subjects. "There is a lot of overlap, and the regulatory obligations are in many respects similar, whether it is publicly or privately funded research," explains Kalb.

"This research area is hard to put in a nutshell because it implicates a number of areas that are of interest to the government, including basic health care fraud, the use of pharmaceuticals, and potential health and safety effects on individuals," explains former Department of Justice attorney John Bentivoglio, now of Arnold and Porter in Washington, DC.

The result is that over the past two years, researchers at about a dozen major institutions have been suspended, while numerous other researchers have received warning letters. That compares to a single suspension that was handed out in the two prior years.

The Department of Justice is now getting into the action as well, through an increasing number of qui tam suits filed by whistle-blowers.

According to Kalb, the primary False Claims Act theory has been that institutions have knowingly submitted improper financial claims, misrepresented their costs, or have made false statements.

Some whistle-blower suits have been a little more creative, linking regulatory failures with false claims, he adds. "They make the argument that if the government has conditioned the receipt of a grant on compliance with the human subject rules; if you violate those rules, you are not only subject to administrative sanctions but you have submitted false claims," Kalb explains.

"The implications are staggering because the regulatory environment is very complex," warns Kalb. "There are hundreds of pages of regulations, and if a violation of those regulations can be the basis of a False Claims Act suit with huge-money damages, that is something research institutions must be very concerned about."

David Hoffman, Assistant U.S. Attorney for the Eastern District of Pennsylvania, maintains that the key ingredient that implicates the False Claims Act is the certification process. "When you are certifying to the government that certain things are happening, that is not just a rubber stamp," he asserts. "From the government’s perspective, those certifications have meaning, and that is how you get to the application of the False Claims Act."

Hoffman says the two central issues involved in the settlement with Thomas Jefferson were allegations the government was paying for a researcher who was not in the country and the falsification of data. "Those are not hypertechnical’ violations," he argues.

"Every technical violation is not going to be fraud," he adds. "But I think somebody would be hard-pressed to look at the Thomas Jefferson model and call it a technical violation."

According to Hoffman, research institutions must establish systems to identify any rogue employees internally before the government does. "That is especially the case now that Medicare is becoming more involved in paying for human subjects," he cautions. "The potential conflicts with researchers having an interest in licensing fees and royalties if things go well are very troublesome."

New guidance helps protect research institutions

Research-based institutions facing the threat of administrative sanctions and qui tam suits under the False Claims Acts can find some comfort from a final guidance released by several government agencies last month.

The Office of Research Integrity (ORI) issued guidance on the responsible conduct of research and education, while the Office of Science and Technology Policy issued a governmentwide definition of "research misconduct."

The new guidance is something of a double-edged sword, explains Robert Wanerman, of the Washington, DC-based Arent Fox. "They have put some more teeth into their enforcement capability, but at the same time they have sent a much clearer signal to the research community about the standard they have to meet."

According to Kendra Dimond, also of Arent Fox, the new guidance adds clarity to this area by providing core elements that must be considered. "The government is going to become active in providing guidance, but it is also becoming more active in enforcing compliance," she adds.

The final policy on the responsible conduct of research requires all institutions applying for public funding to demonstrate by Oct. 1, 2001 that they have a program of instruction in as many as nine core instructional areas and a written description of their programs, according to Rick Rohrbach, a manager with Pricewaterhouse-Coopers. He says the policy is predicated on the following five principles:

  • Emphasis is on quality instruction; not just "checking a box." Only basic instruction is required, but institutions are advised that "high-quality, relevant instruction appropriate to the needs of the individual researcher" may involve more detailed and specific instruction.
  • One size does not fit all. Institutions are given the flexibility to determine the content, length, and level of instruction, in addition to the instructional methodologies and testing resources it will employ.
  • You decide who should be trained. Institutions may reasonably determine which "research staff" fall within the scope of the policy.
  • Applicable instructional areas are based on research profile. Institutions may provide instruction in those "core instructional areas" most applicable to its research activities.
  • There’s no "right way" for documenting or reporting compliance. Institutions may determine the appropriate method of documenting that instruction has occurred.

Rohrbach also notes that full implementation of this policy is not required until Oct. 1, 2003. But he recommends that institutions should develop a strategy for addressing this new policy as soon as possible.

According to Rohrbach, the process for compliance with the new requirements should include the following:

  • Define "research staff" at your institution and identify who fits this definition. While the policy includes a definition of "research staff," Rohrbach says institutions have some flexibility in interpreting and applying this definition, and that each institution should develop a clear definition to suit its organizational structure and research profile.
  • Determine institutional training needs. Once you have identified the affected population, you must determine your training needs, Rohrbach says. "The policy includes nine core instructional areas, but many of these areas may not apply to all individual research staff,’" he says.
  • Develop curriculum and write program description. Once you’ve identified instructional areas and which staff require training in each area, the next step is to develop course materials for each topic, select appropriate training formats, and write a program description.

"Don’t reinvent the wheel," warns Rohrbach, who says there are many resources available externally, including the ORI Web site, which provides links to useful resources. "You can tap into a number of live and Web-based courses offered by consulting firms and peer organizations," he adds.

  • Develop a reporting and monitoring process. According to Rohrbach, one of the stickiest issues institutions must grapple with is managing compliance with this policy. He says that means not only making sure that research staff have completed their required training, but how that is documented and how they stay current as regulations change.
  • Operationalize. Once institutions complete initial implementation, they should determine how the policy would be incorporated into their everyday business practices, says Rohrbach. He says this requirement can be incorporated into policies and procedures such as new hire orientation, promotion, job transfer, and grants submission.