Complex and rapidly evolving laws and regulations could cause us to make significant changes to our operations or incur substantial costs or penalties.
As a participant in the healthcare industry in the United States, we are subject to numerous federal and state regulations. Further, there are various political, economic and regulatory influences that are placing our industry under intense scrutiny and which seek to implement fundamental changes. We cannot predict which reform proposals, if any, will be adopted, when they may be adopted, or what impact they may have on us. Any changes to the current regulatory and legal paradigm could increase the overall regulatory burden and costs associated with our business and materially adversely affect our business and operating results. If we fail to comply with existing or future applicable laws and regulations, we could suffer civil or criminal penalties, including the loss of our licenses to operate our pharmacies and our ability to participate in federal and state healthcare programs. The U.S. Drug Enforcement Administration (the “DEA”), the U.S. Food and Drug Administration (the “FDA”) and various state regulatory authorities have broad enforcement powers, including the ability to seize or recall products and impose significant criminal, civil and administrative sanctions for violations of these laws and regulations. As a consequence of the severe penalties we could face, we must devote significant operational and managerial resources to complying with these laws and regulations. Different legal interpretations and enforcement policies could subject our current practices to allegations of noncompliance or illegality, or could require us to make significant changes to our operations. In addition, we cannot predict the impact of future legislation and regulatory changes on our business or assure that we will be able to obtain or maintain the regulatory approvals required to operate our business. The costs associated with complying with federal and state laws and regulations could be significant and the failure to comply with any such legal requirements could have a material adverse effect on our financial condition, results of operations and liquidity.
If we fail to comply with fraud and abuse laws, false claims provisions or other applicable laws, we may need to curtail operations, and could be subject to significant penalties.
We are subject to federal and state fraud and abuse laws that prohibit payments intended to induce or encourage the referral of patients to, or the recommendation of, a particular provider of items or services. Violation of these laws can result in loss of licensure, civil and criminal penalties, damages and exclusion from the Medicaid, Medicare and other federal healthcare programs. The Office of Inspector General (“OIG”) and U.S. Department of Justice (“DOJ”) have, from time to time, established national enforcement initiatives, targeting all providers of a particular type, that focus on specific billing practices or other suspected areas of abuse. Under the qui tam or “whistleblower” provisions of the federal and various state false claims acts, private citizens may bring lawsuits alleging that a violation of the federal Anti-Kickback Statute (“AKS”) or similar laws has resulted in the submission of “false” claims to federal and/or state healthcare programs, including Medicare and Medicaid. Since the private plaintiff in this type of proceeding is generally entitled to share in any damages a court orders the defendant to pay to federal and state governments under these laws, financial incentives exist for individuals to allege that particular practices or activities constitute a violation of these statutes. A determination that we have violated these laws, or the initiation of lawsuits alleging violations of these laws, could adversely affect our business and financial condition.
As part of our ongoing operations, we are subject to various inspections, audits, inquiries, investigations and similar actions by third parties, as well as governmental/regulatory authorities responsible for enforcing the laws and regulations to which we are subject. From time to time we are subject to whistleblower complaints. Federal and state government agencies have increased their focus on and coordination of civil and criminal efforts in the healthcare area, and the ACA and other recent legislation has expanded federal healthcare fraud enforcement authority. There can be no assurance that the ultimate resolution of any such claims, inquiries or investigations, individually or in the aggregate, will not have a material adverse effect on our consolidated results of operations, financial position or cash flows. Moreover, we cannot predict our future costs associated with compliance with such laws.
Federal and state privacy and security regulations may increase our cost of operations and expose us to civil and criminal sanctions, damages, and penalties.
In the ordinary course of our business, we process, store and transmit data, which may include sensitive personal information of the residents we serve. We must comply with extensive federal and state requirements regarding the use, transmission and maintenance of protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and the Health Information Technology for Economic and Clinical Health Act (“HITECH”), which expanded certain sections of HIPAA, including imposing certain liability on business associates, for example, with respect to impermissible uses and disclosures of PHI and Security Rule obligations, strengthening enforcement activities, and increasing penalties for violations. The requirements of federal and state privacy and security laws such as HIPAA and HITECH are complicated and are subject to interpretation and modification. In addition to HIPAA and HITECH, we must adhere to state privacy laws, including those that provide greater privacy protection for individuals than HIPAA. Failure to comply with HIPAA and HITECH or similar state equivalent laws could subject us to loss of customers, denial of the right to conduct business, civil damages, fines, criminal penalties, class action or other litigation, and other enforcement actions.
38