Former Massachusetts Ambulance Company Pays $1M to Settle Medicaid Fraud & HIPAA Violations
A former Massachusetts ambulance company has agreed to pay a $1,000,000 penalty to resolve allegations of Medicaid fraud and violations of Massachusetts data security regulations and the Health Insurance Portability and Accountability Act (HIPAA).
The settlement concerns Transformative Healthcare and its subsidiaries Lifeline Ambulance Services, Lifeline Healthcare Solutions, Fallon Service, and Fallon Emergency Medical Services. Transformative Healthcare ceased operations in Massachusetts in 2022, although it did not formally cease all company operations in the state and retained its assets and liabilities. The Lifeline and Fallon subsidiaries were sold to another ambulance company in 2022.
Two separate investigations were launched by the state, one into potential billing fraud by Transformative Healthcare’s Lifeline and Fallon operations, and another into a hacking incident at Fallon in 2023 that involved the records of over 750,000 state residents. The fraud investigation involved the Lifeline and Fallon operations, which were alleged to have fraudulently billed the state Medicaid program (MassHealth) for levels of services that were not provided. For instance, MassHealth was billed for emergency transportation services when nonemergency transportation services were provided, and false claims were submitted for advanced life support services when the situations did not meet the regulatory criteria for those services. Claims for medical services were also submitted without the required medical necessity documentation.
The data breach investigation was initiated in response to a hacking incident by the ALPHV/Blackcat ransomware group between February and April 2023 involving the archived protected health information of 911,757 individuals, including 750,116 Massachusetts residents. Transformative Healthcare patients and employees had data compromised in the incident, including names, contact information, dates of birth, Social Security numbers, driver’s license numbers, medical information, insurance information, and other sensitive data. The investigation determined that Massachusetts data security regulations and the HIPAA Privacy and Security Rules had been violated.
The $1,000,000 penalty will be paid over five years, and the companies have agreed to securely delete the personally identifiable information and protected health information in their possession within 45 days, and also destroy any physical copies of that information. Transformative Healthcare and Fallon are prohibited from selling any personal information or protected health information, and are not permitted to maintain or acquire any further personal information or protected health information, unless it is necessary as part of dissolving Transformative Healthcare.
“Healthcare companies have a responsibility to protect the sensitive patient data they are entrusted with and to bill MassHealth only for the services they provide,” said Attorney General Andrea Campbell. “My office will continue to hold companies accountable when they defraud MassHealth and put residents’ personal information at risk.”
