Ambulance Firm Faces $1M Settlement Over Medicaid Fraud and Data Breach
American Medical Response's subsidiary, Fallon Ambulance, will pay $1 million to Massachusetts to resolve allegations of Medicaid billing fraud and HIPAA violations following a 2023 data breach affecting over 750,000 individuals.
Transformative Healthcare, the parent company of the now-defunct Fallon Ambulance, has agreed to a $1 million settlement with Massachusetts regulators. This agreement aims to resolve allegations of Medicaid billing fraud and violations of both HIPAA and state data security laws. The settlement also mandates the secure destruction of sensitive patient and employee data that was exposed in a 2023 data breach.
The proposed settlement, which awaits court approval, requires Transformative Healthcare and its former subsidiary, Fallon Service, to implement a comprehensive plan for the secure disposal of all protected health information (PHI) and personal information (PI). This data must be destroyed within 45 days of the order's effective date, or upon the expiration of any legally mandated retention periods.
Transformative Healthcare, which ceased operations in 2022, faced two separate investigations by the Massachusetts attorney general's office. One investigation uncovered that Fallon and Lifeline Ambulance Services engaged in "upcoding" their claims to MassHealth, the state's Medicaid program. This practice involved billing for higher levels of healthcare services than were actually provided, including billing for emergency transportation when only non-emergency services were rendered, and for advanced life support when not medically necessary.
The second investigation focused on a significant data breach that occurred between February and April 2023 during an archiving process. State officials identified potential violations of HIPAA and Massachusetts data security regulations during their review of the incident. Transformative Healthcare reported the breach, which impacted 911,757 individuals, to the U.S. Department of Health and Human Services in December 2023.
Of the individuals affected, 750,116 were Massachusetts residents, including both patients and employees of Transformative Healthcare. The compromised information potentially included names, addresses, phone numbers, dates of birth, driver's license numbers, state-issued identification card numbers, medical information, insurance details, and Social Security numbers. The breach was discovered when Fallon, which had ceased operations in December 2022, noticed suspicious activity on its network in April 2023, with investigations revealing unauthorized access had begun nearly two months prior.
Ransomware gang AlphV, also known as BlackCat, claimed responsibility for the incident in May 2023, stating they had stolen over 1 terabyte of data from Transformative Healthcare. Although Fallon was no longer operational at the time of the hack, the company maintained an archived copy of data to comply with legal obligations, according to a breach notice issued in late 2023.
The settlement agreement also imposes a ban on Transformative Healthcare and Fallon from selling any PHI or PI in their possession. Furthermore, after the data destruction is complete, the companies are prohibited from maintaining or acquiring control of any PI or PHI, with limited exceptions for employee information necessary for ongoing legal or regulatory compliance.