The Department of Justice (DOJ) is using the False Claims Act (FCA) to pursue organizations that misrepresent their cybersecurity practices or fail to meet federal security requirements. Recent enforcement matters involving electronic medical records and healthcare data security underscore the initiative’s application beyond traditional defense contracting.
McCarter & English partner Zachary Myers, a former US Attorney for the Southern District of Indiana, spoke with GRIP about the DOJ’s approach and the implications for healthcare organizations. Zach emphasized that FCA exposure may arise from cybersecurity compliance failures even when no data breach occurs, highlighting the importance of meeting contractual security obligations and complying with applicable monitoring and incident-reporting requirements.
Organizations should regularly review their cybersecurity commitments, clarify responsibility for security oversight and incident response, and keep policies, procedures, and training current as requirements evolve.