6 troubling questions about the Corizon bankruptcy deal

• The bankruptcy of prison health provider Corizon has faced pressure from senators and a federal regulator in recent weeks.
• A proposed deal is now in doubt after a judge's secret romantic relationship with an attorney was revealed.
• Other troubling questions surrounding the bankruptcy involve payments to insiders, "dishonest" testimony, and a secret data breach.

It's been a tumultuous few weeks for the bankrupt prison healthcare contractor Tehum, formerly known as Corizon Health. In the latest twist, a group of powerful US senators sent a lengthy inquiry to the company Tuesday pressing for answers about what they describe as "abusive" bankruptcy tactics.

The letter comes on the heels of a hearing last week, where Christopher Lopez, a federal bankruptcy judge in Houston, hit the brakes on Tehum's proposed settlement — a deal that, the senators note, would offer current and former prisoners "pennies on the dollar" to resolve medical-malpractice suits against the company.

Days earlier, David Jones, the judge serving as mediator in the bankruptcy settlement talks, resigned after Insider broke the news of allegations that he was in an undisclosed romantic relationship with Elizabeth Freeman, a Houston bankruptcy attorney. She represented another Corizon successor company, YesCare, in the negotiations.

YesCare got all of Corizon's corrections contracts after the company engaged in a controversial legal maneuver last year called the Texas Two-Step that involved splitting Corizon in two. The other company, Tehum, was saddled with most of Corizon's liabilities and, in February, filed for bankruptcy.

Insider has been following the story of Corizon since August, revealing in an investigation — based on leaked documents, business filings, public-records requests, voluminous court filings, and dozens of interviews — that a group of investors with dubious business histories quietly bought out the company in 2021 and engaged in financial maneuvers so opaque and controversial that a former Corizon CEO described them in a lawsuit as "an old-fashioned bankruptcy fraud scheme."

The US Trustee Program, an arm of the Justice Department, filed a 16-page objection in the case earlier this month. Among other concerns, the objection cited the conflicts involving Jones as mediator.

With the next hearing expected in early November, Insider compiled a list of six major issues that now hang over the deal. Tehum did not respond to a request for comment.

1. Judge Jones' conflict of interest.

Jones' relationship with Freeman, YesCare's attorney, has sparked fresh questions among creditors about the fairness of the proposed deal.

Ian Cross, an attorney representing prisoners with negligence claims against Corizon, filed an objection last week raising Jones' conflict of interest, among other issues. "YesCare's lawyer and the mediator who presided over the negotiation of the global settlement in this case share a household and are involved in an intimate relationship," Cross writes in the objection. "Had they been so informed, many creditors likely would have objected to the appointment of Judge Jones as mediator."

He goes on to say that the relationship "raises reasonable doubts as to the fairness of the mediation process."

The letter from nine US senators, including Elizabeth Warren, Bernie Sanders, Cory Booker, and the Judiciary Committee's chair, Dick Durbin, raises the issue as well. "Corizon's tactics are further called into question," they write, "given the secret romantic relationship between the judge mediating the plan negotiations and the attorney representing YesCare in the negotiations."

A ruling by Lopez on objections from creditors could come as soon as early November.

2. Extremely low payouts for prisoners and their families.

The bankruptcy plan breaks creditors down into several classes. The largest is the medical-malpractice claimants, who collectively say they're owed almost $1.1 billion. Claims by a class composed of vendors such as hospitals amount to far less — about $111 million.

Yet the proposed $37 million settlement gives the malpractice claimants only about a quarter of the total.

In other words, "two classes of unsecured claimants get wildly different shares of the settlement funds," Kevin Eckhardt, the deputy managing editor for legal at Reorg, a restructuring and credit-focused research firm, wrote in a post this month.

Hector Garcia Jr., whose father, Hector Garcia, died after three days in Corizon's care at a New Mexico jail, previously described the $5,000 allocated to each claimant as "a slap in the face."

He said that amount wouldn't even cover what the family had already spent since his father's death, including more than $2,500 for funeral services and $5,000 to retain counsel.

"How do you come up with an amount like that — $5,000 — just to say, 'Here's for the death of your brother'?" asked Belen Lowery, the elder Garcia's sister.

The senators' letter urges YesCare CEO Jeff Sholey and Tehum director Isaac Lefkowitz "to use the full financial capabilities of YesCare, Tehum, and any other entities as appropriate, to provide full relief for meritorious claims against Corizon," including by incarcerated people and their families.

3. Numerous liability releases without 'basic information about who these individuals are.'

Among its numerous objections, the US Trustee called out the lack of legal justification for broad releases the plan proposes for a number of individuals connected with Corizon and YesCare.

The objection specifically mentions Lefkowitz, who has served as a director of Corizon, Tehum, and YesCare; Sara Tirschwell, Corizon and YesCare's former CEO; Sholey, YesCare's current CEO; YesCare's chief legal officer, Jeffrey Scott King; its chief medical officer, Ayodeji Olawale Ladele; a YesCare finance executive, Michelle Rice; and Jennifer Finger, whose social-media profiles say she has served as counsel for both Corizon and YesCare.

Tehum's disclosure statement "does not contain basic information about who these individuals are or their connection to the Debtor and other entities involved in the combination and divisional mergers," the objection says, a reference to the Two-Step. Nor does the disclosure say "whether these individuals are contributing to the settlement in return for the releases of non-debtors, and if so, how much."

Creditors have filed objections to these liability releases, with the Arizona Department of Corrections, Rehabilitation, and Reentry saying that before supporting the bankruptcy plan, it would need to see a list of who contributed financially to the settlement — and what they paid.

The senators' letter requests that Sholey and Lefkowitz produce a full description of YesCare's and Tehum's leadership structures, as well as the leadership and ownership of all parent companies.

4. Large payments to insider companies.

In August, Insider reported on financial records showing that at least $48 million had been transferred from Corizon or Tehum to what Tehum called "affiliates," or companies controlled by insiders, from December 2021 to November 2022. Some of those payments, Tehum noted, were offset by incoming transfers.

A subsequent disclosure statement filed in the bankruptcy case confirms that at least $30 million was sent from company coffers to companies controlled by insiders — funds that could potentially have been used to bolster payouts in the settlement. Just before splitting the company, Corizon's owners moved millions of dollars into new bank accounts with a curious feature: The company's chief financial officer couldn't view the transactions.

So bookkeepers were most likely unaware when, from December 2021 to November 2022, $24.5 million was moved out of those accounts and into the account of M2 LoanCo, a lender with ties to Tehum, according to the disclosure. (The disclosure notes that M2 has disputed this amount.) Lefkowitz is a director of both M2 and Tehum.

In addition, Corizon paid $5.5 million from December 2021 to May 2022 to Geneva Consulting LLC, according to the disclosure statement. Lefkowitz had a controlling interest in Geneva, according to a motion submitted in a lawsuit filed against Tehum by the University of Missouri Health Care system and a local hospital. Geneva also manages and financially supports YesCare, according to a bid for a state prison contract obtained by Insider.

The senators' letter raises concerns about a range of company tactics it calls "questionable and unjust," including "diverting millions of Corizon dollars to other companies that the investors personally owned or were associated with, likely limiting funds available for victims."

In a June motion, several creditors said the transactions could be tantamount to a "fraudulent transfer" of assets outside their reach.

According to federal bankruptcy code, a fraudulent-transfer claim requires a showing of intent — "to hinder, delay, or defraud" creditors.

When it comes to showing intent, Edward Janger, a professor of law at Brooklyn Law School, said the Uniform Voidable Transactions Act, which has been adopted in some form by most states, provides a list of factors to consider.

"Intent can be established by looking at the objective characteristics of the transaction," Janger said. "You don't need a smoking gun."

Several of the factors may be present in Tehum's case, including a pattern of transfers to insiders, the concealment of transfers, and the fact that the company became insolvent shortly after the insider transfers were made.

5. 'Dishonest' testimony by a Tehum director.

Lefkowitz, Tehum's director, is a pivotal figure in the bankruptcy. He was one of the investors who bought Corizon and took it into the Two-Step. And he's served as one of Tehum's representatives in the bankruptcy negotiations.

The senators' letter accuses principals of the company of "stonewalling during meetings with creditors," and an August motion by creditors went further, arguing that Lefkowitz "has been dishonest throughout this case" about Tehum's affiliations with Geneva. Dishonesty during a bankruptcy proceeding is an infraction severe enough under federal bankruptcy code to be grounds for handing control to an independent trustee if committed by "current management."

Lefkowitz repeatedly said under oath during a June creditor call that he didn't know who owned Geneva Consulting — the company Corizon paid $5.5 million. Yet in a February 2022 email to Corizon's top executives, introduced as an exhibit in court, Lefkowitz said Geneva was a wholly owned subsidiary of Genesis Healthcare.

Creditors seized on what they called his "dishonest" testimony in arguing at a September hearing that the company should be handed over to a trustee.

Lopez denied the motion, arguing that as a director Lefkowitz did not meet the bankruptcy code's definition of current management.

While the US Trustee is supposed to watchdog bankruptcy crimes, criminal referrals are rare.

In the 2022 fiscal year, according to Justice Department data, the US Trustee made just 2,104 bankruptcy-related criminal referrals. By comparison, there were almost 388,000 bankruptcy filings in the 2022 calendar year. Of those referrals, only seven — 0.3% of all cases — had led to formal charges as of June.

The US Trustee declined to comment on whether it was considering a criminal referral in this case.

6. Failure to disclose a data breach.

In early September, Tehum's chief restructuring officer, Russell Perry, admitted during a hearing that the company had been party to a cyber incident. He did not provide further details.

But the objection filed by the US Trustee says Tehum provided some details months earlier — at a March 20 hearing attended only by Tehum's representatives, representatives of the major creditors, and a representative of the US Trustee. There, the US Trustee's representative told the company it was required to disclose the incident to creditors.

Tehum later sought court approval to hire Baker & Hostetler LLP, a national law firm, to handle cyber-related issues. Tehum said Baker would provide "incident investigation" and "data recovery," as well as help "preparing, mailing, and submitting all required individual and regulatory notifications."

And yet, the US Trustee's objection says, though Tehum spent funds to retain this firm, "to date, there has been no disclosure to the public and creditors regarding the incident."

Baker & Hostetler did not immediately respond to a request for comment.

The US Trustee didn't initially believe any patient records were at risk. But then, as Insider reported, Lefkowitz said during a deposition that some Tehum records — potentially including sensitive prisoner health files — had been stored on his email or in a Dropbox account.

The company never explained in open court what precipitated the hire of Baker & Hostetler. But an objection submitted by a creditor's attorneys in April — Insider obtained an unredacted copy — says Corizon was the subject of a ransomware attack.

A tweet from a cybersecurity firm and an alert from the information-security site RedPacket Security also suggest as much. Both cite a post from the dark web claiming the breached documents included legal and health records pertaining to the company's incarcerated patients.

"It is unclear when the Debtor became aware of the theft — or whether they have reported the incident to the FBI and CISA," the creditors' attorneys wrote in their April filing, referring to the Cybersecurity and Infrastructure Security Agency.

And Department of Health and Human Services regulations require a breach notification in most cases. Representatives for CISA and the FBI declined to comment; HHS did not respond to a request for comment.

An Alabama prisoner, Tracey Grissom, filed suit against Corizon claiming she was forced to live in her own feces for months because Corizon providers failed to give her a properly fitted ostomy bag. Her attorney raised the data breach in an objection filed last week, saying Grissom had not been notified about the potential theft of her sensitive data, as required by HIPAA, the medical privacy law.

Roman Sannikov, a cyberthreat intelligence researcher who founded Constellation Cyber LLC, said the available evidence suggested that Corizon might have paid a ransom to keep patients' personal information off the internet.

Sannikov said it "typically means that the company has paid a ransom" when a data breach appears on an alert website, the data is not leaked, and yet the company's name is removed from the site, as appears to have happened in this case.

In March, the FBI and CISA sent out a joint alert about the same ransomware group that appears to have targeted Corizon, saying it had recently made "ransom demands ranging from approximately $1 million to $11 million" in bitcoin.

The company hasn't yet sought approval from Lopez in court to make such a payment. And the US Trustee, in its objection, said Tehum hadn't told creditors whether voting for the settlement would release the company and other parties from liability for any claims related to the information breach.

The disclosure statement "must be modified to include information concerning the data incident, the impact of the incident on potential claims and the effect of the third-party releases," the objection reads.

What's next?

The proposed settlement isn't a done deal yet. Lopez raised so many concerns at the October 17 hearing that, he said, "the fundamental deal has to be reconsidered." Once it's finalized, a majority of the creditors still have to approve it in a vote.

The involvement of the US Trustee's office is a huge development. The job of that office, the agency says, is to "promote the integrity and efficiency of the bankruptcy system for the benefit of all stakeholders." Historically, the office says, it has played a critical role in policing conflicts of interest and has taken "a narrow view" of the authority of bankruptcy courts to release third parties from liability.

It filed objections, motions, or complaints to disclosure statements in only 249 cases in the 2021 fiscal year, the period covered by its latest annual report; the report says 98% of those interventions were successful.

Meanwhile, the nine senators who authored the letter have given YesCare and Tehum until November 8 to answer their detailed inquiries.