Three Critical Steps to Take Today If You Face Healthcare Fraud Exposure

Step One: Implement a Litigation Hold and Preserve Every Byte of Evidence

In my 25 years as a federal prosecutor, I witnessed countless investigations where the difference between a declination and an indictment turned on whether the target had preserved or spoliated evidence. When you first learn of potential healthcare fraud exposure—whether through a whistleblower complaint, a civil investigative demand, or a media inquiry—your immediate obligation is to halt all routine document destruction policies. Under the Sarbanes-Oxley Act, specifically 18 U.S.C. § 1519, any person who knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence a federal investigation commits a felony punishable by up to 20 years in federal prison. This statute applies even if no subpoena or grand jury has yet been convened; the mere anticipation of a federal inquiry is sufficient to trigger its prohibitions.

The scope of preservation must be comprehensive and defensible. Your litigation hold should cover all electronic communications, including emails, text messages, Slack messages, Microsoft Teams chats, and any encrypted messaging applications used in the course of your healthcare business. I have seen cases where a single deleted text message containing a referral arrangement between a physician and a laboratory became the cornerstone of a kickback conspiracy charge under 42 U.S.C. § 1320a-7b(b)(2)(A). Your counsel should immediately issue a written preservation directive to all employees, contractors, and affiliates, and should confirm receipt and compliance in writing. Do not rely on verbal instructions; the government will depose your IT director and ask whether a formal hold was ever implemented.

Beyond communications, you must preserve all financial records, billing logs, coding sheets, medical necessity documentation, and any internal audits or compliance reviews. The False Claims Act, 31 U.S.C. § 3729(a)(1)(A), imposes liability on any person who knowingly presents, or causes to be presented, a false or fraudulent claim for payment to the federal government. If you destroy evidence that could have demonstrated good-faith reliance on a legitimate coding interpretation, you forfeit the ability to argue absence of scienter. I have prosecuted healthcare executives who thought they could "clean up" files before a federal agent arrived; each of them learned that the government's forensic accountants can reconstruct deleted files and that spoliation instructions are given to every jury in federal court.

Your preservation obligation extends to metadata as well. The Federal Rules of Civil Procedure, particularly Rule 26(b)(2)(B), address the discoverability of electronically stored information, and federal prosecutors routinely subpoena server logs, access records, and backup tapes. If you use a cloud-based electronic health records system, you must ensure that the vendor does not automatically purge data under its standard retention policy. I recommend that your counsel send a written notice to every third-party vendor who holds your data, instructing them to preserve all records in their current state. Failure to do so can result in adverse inference instructions at trial, which can be devastating to your defense.

Finally, do not assume that the government's investigation is limited to a specific time period or a single billing code. Federal healthcare fraud investigations under the Health Care Fraud Statute, 18 U.S.C. § 1347, often expand exponentially once agents begin reviewing preserved documents. I have handled cases where a target preserved only billing records from the last two years, only to discover that the government's subpoena demanded records going back seven years under the statute of limitations for fraud. A comprehensive preservation strategy should assume that every document created during the entire period of your Medicare or Medicaid participation is potentially relevant. This is not the time for cost-cutting; it is the time for over-preservation.

Step Two: Engage Counsel Before the Government Engages You—And Conduct a Privileged Internal Audit

The single most common mistake I observed as a prosecutor was healthcare providers waiting until they received a subpoena or a search warrant before hiring a federal criminal defense attorney. By that point, the government has already built a preliminary case, often using voluntary interviews or cooperating witnesses. In my experience, the optimal time to retain counsel is the moment you have a good-faith basis to believe that a federal investigation is underway or imminent. Under the Department of Justice's Principles of Federal Prosecution, found in the Justice Manual § 9-27.000, prosecutors evaluate a target's cooperation and acceptance of responsibility from the very first interaction. If you have counsel in place before the government contacts you, your attorney can proactively engage with the Assistant U.S. Attorney and the FBI case agent to frame the narrative before charges are drafted.

Your counsel should immediately initiate a privileged internal audit of your billing practices, referral relationships, and documentation protocols. This audit must be conducted under the protection of the attorney-client privilege and the work-product doctrine, as articulated in Upjohn Co. v. United States, 449 U.S. 383 (1981), which extends privilege to communications between corporate counsel and employees regarding legal advice. The audit should focus on three specific areas: first, whether your billing reflects the actual services rendered and documented in the medical record; second, whether any financial relationships with referring providers comply with the Anti-Kickback Statute's safe harbors codified at 42 C.F.R. § 1001.952; and third, whether your coding practices adhere to the Physician Self-Referral Law, commonly known as the Stark Law, under 42 U.S.C. § 1395nn.

The internal audit must be thorough and honest. I have seen defense attorneys who conducted superficial audits that missed clear red flags, only to have those same red flags discovered by the government during a subsequent investigation. Under the Federal Sentencing Guidelines, particularly § 8B2.1, an effective compliance and ethics program requires due diligence in detecting and preventing criminal conduct. If your audit reveals problematic billing or referral patterns, your counsel can advise you on how to self-disclose to the OIG or the Department of Justice under the OIG's Self-Disclosure Protocol, which can result in significantly reduced penalties and avoid exclusion from federal healthcare programs. Self-disclosure is not an admission of guilt; it is a strategic decision that demonstrates good faith and cooperation.

During this audit, you must also assess whether any whistleblower has already filed a complaint under the False Claims Act's qui tam provisions, 31 U.S.C. § 3730. The government often seals these complaints for months or years while investigating, and you may not know a case exists until you receive a civil investigative demand. Your counsel can monitor public dockets and maintain relationships with the U.S. Attorney's Office to learn whether a sealed complaint is pending. If a qui tam action is underway, your window for voluntary self-disclosure narrows dramatically, because the relator's counsel has already provided the government with a roadmap to your alleged fraud. In that scenario, your attorney must immediately begin negotiating a potential resolution before the government files a complaint in intervention.

Finally, the internal audit should produce a written report that is protected by privilege and shared only with your defense team. Do not distribute this report to your compliance officer, CFO, or board of directors without explicit guidance from counsel, as such distribution can waive privilege. I have prosecuted cases where a company's internal audit report became the government's exhibit one at trial because it was shared with a third-party auditor who was not covered by privilege. The audit is a tool for your defense, not a confession. Use it to identify weaknesses, develop mitigation strategies, and prepare your defense narrative before the government asks you a single question.

Step Three: Cease Questionable Billing Practices Immediately and Document Your Good-Faith Compliance Efforts

Once you have preserved evidence and engaged counsel, your next critical step is to halt any billing practices that could reasonably be interpreted as fraudulent. This is not an admission of wrongdoing; it is a prudent risk-management decision that demonstrates good faith to prosecutors. Under the False Claims Act, the government must prove that a claim was submitted "knowingly," which includes deliberate ignorance or reckless disregard of the truth or falsity of the information, per 31 U.S.C. § 3729(b)(1)(A). If you continue billing in a manner that your own counsel has flagged as potentially problematic, you are creating powerful evidence of scienter. I have seen juries convict defendants not because the original billing was fraudulent, but because they continued the same pattern after receiving legal advice identifying the risk.

Your cessation of questionable billing should be accompanied by a written directive from your counsel, memorialized in a privileged communication, that outlines the specific codes, services, or referral arrangements that require immediate suspension. This directive should also include a plan for how to handle patients who are currently receiving services that may be impacted. For example, if you are a durable medical equipment supplier and you have been billing for items that were not medically necessary under Medicare's Local Coverage Determinations, you must stop those shipments and billings immediately. Then, you must work with your counsel to determine whether you have an obligation to refund payments already received under the False Claims Act's implied certification theory, which holds that each claim implicitly certifies compliance with all applicable statutory and regulatory requirements.

In addition to stopping problematic billing, you must begin documenting every step you take toward compliance. Federal prosecutors and OIG agents are far more likely to decline prosecution or offer a non-prosecution agreement if they see a contemporaneous record of corrective action. Create a compliance log that includes the date you retained counsel, the date you issued the litigation hold, the date you suspended specific billing codes, and the date you initiated any internal training or policy revisions. Under the Federal Sentencing Guidelines, a company that has an effective compliance program at the time of the offense can receive a significant reduction in its culpability score. Even if your program was not perfect before the investigation, implementing immediate corrective measures shows that you are not the type of defendant who requires criminal sanctions to change behavior.

Your documentation should also include any consultations with coding experts, compliance consultants, or healthcare attorneys who can attest to the legitimacy of your billing practices under applicable regulations. For instance, if you billed for evaluation and management services at a higher level than the documentation supported, you should work with a certified professional coder to conduct a retrospective review and determine whether the overbilling was due to a systemic error rather than intentional fraud. The government's burden is to prove intent, and a well-documented pattern of reliance on professional coding guidance can negate the inference of willfulness. I have defended cases where the government's own expert admitted that the coding guidelines were ambiguous, and our contemporaneous documentation of compliance efforts made conviction impossible.

Finally, do not forget to address the Stark Law and Anti-Kickback Statute implications of your current compensation arrangements. If you have financial relationships with referring physicians that are not within a safe harbor, you must either restructure those relationships or terminate them. The OIG's advisory opinions, available on its website, provide guidance on whether specific arrangements pose a risk of prosecution. Your counsel should review these opinions and, if appropriate, submit a request for a new advisory opinion regarding your specific facts. While advisory opinions are not binding on the Department of Justice, they are highly persuasive to juries and judges. I have seen cases where a defendant's reliance on an OIG advisory opinion was the single most powerful piece of evidence in defeating a criminal kickback charge.

If you are facing healthcare fraud exposure, the decisions you make in the next 48 hours will shape the outcome of your case for years to come. In my quarter-century of federal practice, I have seen too many well-intentioned healthcare providers make irreversible mistakes by delaying action, failing to preserve evidence, or attempting to handle government inquiries without experienced counsel. The steps outlined above—preserving all evidence, retaining counsel before the government contacts you, conducting a privileged internal audit, and ceasing questionable billing practices with documented good faith—are not theoretical suggestions; they are the tactical imperatives that separate successful defenses from indictments. Do not wait for a subpoena to land on your desk. Contact my office today for a confidential consultation, and let us build your defense before the government builds its case.