The False Claims Act (FCA) Enforcement – Healthcare

The False Claims Act

The False Claims Act (FCA) has long been one of the most powerful tools for combating fraud against the U.S. government. Originally enacted in response to procurement fraud during the American Civil War, this U.S. federal law is an effective tool for exposing entities and individuals engaged in deceptive practices costing the government billions of dollars. The qui tam provisions further increase the FCA’s effectiveness by incentivizing whistleblowers to come forward with suspicions of fraud, waste and abuse and agree to share a portion of any ultimate recoveries.

While the FCA is a broad law applicable to all industries, this article will focus on FCA enforcement within the healthcare industry, an area historically fraught with abuse of government funding.

Recent Enforcement Trends

In 2024, 57% (or $1.67 billion) of all FCA settlements and judgments involved the Department of Health and Human Services (HHS).^[1] This number is indicative of the DOJ’s continued prioritization of healthcare enforcement through targeted Strike Force teams. Government-backed healthcare programs, such as Medicare, remain ripe for fraud and continue to be exploited through various billing and coding schemes. Recent examples include Independent Health, a Medicare Advantage plan provider, who agreed to pay $98 million following allegations they were upcoding diagnoses to receive higher payments from Medicare.^[2]

The FCA also continues to serve as an enforcement mechanism for Stark Law and Anti-Kickback Statute violations – cases which often result in significant penalties. In fact, earlier this year the DOJ announced a $202 million settlement with Gilead Sciences, Inc. for allegedly paying kickbacks to healthcare practitioners to induce sales of its HIV medication.^[3] Similarly, Teva Pharmaceuticals also paid $450 million in October 2024 to resolve allegations it conspired with third parties to cover Medicare beneficiary copays for its multiple sclerosis drug, and also colluded with other drug companies to fix generic drug prices.^[4]

Additionally, the DOJ is still actively working through cases emerging from the COVID-19 pandemic and the prolific rise of telehealth across the nation. The remote element of COVID-19 – which is also at the core of the telehealth business model – has been particularly susceptible to fraud, waste and abuse. To respond to patient needs, healthcare organizations streamlined processes and, in some cases, key checks and balances (i.e. controls) were not established. This phenomenon created opportunities for providers to exploit the system and bill services with codes for which reimbursement was higher, that may not have been medically necessary or may not have been rendered to the patient.

Enforcement Outlook

Looking forward to 2025 and beyond, we can expect there will be a continued focus – and likely an increase – in healthcare related FCA enforcement. Both Attorney General Pam Bondi and Deputy Assistant Attorney General Michael Granston have made public commitments to aggressive and vigorous FCA enforcement, aligning with President Trump’s administrations goals to uncover waste, fraud and abuse. Additionally, the DOJ’s recently released white-collar enforcement plan clearly instructs prosecutors to prioritize health care fraud when investigating and prosecuting white-collar crimes.^[5] If this guidance is not indicative enough of what is to come, during the Annual Qui Tam Conference in February 2025, Deputy Assistant Attorney General Granston highlighted the positive rate of return on fighting fraud and noted that the government typically recovers three dollars for every dollar spent fighting fraud.  

Landmark settlements involving Walgreens and McKinsey also highlight the DOJ’s intent to leverage the FCA as a tool to combat the opioid crisis. In April 2025, Walgreens agreed to pay up to $350 million to resolve allegations they unlawfully filled opioid prescriptions and falsely claimed payment from Medicare and other federal healthcare programs.^[6] Relatedly, the $650 million settlement with McKinsey & Company last year marked the first settlement with a consulting firm for its role in providing advice to a pharmaceutical company to accelerate sales of OxyContin^[7] - clearly signaling that opioid related enforcement will now encompass more than just the healthcare industry.    

These recent enforcement trends and regulatory guidance emphasize the government’s priority to investigate and prosecute healthcare FCA violations. Healthcare companies must be prepared for increased scrutiny and have a strong compliance program supported by effective internal controls to prevent and detect misconduct. Compliance-focused organizations will reduce their risk of facing costly enforcement actions while reinforcing a standard of trust and integrity in the healthcare system.

Practical guidance to mitigate FCA risks

Since FCA enforcement is here to stay – and will likely be in full force in the coming years – what are some practical steps to help mitigate FCA risk?

The foundation of FCA compliance begins with a thorough understanding of contractual obligations. Organizations must evaluate whether they have the operational capacity, resources, and systems necessary to meet those obligations consistently. This includes reviewing performance requirements, reporting expectations, and billing terms — not only at the outset but throughout the entire contract lifecycle.

Organizations should have an established compliance program with clear policies addressing key risk areas and procedures to receive, investigate, and address reports of FCA non-compliance. Leadership should promote a compliance-focused culture and reinforce the organization’s values and commitment to adhering to regulatory requirements. By having a strong “tone-at-the-top” and strong internal policies and procedures, employees will be more likely to report potential concerns.

Ongoing monitoring and auditing plays a critical role in providing assurance that regulatory obligations are being met. Organizations should conduct regular monitoring and auditing activities – via audits or proactive risk assessments – with particular attention to reimbursements from federal programs. These proactive assessments help identify potential gaps and enable the implementation of policies, procedures and controls over high FCA risk areas, including billing, coding, and referrals. Monitoring and auditing activities are vital for ensuring that policies, procedures and controls are effective and timely detect any FCA compliance issues.

Furthermore, employees should receive regular compliance training and workshops where the organization shares information on current FCA regulations and best practices. Training is most effective when it is tailored to the specific roles and responsibilities, and it includes clear examples of FCA violations. The intersections of the FCA with HIPAA, Anti-Kickback Statutes, and Stark Law should also be incorporated.

Finally, accurate and thorough documentation is crucial to demonstrating compliance with federal and state regulations in the event an organization is required to produce documentation and defend against FCA claims. Detailed patient and billing records, documentation to demonstrate medical necessity, and records of compliance training sessions should be properly stored and maintained. Additionally, organizations should retain all communications in situations where they may have attempted to seek clarity from the government or obtained legal guidance on the complex, rapidly evolving, and often ambiguous healthcare rules and regulations.