Healthcare fraud is a federal crime that covers billing schemes, kickbacks, and improper referrals against public and private health programs, and it can bring up to 10 years in prison for a basic offense, 20 years when a patient is seriously injured, and up to life when a patient dies. The Department of Justice charged 324 defendants in its 2025 national takedown alone, targeting more than $14.6 billion in fraudulent billing.1Office of Inspector General. 2025 National Health Care Fraud Takedown Beyond criminal prosecution, civil penalties routinely run into the billions, and individuals with inside knowledge of fraud against government programs can file whistleblower lawsuits that pay 15 to 30 percent of what the government recovers.
What Healthcare Fraud Looks Like
Most large-scale fraud starts with providers manipulating billing to pull more money out of insurers than the care actually earns. Three tactics dominate.
Upcoding means billing for a more expensive procedure or visit than the one actually performed. A short check-in gets coded as a comprehensive evaluation, and the reimbursement jumps by hundreds of dollars. Repeated across a patient panel, the overcharges compound.
Unbundling breaks a treatment that should be billed as a single package into separate line items, each with its own charge. Insurers set bundled rates precisely to control cost, so splitting the components defeats the discount.
Phantom billing is the most brazen version: claims for services, equipment, or consultations that never happened. The provider uses real patient information to generate invoices for surgeries, tests, or supplies never delivered. Patients caught up in it may find their coverage limits burned through on care they never received.
Telehealth Schemes
Telehealth has opened a specific fraud channel the HHS Office of Inspector General tracks closely. Telemarketers collect insurance information from patients, a provider signs off on orders for durable medical equipment, genetic tests, or prescriptions without examining the patient, and a separate company buys the completed paperwork and bills Medicare or Medicaid.2Office of Inspector General. Telehealth The signature red flag is a provider ordering treatment for someone they’ve never actually seen.
Fraud by Patients
Not all fraud is on the provider side. Sharing insurance cards with uncovered friends or family, lying on a Medicaid application, doctor shopping for controlled substances, and using someone else’s insurance number to get care all count. Each diverts resources from legitimate patients, and each can trigger federal charges.
The Federal Laws That Apply
Four statutes carry most healthcare fraud enforcement, and prosecutors often charge under more than one at a time.
The Health Care Fraud Statute
Under 18 U.S.C. § 1347, it is a federal crime to knowingly execute a scheme to defraud any health care benefit program, whether public or private. The government has to prove deliberate intent to obtain money through false representations. It reaches everything from a solo billing scam to a coordinated fraud ring.3Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud
The False Claims Act
The False Claims Act, at 31 U.S.C. §§ 3729–3733, creates civil liability for anyone who knowingly submits a false claim for payment to the federal government. It uses a civil standard rather than the criminal beyond-a-reasonable-doubt standard, and it lets private citizens sue on the government’s behalf. Settlements and judgments under the Act topped $6.8 billion in fiscal year 2025.4United States Department of Justice. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025
The Anti-Kickback Statute
The Anti-Kickback Statute, 42 U.S.C. § 1320a-7b, makes it a felony to offer, pay, solicit, or receive anything of value in exchange for referrals to services covered by federal healthcare programs. A physician taking cash from a lab in exchange for patient referrals violates it. So does a device company paying for a surgeon’s vacation in exchange for using its products.5Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Not every payment between healthcare entities is illegal; federal regulations set out specific safe harbors for arrangements like fair-market-value equipment leases, bona fide employment, and qualifying discounts, and an arrangement fitting squarely within one is not treated as a kickback.6eCFR. 42 CFR 1001.952 – Exceptions
The Stark Law
The Stark Law, 42 U.S.C. § 1395nn, prohibits physicians from referring Medicare patients for certain designated services (lab work, physical therapy, radiology, durable medical equipment, home health, outpatient prescriptions, and hospital services, among others) to entities where the physician or an immediate family member has a financial interest. Unlike the Anti-Kickback Statute, Stark is strict liability: a prohibited referral with no applicable exception is a violation regardless of intent.7Office of the Law Revision Counsel. 42 US Code 1395nn – Limitation on Certain Physician Referrals Medicare denies payment on tainted claims, the provider must refund anything already collected, and 2026 inflation-adjusted penalties reach $31,670 per improper claim and $211,146 for each scheme designed to disguise a prohibited arrangement.8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
What Offenders Face
A conviction under § 1347 carries up to 10 years in federal prison, up to 20 years if the fraud causes serious bodily injury, and any term of years up to life if it causes a patient’s death.3Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud Federal fines can reach $250,000 for individuals and $500,000 for organizations per offense.9Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine Anti-Kickback violations are punished separately at up to $100,000 in fines and 10 years of imprisonment per offense.5Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
On the civil side, the False Claims Act stacks a per-claim penalty (the statutory base of $5,000 to $10,000 is adjusted upward for inflation each year) on top of three times the government’s actual losses. Because one scheme can generate thousands of claims, 500 false claims produce 500 separate per-claim penalties plus treble damages.10Office of the Law Revision Counsel. 31 USC 3729 – False Claimsa>
The most career-ending consequence is often exclusion from federal healthcare programs. A provider convicted of a program-related crime, patient abuse, a healthcare fraud felony, or a felony involving controlled substances faces mandatory exclusion of at least five years. A second conviction extends the minimum to 10 years; a third means permanent exclusion.11Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Federal Health Care Programs With Medicare and Medicaid making up so much of most practices’ revenue, even the minimum can effectively close a business.
Organizations that settle without being excluded typically operate under a Corporate Integrity Agreement with the OIG for five years, with a designated compliance officer, independent audits, annual reporting, and self-reporting of overpayments and compliance failures.12Office of Inspector General. Corporate Integrity Agreements
How to Spot It on Your Own Bills
Your Explanation of Benefits is the practical starting point. Each EOB lists what was billed, what the insurer paid, and what you owe. Read every one. Look for services you didn’t receive, dates you weren’t seen, providers you don’t recognize, and equipment that never arrived. Those discrepancies are the raw material investigators need.
When something is off, pull together the provider’s name and address, the dates of service in question, and the EOB itself before you make the call.
Where to Report It
- OIG Hotline. Call 1-800-HHS-TIPS or file online for fraud involving Medicare, Medicaid, or other federal healthcare programs.13Office of Inspector General. Report Fraud, Waste, and Abuse
- Your insurance company. Private insurers run their own fraud investigation units. The number is on the back of your card and on your EOB.
- Your state insurance department. Every state investigates insurance fraud. Timelines vary, but reporting within 30 to 60 days of discovery keeps your options open.
After you file, you’ll usually get a confirmation number for tracking, and an investigator may reach back for more detail.
Filing a Whistleblower Lawsuit
If you have inside knowledge of fraud against a government healthcare program, the False Claims Act lets you do more than pass a tip along. You can file a qui tam action, meaning a civil lawsuit on the government’s behalf, and share in the recovery.
The complaint is filed under seal in federal court, so it stays confidential while the Department of Justice investigates. DOJ then decides whether to intervene and take over the case or decline and let you continue on your own. Your share depends on that decision:14Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims
- If the government intervenes, you receive 15 to 25 percent of the recovery, depending on your contribution to the case.
- If the government declines and you carry the litigation, you receive 25 to 30 percent.
Given how large healthcare fraud settlements can run, even the lower end is meaningful. Qui tam attorneys typically work on contingency, so their fee comes out of any recovery rather than out of pocket.
Retaliation Protections
The False Claims Act’s anti-retaliation provision covers employees who report fraud or support an investigation. An employer who fires, demotes, suspends, or harasses you for that activity is liable for reinstatement, double back pay with interest, and special damages including litigation costs and attorney fees.14Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims You have three years from the retaliatory act to bring a claim.
HIPAA and Patient Information
Reporting from inside a healthcare organization often means disclosing protected health information, and HIPAA’s whistleblower safe harbor addresses that directly. You can share PHI with a health oversight agency, a public health authority, or your own attorney when you have a good-faith belief that your employer has engaged in unlawful conduct or that patient safety is at risk.15eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules Disclosures to those recipients for that purpose won’t create HIPAA liability on their own.
If Your Identity Was Used for Medical Care
Medical identity theft causes damage beyond billing. Fraudulent entries in your records can drive future treatment decisions, trigger interaction warnings for drugs you never took, or cause legitimate claims to be denied because your coverage looks exhausted. Move quickly.
Start with your health insurer’s fraud department and request EOBs for the affected period. Then contact every provider, pharmacy, or lab where the thief used your information and request the medical records created in your name. Report errors in writing and ask for corrections. If a provider will not release your records within 30 days, file a complaint with the HHS Office for Civil Rights. Report the identity theft itself at IdentityTheft.gov or by calling 1-877-438-4338.16Federal Trade Commission. Medical Identity Theft – What to Know, What to Do