A healthcare attorney is a lawyer who concentrates on the laws and regulations governing the medical industry, advising hospitals, physician practices, pharmaceutical companies, insurers, and individual providers on how to operate within an unusually dense regulatory framework. A single physician practice may need to comply with federal fraud and abuse statutes, patient privacy rules, state licensing requirements, and payer-specific billing standards all at once, and a healthcare attorney is the person who guides providers and organizations through that web — structuring compliant operations, negotiating deals, responding to government investigations, and defending enforcement actions or malpractice claims.
What the Work Looks Like Day to Day
The title covers a lot of ground. Some healthcare attorneys spend most of their time reviewing contracts and advising on regulatory compliance, making sure a new physician employment agreement doesn’t trigger a federal fraud statute. Others defend providers in malpractice suits, handle licensing disputes before state medical boards, or guide hospital mergers through antitrust and regulatory review. A smaller group concentrates on government investigations, representing providers who receive subpoenas from the Office of Inspector General (OIG) or the Department of Justice.
What ties the work together is that every engagement requires understanding both the legal framework and the operational reality of healthcare delivery. An attorney drafting a joint venture agreement between a hospital and a group of surgeons needs to know not just contract law, but also how the Stark Law and Anti-Kickback Statute apply to referral relationships, how Medicare reimbursement flows, and how the arrangement might look to a government auditor years later. That dual competency is what separates a healthcare attorney from a general business lawyer who occasionally takes a medical client.
Federal Fraud and Abuse Laws
The federal government spends hundreds of billions annually on Medicare and Medicaid, and it enforces several overlapping statutes designed to prevent fraud, waste, and financial conflicts of interest in those programs. Three of them form the backbone of healthcare regulatory work.
The Stark Law
The Physician Self-Referral Law, universally called the Stark Law, bars physicians from referring Medicare or Medicaid patients for designated health services to any entity where the physician or an immediate family member has a financial relationship, unless a specific exception applies. Designated health services include clinical lab work, physical therapy, radiology, durable medical equipment, home health services, outpatient prescription drugs, and inpatient and outpatient hospital services, among others.1Office of the Law Revision Counsel. 42 USC 1395nn – Limitation on Certain Physician Referrals
Stark is a strict-liability statute. Intent doesn’t matter. If the financial relationship exists and no exception covers it, the referral violates the law even when everyone involved had good intentions. Penalties include denial of Medicare payment for the referred services, civil fines of up to $15,000 per service, and potential exclusion from federal healthcare programs.1Office of the Law Revision Counsel. 42 USC 1395nn – Limitation on Certain Physician Referrals Healthcare attorneys spend significant time structuring compensation arrangements, lease agreements, and practice acquisitions so they fit within one of the Stark exceptions for fair-market-value transactions, employment relationships, or in-office ancillary services.
The Anti-Kickback Statute
The Anti-Kickback Statute (AKS) makes it a felony to knowingly offer, pay, solicit, or receive anything of value to induce or reward referrals for services covered by a federal healthcare program. Unlike Stark, the AKS requires intent; prosecutors must show the person acted “knowingly and willfully.” The penalties are severe: criminal fines of up to $100,000, imprisonment of up to 10 years, or both, plus potential exclusion from Medicare and Medicaid.2Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
Because the statute is written so broadly, the OIG has established regulatory safe harbors that protect certain common arrangements from prosecution, including investment returns in publicly traded companies, fair-market-value equipment and space rentals, and bona fide employment relationships.3eCFR. 42 CFR 1001.952 – Exceptions A healthcare attorney’s job is to structure financial arrangements so they either fall squarely within a safe harbor or present minimal enforcement risk. The work gets granular. The difference between a compliant physician recruitment package and an illegal inducement can come down to how a relocation bonus is calculated or whether a lease payment reflects fair market value.
The False Claims Act
The False Claims Act (FCA) is the government’s primary civil tool for recovering money lost to healthcare fraud. Anyone who knowingly submits a false claim for payment to a federal healthcare program faces a civil penalty of $5,000 to $10,000 per claim (adjusted annually for inflation), plus three times the amount of damages the government sustained.4Office of the Law Revision Counsel. 31 USC 3729 – False Claims For a hospital that submitted thousands of inflated claims, the math escalates quickly.
The FCA also has a powerful whistleblower provision. A private individual, often a billing specialist, nurse, or disgruntled employee, can file a qui tam lawsuit on the government’s behalf. If the government intervenes, the whistleblower receives between 15% and 25% of whatever is recovered. If the government declines and the whistleblower proceeds alone, the share jumps to between 25% and 30%.5Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims Healthcare attorneys handle both sides of these cases, representing whistleblowers who bring them and defending providers accused in them. The OIG, the Department of Justice, and the Centers for Medicare and Medicaid Services all play roles in enforcement.6U.S. Department of Health and Human Services Office of Inspector General. Fraud and Abuse Laws
HIPAA and Patient Privacy
The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting patient health information. Its Privacy Rule governs when and how protected health information can be used or shared. Its Security Rule requires technical, administrative, and physical safeguards for electronic health records. Its Breach Notification Rule requires covered entities to notify affected patients and the Department of Health and Human Services when protected health information is compromised, with patients notified no later than 60 days after a breach is discovered and breaches affecting 500 or more people reported to HHS within the same window.7HHS.gov. Breach Notification Rule
Civil penalties are tiered by the level of culpability and run from a few hundred dollars per violation up to over two million dollars per year for willful neglect left uncorrected, with the figures adjusted annually for inflation.8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Healthcare attorneys help organizations build HIPAA compliance programs, conduct risk assessments, and manage breach response, including drafting notification letters, coordinating with forensic investigators, and negotiating with HHS when an investigation follows.
Transactions and Business Structures
Healthcare is a consolidating industry. Hospitals acquire physician practices, private equity firms invest in specialty groups, and health systems form joint ventures with ambulatory surgery centers. Every one of these deals requires a healthcare attorney because ordinary business law doesn’t account for the regulatory landmines unique to medicine.
A merger between two physician groups has to be evaluated not just for antitrust and tax implications, but also for Stark Law compliance (does the combined entity create prohibited referral relationships?), AKS exposure (is any part of the purchase price tied to referral volume?), and licensure continuity (do the physicians’ licenses and credentials transfer cleanly?). Healthcare attorneys conduct regulatory due diligence alongside the usual financial review, flagging compliance risks that could blow up the deal or lead to government enforcement years after closing.
Roughly 33 states and the District of Columbia enforce some version of the corporate practice of medicine doctrine, which prevents non-physician-owned corporations from directly employing physicians or controlling clinical decisions. In those states, a technology company or private equity fund can’t simply hire physicians as employees the way it would hire engineers. The business typically contracts with a physician-owned professional entity through a management services agreement, and getting that structure wrong can void the arrangement entirely. Attorneys also negotiate and draft the physician employment agreements that follow, which routinely include non-compete clauses, productivity-based compensation formulas, and termination provisions with significant financial consequences. State law on physician non-competes varies widely, with some states banning them outright and others enforcing them with limits on duration and geographic scope.
Licensing and Disciplinary Defense
A physician’s license is their livelihood, and losing it, even temporarily, has cascading consequences. Healthcare attorneys represent physicians, nurses, and other licensed professionals facing investigations or disciplinary proceedings before state licensing boards.
The typical process starts with a complaint, which triggers a board investigation. If the board finds a reasonable basis for a violation, it brings formal charges. The provider then has the opportunity to defend themselves in an administrative hearing, often before an administrative law judge. Penalties can range from mandatory retraining or ethics courses to probation, suspension, or revocation of the license. Having counsel from the investigation stage matters enormously. What a provider says, or doesn’t say, before formal charges are filed can shape the entire outcome.
Any adverse action against a provider — malpractice payments, license restrictions, lost clinical privileges, exclusion from a federal healthcare program — gets reported to the National Practitioner Data Bank (NPDB), a federal database that hospitals are required to check before granting credentials. Reports must be submitted within 30 days of the triggering event.9U.S. Department of Health and Human Services – National Practitioner Data Bank. What You Must Report to the NPDB A single NPDB report can follow a provider for their entire career, making it harder to get hospital privileges, join insurance panels, or find employment. Healthcare attorneys often negotiate settlements specifically structured to minimize or avoid NPDB reporting, for example resolving a malpractice claim before a formal payment triggers a report, or negotiating the terms of a privilege restriction so it falls below the 30-day reporting threshold.
Hospitals also conduct internal peer review to evaluate physician competence and conduct, which can lead to restrictions on clinical privileges. The Health Care Quality Improvement Act (HCQIA) grants qualified immunity to hospitals and peer reviewers when the review was taken in the reasonable belief it furthered quality care, after a reasonable effort to gather the facts, with adequate notice and hearing procedures for the physician, and in the reasonable belief the action was warranted by the known facts. When the process falls short, physicians can challenge the peer review in court, and healthcare attorneys represent both sides.
Medicare and Medicaid Audits
Government audits are a fact of life for providers who bill Medicare or Medicaid. The Centers for Medicare and Medicaid Services uses Recovery Audit Contractors (RACs) to review claims after payment and identify overpayments or underpayments through automated reviews at the system level and complex reviews that require a qualified person to examine the medical record.10Centers for Medicare & Medicaid Services. Medicare Fee for Service Recovery Audit Program When a RAC identifies an overpayment, the provider receives a demand letter, and that is typically where a healthcare attorney gets involved.
Original Medicare has five levels of appeal, each with its own deadline and decision-maker, running from redetermination by the Medicare Administrative Contractor through reconsideration, an Administrative Law Judge hearing, Medicare Appeals Council review, and finally federal district court. Missing a deadline at any level generally forfeits the right to further appeal, which is why providers facing significant overpayment demands almost always engage a healthcare attorney to manage the process.11Medicare. Appeals in Original Medicare
Telehealth and Multi-State Practice
Telehealth has expanded dramatically, but the regulatory framework hasn’t fully caught up. Medical practice is licensed at the state level, and a physician providing telehealth services to a patient in another state generally needs to be licensed in the patient’s state, not just their own. The Interstate Medical Licensure Compact (IMLC) offers a streamlined pathway for physicians to obtain licenses in multiple states, with 42 states, Washington D.C., and Guam currently participating. Participation doesn’t eliminate the need for a separate state license; it just makes the application process faster.
Prescribing adds another layer. A DEA registration is tied to the state where the practitioner holds a license, and practitioners maintaining a professional practice in multiple states need a separate DEA registration in each one. Healthcare attorneys advise telehealth providers on building compliant multi-state practices, including which states require special telehealth registrations, how to handle prescribing across state lines, and how to structure informed consent for remote care.
When to Hire One
Some situations obviously call for legal help, like receiving a subpoena from the OIG, being named in a malpractice suit, or facing a licensing board complaint. But a healthcare attorney often adds the most value before anything has gone wrong:
- Starting or joining a practice. Reviewing employment agreements, partnership buy-ins, and compensation structures for Stark Law and AKS compliance before you sign.
- Building a compliance program. Designing internal policies, training protocols, and audit procedures that satisfy federal standards and provide a defense if something goes wrong later.
- Entering a business transaction. Any merger, acquisition, joint venture, or management services agreement involving a healthcare entity needs regulatory due diligence alongside the financial review.
- Responding to a government audit. Whether it’s a RAC audit, a CMS probe, or an OIG investigation, the response strategy in the first few weeks shapes the outcome.
- Experiencing a data breach. HIPAA’s 60-day notification clock starts ticking when the breach is discovered.
- Expanding into telehealth. Cross-state licensing, DEA registration, and state-specific telehealth laws create a compliance puzzle that grows with each new state you serve.
Healthcare law problems are almost always cheaper to prevent than to fix. A compliance review that costs a few thousand dollars up front can head off an investigation that would cost hundreds of thousands to defend.
How to Choose One
Healthcare law is broad enough that most attorneys concentrate in a few sub-specialties. Someone who spends their career on hospital mergers may not be the right fit for a licensing board defense, and vice versa. The first question to ask is whether the attorney has direct experience with your specific type of issue, not just healthcare law generally.
Some state bar associations offer board certification in health law, which typically requires at least five years of practice, substantial involvement in health law matters, continuing legal education, and peer review. Membership in the American Health Law Association (AHLA) is common among practitioners in the field, though it’s a professional association rather than a credentialing body. Neither certification nor AHLA membership is required to practice healthcare law, but both signal that the attorney treats it as a primary focus rather than an occasional sideline.
Fee structures vary with the type of work. Regulatory compliance counseling, contract drafting, and transactional work are typically billed hourly, and rates for specialized healthcare attorneys generally run from roughly $200 to $400 or more per hour depending on the market and the attorney’s experience. Some attorneys offer flat fees for discrete tasks like reviewing a single employment agreement or filing a license application. For ongoing advisory relationships, a retainer arrangement is common. Litigation and government investigation defense are almost always billed hourly because the scope is unpredictable. An initial consultation is worth having before committing; most healthcare attorneys use it to assess the situation and explain how they would approach it, which also gives you a chance to evaluate whether their communication style works for you.