Civil Investigative Demand (CID) Response Guide for Healthcare Providers: First Steps and Common Mistakes

For many healthcare providers, the first sign of a federal False Claims Act investigation is a civil investigative demand, often called a CID. A CID is a formal demand from the Department of Justice (DOJ) that can require an organization or individual to produce documents, answer written questions, or give sworn oral testimony. CIDs are frequently connected to qui tam whistleblower lawsuits that have been filed under seal, so a provider may receive a CID without knowing who raised the allegations or what exactly is being investigated.

CIDs are increasingly common in healthcare. DOJ reported that whistleblowers filed a record 1,297 qui tam lawsuits in fiscal year 2025, and that the government opened 401 investigations, with more than $5.7 billion in False Claims Act settlements and judgments related to the healthcare industry that year. In 2026, Executive Order 14395 directed the Attorney General to promote meritorious qui tam actions involving federal benefit programs, and DOJ reorganized its fraud enforcement through the new National Fraud Enforcement Division.

How a provider responds to a CID in the first days and weeks can significantly affect the course of the investigation. This guide explains what a CID is, the legal framework, first steps to take, how to manage the response, and common mistakes to avoid. It is educational and is not legal advice. Any organization that receives a CID should contact experienced legal counsel immediately.

What Is a Civil Investigative Demand?

The False Claims Act authorizes the Attorney General, or a designee, to issue a CID before filing a civil complaint or making an election in a qui tam case, when there is reason to believe a person may be in possession, custody, or control of documentary material or information relevant to a False Claims Act investigation. This authority is found at 31 U.S.C. 3733.

A CID may require the recipient to:

• Produce documentary material for inspection and copying.

• Answer written interrogatories in writing and under oath.

• Give oral testimony under oath.

• Furnish any combination of these.

CIDs may be issued to the organization under investigation, to its employees or former employees, or to third parties, such as vendors, billing companies, or referral sources.

How CIDs Differ From Other Requests

• A CID is a civil tool under the False Claims Act.

• A grand jury subpoena is a criminal tool and may indicate a criminal investigation.

• An HHS-OIG subpoena is issued under the Inspector General's authority.

• A records request from a Medicare contractor, such as an Additional Documentation Request, is part of program integrity review and is different from a DOJ investigation.

Because civil and criminal investigations can proceed in parallel, information produced in response to a CID may be shared with other government components as permitted by law. Counsel should evaluate the possibility of a parallel criminal investigation from the start.

Why Healthcare Providers Receive CIDs

Common reasons include:

• A qui tam complaint filed by a current or former employee, business partner, or competitor.

• Data analytics identifying unusual billing patterns.

• Referrals from CMS, Medicare contractors, or state Medicaid agencies.

• HHS-OIG audits or investigations.

• Information obtained in related investigations of other providers, vendors, or referral sources.

Common healthcare subject areas include medical necessity, coding and billing accuracy, Medicare Advantage risk adjustment, kickbacks and referral arrangements, physician self-referral issues, hospice eligibility, laboratory testing, durable medical equipment, and retention of overpayments.

Key Features of a CID

Under 31 U.S.C. 3733, a CID must describe the nature of the conduct constituting the alleged violation and the applicable provision of law. A CID for documents must describe the material with enough definiteness to identify it, specify a return date that provides a reasonable period of time to assemble the material, and identify the false claims law investigator to whom the material is to be made available. A CID for interrogatories or testimony has similar specifications.

The statute also includes provisions about custodians of documents, the confidentiality of material produced, and the ability of the government to share information in certain circumstances, including with a qui tam relator when the Attorney General determines it is necessary as part of the investigation.

Petitions to Modify or Set Aside

Under 31 U.S.C. 3733(j), a recipient may file a petition in federal court to modify or set aside a CID. The petition generally must be filed within 20 days after service of the CID or before the return date, whichever is earlier. In practice, many scope and timing issues are resolved through negotiation with the DOJ attorney, but recipients should be aware of this deadline.

Enforcement

If a recipient fails to comply, the government may petition a federal court to enforce the CID. Failure to obey a court order enforcing a CID can be punished as contempt.

First Steps After Receiving a CID

Step 1: Do Not Ignore It, and Do Not Panic

A CID is a serious legal document with deadlines, but receiving one does not mean the organization will be found liable. Many investigations close without litigation, and early, careful action can improve outcomes.

Step 2: Contact Experienced Counsel Immediately

Engage counsel with experience in False Claims Act investigations and healthcare regulation. Counsel can contact the DOJ attorney, help understand the scope of the investigation, negotiate the response, and protect privileged communications.

Step 3: Calendar All Deadlines

• Note the date of service, the return date, and any testimony dates.

• Calendar the 20-day deadline for a petition to modify or set aside, if relevant.

• Track any negotiated extensions in writing.

Step 4: Issue a Legal Hold

Immediately issue a written legal hold that suspends routine deletion and requires preservation of all potentially relevant documents and data, including:

• Medical records and billing data.

• Emails, text messages, and messaging applications.

• Shared drives, cloud storage, and collaboration tools.

• Policies, contracts, and financial records.

• Data held by vendors, such as billing companies and electronic health record providers.

• Devices of key employees.

Make sure the legal hold reaches the right people, including information technology staff, and confirm in writing that they understand their obligations.

Step 5: Notify Insurance Carriers

Review directors and officers, professional liability, and regulatory coverage policies, and notify carriers as required. Late notice can affect coverage.

Step 6: Limit Internal Communication

Share information about the CID only with people who need to know, and route discussions through counsel where appropriate to help protect privilege. Avoid creating new documents that speculate about the investigation.

Step 7: Identify Key Personnel and Data Sources

Work with counsel to identify the people, departments, systems, and time periods most likely to be relevant.

Managing the CID Response

Meet and Confer With DOJ

Counsel typically contacts the DOJ attorney early to discuss the scope of the CID, priorities, rolling production, search terms, custodians, date ranges, formats, and timelines. Many CIDs are broad, and reasonable negotiation can make the response more manageable without delaying the investigation.

Collect Documents Defensibly

• Use a documented, consistent process to collect documents and data.

• Consider using an experienced e-discovery vendor.

• Keep records of where documents came from and how they were collected.

Review for Responsiveness and Privilege

• Review documents for responsiveness to the CID requests.

• Identify documents protected by attorney-client privilege or the work product doctrine.

• Prepare a privilege log as agreed with DOJ.

Protect Patient Information

Healthcare CIDs often require production of protected health information. HIPAA permits covered entities to disclose protected health information for health oversight activities and for judicial and administrative proceedings, subject to the conditions in 45 CFR 164.512. Counsel can help confirm that disclosures meet applicable requirements and that productions are handled securely.

Answer Interrogatories Carefully

Interrogatory answers are made under oath. Answers should be accurate, complete, and carefully reviewed. Where information is not reasonably available, the answer should explain that.

Prepare for Oral Testimony

CID testimony is taken under oath and can be used later. Witnesses should be prepared by counsel, understand their rights, and testify truthfully. Individuals may need separate counsel if their interests may differ from the organization's.

Certify Compliance

CIDs typically require a sworn certificate of compliance confirming that the production is complete, subject to any agreed limitations. Make sure the certification is accurate.

Understanding the Typical Investigation Timeline

False Claims Act investigations often take months or years. While every matter is different, many follow a similar general pattern:

1. A qui tam complaint is filed under seal, or DOJ opens an investigation based on other information.

2. DOJ and HHS-OIG review data and information, sometimes interviewing the relator.

3. DOJ issues one or more CIDs to the organization, individuals, or third parties.

4. The organization produces documents and data on a rolling basis, answers interrogatories, and provides witnesses for testimony.

5. DOJ may request meetings or presentations to discuss the facts, legal theories, and potential damages.

6. DOJ decides whether to intervene in a qui tam case, decline, or pursue resolution.

7. The matter is resolved through closure, settlement, or litigation.

Understanding this timeline helps organizations plan resources, manage costs, and maintain operations during a lengthy process.

Communicating With Employees About a CID

Employees may learn about a CID through document collection, legal hold notices, or requests for interviews. Careful communication helps protect the organization and respects employees' rights.

• Explain the legal hold clearly and tell employees what they must preserve.

• Remind employees that they must not delete, alter, or create records related to the investigation.

• Inform employees, with counsel's guidance, that they may be contacted by government investigators and that they have the right to decide whether to speak with them and to have counsel present.

• Make clear that the organization does not prohibit employees from speaking with the government and does not tolerate retaliation.

• Provide a contact person for questions.

• Avoid speculating about the investigation or the identity of any whistleblower.

Third-Party CIDs

Healthcare organizations sometimes receive CIDs not because they are the subject of an investigation, but because they have information about another party, such as a vendor, a referral source, a former business partner, or a physician who works at multiple facilities. Even when the organization is not the target, it should:

• Engage counsel to understand its role and obligations.

• Issue a legal hold for relevant materials.

• Clarify with DOJ whether it is considered a third-party witness.

• Respond completely and accurately, while protecting privileged and patient information.

• Consider whether the investigation reveals compliance issues that affect its own operations.

Conducting a Privileged Internal Review

While responding to the CID, organizations often conduct a privileged internal review under the direction of counsel to understand the facts and evaluate potential exposure. An internal review can help the organization:

• Understand what happened and why.

• Identify any overpayments that must be reported and returned under 42 CFR 401.305.

• Implement corrective actions.

• Evaluate whether cooperation or self-disclosure is appropriate.

• Prepare factual presentations to DOJ.

Cooperation and Resolution

DOJ has stated that it remains committed to incentivizing and rewarding entities and individuals that self-disclose misconduct, cooperate in investigations, and take effective remedial measures. DOJ reported that several fiscal year 2025 False Claims Act settlements reflected credit for cooperation, in the form of reduced penalties or damages multiples.

Possible outcomes of a CID investigation include:

• Closing the investigation without action.

• A government decision not to intervene in a related qui tam case.

• A negotiated settlement, which may include a corporate integrity agreement with HHS-OIG.

• Litigation.

Decisions about cooperation, presentations to DOJ, and settlement should be made with experienced counsel.

Managing Cost and Business Disruption

A CID response can be expensive and time-consuming, especially for smaller organizations. Practical steps to manage cost and disruption include:

• Negotiating reasonable scope, custodians, date ranges, and search terms with DOJ through counsel.

• Prioritizing the most important categories of documents and producing them first.

• Using technology, such as e-discovery platforms and analytics, to make review more efficient.

• Assigning an internal project coordinator who works with counsel and vendors.

• Protecting clinical operations by scheduling document collection and interviews to minimize disruption to patient care.

• Reviewing insurance coverage for defense costs and complying with carrier requirements.

• Creating a realistic budget and updating it as the investigation evolves.

• Keeping leadership and the governing body informed about costs, timelines, and risks.

Taking these steps early helps the organization respond completely and on time without unnecessary expense.

Common Mistakes to Avoid

Mistake 1: Delaying Action

Waiting days or weeks to engage counsel or issue a legal hold can lead to missed deadlines, lost data, and lost opportunities to shape the response.

Mistake 2: Failing to Preserve Data

Routine deletion of emails, text messages, or other data after receiving a CID can create serious problems, including potential obstruction concerns. Federal law makes it a crime to destroy, alter, or falsify records with intent to impede a federal investigation, under statutes such as 18 U.S.C. 1519.

Mistake 3: Altering or Creating Records

Never alter, backdate, or create documents to appear as though they existed earlier. DOJ has prosecuted healthcare providers who fabricated or backdated records after receiving government process.

Mistake 4: Retaliating Against Suspected Whistleblowers

Trying to identify or retaliate against a suspected whistleblower is prohibited and can lead to additional liability under 31 U.S.C. 3730(h). The organization should not discourage employees from speaking with the government.

Mistake 5: Speaking With DOJ Without Preparation

Informal conversations with government attorneys or agents without counsel can lead to inaccurate or incomplete statements.

Mistake 6: Producing Documents Without Review

Producing documents without reviewing them for privilege, responsiveness, and protected health information can waive privilege and create privacy issues.

Mistake 7: Overlooking Overpayment Obligations

If the internal review identifies overpayments, the 60-day overpayment rule may apply. Ignoring identified overpayments can increase False Claims Act exposure.

Mistake 8: Ignoring Individual Interests

Executives and employees may need separate counsel. Failing to address potential conflicts early can complicate the investigation.

Mistake 9: Treating the CID as a Records Request Only

A CID is part of a legal investigation that may lead to significant liability. It should be managed strategically, not simply as an administrative task.

Mistake 10: Inaccurate Certifications

Certifying that a production is complete when it is not can create additional legal problems.

Lessons for Future Readiness

Even after a CID matter is resolved, organizations can strengthen their readiness for future government contact by adopting a written protocol for subpoenas, CIDs, and agent visits; improving records retention and e-discovery capabilities; reviewing the compliance issues the investigation revealed; updating training; and reporting lessons learned to leadership and the governing body. Organizations that treat a CID as a learning opportunity are often better prepared to prevent the underlying issues from recurring.

A CID Response Checklist

• Engage experienced False Claims Act counsel immediately.

• Calendar the return date, testimony dates, and the 20-day petition deadline.

• Issue a written legal hold, including electronic data and vendor-held data.

• Notify insurance carriers.

• Limit internal communications and route them through counsel.

• Identify key custodians, systems, and time periods.

• Meet and confer with DOJ on scope, timing, and format.

• Collect, review, and produce documents defensibly.

• Protect privileged information and patient data.

• Prepare interrogatory answers and witnesses carefully.

• Conduct a privileged internal review.

• Address any identified overpayments.

• Evaluate cooperation and resolution options with counsel.

• Implement corrective actions.

Frequently Asked Questions

Does a CID mean I am being sued?

Not necessarily. A CID is an investigative tool used before DOJ decides whether to file a complaint or intervene in a qui tam case. Many CIDs relate to sealed qui tam lawsuits.

How long do I have to respond?

The CID specifies a return date. Under 31 U.S.C. 3733(j), a petition to modify or set aside must generally be filed within 20 days after service or before the return date, whichever is earlier. Extensions of the return date are often negotiated with DOJ.

Can I find out who the whistleblower is?

Qui tam complaints are filed under seal, and the organization generally will not be told the relator's identity during the sealed period. Attempting to identify or retaliate against a suspected whistleblower can create legal liability.

Can information from a CID be used in a criminal case?

Information may be shared with other government components as permitted by law. Counsel should evaluate the possibility of parallel proceedings.

Should we produce documents on a rolling basis?

Rolling productions are common and can demonstrate good faith while allowing the organization to manage a large response. Discuss the approach with DOJ through counsel.

Conclusion

A civil investigative demand is a serious step in a False Claims Act investigation, but a careful, organized response can protect an organization's rights and improve outcomes. The most important steps are engaging experienced counsel immediately, preserving all relevant data, calendaring deadlines, negotiating the scope of the response, reviewing and producing documents defensibly, protecting privilege and patient information, preparing witnesses, conducting a privileged internal review, addressing overpayments, and avoiding common mistakes such as delay, data loss, and retaliation.

Organizations that have strong compliance programs, good records management, and a written plan for responding to government contact are better prepared to handle a CID efficiently.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in compliance, audit response, and investigation readiness. We help providers organize records and billing data, support document collection and review in coordination with legal counsel, analyze billing and claims issues raised in investigations, quantify potential overpayments, and strengthen compliance programs and response protocols. If your organization has received a civil investigative demand or wants to be prepared, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Code. 31 U.S.C. 3733, Civil Investigative Demands. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3733&num=0&edition=prelim

• U.S. Code. 31 U.S.C. 3729, False Claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3729&num=0&edition=prelim

• U.S. Code. 31 U.S.C. 3730, Civil Actions for False Claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3730&num=0&edition=prelim

• U.S. Code. 18 U.S.C. 1519, Destruction, Alteration, or Falsification of Records in Federal Investigations. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section1519&num=0&edition=prelim

• Electronic Code of Federal Regulations. 45 CFR 164.512, Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required. https://www.ecfr.gov/current/title-45/section-164.512

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305

• U.S. Department of Justice, Office of Public Affairs. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025. https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-68b-fiscal-year-2025

• U.S. Department of Justice. Fact Sheet: False Claims Act Settlements and Judgments, FY2025. https://www.justice.gov/opa/media/1424126/dl

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division's Healthcare Fraud Unit Secures Six Trial Convictions Involving over $1.1 Billion in Fraud. https://www.justice.gov/opa/pr/national-fraud-enforcement-divisions-healthcare-fraud-unit-secures-six-trial-convictions

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud. https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self

• The White House. Establishing the Task Force to Eliminate Fraud, Executive Order 14395 (March 16, 2026). https://www.whitehouse.gov/presidential-actions/2026/03/establishing-the-task-force-to-eliminate-fraud/

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Corporate Integrity Agreements. https://oig.hhs.gov/compliance/corporate-integrity-agreements/