False Claims Act Exposure for Healthcare Providers in 2026: Audit Findings That Turn Into Whistleblower Cases

The False Claims Act is the federal government's primary civil tool for combating fraud against federal programs, and healthcare is its largest area of enforcement. In fiscal year 2025, settlements and judgments under the False Claims Act exceeded $6.8 billion, the highest amount in a single year in the law's history, according to the Department of Justice (DOJ). More than $5.7 billion of that total related to matters involving the healthcare industry.

Whistleblowers drive much of this activity. DOJ reported that whistleblowers filed 1,297 qui tam lawsuits in fiscal year 2025, the highest number in a single year, breaking the prior record of 980 set in 2024. In 2026, Executive Order 14395 directed the Attorney General to promote the meritorious pursuit of qui tam actions involving fraud in federal benefit programs.

Many False Claims Act cases do not begin with a dramatic scheme. They begin with something more ordinary: an internal audit that found errors, a contractor review that identified a pattern, an employee who raised a concern, or an overpayment that was identified but not returned. How a provider responds to these findings can determine whether a billing problem stays a compliance issue or becomes a False Claims Act case.

This article explains the basics of the False Claims Act, how qui tam cases work, how audit findings can turn into whistleblower cases, the current enforcement environment, and practical steps providers can take to reduce their exposure. It is educational and not legal advice.

What Is the False Claims Act?

The False Claims Act, at 31 U.S.C. 3729 through 3733, imposes liability on any person who, among other things:

• Knowingly presents, or causes to be presented, a false or fraudulent claim for payment or approval.

• Knowingly makes, uses, or causes to be made or used, a false record or statement material to a false or fraudulent claim.

• Knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money or property to the government. This is often called a "reverse false claim."

• Conspires to commit a violation.

What "Knowingly" Means

Under the statute, "knowingly" means that a person has actual knowledge of the information, acts in deliberate ignorance of the truth or falsity of the information, or acts in reckless disregard of the truth or falsity of the information. No proof of specific intent to defraud is required. In 2023, the U.S. Supreme Court held in United States ex rel. Schutte v. SuperValu Inc. that the knowledge element focuses on the defendant's own knowledge and subjective beliefs, not on what an objectively reasonable person might have believed.

This standard is critical for understanding how audit findings become cases. Once a provider has been told about a problem, through an internal audit, a contractor's education, or an employee's complaint, continuing the same practice may support an argument of reckless disregard or deliberate ignorance.

Damages and Penalties

DOJ explains that the False Claims Act imposes treble damages and penalties on those who knowingly and falsely claim money from the United States or knowingly fail to pay money owed. Civil penalties are assessed per claim and are adjusted for inflation periodically. Because healthcare billing often involves many individual claims, potential liability can grow quickly.

Retained Overpayments

The Affordable Care Act provides that an overpayment must be reported and returned within the required timeframe, and that an overpayment retained after the deadline is an "obligation" for purposes of the False Claims Act. CMS's overpayment regulation at 42 CFR 401.305 implements this requirement for Medicare. CMS amended the rule effective January 1, 2025, to allow the 60-day deadline to be suspended for up to 180 days while a provider conducts a timely, good-faith investigation to identify related overpayments.

This connection is one of the most important reasons audit findings matter. An internal audit that identifies an overpayment can start the clock, and failing to report and return the overpayment can create reverse false claim liability.

How Qui Tam Whistleblower Cases Work

Who Can File

Under 31 U.S.C. 3730, private individuals, called relators, can file lawsuits on behalf of the United States. In healthcare, relators are often current or former employees, such as clinicians, coders, billers, compliance staff, or managers, but they can also be business partners, competitors, or patients.

Filing Under Seal

A qui tam complaint is filed under seal and served on the government, not the defendant. The government investigates while the case remains sealed, which can last for an extended period. A provider may first learn of a qui tam case through a civil investigative demand, subpoena, or interview request, without knowing that a whistleblower is involved.

Government Intervention

After investigating, the government decides whether to intervene and take over the case. If it declines, the relator may continue the case on their own.

Relator Rewards

DOJ explains that when a qui tam action is successful, the relator typically receives between 15 percent and 30 percent of the recovery. DOJ reported settlements and judgments exceeding $5.3 billion in fiscal year 2025 from qui tam suits.

Anti-Retaliation Protection

The False Claims Act at 31 U.S.C. 3730(h) protects employees, contractors, and agents from retaliation for lawful acts in furtherance of a False Claims Act action or efforts to stop violations. Remedies can include reinstatement, double back pay, and special damages.

Time Limits

Under 31 U.S.C. 3731(b), a False Claims Act action generally must be brought within six years of the violation, or within three years after the relevant government official knew or should have known the material facts, but no more than 10 years after the violation.

The 2026 Enforcement Environment

Record Recoveries and Filings

DOJ's fiscal year 2025 results reflected record False Claims Act recoveries and a record number of qui tam filings. DOJ identified managed care, prescription drugs, and medically unnecessary care as major areas of healthcare enforcement. DOJ also noted that it continued to credit defendants that self-disclose misconduct, cooperate, and take effective remedial measures, through reduced penalties or damages multiples.

Executive Order 14395

On March 16, 2026, Executive Order 14395 established the White House Task Force to Eliminate Fraud. Section 6 directs the Attorney General to take appropriate action to promote the meritorious pursuit by private persons of civil actions under 31 U.S.C. 3730 concerning fraud within federal benefit programs.

Coordinated Enforcement

In 2026, DOJ established the National Fraud Enforcement Division, and federal agencies expanded data sharing. DOJ announced that its Fraud Division gained access to CMS's Integrated Data Repository environment for advanced analytics. The 2026 National Health Care Fraud Takedown included civil charges against 13 defendants for $14.8 million and civil settlements with 31 defendants totaling $23 million, alongside criminal and administrative actions.

In October 2026, DOJ's National Fraud Enforcement Division and HHS-OIG also announced a joint self-disclosure policy for potentially criminal health care conduct.

How Audit Findings Turn Into Whistleblower Cases

Scenario 1: An Internal Audit Finds Errors That Are Not Fixed

An internal or external audit identifies documentation or coding problems, but the organization does not correct the process, does not quantify the impact, and does not return overpayments. Employees who participated in the audit know about the findings. If the practice continues, the organization's knowledge may support an argument of reckless disregard, and retained overpayments may create reverse false claim exposure. A frustrated employee may report the issue to the government or file a qui tam complaint.

Scenario 2: Contractor Education Is Ignored

A Medicare Administrative Contractor conducts Targeted Probe and Educate reviews and provides education about errors. Error rates remain high after education. Prior notice of the requirements can be used as evidence that later claims were submitted with knowledge or reckless disregard.

Scenario 3: An Employee Raises a Concern and Is Ignored or Disciplined

A coder, nurse, or biller raises concerns about billing practices internally, but the concerns are dismissed, or the employee experiences negative treatment. The employee may become a relator, and may also pursue a retaliation claim under 31 U.S.C. 3730(h). DOJ's fiscal year 2025 resolutions include cases filed by former employees, such as a former risk adjustment coding auditor and former hospice employees.

Scenario 4: An Outlier Pattern Becomes a Data-Driven Case

Government data analysis identifies a provider as an outlier. A review of records shows problems that the provider's own data monitoring should have detected. Combined with internal knowledge, this can lead to a civil investigation.

Scenario 5: Financial Relationships Raise Kickback Concerns

An audit or review identifies payments to referral sources that are above fair market value or tied to referral volume. Claims resulting from Anti-Kickback Statute violations can be treated as false claims. Many False Claims Act healthcare cases involve kickback allegations raised by employees or business partners.

Scenario 6: Certifications Are Inaccurate

Providers make certifications in enrollment applications, cost reports, and claim forms. If an audit reveals that certifications were inaccurate and nothing is done, the organization may face false statement or false certification theories.

The Typical Lifecycle of a Healthcare Qui Tam Case

Understanding how a qui tam case usually unfolds helps providers recognize where they are in the process:

1. A concern arises inside the organization, often from an audit, a billing review, or day-to-day work.

2. The concern is raised internally, or the individual decides to go directly to an attorney.

3. The relator's attorney files a complaint under seal in federal court and provides the government with a disclosure of the relevant evidence.

4. The government investigates while the case remains sealed, using tools such as civil investigative demands, subpoenas, interviews, and data analysis.

5. The organization may receive a document request or interview request without being told that a qui tam case exists.

6. The government decides whether to intervene, and the case is eventually unsealed.

7. The case proceeds to settlement, litigation, or dismissal. Settlements may include a corporate integrity agreement with HHS-OIG.

The earlier an organization identifies and addresses a problem internally, the more options it has, including correcting the issue, returning overpayments, and considering disclosure.

Common Healthcare Risk Areas

Based on DOJ's fiscal year 2025 fact sheet and other enforcement announcements, common healthcare False Claims Act risk areas include:

• Medicare Advantage risk adjustment and diagnosis coding.

• Medically unnecessary services, including inpatient admissions, laboratory tests, and hospice care for patients who do not meet eligibility requirements.

• Kickbacks to referral sources, disguised as consulting fees, medical director fees, speaker fees, or other payments.

• Physician self-referral law violations.

• Billing for services not provided or not provided as billed.

• Upcoding and unbundling.

• Inflated pricing or improper drug dispensing.

• Retention of identified overpayments.

Red Flags That an Internal Issue May Escalate

Certain signs suggest that an internal billing or compliance issue may be at risk of becoming an external matter:

• The same audit finding appears in multiple review cycles without improvement.

• An employee has raised the same concern more than once, or has raised it in writing.

• An employee who raised concerns has resigned, been terminated, or been disciplined.

• Leadership has delayed decisions about quantifying or returning overpayments.

• Contractor reviews continue to show high error rates after education.

• The organization has received unusual requests from former employees for documents or data.

• A government agency has requested records or interviews without explaining the reason.

• Financial arrangements with referral sources have not been reviewed by counsel.

Any of these red flags warrants prompt attention from compliance leadership and, in many cases, legal counsel.

Building an Audit Findings Response Protocol

A written protocol helps ensure that audit findings are handled consistently and promptly. A practical protocol might include the following stages:

Intake

• Log every audit finding, whether it comes from an internal audit, an external review, a contractor, a government agency, or an employee report.

• Assign a unique tracking number, an owner, and a target completion date.

Triage

• Classify findings by severity, such as isolated documentation errors, systemic process problems, or potential fraud or kickback concerns.

• Escalate high-severity findings immediately to the compliance officer and, where appropriate, to legal counsel.

Investigation

• Determine the scope of the issue, including affected time periods, services, clinicians, and payers.

• Consider conducting the investigation under the direction of counsel when legal risk is significant.

• Preserve relevant records.

Quantification

• Determine whether overpayments exist and calculate their amount, using appropriate methods.

• Track the overpayment timeline under 42 CFR 401.305, including any suspension of the 60-day deadline during a timely, good-faith investigation.

Resolution

• Report and return overpayments as required.

• Implement corrective actions, such as training, policy updates, system changes, or personnel actions.

• Evaluate, with counsel, whether a self-disclosure is appropriate.

Verification

• Conduct follow-up audits to confirm that corrective actions are working.

• Report outcomes to the compliance committee and governing body.

• Close the finding only when evidence shows the issue has been resolved.

How to Reduce False Claims Act Exposure

1. Treat Audit Findings as Action Items

• Assign each finding an owner and a deadline.

• Determine root causes and implement corrective actions.

• Quantify any overpayments and report and return them as required under 42 CFR 401.305.

• Document every step, including decisions and their rationale.

2. Follow Up on Contractor Education and Reviews

• Track Targeted Probe and Educate results, Additional Documentation Request outcomes, and contractor education.

• Implement changes after education and measure whether error rates improve.

3. Build a Culture That Encourages Internal Reporting

• Maintain a confidential or anonymous hotline.

• Communicate clearly that employees can raise concerns without fear of retaliation.

• Investigate every report promptly and thoroughly.

• Communicate outcomes to reporters when appropriate.

• Train managers on how to respond to concerns and prohibit retaliation.

4. Maintain an Effective Compliance Program

HHS-OIG's General Compliance Program Guidance describes the elements of an effective compliance program. An effective program helps organizations identify and fix problems early, and DOJ considers compliance program effectiveness and remediation when evaluating cases.

5. Monitor Billing Data

Use PEPPER, comparative data, and internal analytics to identify outlier patterns, and audit the records behind them.

6. Review Financial Relationships

Inventory and review arrangements with referral sources for compliance with the Anti-Kickback Statute and the physician self-referral law, with help from qualified counsel.

7. Understand Disclosure Options

• Routine overpayments are reported and returned through the Medicare Administrative Contractor.

• The HHS-OIG Health Care Fraud Self-Disclosure Protocol addresses conduct that may violate civil or administrative law.

• The CMS Voluntary Self-Referral Disclosure Protocol addresses potential Stark Law violations.

• Potentially criminal conduct may be disclosed to DOJ under the 2026 joint policy.

• DOJ has stated that it credits self-disclosure, cooperation, and remediation in False Claims Act resolutions.

Disclosure decisions should be made with experienced legal counsel.

8. Respond Carefully to Government Requests

If your organization receives a civil investigative demand, subpoena, or interview request, contact counsel immediately, preserve records, and respond accurately and completely. The request may relate to a sealed qui tam case.

9. Handle Departing Employees Thoughtfully

Exit interviews can be an opportunity to ask whether departing employees have compliance concerns, while respecting their rights. Agreements must not prevent employees from reporting potential violations to the government.

Frequently Asked Questions

Can honest mistakes lead to False Claims Act liability?

The False Claims Act requires knowing conduct, which includes actual knowledge, deliberate ignorance, and reckless disregard. Simple mistakes are generally treated as overpayments. However, continuing a practice after learning it is wrong, or failing to return identified overpayments, can create liability.

How do I know if a qui tam case has been filed against my organization?

Qui tam cases are filed under seal. Often, the first sign is a civil investigative demand, subpoena, or request for information from DOJ or HHS-OIG.

What share of a recovery does a whistleblower receive?

DOJ states that relators typically receive between 15 percent and 30 percent of the recovery in a successful qui tam action.

Does returning an overpayment protect us?

Reporting and returning identified overpayments on time is required and reduces the risk of reverse false claim liability. It does not necessarily resolve all potential liability for underlying conduct, which is why legal advice is important for significant issues.

Does the government always intervene in qui tam cases?

No. After investigating, the government decides whether to intervene. If it declines, the relator may still pursue the case. Declined cases can still result in settlements or judgments.

Are state Medicaid programs affected by False Claims Act cases?

Yes. Many states have their own false claims laws, and DOJ has noted that in many federal cases it helped recover additional amounts for state Medicaid programs beyond the federal recovery.

Can we prevent employees from reporting to the government?

No. Employees have the right to report potential violations to the government, and retaliation is prohibited under 31 U.S.C. 3730(h).

Conclusion

False Claims Act enforcement in healthcare reached record levels in fiscal year 2025, with more than $5.7 billion in healthcare-related recoveries and a record 1,297 qui tam filings. In 2026, executive action encouraging qui tam suits, expanded data sharing, and a coordinated federal anti-fraud effort point to continued high activity.

Many False Claims Act cases begin with audit findings, contractor education, or employee concerns that were not addressed. Providers can reduce their exposure by treating audit findings as action items, returning overpayments on time, following up on contractor education, encouraging and responding to internal reports, maintaining an effective compliance program, monitoring billing data, reviewing financial relationships, and seeking legal advice about disclosure when appropriate.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in compliance, audit response, and program integrity. We help providers conduct and follow up on internal audits, quantify and address overpayments, strengthen compliance programs and internal reporting systems, monitor billing data, and coordinate with legal counsel on disclosure and response strategies. If you would like help reducing your organization's False Claims Act exposure, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Justice, Office of Public Affairs. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025. https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-68b-fiscal-year-2025

• U.S. Department of Justice. Fact Sheet: False Claims Act Settlements and Judgments, FY2025. https://www.justice.gov/opa/media/1424126/dl

• U.S. Department of Justice, Office of Public Affairs. Aetna Agrees to Pay $117.7 Million to Resolve False Claims Act Allegations. https://www.justice.gov/opa/pr/aetna-agrees-pay-1177-million-resolve-false-claims-act-allegations

• U.S. Department of Justice, Office of Public Affairs. Saad Healthcare Agrees to Pay $3M to Settle False Claims Act Allegations That It Billed Medicare for Ineligible Hospice Patients. https://www.justice.gov/opa/pr/saad-healthcare-agrees-pay-3m-settle-false-claims-act-allegations-it-billed-medicare

• U.S. Department of Justice, Office of Public Affairs. National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection with Over $6.5 Billion in Alleged Fraud (June 23, 2026). https://www.justice.gov/opa/pr/national-health-care-fraud-takedown-results-455-defendants-charged-connection-over-65

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud. https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self

• The White House. Establishing the Task Force to Eliminate Fraud, Executive Order 14395 (March 16, 2026). https://www.whitehouse.gov/presidential-actions/2026/03/establishing-the-task-force-to-eliminate-fraud/

• Supreme Court of the United States. United States ex rel. Schutte v. SuperValu Inc., No. 21-1326 (2023). https://www.supremecourt.gov/opinions/22pdf/21-1326_9o6b.pdf

• U.S. Code. 31 U.S.C. 3729, False Claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3729&num=0&edition=prelim

• U.S. Code. 31 U.S.C. 3730, Civil Actions for False Claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3730&num=0&edition=prelim

• U.S. Code. 31 U.S.C. 3731, False Claims Procedure. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3731&num=0&edition=prelim

• U.S. Code. 42 U.S.C. 1320a-7k, Medicare and Medicaid Program Integrity Provisions (Reporting and Returning of Overpayments). https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320a-7k&num=0&edition=prelim

• U.S. Code. 42 U.S.C. 1320a-7b, Criminal Penalties for Acts Involving Federal Health Care Programs. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320a-7b&num=0&edition=prelim

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/section-401.305

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure. https://oig.hhs.gov/compliance/self-disclosure-info/

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs